Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69c4e8ad authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files

selftests/bpf: variable offset negative tests 



Variable ctx accesses and stack accesses aren't allowed, because we can't
 determine what type of value will be read.

Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f999d64c

tools/testing/selftests/bpf/test_verifier.c

+41 −0
Original line number Original line Diff line number Diff line
@@ -5980,6 +5980,47 @@ static struct bpf_test tests[] = { 
		.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",

		.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",

		.result = REJECT,

		.result = REJECT,

	},

	},

	{

		"variable-offset ctx access",

		.insns = {

			/* Get an unknown value */

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

			/* Make it small and 4-byte aligned */

			BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),

			/* add it to skb.  We now have either &skb->len or

			 * &skb->pkt_type, but we don't know which

			 */

			BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),

			/* dereference it */

			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),

			BPF_EXIT_INSN(),

		},

		.errstr = "variable ctx access var_off=(0x0; 0x4)",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_LWT_IN,

	},

	{

		"variable-offset stack access",

		.insns = {

			/* Fill the top 8 bytes of the stack */

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			/* Get an unknown value */

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

			/* Make it small and 4-byte aligned */

			BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),

			BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),

			/* add it to fp.  We now have either fp-4 or fp-8, but

			 * we don't know which

			 */

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),

			/* dereference it */

			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),

			BPF_EXIT_INSN(),

		},

		.errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_LWT_IN,

	},

};

};





static int probe_filter_length(const struct bpf_insn *fp)

static int probe_filter_length(const struct bpf_insn *fp)