Skip to content

L
linux
Commit f65b1849 authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files
Options

selftests/bpf: change test_verifier expectations 

Some of the verifier's error messages have changed, and some constructs
 that previously couldn't be verified are now accepted.
Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7d1238f2
Show whitespace changes
Inline Side-by-side
Showing with 152 additions and 180 deletions
tools/testing/selftests/bpf/test_verifier.c
View file @ f65b1849
...@@ -421,7 +421,7 @@ static struct bpf_test tests[] = { ...@@ -421,7 +421,7 @@ static struct bpf_test tests[] = {
BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0), BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr_unpriv = "R1 pointer arithmetic", .errstr_unpriv = "R1 subtraction from stack pointer",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.errstr = "R1 invalid mem access", .errstr = "R1 invalid mem access",
.result = REJECT, .result = REJECT,
...@@ -603,8 +603,9 @@ static struct bpf_test tests[] = { ...@@ -603,8 +603,9 @@ static struct bpf_test tests[] = {
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4), BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned stack access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"invalid map_fd for function call", "invalid map_fd for function call",
...@@ -650,8 +651,9 @@ static struct bpf_test tests[] = { ...@@ -650,8 +651,9 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr = "misaligned access", .errstr = "misaligned value access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"sometimes access memory with incorrect alignment", "sometimes access memory with incorrect alignment",
...@@ -672,6 +674,7 @@ static struct bpf_test tests[] = { ...@@ -672,6 +674,7 @@ static struct bpf_test tests[] = {
.errstr = "R0 invalid mem access", .errstr = "R0 invalid mem access",
.errstr_unpriv = "R0 leaks addr", .errstr_unpriv = "R0 leaks addr",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"jump test 1", "jump test 1",
...@@ -1215,8 +1218,9 @@ static struct bpf_test tests[] = { ...@@ -1215,8 +1218,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[0]) + 1), offsetof(struct __sk_buff, cb[0]) + 1),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check __sk_buff->hash, offset 0, half store not permitted", "check __sk_buff->hash, offset 0, half store not permitted",
...@@ -1319,8 +1323,9 @@ static struct bpf_test tests[] = { ...@@ -1319,8 +1323,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[0]) + 2), offsetof(struct __sk_buff, cb[0]) + 2),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: word, unaligned 2", "check cb access: word, unaligned 2",
...@@ -1330,8 +1335,9 @@ static struct bpf_test tests[] = { ...@@ -1330,8 +1335,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[4]) + 1), offsetof(struct __sk_buff, cb[4]) + 1),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: word, unaligned 3", "check cb access: word, unaligned 3",
...@@ -1341,8 +1347,9 @@ static struct bpf_test tests[] = { ...@@ -1341,8 +1347,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[4]) + 2), offsetof(struct __sk_buff, cb[4]) + 2),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: word, unaligned 4", "check cb access: word, unaligned 4",
...@@ -1352,8 +1359,9 @@ static struct bpf_test tests[] = { ...@@ -1352,8 +1359,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[4]) + 3), offsetof(struct __sk_buff, cb[4]) + 3),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: double", "check cb access: double",
...@@ -1379,8 +1387,9 @@ static struct bpf_test tests[] = { ...@@ -1379,8 +1387,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[1])), offsetof(struct __sk_buff, cb[1])),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: double, unaligned 2", "check cb access: double, unaligned 2",
...@@ -1390,8 +1399,9 @@ static struct bpf_test tests[] = { ...@@ -1390,8 +1399,9 @@ static struct bpf_test tests[] = {
offsetof(struct __sk_buff, cb[3])), offsetof(struct __sk_buff, cb[3])),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "misaligned access", .errstr = "misaligned context access",
.result = REJECT, .result = REJECT,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"check cb access: double, oob 1", "check cb access: double, oob 1",
...@@ -1523,7 +1533,8 @@ static struct bpf_test tests[] = { ...@@ -1523,7 +1533,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "misaligned access off -6 size 8", .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"PTR_TO_STACK store/load - bad alignment on reg", "PTR_TO_STACK store/load - bad alignment on reg",
