Skip to content

Commit a6c39de

Browse files
borkmannborkmann
committed
bpf, selftests: Add test cases for pointer alu from multiple paths
Add several test cases for checking update_alu_sanitation_state() under multiple paths: # ./test_verifier [...] Rust-for-Linux#1061/u map access: known scalar += value_ptr unknown vs const OK Rust-for-Linux#1061/p map access: known scalar += value_ptr unknown vs const OK Rust-for-Linux#1062/u map access: known scalar += value_ptr const vs unknown OK Rust-for-Linux#1062/p map access: known scalar += value_ptr const vs unknown OK Rust-for-Linux#1063/u map access: known scalar += value_ptr const vs const (ne) OK Rust-for-Linux#1063/p map access: known scalar += value_ptr const vs const (ne) OK Rust-for-Linux#1064/u map access: known scalar += value_ptr const vs const (eq) OK Rust-for-Linux#1064/p map access: known scalar += value_ptr const vs const (eq) OK Rust-for-Linux#1065/u map access: known scalar += value_ptr unknown vs unknown (eq) OK Rust-for-Linux#1065/p map access: known scalar += value_ptr unknown vs unknown (eq) OK Rust-for-Linux#1066/u map access: known scalar += value_ptr unknown vs unknown (lt) OK Rust-for-Linux#1066/p map access: known scalar += value_ptr unknown vs unknown (lt) OK Rust-for-Linux#1067/u map access: known scalar += value_ptr unknown vs unknown (gt) OK Rust-for-Linux#1067/p map access: known scalar += value_ptr unknown vs unknown (gt) OK [...] Summary: 1762 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Alexei Starovoitov <[email protected]>
1 parent e042aa5 commit a6c39de

