Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1633ac0a authored by Aaron Yue's avatar Aaron Yue Committed by David S. Miller
Browse files

samples/bpf: add verifier tests for the helper access to the packet 



test various corner cases of the helper function access to the packet
via crafted XDP programs.

Signed-off-by: default avatarAaron Yue <haoxuany@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6841de8b

samples/bpf/test_verifier.c

+110 −4
Original line number Diff line number Diff line
@@ -1449,7 +1449,7 @@ static struct bpf_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"pkt: test1",

		"direct packet access: test1",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, data)),
@@ -1466,7 +1466,7 @@ static struct bpf_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"pkt: test2",

		"direct packet access: test2",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
@@ -1499,7 +1499,7 @@ static struct bpf_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"pkt: test3",

		"direct packet access: test3",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, data)),
@@ -1511,7 +1511,7 @@ static struct bpf_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

	},

	{

		"pkt: test4",

		"direct packet access: test4",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, data)),
@@ -1528,6 +1528,112 @@ static struct bpf_test tests[] = { 
		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"helper access to packet: test1, valid packet_ptr range",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct xdp_md, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct xdp_md, data_end)),

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),

			BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),

			BPF_MOV64_IMM(BPF_REG_4, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup = {5},

		.result_unpriv = ACCEPT,

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_XDP,

	},

	{

		"helper access to packet: test2, unchecked packet_ptr",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct xdp_md, data)),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup = {1},

		.result = REJECT,

		.errstr = "invalid access to packet",

		.prog_type = BPF_PROG_TYPE_XDP,

	},

	{

		"helper access to packet: test3, variable add",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

					offsetof(struct xdp_md, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

					offsetof(struct xdp_md, data_end)),

			BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),

			BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),

			BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),

			BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),

			BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),

			BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup = {11},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_XDP,

	},

	{

		"helper access to packet: test4, packet_ptr with bad range",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct xdp_md, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct xdp_md, data_end)),

			BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),

			BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup = {7},

		.result = REJECT,

		.errstr = "invalid access to packet",

		.prog_type = BPF_PROG_TYPE_XDP,

	},

	{

		"helper access to packet: test5, packet_ptr with too short range",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct xdp_md, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct xdp_md, data_end)),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),

			BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),

			BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup = {6},

		.result = REJECT,

		.errstr = "invalid access to packet",

		.prog_type = BPF_PROG_TYPE_XDP,

	},

};



static int probe_filter_length(struct bpf_insn *fp)