...@@ -1535,7 +1546,8 @@ static struct bpf_test tests[] = { ...@@ -1535,7 +1546,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "misaligned access off -2 size 8", .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
}, },
{ {
"PTR_TO_STACK store/load - out of bounds low", "PTR_TO_STACK store/load - out of bounds low",
...@@ -1579,8 +1591,6 @@ static struct bpf_test tests[] = { ...@@ -1579,8 +1591,6 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.result_unpriv = REJECT,
.errstr_unpriv = "R1 pointer arithmetic",
}, },
{ {
"unpriv: add pointer to pointer", "unpriv: add pointer to pointer",
...@@ -1591,7 +1601,7 @@ static struct bpf_test tests[] = { ...@@ -1591,7 +1601,7 @@ static struct bpf_test tests[] = {
}, },
.result = ACCEPT, .result = ACCEPT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
.errstr_unpriv = "R1 pointer arithmetic", .errstr_unpriv = "R1 pointer += pointer",
}, },
{ {
"unpriv: neg pointer", "unpriv: neg pointer",
...@@ -1932,10 +1942,7 @@ static struct bpf_test tests[] = { ...@@ -1932,10 +1942,7 @@ static struct bpf_test tests[] = {
BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8), BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr_unpriv = "pointer arithmetic prohibited", .result = ACCEPT,
.result_unpriv = REJECT,
.errstr = "R1 invalid mem access",
.result = REJECT,
}, },
{ {
"unpriv: cmp of stack pointer", "unpriv: cmp of stack pointer",
...@@ -1999,7 +2006,7 @@ static struct bpf_test tests[] = { ...@@ -1999,7 +2006,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid stack type R3", .errstr = "R4 min value is negative",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
...@@ -2016,7 +2023,7 @@ static struct bpf_test tests[] = { ...@@ -2016,7 +2023,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid stack type R3", .errstr = "R4 min value is negative",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
...@@ -2218,7 +2225,7 @@ static struct bpf_test tests[] = { ...@@ -2218,7 +2225,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid stack type R3 off=-1 access_size=-1", .errstr = "R4 min value is negative",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
...@@ -2235,7 +2242,7 @@ static struct bpf_test tests[] = { ...@@ -2235,7 +2242,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid stack type R3 off=-1 access_size=2147483647", .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
...@@ -2252,7 +2259,7 @@ static struct bpf_test tests[] = { ...@@ -2252,7 +2259,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid stack type R3 off=-512 access_size=2147483647", .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
...@@ -2652,7 +2659,7 @@ static struct bpf_test tests[] = { ...@@ -2652,7 +2659,7 @@ static struct bpf_test tests[] = {
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_A(-6), BPF_JMP_A(-6),
}, },
.errstr = "misaligned packet access off 2+15+-4 size 4", .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.flags = F_LOAD_WITH_STRICT_ALIGNMENT, .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
...@@ -2795,7 +2802,7 @@ static struct bpf_test tests[] = { ...@@ -2795,7 +2802,7 @@ static struct bpf_test tests[] = {
}, },
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = REJECT, .result = REJECT,
.errstr = "cannot add integer value with 47 upper zero bits to ptr_to_packet", .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
}, },
{ {
"direct packet access: test24 (x += pkt_ptr, 5)", "direct packet access: test24 (x += pkt_ptr, 5)",
...@@ -3112,7 +3119,7 @@ static struct bpf_test tests[] = { ...@@ -3112,7 +3119,7 @@ static struct bpf_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test14, cls helper fail sub", "helper access to packet: test14, cls helper ok sub",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3132,12 +3139,36 @@ static struct bpf_test tests[] = { ...@@ -3132,12 +3139,36 @@ static struct bpf_test tests[] = {
BPF_MOV64_IMM(BPF_REG_0, 0), BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
},
{
"helper access to packet: test15, cls helper fail sub",
.insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)),
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
offsetof(struct __sk_buff, data_end)),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
BPF_MOV64_IMM(BPF_REG_2, 4),
BPF_MOV64_IMM(BPF_REG_3, 0),
BPF_MOV64_IMM(BPF_REG_4, 0),
BPF_MOV64_IMM(BPF_REG_5, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_csum_diff),
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.result = REJECT, .result = REJECT,
