a08dd0da53
Commit57a09bf0a4("bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers") introduced a regression where existing programs stopped loading due to reaching the verifier's maximum complexity limit, whereas prior to this commit they were loading just fine; the affected program has roughly 2k instructions. What was found is that state pruning couldn't be performed effectively anymore due to mismatches of the verifier's register state, in particular in the id tracking. It doesn't mean that57a09bf0a4is incorrect per se, but rather that verifier needs to perform a lot more work for the same program with regards to involved map lookups. Since commit57a09bf0a4is only about tracking registers with type PTR_TO_MAP_VALUE_OR_NULL, the id is only needed to follow registers until they are promoted through pattern matching with a NULL check to either PTR_TO_MAP_VALUE or UNKNOWN_VALUE type. After that point, the id becomes irrelevant for the transitioned types. For UNKNOWN_VALUE, id is already reset to 0 via mark_reg_unknown_value(), but not so for PTR_TO_MAP_VALUE where id is becoming stale. It's even transferred further into other types that don't make use of it. Among others, one example is where UNKNOWN_VALUE is set on function call return with RET_INTEGER return type. states_equal() will then fall through the memcmp() on register state; note that the second memcmp() uses offsetofend(), so the id is part of that sinced2a4dd37f6("bpf: fix state equivalence"). But the bisect pointed already to57a09bf0a4, where we really reach beyond complexity limit. What I found was that states_equal() often failed in this case due to id mismatches in spilled regs with registers in type PTR_TO_MAP_VALUE. Unlike non-spilled regs, spilled regs just perform a memcmp() on their reg state and don't have any other optimizations in place, therefore also id was relevant in this case for making a pruning decision. We can safely reset id to 0 as well when converting to PTR_TO_MAP_VALUE. For the affected program, it resulted in a ~17 fold reduction of complexity and let the program load fine again. Selftest suite also runs fine. The only other place where env->id_gen is used currently is through direct packet access, but for these cases id is long living, thus a different scenario. Also, the current logic in mark_map_regs() is not fully correct when marking NULL branch with UNKNOWN_VALUE. We need to cache the destination reg's id in any case. Otherwise, once we marked that reg as UNKNOWN_VALUE, it's id is reset and any subsequent registers that hold the original id and are of type PTR_TO_MAP_VALUE_OR_NULL won't be marked UNKNOWN_VALUE anymore, since mark_map_reg() reuses the uncached regs[regno].id that was just overridden. Note, we don't need to cache it outside of mark_map_regs(), since it's called once on this_branch and the other time on other_branch, which are both two independent verifier states. A test case for this is added here, too. Fixes:57a09bf0a4("bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Thomas Graf <tgraf@suug.ch> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
3082 lines
89 KiB
C
3082 lines
89 KiB
C
/*
|
|
* Testsuite for eBPF verifier
|
|
*
|
|
* Copyright (c) 2014 PLUMgrid, http://plumgrid.com
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
* License as published by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <string.h>
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
#include <sched.h>
|
|
|
|
#include <sys/resource.h>
|
|
|
|
#include <linux/unistd.h>
|
|
#include <linux/filter.h>
|
|
#include <linux/bpf_perf_event.h>
|
|
#include <linux/bpf.h>
|
|
|
|
#include "../../../include/linux/filter.h"
|
|
|
|
#include "bpf_sys.h"
|
|
|
|
#ifndef ARRAY_SIZE
|
|
# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
|
|
#endif
|
|
|
|
#define MAX_INSNS 512
|
|
#define MAX_FIXUPS 8
|
|
|
|
struct bpf_test {
|
|
const char *descr;
|
|
struct bpf_insn insns[MAX_INSNS];
|
|
int fixup_map1[MAX_FIXUPS];
|
|
int fixup_map2[MAX_FIXUPS];
|
|
int fixup_prog[MAX_FIXUPS];
|
|
const char *errstr;
|
|
const char *errstr_unpriv;
|
|
enum {
|
|
UNDEF,
|
|
ACCEPT,
|
|
REJECT
|
|
} result, result_unpriv;
|
|
enum bpf_prog_type prog_type;
|
|
};
|
|
|
|
/* Note we want this to be 64 bit aligned so that the end of our array is
|
|
* actually the end of the structure.
