12e6196fb1
Commitafbf21dce6("bpf: Support readonly/readwrite buffers in verifier") added readonly/readwrite buffer support which is currently used by bpf_iter tracing programs. It has a bug with incorrect parameter ordering which later fixed by Commitf6dfbe31e8("bpf: Fix swapped arguments in calls to check_buffer_access"). This patch added a test case with a negative offset access which will trigger the error path. Without Commitf6dfbe31e8, running the test case in the patch, the error message looks like: R1_w=rdwr_buf(id=0,off=0,imm=0) R10=fp0 ; value_sum += *(__u32 *)(value - 4); 2: (61) r1 = *(u32 *)(r1 -4) R1 invalid (null) buffer access: off=-4, size=4 With the above commit, the error message looks like: R1_w=rdwr_buf(id=0,off=0,imm=0) R10=fp0 ; value_sum += *(__u32 *)(value - 4); 2: (61) r1 = *(u32 *)(r1 -4) R1 invalid rdwr buffer access: off=-4, size=4 Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Song Liu <songliubraving@fb.com> Link: https://lore.kernel.org/bpf/20200728221801.1090406-1-yhs@fb.com
22 lines
428 B
C
22 lines
428 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright (c) 2020 Facebook */
|
|
#include "bpf_iter.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
__u32 value_sum = 0;
|
|
|
|
SEC("iter/bpf_map_elem")
|
|
int dump_bpf_hash_map(struct bpf_iter__bpf_map_elem *ctx)
|
|
{
|
|
void *value = ctx->value;
|
|
|
|
if (value == (void *)0)
|
|
return 0;
|
|
|
|
/* negative offset, verifier failure. */
|
|
value_sum += *(__u32 *)(value - 4);
|
|
return 0;
|
|
}
|