.errstr = "type=inv expected=fp", .errstr = "invalid access to packet",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test15, cls helper fail range 1", "helper access to packet: test16, cls helper fail range 1",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3162,7 +3193,7 @@ static struct bpf_test tests[] = { ...@@ -3162,7 +3193,7 @@ static struct bpf_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test16, cls helper fail range 2", "helper access to packet: test17, cls helper fail range 2",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3183,11 +3214,11 @@ static struct bpf_test tests[] = { ...@@ -3183,11 +3214,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid access to packet", .errstr = "R2 min value is negative",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test17, cls helper fail range 3", "helper access to packet: test18, cls helper fail range 3",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3208,11 +3239,11 @@ static struct bpf_test tests[] = { ...@@ -3208,11 +3239,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "invalid access to packet", .errstr = "R2 min value is negative",
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test18, cls helper fail range zero", "helper access to packet: test19, cls helper fail range zero",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3237,7 +3268,7 @@ static struct bpf_test tests[] = { ...@@ -3237,7 +3268,7 @@ static struct bpf_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test19, pkt end as input", "helper access to packet: test20, pkt end as input",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3262,7 +3293,7 @@ static struct bpf_test tests[] = { ...@@ -3262,7 +3293,7 @@ static struct bpf_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
{ {
"helper access to packet: test20, wrong reg", "helper access to packet: test21, wrong reg",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
offsetof(struct __sk_buff, data)), offsetof(struct __sk_buff, data)),
...@@ -3322,7 +3353,7 @@ static struct bpf_test tests[] = { ...@@ -3322,7 +3353,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = ACCEPT, .result = ACCEPT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -3346,7 +3377,7 @@ static struct bpf_test tests[] = { ...@@ -3346,7 +3377,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = ACCEPT, .result = ACCEPT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -3374,7 +3405,7 @@ static struct bpf_test tests[] = { ...@@ -3374,7 +3405,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = ACCEPT, .result = ACCEPT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -3415,9 +3446,7 @@ static struct bpf_test tests[] = { ...@@ -3415,9 +3446,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is outside of the array range", .errstr = "R0 min value is outside of the array range",
.result_unpriv = REJECT,
.result = REJECT, .result = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
}, },
...@@ -3439,9 +3468,7 @@ static struct bpf_test tests[] = { ...@@ -3439,9 +3468,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
.result_unpriv = REJECT,
.result = REJECT, .result = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
}, },
...@@ -3455,7 +3482,7 @@ static struct bpf_test tests[] = { ...@@ -3455,7 +3482,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem), BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES), BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1), BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
BPF_MOV32_IMM(BPF_REG_1, 0), BPF_MOV32_IMM(BPF_REG_1, 0),
...@@ -3466,8 +3493,8 @@ static struct bpf_test tests[] = { ...@@ -3466,8 +3493,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.", .errstr = "R0 unbounded memory access",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = REJECT, .result = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -3493,7 +3520,7 @@ static struct bpf_test tests[] = { ...@@ -3493,7 +3520,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.errstr = "invalid access to map value, value_size=48 off=44 size=8", .errstr = "invalid access to map value, value_size=48 off=44 size=8",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = REJECT, .result = REJECT,
...@@ -3523,8 +3550,8 @@ static struct bpf_test tests[] = { ...@@ -3523,8 +3550,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3, 11 }, .fixup_map2 = { 3, 11 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 pointer += pointer",
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.", .errstr = "R0 invalid mem access 'inv'",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.result = REJECT, .result = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -3665,34 +3692,6 @@ static struct bpf_test tests[] = { ...@@ -3665,34 +3692,6 @@ static struct bpf_test tests[] = {
.result = ACCEPT, .result = ACCEPT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS .prog_type = BPF_PROG_TYPE_SCHED_CLS
}, },
{
"multiple registers share map_lookup_elem bad reg type",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, 10),