|
|
*/
|
|
#define MAX_ENTRIES 11
|
|
|
|
struct test_val {
|
|
unsigned int index;
|
|
int foo[MAX_ENTRIES];
|
|
};
|
|
|
|
static struct bpf_test tests[] = {
|
|
{
|
|
"add+sub+mul",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 1),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
|
|
BPF_MOV64_IMM(BPF_REG_2, 3),
|
|
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
|
|
BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unreachable",
|
|
.insns = {
|
|
BPF_EXIT_INSN(),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "unreachable",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unreachable2",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "unreachable",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"out of range jump",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "jump out of range",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"out of range jump2",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "jump out of range",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"test1 ld_imm64",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_MOV64_IMM(BPF_REG_0, 2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid BPF_LD_IMM insn",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"test2 ld_imm64",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid BPF_LD_IMM insn",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"test3 ld_imm64",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
|
BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 0),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_LD_IMM64(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_ld_imm64 insn",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"test4 ld_imm64",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_ld_imm64 insn",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"test5 ld_imm64",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
|
|
},
|
|
.errstr = "invalid bpf_ld_imm64 insn",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"no bpf_exit",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
|
|
},
|
|
.errstr = "jump out of range",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"loop (back-edge)",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "back-edge",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"loop2 (back-edge)",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -4),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "back-edge",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"conditional loop",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "back-edge",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"read uninitialized register",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R2 !read_ok",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"read invalid register",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_0, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R15 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"program doesn't init R0 before exit",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R0 !read_ok",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"program doesn't init R0 before exit in all branches",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R0 !read_ok",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"stack out of bounds",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid stack",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid call insn1",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "BPF_CALL uses reserved",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid call insn2",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "BPF_CALL uses reserved",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid function call",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid func unknown#1234567",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"uninitialized stack1",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 2 },
|
|
.errstr = "invalid indirect read from stack",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"uninitialized stack2",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid read from stack",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid argument register",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_cgroup_classid),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_cgroup_classid),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R1 !read_ok",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"non-invalid argument register",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_cgroup_classid),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_cgroup_classid),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"check valid spill/fill",
|
|
.insns = {
|
|
/* spill R1(ctx) into stack */
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
/* fill it back into R2 */
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
|
|
/* should be able to access R0 = *(R2 + 8) */
|
|
/* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R0 leaks addr",
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
},
|
|
{
|
|
"check valid spill/fill, skb mark",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = ACCEPT,
|
|
},
|
|
{
|
|
"check corrupted spill/fill",
|
|
.insns = {
|
|
/* spill R1(ctx) into stack */
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
/* mess up with R1 pointer on stack */
|
|
BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
|
|
/* fill back into R0 should fail */
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "attempt to corrupt spilled",
|
|
.errstr = "corrupted spill",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid src register in STX",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R15 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid dst register in STX",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R14 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid dst register in ST",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_B, 14, -1, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R14 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid src register in LDX",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R12 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid dst register in LDX",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "R11 is invalid",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"junk insn",
|
|
.insns = {
|
|
BPF_RAW_INSN(0, 0, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid BPF_LD_IMM",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"junk insn2",
|
|
.insns = {
|
|
BPF_RAW_INSN(1, 0, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "BPF_LDX uses reserved fields",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"junk insn3",
|
|
.insns = {
|
|
BPF_RAW_INSN(-1, 0, 0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid BPF_ALU opcode f0",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"junk insn4",
|
|
.insns = {
|
|
BPF_RAW_INSN(-1, -1, -1, -1, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid BPF_ALU opcode f0",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"junk insn5",