File tree

1 file changed

+229
-0
lines changed

1 file changed

+229
-0
lines changed

‎tools/testing/selftests/bpf/verifier/value_ptr_arith.c

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,232 @@
1+
{
2+
"map access: known scalar += value_ptr unknown vs const",
3+
.insns = {
4+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5+
offsetof(struct __sk_buff, len)),
6+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
10+
BPF_LD_MAP_FD(BPF_REG_1, 0),
11+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
12+
BPF_LD_MAP_FD(BPF_REG_1, 0),
13+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
14+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
15+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
16+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4),
17+
BPF_MOV64_IMM(BPF_REG_1, 6),
18+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
19+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
20+
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
21+
BPF_MOV64_IMM(BPF_REG_1, 3),
22+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
23+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
24+
BPF_MOV64_IMM(BPF_REG_0, 1),
25+
BPF_EXIT_INSN(),
26+
},
27+
.fixup_map_hash_16b = { 5 },
28+
.fixup_map_array_48b = { 8 },
29+
.result_unpriv = REJECT,
30+
.errstr_unpriv = "R1 tried to add from different maps, paths or scalars",
31+
.result = ACCEPT,
32+
.retval = 1,
33+
},
34+
{
35+
"map access: known scalar += value_ptr const vs unknown",
36+
.insns = {
37+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
38+
offsetof(struct __sk_buff, len)),
39+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
40+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
41+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
42+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
43+
BPF_LD_MAP_FD(BPF_REG_1, 0),
44+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
45+
BPF_LD_MAP_FD(BPF_REG_1, 0),
46+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
47+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
48+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
49+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2),
50+
BPF_MOV64_IMM(BPF_REG_1, 3),
51+
BPF_JMP_IMM(BPF_JA, 0, 0, 3),
52+
BPF_MOV64_IMM(BPF_REG_1, 6),
53+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
54+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
55+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
56+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
57+
BPF_MOV64_IMM(BPF_REG_0, 1),
58+
BPF_EXIT_INSN(),
59+
},
60+
.fixup_map_hash_16b = { 5 },
61+
.fixup_map_array_48b = { 8 },
62+
.result_unpriv = REJECT,
63+
.errstr_unpriv = "R1 tried to add from different maps, paths or scalars",
64+
.result = ACCEPT,
65+
.retval = 1,
66+
},
67+
{
68+
"map access: known scalar += value_ptr const vs const (ne)",
69+
.insns = {
70+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
71+
offsetof(struct __sk_buff, len)),
72+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
73+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
74+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
75+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
76+
BPF_LD_MAP_FD(BPF_REG_1, 0),
77+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
78+
BPF_LD_MAP_FD(BPF_REG_1, 0),
79+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
80+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
81+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
82+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2),
83+
BPF_MOV64_IMM(BPF_REG_1, 3),
84+
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
85+
BPF_MOV64_IMM(BPF_REG_1, 5),
86+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
87+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
88+
BPF_MOV64_IMM(BPF_REG_0, 1),
89+
BPF_EXIT_INSN(),
90+
},
91+
.fixup_map_hash_16b = { 5 },
92+
.fixup_map_array_48b = { 8 },
93+
.result_unpriv = REJECT,
94+
.errstr_unpriv = "R1 tried to add from different maps, paths or scalars",
95+
.result = ACCEPT,
96+
.retval = 1,
97+
},
98+
{
99+
"map access: known scalar += value_ptr const vs const (eq)",
100+
.insns = {
101+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
102+
offsetof(struct __sk_buff, len)),
103+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
104+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
105+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
106+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
107+
BPF_LD_MAP_FD(BPF_REG_1, 0),
108+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
109+
BPF_LD_MAP_FD(BPF_REG_1, 0),
110+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
111+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
112+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
113+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 2),
114+
BPF_MOV64_IMM(BPF_REG_1, 5),
115+
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
116+
BPF_MOV64_IMM(BPF_REG_1, 5),
117+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
118+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
119+
BPF_MOV64_IMM(BPF_REG_0, 1),
120+
BPF_EXIT_INSN(),
121+
},
122+
.fixup_map_hash_16b = { 5 },
123+
.fixup_map_array_48b = { 8 },
124+
.result = ACCEPT,
125+
.retval = 1,
126+
},
127+
{
128+
"map access: known scalar += value_ptr unknown vs unknown (eq)",
129+
.insns = {
130+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
131+
offsetof(struct __sk_buff, len)),
132+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
133+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
134+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
135+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
136+
BPF_LD_MAP_FD(BPF_REG_1, 0),
137+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
138+
BPF_LD_MAP_FD(BPF_REG_1, 0),
139+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
140+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
141+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
142+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4),
143+
BPF_MOV64_IMM(BPF_REG_1, 6),
144+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
145+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
146+
BPF_JMP_IMM(BPF_JA, 0, 0, 3),
147+
BPF_MOV64_IMM(BPF_REG_1, 6),
148+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
149+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
150+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
151+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
152+
BPF_MOV64_IMM(BPF_REG_0, 1),
153+
BPF_EXIT_INSN(),
154+
},
155+
.fixup_map_hash_16b = { 5 },
156+
.fixup_map_array_48b = { 8 },
157+
.result = ACCEPT,
158+
.retval = 1,
159+
},
160+
{
161+
"map access: known scalar += value_ptr unknown vs unknown (lt)",
162+
.insns = {
163+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
164+
offsetof(struct __sk_buff, len)),
165+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
166+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
167+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
168+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
169+
BPF_LD_MAP_FD(BPF_REG_1, 0),
170+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
171+
BPF_LD_MAP_FD(BPF_REG_1, 0),
172+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
173+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
174+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
175+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4),
176+
BPF_MOV64_IMM(BPF_REG_1, 6),
177+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
178+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x3),
179+
BPF_JMP_IMM(BPF_JA, 0, 0, 3),
180+
BPF_MOV64_IMM(BPF_REG_1, 6),
181+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
182+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
183+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
184+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
185+
BPF_MOV64_IMM(BPF_REG_0, 1),
186+
BPF_EXIT_INSN(),
187+
},
188+
.fixup_map_hash_16b = { 5 },
189+
.fixup_map_array_48b = { 8 },
190+
.result_unpriv = REJECT,
191+
.errstr_unpriv = "R1 tried to add from different maps, paths or scalars",
192+
.result = ACCEPT,
193+
.retval = 1,
194+
},
195+
{
196+
"map access: known scalar += value_ptr unknown vs unknown (gt)",
197+
.insns = {
198+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
199+
offsetof(struct __sk_buff, len)),
200+
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
201+
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
202+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
203+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
204+
BPF_LD_MAP_FD(BPF_REG_1, 0),
205+
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
206+
BPF_LD_MAP_FD(BPF_REG_1, 0),
207+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
208+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
209+
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_0, 0),
210+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_4, 1, 4),
211+
BPF_MOV64_IMM(BPF_REG_1, 6),
212+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
213+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
214+
BPF_JMP_IMM(BPF_JA, 0, 0, 3),
215+
BPF_MOV64_IMM(BPF_REG_1, 6),
216+
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
217+
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x3),
218+
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
219+
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
220+
BPF_MOV64_IMM(BPF_REG_0, 1),
221+
BPF_EXIT_INSN(),
222+
},
223+
.fixup_map_hash_16b = { 5 },
224+
.fixup_map_array_48b = { 8 },
225+
.result_unpriv = REJECT,
226+
.errstr_unpriv = "R1 tried to add from different maps, paths or scalars",
227+
.result = ACCEPT,
228+
.retval = 1,
229+
},
1230
{
2231
"map access: known scalar += value_ptr from different maps",
3232
.insns = {

0 commit comments

Comments
 (0)