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
BPF_LD_MAP_FD(BPF_REG_1, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
BPF_MOV64_IMM(BPF_REG_1, 1),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
BPF_MOV64_IMM(BPF_REG_1, 2),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
BPF_MOV64_IMM(BPF_REG_1, 3),
BPF_EXIT_INSN(),
},
.fixup_map1 = { 4 },
.result = REJECT,
.errstr = "R3 invalid mem access 'inv'",
.prog_type = BPF_PROG_TYPE_SCHED_CLS
},
{ {
"invalid map access from else condition", "invalid map access from else condition",
.insns = { .insns = {
...@@ -3711,9 +3710,9 @@ static struct bpf_test tests[] = { ...@@ -3711,9 +3710,9 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map", .errstr = "R0 unbounded memory access",
.result = REJECT, .result = REJECT,
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result_unpriv = REJECT, .result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
}, },
...@@ -4091,7 +4090,7 @@ static struct bpf_test tests[] = { ...@@ -4091,7 +4090,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "invalid access to map value, value_size=48 off=0 size=-8", .errstr = "R2 min value is negative",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4157,7 +4156,7 @@ static struct bpf_test tests[] = { ...@@ -4157,7 +4156,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "R1 min value is outside of the array range", .errstr = "invalid access to map value, value_size=48 off=4 size=0",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4203,7 +4202,7 @@ static struct bpf_test tests[] = { ...@@ -4203,7 +4202,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "invalid access to map value, value_size=48 off=4 size=-8", .errstr = "R2 min value is negative",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4225,7 +4224,7 @@ static struct bpf_test tests[] = { ...@@ -4225,7 +4224,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "R1 min value is outside of the array range", .errstr = "R2 min value is negative",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4341,7 +4340,7 @@ static struct bpf_test tests[] = { ...@@ -4341,7 +4340,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "invalid access to map value, value_size=48 off=4 size=-8", .errstr = "R2 min value is negative",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4364,7 +4363,7 @@ static struct bpf_test tests[] = { ...@@ -4364,7 +4363,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "R1 min value is outside of the array range", .errstr = "R2 min value is negative",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4452,13 +4451,13 @@ static struct bpf_test tests[] = { ...@@ -4452,13 +4451,13 @@ static struct bpf_test tests[] = {
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0), BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3), BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
BPF_MOV64_IMM(BPF_REG_2, 0), BPF_MOV64_IMM(BPF_REG_2, 1),
BPF_MOV64_IMM(BPF_REG_3, 0), BPF_MOV64_IMM(BPF_REG_3, 0),
BPF_EMIT_CALL(BPF_FUNC_probe_read), BPF_EMIT_CALL(BPF_FUNC_probe_read),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr = "R1 min value is negative, either use unsigned index or do a if (index >=0) check", .errstr = "R1 unbounded memory access",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -4578,7 +4577,7 @@ static struct bpf_test tests[] = { ...@@ -4578,7 +4577,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result = ACCEPT, .result = ACCEPT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -4606,7 +4605,7 @@ static struct bpf_test tests[] = { ...@@ -4606,7 +4605,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result = ACCEPT, .result = ACCEPT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -4625,7 +4624,7 @@ static struct bpf_test tests[] = { ...@@ -4625,7 +4624,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 bitwise operator &= on pointer",
.errstr = "invalid mem access 'inv'", .errstr = "invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
...@@ -4644,7 +4643,7 @@ static struct bpf_test tests[] = { ...@@ -4644,7 +4643,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 32-bit pointer arithmetic prohibited",
.errstr = "invalid mem access 'inv'", .errstr = "invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
...@@ -4663,7 +4662,7 @@ static struct bpf_test tests[] = { ...@@ -4663,7 +4662,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 pointer arithmetic with /= operator",
.errstr = "invalid mem access 'inv'", .errstr = "invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
...@@ -4706,10 +4705,8 @@ static struct bpf_test tests[] = { ...@@ -4706,10 +4705,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 invalid mem access 'inv'",