|
|
.insns = {
|
|
BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "BPF_ALU uses reserved fields",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"misaligned read from stack",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "misaligned access",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map_fd for function call",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_delete_elem),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "fd 0 is not pointing to valid bpf_map",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"don't check return value before access",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr = "R0 invalid mem access 'map_value_or_null'",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"access memory with incorrect alignment",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr = "misaligned access",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"sometimes access memory with incorrect alignment",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr = "R0 invalid mem access",
|
|
.errstr_unpriv = "R0 leaks addr",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"jump test 1",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"jump test 2",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 14),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 11),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 8),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 5),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"jump test 3",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 19),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 15),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 11),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 7),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_delete_elem),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 24 },
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"jump test 4",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"jump test 5",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"access skb fields ok",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, len)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, pkt_type)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, queue_mapping)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, protocol)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, vlan_present)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, vlan_tci)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"access skb fields bad1",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"access skb fields bad2",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, pkt_type)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 4 },
|
|
.errstr = "different pointers",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"access skb fields bad3",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, pkt_type)),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -12),
|
|
},
|
|
.fixup_map1 = { 6 },
|
|
.errstr = "different pointers",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"access skb fields bad4",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, len)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -13),
|
|
},
|
|
.fixup_map1 = { 7 },
|
|
.errstr = "different pointers",
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"check skb->mark is not writeable by sockets",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access",
|
|
.errstr_unpriv = "R1 leaks addr",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"check skb->tc_index is not writeable by sockets",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_index)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access",
|
|
.errstr_unpriv = "R1 leaks addr",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"check non-u32 access to cb",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[0])),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access",
|
|
.errstr_unpriv = "R1 leaks addr",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"check out of range skb->cb access",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[0]) + 256),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access",
|
|
.errstr_unpriv = "",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_ACT,
|
|
},
|
|
{
|
|
"write skb fields from socket prog",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[4])),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_index)),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[0])),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[2])),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.errstr_unpriv = "R1 leaks addr",
|
|
.result_unpriv = REJECT,
|
|
},
|
|
{
|
|
"write skb fields from tc_cls_act prog",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, cb[0])),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_index)),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
|
|
offsetof(struct __sk_buff, tc_index)),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
|
|
offsetof(struct __sk_buff, cb[3])),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"PTR_TO_STACK store/load",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"PTR_TO_STACK store/load - bad alignment on off",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "misaligned access off -6 size 8",
|
|
},
|
|
{
|
|
"PTR_TO_STACK store/load - bad alignment on reg",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "misaligned access off -2 size 8",
|
|
},
|
|
{
|
|
"PTR_TO_STACK store/load - out of bounds low",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack off=-79992 size=8",
|
|
},
|
|
{
|
|
"PTR_TO_STACK store/load - out of bounds high",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack off=0 size=8",
|
|
},
|
|
{
|
|
"unpriv: return pointer",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R0 leaks addr",
|
|
},
|
|
{
|
|
"unpriv: add const to pointer",
|
|
.insns = {
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R1 pointer arithmetic",
|
|
},
|
|
{
|
|
"unpriv: add pointer to pointer",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R1 pointer arithmetic",
|
|
},
|
|
{
|
|
"unpriv: neg pointer",
|
|
.insns = {
|
|
BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R1 pointer arithmetic",
|
|
},
|
|
{
|
|
"unpriv: cmp pointer with const",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
},
|
|
{
|
|
"unpriv: cmp pointer with pointer",
|
|
.insns = {
|
|
BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "R10 pointer comparison",
|
|
},
|
|
{
|
|
"unpriv: check that printk is disallowed",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
|
|
BPF_MOV64_IMM(BPF_REG_2, 8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_trace_printk),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "unknown func 6",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: pass pointer to helper function",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_update_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr_unpriv = "R4 leaks addr",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: indirectly pass pointer on stack to helper function",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr = "invalid indirect read from stack off -8+0 size 8",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unpriv: mangle pointer on stack 1",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
