tools/testing/selftests/bpf/verifier/map_in_map.c

   1 {
   2         "map in map access",
   3         .insns = {
   4         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
   5         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
   6         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
   7         BPF_LD_MAP_FD(BPF_REG_1, 0),
   8         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
   9         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
  10         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
  11         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  12         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
  13         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
  14         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  15         BPF_MOV64_IMM(BPF_REG_0, 0),
  16         BPF_EXIT_INSN(),
  17         },
  18         .fixup_map_in_map = { 3 },
  19         .result = ACCEPT,
  20 },
  21 {
  22         "invalid inner map pointer",
  23         .insns = {
  24         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
  25         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  26         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
  27         BPF_LD_MAP_FD(BPF_REG_1, 0),
  28         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  29         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
  30         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
  31         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  32         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
  33         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
  34         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
  35         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  36         BPF_MOV64_IMM(BPF_REG_0, 0),
  37         BPF_EXIT_INSN(),
  38         },
  39         .fixup_map_in_map = { 3 },
  40         .errstr = "R1 pointer arithmetic on map_ptr prohibited",
  41         .result = REJECT,
  42 },
  43 {
  44         "forgot null checking on the inner map pointer",
  45         .insns = {
  46         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
  47         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  48         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
  49         BPF_LD_MAP_FD(BPF_REG_1, 0),
  50         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  51         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
  52         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  53         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
  54         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
  55         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  56         BPF_MOV64_IMM(BPF_REG_0, 0),
  57         BPF_EXIT_INSN(),
  58         },
  59         .fixup_map_in_map = { 3 },
  60         .errstr = "R1 type=map_value_or_null expected=map_ptr",
  61         .result = REJECT,
  62 },