.errstr = "R0 invalid mem access 'inv'", .errstr = "R0 invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"map element value is preserved across register spilling", "map element value is preserved across register spilling",
...@@ -4731,7 +4728,7 @@ static struct bpf_test tests[] = { ...@@ -4731,7 +4728,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 leaks addr",
.result = ACCEPT, .result = ACCEPT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
...@@ -4913,7 +4910,8 @@ static struct bpf_test tests[] = { ...@@ -4913,7 +4910,8 @@ static struct bpf_test tests[] = {
BPF_MOV64_IMM(BPF_REG_0, 0), BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "R2 unbounded memory access", /* because max wasn't checked, signed min is negative */
.errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
...@@ -5061,6 +5059,20 @@ static struct bpf_test tests[] = { ...@@ -5061,6 +5059,20 @@ static struct bpf_test tests[] = {
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
}, },
{
"helper access to variable memory: size = 0 allowed on NULL",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, 0),
BPF_MOV64_IMM(BPF_REG_2, 0),
BPF_MOV64_IMM(BPF_REG_3, 0),
BPF_MOV64_IMM(BPF_REG_4, 0),
BPF_MOV64_IMM(BPF_REG_5, 0),
BPF_EMIT_CALL(BPF_FUNC_csum_diff),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
},
{ {
"helper access to variable memory: size > 0 not allowed on NULL", "helper access to variable memory: size > 0 not allowed on NULL",
.insns = { .insns = {
...@@ -5075,7 +5087,7 @@ static struct bpf_test tests[] = { ...@@ -5075,7 +5087,7 @@ static struct bpf_test tests[] = {
BPF_EMIT_CALL(BPF_FUNC_csum_diff), BPF_EMIT_CALL(BPF_FUNC_csum_diff),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "R1 type=imm expected=fp", .errstr = "R1 type=inv expected=fp",
.result = REJECT, .result = REJECT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
}, },
...@@ -5160,7 +5172,7 @@ static struct bpf_test tests[] = { ...@@ -5160,7 +5172,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem), BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
BPF_MOV64_IMM(BPF_REG_1, 6), BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4), BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
...@@ -5169,10 +5181,8 @@ static struct bpf_test tests[] = { ...@@ -5169,10 +5181,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr = "R0 max value is outside of the array range",
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
}, },
{ {
...@@ -5201,10 +5211,8 @@ static struct bpf_test tests[] = { ...@@ -5201,10 +5211,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map2 = { 3 }, .fixup_map2 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr = "R0 max value is outside of the array range",
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
}, },
{ {
...@@ -5251,7 +5259,7 @@ static struct bpf_test tests[] = { ...@@ -5251,7 +5259,7 @@ static struct bpf_test tests[] = {
}, },
.fixup_map_in_map = { 3 }, .fixup_map_in_map = { 3 },
.errstr = "R1 type=inv expected=map_ptr", .errstr = "R1 type=inv expected=map_ptr",
.errstr_unpriv = "R1 pointer arithmetic prohibited", .errstr_unpriv = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -5531,10 +5539,8 @@ static struct bpf_test tests[] = { ...@@ -5531,10 +5539,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned", "bounds checks mixing signed and unsigned",
...@@ -5557,10 +5563,8 @@ static struct bpf_test tests[] = { ...@@ -5557,10 +5563,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 2", "bounds checks mixing signed and unsigned, variant 2",
...@@ -5585,10 +5589,8 @@ static struct bpf_test tests[] = { ...@@ -5585,10 +5589,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R8 invalid mem access 'inv'", .errstr = "R8 invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 3", "bounds checks mixing signed and unsigned, variant 3",
...@@ -5612,10 +5614,8 @@ static struct bpf_test tests[] = { ...@@ -5612,10 +5614,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R8 invalid mem access 'inv'", .errstr = "R8 invalid mem access 'inv'",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 4", "bounds checks mixing signed and unsigned, variant 4",
...@@ -5638,10 +5638,7 @@ static struct bpf_test tests[] = { ...@@ -5638,10 +5638,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .result = ACCEPT,
.errstr = "R0 min value is negative",
.result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 5", "bounds checks mixing signed and unsigned, variant 5",
...@@ -5665,10 +5662,8 @@ static struct bpf_test tests[] = { ...@@ -5665,10 +5662,8 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr = "R0 min value is negative",
.errstr = "R0 invalid mem access",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 6", "bounds checks mixing signed and unsigned, variant 6",