|
|
BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "attempt to corrupt spilled",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: mangle pointer on stack 2",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
|
|
BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "attempt to corrupt spilled",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: read pointer from stack in small chunks",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid size",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unpriv: write pointer into ctx",
|
|
.insns = {
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R1 leaks addr",
|
|
.result_unpriv = REJECT,
|
|
.errstr = "invalid bpf_context access",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of ctx",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of ctx 2",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_hash_recalc),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of ctx 3",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_hash_recalc),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "R1 type=fp expected=ctx",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of ctx 4",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
|
|
BPF_REG_0, -8, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_get_hash_recalc),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "R1 type=inv expected=ctx",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of different pointers stx",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_3, 42),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "same insn cannot be used with different pointers",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"unpriv: spill/fill of different pointers ldx",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
|
|
-(__s32)offsetof(struct bpf_perf_event_data,
|
|
sample_period) - 8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct bpf_perf_event_data,
|
|
sample_period)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "same insn cannot be used with different pointers",
|
|
.prog_type = BPF_PROG_TYPE_PERF_EVENT,
|
|
},
|
|
{
|
|
"unpriv: write pointer into map elem value",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 3 },
|
|
.errstr_unpriv = "R0 leaks addr",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: partial copy of pointer",
|
|
.insns = {
|
|
BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R10 partial copy",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: pass pointer to tail_call",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
|
|
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_tail_call),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_prog = { 1 },
|
|
.errstr_unpriv = "R3 leaks addr into helper",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: cmp map pointer with zero",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 0),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 1 },
|
|
.errstr_unpriv = "R1 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: write into frame pointer",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "frame pointer is read only",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unpriv: spill/fill frame pointer",
|
|
.insns = {
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "frame pointer is read only",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"unpriv: cmp of frame pointer",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R10 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: cmp of stack pointer",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R2 pointer comparison",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"unpriv: obfuscate stack pointer",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R2 pointer arithmetic",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"raw_stack: no skb_load_bytes",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
/* Call to skb_load_bytes() omitted. */
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid read from stack off -8+0 size 8",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, negative len",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, -8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, negative len 2",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, ~0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, zero len",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, no init",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, init",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, spilled regs around bounds",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
|
|
offsetof(struct __sk_buff, priority)),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, spilled regs corruption",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "R0 invalid mem access 'inv'",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, spilled regs corruption 2",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
|
|
offsetof(struct __sk_buff, priority)),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
|
|
offsetof(struct __sk_buff, pkt_type)),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "R3 invalid mem access 'inv'",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, spilled regs + data",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
|
|
offsetof(struct __sk_buff, priority)),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 1",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-513 access_size=8",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 2",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-1 access_size=8",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 3",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-1 access_size=-1",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 4",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-1 access_size=2147483647",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 5",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-512 access_size=2147483647",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, invalid access 6",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid stack type R3 off=-512 access_size=0",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"raw_stack: skb_load_bytes, large access",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_4, 512),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test1",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test2",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
|
|
BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 48),
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 48),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test3",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid bpf_context access off=76",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
|
},
|
|
{
|
|
