mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-13 14:56:11 -04:00
21596761ff
Add verifier coverage for the three cases affected by preserving the full pointer state across scalar += pointer: stack frame number inheritance, readonly-untrusted memory access, and dynptr data-slice invalidation. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-4-8ee297e2346b@mails.tsinghua.edu.cn Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
142 lines
3.1 KiB
C
142 lines
3.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Converted from tools/testing/selftests/bpf/verifier/basic_stack.c */
|
|
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include "bpf_misc.h"
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_HASH);
|
|
__uint(max_entries, 1);
|
|
__type(key, long long);
|
|
__type(value, long long);
|
|
} map_hash_8b SEC(".maps");
|
|
|
|
SEC("socket")
|
|
__description("stack out of bounds")
|
|
__failure __msg("invalid write to stack")
|
|
__failure_unpriv
|
|
__naked void stack_out_of_bounds(void)
|
|
{
|
|
asm volatile (" \
|
|
r1 = 0; \
|
|
*(u64*)(r10 + 8) = r1; \
|
|
exit; \
|
|
" ::: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("uninitialized stack1")
|
|
__success __log_level(4) __msg("stack depth 8")
|
|
__failure_unpriv __msg_unpriv("invalid read from stack")
|
|
__naked void uninitialized_stack1(void)
|
|
{
|
|
asm volatile (" \
|
|
r2 = r10; \
|
|
r2 += -8; \
|
|
r1 = %[map_hash_8b] ll; \
|
|
call %[bpf_map_lookup_elem]; \
|
|
exit; \
|
|
" :
|
|
: __imm(bpf_map_lookup_elem),
|
|
__imm_addr(map_hash_8b)
|
|
: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("uninitialized stack2")
|
|
__success __log_level(4) __msg("stack depth 8")
|
|
__failure_unpriv __msg_unpriv("invalid read from stack")
|
|
__naked void uninitialized_stack2(void)
|
|
{
|
|
asm volatile (" \
|
|
r2 = r10; \
|
|
r0 = *(u64*)(r2 - 8); \
|
|
exit; \
|
|
" ::: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("invalid fp arithmetic")
|
|
__failure __msg("R1 subtraction from stack pointer")
|
|
__failure_unpriv
|
|
__naked void invalid_fp_arithmetic(void)
|
|
{
|
|
/* If this gets ever changed, make sure JITs can deal with it. */
|
|
asm volatile (" \
|
|
r0 = 0; \
|
|
r1 = r10; \
|
|
r1 -= 8; \
|
|
*(u64*)(r1 + 0) = r0; \
|
|
exit; \
|
|
" ::: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("non-invalid fp arithmetic")
|
|
__success __success_unpriv __retval(0)
|
|
__naked void non_invalid_fp_arithmetic(void)
|
|
{
|
|
asm volatile (" \
|
|
r0 = 0; \
|
|
*(u64*)(r10 - 8) = r0; \
|
|
exit; \
|
|
" ::: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("misaligned read from stack")
|
|
__failure __msg("misaligned stack access")
|
|
__failure_unpriv
|
|
__naked void misaligned_read_from_stack(void)
|
|
{
|
|
asm volatile (" \
|
|
r2 = r10; \
|
|
r0 = *(u64*)(r2 - 4); \
|
|
exit; \
|
|
" ::: __clobber_all);
|
|
}
|
|
|
|
SEC("socket")
|
|
__description("stack pointer arithmetic preserves frame number")
|
|
__failure __msg("R7 invalid mem access 'scalar'")
|
|
__naked void stack_ptr_arith_preserves_frameno(void)
|
|
{
|
|
asm volatile ("\
|
|
r3 = 0; \
|
|
*(u64 *)(r10 - 8) = r3; \
|
|
r1 = %[map_hash_8b] ll; \
|
|
r2 = r10; \
|
|
r2 += -8; \
|
|
call %[bpf_map_lookup_elem]; \
|
|
if r0 != 0 goto +2; \
|
|
r0 = 0; \
|
|
exit; \
|
|
r1 = r0; \
|
|
r2 = 0; \
|
|
r3 = 0; \
|
|
call stack_ptr_arith_preserves_frameno_subprog;\
|
|
r0 = 0; \
|
|
exit; \
|
|
":
|
|
: __imm(bpf_map_lookup_elem),
|
|
__imm_addr(map_hash_8b)
|
|
: __clobber_all);
|
|
}
|
|
|
|
static __used __naked void stack_ptr_arith_preserves_frameno_subprog(void)
|
|
{
|
|
asm volatile ("\
|
|
*(u64 *)(r10 - 8) = r1; \
|
|
r6 = -8; \
|
|
r6 += r10; \
|
|
*(u64 *)(r6 + 0) = r2; \
|
|
r7 = *(u64 *)(r10 - 8); \
|
|
*(u64 *)(r7 + 0) = r3; \
|
|
r0 = 0; \
|
|
exit; \
|
|
"::: __clobber_all);
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|