...@@ -5689,10 +5684,8 @@ static struct bpf_test tests[] = { ...@@ -5689,10 +5684,8 @@ static struct bpf_test tests[] = {
BPF_MOV64_IMM(BPF_REG_0, 0), BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr_unpriv = "R4 min value is negative, either use unsigned",
.errstr = "R4 min value is negative, either use unsigned", .errstr = "R4 min value is negative, either use unsigned",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 7", "bounds checks mixing signed and unsigned, variant 7",
...@@ -5715,39 +5708,10 @@ static struct bpf_test tests[] = { ...@@ -5715,39 +5708,10 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .result = ACCEPT,
.errstr = "R0 min value is negative",
.result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 8", "bounds checks mixing signed and unsigned, variant 8",
.insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
BPF_LD_MAP_FD(BPF_REG_1, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024 + 1),
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative",
.result = REJECT,
.result_unpriv = REJECT,
},
{
"bounds checks mixing signed and unsigned, variant 9",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5769,13 +5733,11 @@ static struct bpf_test tests[] = { ...@@ -5769,13 +5733,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 10", "bounds checks mixing signed and unsigned, variant 9",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5797,13 +5759,10 @@ static struct bpf_test tests[] = { ...@@ -5797,13 +5759,10 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .result = ACCEPT,
.errstr = "R0 min value is negative",
.result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 11", "bounds checks mixing signed and unsigned, variant 10",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5825,13 +5784,11 @@ static struct bpf_test tests[] = { ...@@ -5825,13 +5784,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 12", "bounds checks mixing signed and unsigned, variant 11",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5854,13 +5811,11 @@ static struct bpf_test tests[] = { ...@@ -5854,13 +5811,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 13", "bounds checks mixing signed and unsigned, variant 12",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5882,13 +5837,11 @@ static struct bpf_test tests[] = { ...@@ -5882,13 +5837,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 14", "bounds checks mixing signed and unsigned, variant 13",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5913,13 +5866,11 @@ static struct bpf_test tests[] = { ...@@ -5913,13 +5866,11 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 15", "bounds checks mixing signed and unsigned, variant 14",
.insns = { .insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1, BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
offsetof(struct __sk_buff, mark)), offsetof(struct __sk_buff, mark)),
...@@ -5945,13 +5896,11 @@ static struct bpf_test tests[] = { ...@@ -5945,13 +5896,11 @@ static struct bpf_test tests[] = {
BPF_JMP_IMM(BPF_JA, 0, 0, -7), BPF_JMP_IMM(BPF_JA, 0, 0, -7),
}, },
.fixup_map1 = { 4 }, .fixup_map1 = { 4 },
.errstr_unpriv = "R0 pointer arithmetic prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
{ {
"bounds checks mixing signed and unsigned, variant 16", "bounds checks mixing signed and unsigned, variant 15",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -5975,13 +5924,13 @@ static struct bpf_test tests[] = { ...@@ -5975,13 +5924,13 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr_unpriv = "R0 pointer comparison prohibited",
.errstr = "R0 min value is negative", .errstr = "R0 min value is negative",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT, .result_unpriv = REJECT,
}, },
{ {
"subtraction bounds (map value)", "subtraction bounds (map value) variant 1",
.insns = { .insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
...@@ -6003,10 +5952,33 @@ static struct bpf_test tests[] = { ...@@ -6003,10 +5952,33 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.fixup_map1 = { 3 }, .fixup_map1 = { 3 },
.errstr_unpriv = "R0 pointer arithmetic prohibited", .errstr = "R0 max value is outside of the array range",
.result = REJECT,
},
{
"subtraction bounds (map value) variant 2",
.insns = {
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
BPF_LD_MAP_FD(BPF_REG_1, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
BPF_EXIT_INSN(),
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map1 = { 3 },
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.", .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
.result = REJECT, .result = REJECT,
.result_unpriv = REJECT,
}, },
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7