"direct packet access: test4 (write)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test5 (pkt_end >= reg, good access)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test6 (pkt_end >= reg, bad access)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid access to packet",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test7 (pkt_end >= reg, both accesses)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid access to packet",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test8 (double test, variant 1)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test9 (double test, variant 2)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"direct packet access: test10 (write invalid)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid access to packet",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test1, valid packet_ptr range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct xdp_md, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct xdp_md, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_update_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 5 },
|
|
.result_unpriv = ACCEPT,
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
},
|
|
{
|
|
"helper access to packet: test2, unchecked packet_ptr",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct xdp_md, data)),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 1 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
},
|
|
{
|
|
"helper access to packet: test3, variable add",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct xdp_md, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct xdp_md, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
|
|
BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 11 },
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
},
|
|
{
|
|
"helper access to packet: test4, packet_ptr with bad range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct xdp_md, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct xdp_md, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 7 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
},
|
|
{
|
|
"helper access to packet: test5, packet_ptr with too short range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct xdp_md, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct xdp_md, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 6 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
},
|
|
{
|
|
"helper access to packet: test6, cls valid packet_ptr range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_update_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 5 },
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test7, cls unchecked packet_ptr",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 1 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test8, cls variable add",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
|
|
BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 11 },
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test9, cls packet_ptr with bad range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 7 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test10, cls packet_ptr with too short range",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 6 },
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test11, cls unsuitable helper 1",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
|
|
BPF_MOV64_IMM(BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 42),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_store_bytes),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "helper access to the packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test12, cls unsuitable helper 2",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
|
|
BPF_MOV64_IMM(BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 4),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_skb_load_bytes),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "helper access to the packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test13, cls helper ok",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test14, cls helper fail sub",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "type=inv expected=fp",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test15, cls helper fail range 1",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_2, 8),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test16, cls helper fail range 2",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_2, -9),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test17, cls helper fail range 3",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_2, ~0),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test18, cls helper fail range zero",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_MOV64_IMM(BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test19, pkt end as input",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "R1 type=pkt_end expected=fp",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"helper access to packet: test20, wrong reg",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
|
|
BPF_MOV64_IMM(BPF_REG_2, 4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_MOV64_IMM(BPF_REG_4, 0),
|
|
BPF_MOV64_IMM(BPF_REG_5, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_csum_diff),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid access to packet",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
},
|
|
{
|
|
"valid map access into an array with a constant",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 leaks addr",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"valid map access into an array with a register",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
BPF_MOV64_IMM(BPF_REG_1, 4),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"valid map access into an array with a variable",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"valid map access into an array with a signed variable",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
|
|
BPF_MOV32_IMM(BPF_REG_1, 0),
|
|
BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
|
|
BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
|
|
BPF_MOV32_IMM(BPF_REG_1, 0),
|
|
BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
},
|
|
{
|
|
"invalid map access into an array with a constant",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr = "invalid access to map value, value_size=48 off=48 size=8",
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map access into an array with a register",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.errstr = "R0 min value is outside of the array range",
|
|
.result_unpriv = REJECT,
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map access into an array with a variable",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
|
.result_unpriv = REJECT,
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map access into an array with no floor check",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
|
|
BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
|
|
BPF_MOV32_IMM(BPF_REG_1, 0),
|
|
BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
|
.result_unpriv = REJECT,
