tools/testing/selftests/bpf/verifier/bounds_deduction.c

   1 {
   2         "check deducing bounds from const, 1",
   3         .insns = {
   4                 BPF_MOV64_IMM(BPF_REG_0, 1),
   5                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
   6                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
   7                 BPF_EXIT_INSN(),
   8         },
   9         .result = REJECT,
  10         .errstr = "R0 tried to subtract pointer from scalar",
  11 },
  12 {
  13         "check deducing bounds from const, 2",
  14         .insns = {
  15                 BPF_MOV64_IMM(BPF_REG_0, 1),
  16                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
  17                 BPF_EXIT_INSN(),
  18                 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
  19                 BPF_EXIT_INSN(),
  20                 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
  21                 BPF_EXIT_INSN(),
  22         },
  23         .result = ACCEPT,
  24         .retval = 1,
  25 },
  26 {
  27         "check deducing bounds from const, 3",
  28         .insns = {
  29                 BPF_MOV64_IMM(BPF_REG_0, 0),
  30                 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
  31                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
  32                 BPF_EXIT_INSN(),
  33         },
  34         .result = REJECT,
  35         .errstr = "R0 tried to subtract pointer from scalar",
  36 },
  37 {
  38         "check deducing bounds from const, 4",
  39         .insns = {
  40                 BPF_MOV64_IMM(BPF_REG_0, 0),
  41                 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
  42                 BPF_EXIT_INSN(),
  43                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
  44                 BPF_EXIT_INSN(),
  45                 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
  46                 BPF_EXIT_INSN(),
  47         },
  48         .result = ACCEPT,
  49 },
  50 {
  51         "check deducing bounds from const, 5",
  52         .insns = {
  53                 BPF_MOV64_IMM(BPF_REG_0, 0),
  54                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
  55                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
  56                 BPF_EXIT_INSN(),
  57         },
  58         .result = REJECT,
  59         .errstr = "R0 tried to subtract pointer from scalar",
  60 },
  61 {
  62         "check deducing bounds from const, 6",
  63         .insns = {
  64                 BPF_MOV64_IMM(BPF_REG_0, 0),
  65                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
  66                 BPF_EXIT_INSN(),
  67                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
  68                 BPF_EXIT_INSN(),
  69         },
  70         .result = REJECT,
  71         .errstr = "R0 tried to subtract pointer from scalar",
  72 },
  73 {
  74         "check deducing bounds from const, 7",
  75         .insns = {
  76                 BPF_MOV64_IMM(BPF_REG_0, ~0),
  77                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
  78                 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
  79                 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  80                             offsetof(struct __sk_buff, mark)),
  81                 BPF_EXIT_INSN(),
  82         },
  83         .result = REJECT,
  84         .errstr = "dereference of modified ctx ptr",
  85         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
  86 },
  87 {
  88         "check deducing bounds from const, 8",
  89         .insns = {
  90                 BPF_MOV64_IMM(BPF_REG_0, ~0),
  91                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
  92                 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
  93                 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  94                             offsetof(struct __sk_buff, mark)),
  95                 BPF_EXIT_INSN(),
  96         },
  97         .result = REJECT,
  98         .errstr = "dereference of modified ctx ptr",
  99         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 100 },
 101 {
 102         "check deducing bounds from const, 9",
 103         .insns = {
 104                 BPF_MOV64_IMM(BPF_REG_0, 0),
 105                 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
 106                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
 107                 BPF_EXIT_INSN(),
 108         },
 109         .result = REJECT,
 110         .errstr = "R0 tried to subtract pointer from scalar",
 111 },
 112 {
 113         "check deducing bounds from const, 10",
 114         .insns = {
 115                 BPF_MOV64_IMM(BPF_REG_0, 0),
 116                 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
 117                 /* Marks reg as unknown. */
 118                 BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
 119                 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
 120                 BPF_EXIT_INSN(),
 121         },
 122         .result = REJECT,
 123         .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
 124 },