blob: 0eb495ce85c1cba2e0f50296909b9ab56ce63a8f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
// SPDX-License-Identifier: GPL-2.0
/* Converted from tools/testing/selftests/bpf/verifier/basic_stack.c */
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1);
__type(key, long long);
__type(value, long long);
} map_hash_8b SEC(".maps");
SEC("socket")
__description("stack out of bounds")
__failure __msg("invalid write to stack")
__failure_unpriv
__naked void stack_out_of_bounds(void)
{
asm volatile (" \
r1 = 0; \
*(u64*)(r10 + 8) = r1; \
exit; \
" ::: __clobber_all);
}
SEC("socket")
__description("uninitialized stack1")
__success __log_level(4)
__msg("subprog 0 (uninitialized_stack1) main {{.*}} stack 8")
__failure_unpriv __msg_unpriv("invalid read from stack")
__naked void uninitialized_stack1(void)
{
asm volatile (" \
r2 = r10; \
r2 += -8; \
r1 = %[map_hash_8b] ll; \
call %[bpf_map_lookup_elem]; \
exit; \
" :
: __imm(bpf_map_lookup_elem),
__imm_addr(map_hash_8b)
: __clobber_all);
}
SEC("socket")
__description("uninitialized stack2")
__success __log_level(4)
__msg("subprog 0 (uninitialized_stack2) main insns_self {{[0-9]+}} insns_total {{[0-9]+}} stack 8")
__failure_unpriv __msg_unpriv("invalid read from stack")
__naked void uninitialized_stack2(void)
{
asm volatile (" \
r2 = r10; \
r0 = *(u64*)(r2 - 8); \
exit; \
" ::: __clobber_all);
}
SEC("socket")
__description("invalid fp arithmetic")
__failure __msg("R1 subtraction from stack pointer")
__failure_unpriv
__naked void invalid_fp_arithmetic(void)
{
/* If this gets ever changed, make sure JITs can deal with it. */
asm volatile (" \
r0 = 0; \
r1 = r10; \
r1 -= 8; \
*(u64*)(r1 + 0) = r0; \
exit; \
" ::: __clobber_all);
}
SEC("socket")
__description("non-invalid fp arithmetic")
__success __success_unpriv __retval(0)
__naked void non_invalid_fp_arithmetic(void)
{
asm volatile (" \
r0 = 0; \
*(u64*)(r10 - 8) = r0; \
exit; \
" ::: __clobber_all);
}
SEC("socket")
__description("misaligned read from stack")
__failure __msg("misaligned stack access")
__failure_unpriv
__naked void misaligned_read_from_stack(void)
{
asm volatile (" \
r2 = r10; \
r0 = *(u64*)(r2 - 4); \
exit; \
" ::: __clobber_all);
}
SEC("socket")
__description("stack pointer arithmetic preserves frame number")
__failure __msg("R7 invalid mem access 'scalar'")
__naked void stack_ptr_arith_preserves_frameno(void)
{
asm volatile ("\
r3 = 0; \
*(u64 *)(r10 - 8) = r3; \
r1 = %[map_hash_8b] ll; \
r2 = r10; \
r2 += -8; \
call %[bpf_map_lookup_elem]; \
if r0 != 0 goto +2; \
r0 = 0; \
exit; \
r1 = r0; \
r2 = 0; \
r3 = 0; \
call stack_ptr_arith_preserves_frameno_subprog;\
r0 = 0; \
exit; \
":
: __imm(bpf_map_lookup_elem),
__imm_addr(map_hash_8b)
: __clobber_all);
}
static __used __naked void stack_ptr_arith_preserves_frameno_subprog(void)
{
asm volatile ("\
*(u64 *)(r10 - 8) = r1; \
r6 = -8; \
r6 += r10; \
*(u64 *)(r6 + 0) = r2; \
r7 = *(u64 *)(r10 - 8); \
*(u64 *)(r7 + 0) = r3; \
r0 = 0; \
exit; \
"::: __clobber_all);
}
char _license[] SEC("license") = "GPL";
|