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map access into an array with a invalid max check",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
|
|
BPF_MOV32_IMM(BPF_REG_1, 0),
|
|
BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.errstr = "invalid access to map value, value_size=48 off=44 size=8",
|
|
.result_unpriv = REJECT,
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"invalid map access into an array with a invalid max check",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
|
|
BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
|
|
offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3, 11 },
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
|
.result_unpriv = REJECT,
|
|
.result = REJECT,
|
|
},
|
|
{
|
|
"multiple registers share map_lookup_elem result",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 10),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 4 },
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS
|
|
},
|
|
{
|
|
"invalid memory access with multiple map_lookup_elem calls",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 10),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
|
|
BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 4 },
|
|
.result = REJECT,
|
|
.errstr = "R4 !read_ok",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS
|
|
},
|
|
{
|
|
"valid indirect map_lookup_elem access with 2nd lookup in branch",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 10),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
|
|
BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_IMM(BPF_REG_2, 10),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 4 },
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS
|
|
},
|
|
{
|
|
"multiple registers share map_lookup_elem bad reg type",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 10),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
|
BPF_FUNC_map_lookup_elem),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
|
|
BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_MOV64_IMM(BPF_REG_1, 1),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
|
BPF_MOV64_IMM(BPF_REG_1, 2),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
|
|
BPF_MOV64_IMM(BPF_REG_1, 3),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map1 = { 4 },
|
|
.result = REJECT,
|
|
.errstr = "R3 invalid mem access 'inv'",
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS
|
|
},
|
|
{
|
|
"invalid map access from else condition",
|
|
.insns = {
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_map2 = { 3 },
|
|
.errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
|
|
.result = REJECT,
|
|
.errstr_unpriv = "R0 pointer arithmetic prohibited",
|
|
.result_unpriv = REJECT,
|
|
},
|
|
{
|
|
"constant register |= constant should keep constant type",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
|
|
BPF_MOV64_IMM(BPF_REG_2, 34),
|
|
BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_EMIT_CALL(BPF_FUNC_probe_read),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"constant register |= constant should not bypass stack boundary checks",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
|
|
BPF_MOV64_IMM(BPF_REG_2, 34),
|
|
BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_EMIT_CALL(BPF_FUNC_probe_read),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid stack type R1 off=-48 access_size=58",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"constant register |= constant register should keep constant type",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
|
|
BPF_MOV64_IMM(BPF_REG_2, 34),
|
|
BPF_MOV64_IMM(BPF_REG_4, 13),
|
|
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_EMIT_CALL(BPF_FUNC_probe_read),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"constant register |= constant register should not bypass stack boundary checks",
|
|
.insns = {
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
|
|
BPF_MOV64_IMM(BPF_REG_2, 34),
|
|
BPF_MOV64_IMM(BPF_REG_4, 24),
|
|
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
|
|
BPF_MOV64_IMM(BPF_REG_3, 0),
|
|
BPF_EMIT_CALL(BPF_FUNC_probe_read),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "invalid stack type R1 off=-48 access_size=58",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"invalid direct packet write for LWT_IN",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "cannot write into packet",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_IN,
|
|
},
|
|
{
|
|
"invalid direct packet write for LWT_OUT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr = "cannot write into packet",
|
|
.result = REJECT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_OUT,
|
|
},
|
|
{
|
|
"direct packet write for LWT_XMIT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_XMIT,
|
|
},
|
|
{
|
|
"direct packet read for LWT_IN",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_IN,
|
|
},
|
|
{
|
|
"direct packet read for LWT_OUT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_OUT,
|
|
},
|
|
{
|
|
"direct packet read for LWT_XMIT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data)),
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
|
offsetof(struct __sk_buff, data_end)),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_LWT_XMIT,
|
|
},
|
|
{
|
|
"invalid access of tc_classid for LWT_IN",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_classid)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid bpf_context access",
|
|
},
|
|
{
|
|
"invalid access of tc_classid for LWT_OUT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_classid)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid bpf_context access",
|
|
},
|
|
{
|
|
"invalid access of tc_classid for LWT_XMIT",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
|
offsetof(struct __sk_buff, tc_classid)),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "invalid bpf_context access",
|
|
},
|
|
};
|
|
|
|
static int probe_filter_length(const struct bpf_insn *fp)
|
|
{
|
|
int len;
|
|
|
|
for (len = MAX_INSNS - 1; len > 0; --len)
|
|
if (fp[len].code != 0 || fp[len].imm != 0)
|
|
break;
|
|
return len + 1;
|
|
}
|
|
|
|
static int create_map(uint32_t size_value, uint32_t max_elem)
|
|
{
|
|
int fd;
|
|
|
|
fd = bpf_map_create(BPF_MAP_TYPE_HASH, sizeof(long long),
|
|
size_value, max_elem, BPF_F_NO_PREALLOC);
|
|
if (fd < 0)
|
|
printf("Failed to create hash map '%s'!\n", strerror(errno));
|
|
|
|
return fd;
|
|
}
|
|
|
|
static int create_prog_array(void)
|
|
{
|
|
int fd;
|
|
|
|
fd = bpf_map_create(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
|
|
sizeof(int), 4, 0);
|
|
if (fd < 0)
|
|
printf("Failed to create prog array '%s'!\n", strerror(errno));
|
|
|
|
return fd;
|
|
}
|
|
|
|
static char bpf_vlog[32768];
|
|
|
|
static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
|
|
int *fd_f1, int *fd_f2, int *fd_f3)
|
|
{
|
|
int *fixup_map1 = test->fixup_map1;
|
|
int *fixup_map2 = test->fixup_map2;
|
|
int *fixup_prog = test->fixup_prog;
|
|
|
|
/* Allocating HTs with 1 elem is fine here, since we only test
|
|
* for verifier and not do a runtime lookup, so the only thing
|
|
* that really matters is value size in this case.
|
|
*/
|
|
if (*fixup_map1) {
|
|
*fd_f1 = create_map(sizeof(long long), 1);
|
|
do {
|
|
prog[*fixup_map1].imm = *fd_f1;
|
|
fixup_map1++;
|
|
} while (*fixup_map1);
|
|
}
|
|
|
|
if (*fixup_map2) {
|
|
*fd_f2 = create_map(sizeof(struct test_val), 1);
|
|
do {
|
|
prog[*fixup_map2].imm = *fd_f2;
|
|
fixup_map2++;
|
|
} while (*fixup_map2);
|
|
}
|
|
|
|
if (*fixup_prog) {
|
|
*fd_f3 = create_prog_array();
|
|
do {
|
|
prog[*fixup_prog].imm = *fd_f3;
|
|
fixup_prog++;
|
|
} while (*fixup_prog);
|
|
}
|
|
}
|
|
|
|
static void do_test_single(struct bpf_test *test, bool unpriv,
|
|
int *passes, int *errors)
|
|
{
|
|
struct bpf_insn *prog = test->insns;
|
|
int prog_len = probe_filter_length(prog);
|
|
int prog_type = test->prog_type;
|
|
int fd_f1 = -1, fd_f2 = -1, fd_f3 = -1;
|
|
int fd_prog, expected_ret;
|
|
const char *expected_err;
|
|
|
|
do_test_fixup(test, prog, &fd_f1, &fd_f2, &fd_f3);
|
|
|
|
fd_prog = bpf_prog_load(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
|
|
prog, prog_len * sizeof(struct bpf_insn),
|
|
"GPL", bpf_vlog, sizeof(bpf_vlog));
|
|
|
|
expected_ret = unpriv && test->result_unpriv != UNDEF ?
|
|
test->result_unpriv : test->result;
|
|
expected_err = unpriv && test->errstr_unpriv ?
|
|
test->errstr_unpriv : test->errstr;
|
|
if (expected_ret == ACCEPT) {
|
|
if (fd_prog < 0) {
|
|
printf("FAIL\nFailed to load prog '%s'!\n",
|
|
strerror(errno));
|
|
goto fail_log;
|
|
}
|
|
} else {
|
|
if (fd_prog >= 0) {
|
|
printf("FAIL\nUnexpected success to load!\n");
|
|
goto fail_log;
|
|
}
|
|
if (!strstr(bpf_vlog, expected_err)) {
|
|
printf("FAIL\nUnexpected error message!\n");
|
|
goto fail_log;
|
|
}
|
|
}
|
|
|
|
(*passes)++;
|
|
printf("OK\n");
|
|
close_fds:
|
|
close(fd_prog);
|
|
close(fd_f1);
|
|
close(fd_f2);
|
|
close(fd_f3);
|
|
sched_yield();
|
|
return;
|
|
fail_log:
|
|
(*errors)++;
|
|
printf("%s", bpf_vlog);
|
|
goto close_fds;
|
|
}
|
|
|
|
static int do_test(bool unpriv, unsigned int from, unsigned int to)
|
|
{
|
|
int i, passes = 0, errors = 0;
|
|
|
|
for (i = from; i < to; i++) {
|
|
struct bpf_test *test = &tests[i];
|
|
|
|
/* Program types that are not supported by non-root we
|
|
* skip right away.
|
|
*/
|
|
if (unpriv && test->prog_type)
|
|
continue;
|
|
|
|
printf("#%d %s ", i, test->descr);
|
|
do_test_single(test, unpriv, &passes, &errors);
|
|
}
|
|
|
|
printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
|
|
return errors ? -errors : 0;
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
|
|
struct rlimit rlim = { 1 << 20, 1 << 20 };
|
|
unsigned int from = 0, to = ARRAY_SIZE(tests);
|
|
bool unpriv = geteuid() != 0;
|
|
|
|
if (argc == 3) {
|
|
unsigned int l = atoi(argv[argc - 2]);
|
|
unsigned int u = atoi(argv[argc - 1]);
|
|
|
|
if (l < to && u < to) {
|
|
from = l;
|
|
to = u + 1;
|
|
}
|
|
} else if (argc == 2) {
|
|
unsigned int t = atoi(argv[argc - 1]);
|
|
|
|
if (t < to) {
|
|
from = t;
|
|
to = t + 1;
|
|
}
|
|
}
|
|
|
|
setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
|
|
return do_test(unpriv, from, to);
|
|
}
|