tools/testing/selftests/bpf/verifier/cgroup_storage.c

   1 {
   2         "valid cgroup storage access",
   3         .insns = {
   4         BPF_MOV64_IMM(BPF_REG_2, 0),
   5         BPF_LD_MAP_FD(BPF_REG_1, 0),
   6         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
   7         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
   8         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
   9         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
  10         BPF_EXIT_INSN(),
  11         },
  12         .fixup_cgroup_storage = { 1 },
  13         .result = ACCEPT,
  14         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  15 },
  16 {
  17         "invalid cgroup storage access 1",
  18         .insns = {
  19         BPF_MOV64_IMM(BPF_REG_2, 0),
  20         BPF_LD_MAP_FD(BPF_REG_1, 0),
  21         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  22         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
  23         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
  24         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
  25         BPF_EXIT_INSN(),
  26         },
  27         .fixup_map_hash_8b = { 1 },
  28         .result = REJECT,
  29         .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
  30         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  31 },
  32 {
  33         "invalid cgroup storage access 2",
  34         .insns = {
  35         BPF_MOV64_IMM(BPF_REG_2, 0),
  36         BPF_LD_MAP_FD(BPF_REG_1, 1),
  37         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  38         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
  39         BPF_EXIT_INSN(),
  40         },
  41         .result = REJECT,
  42         .errstr = "fd 1 is not pointing to valid bpf_map",
  43         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  44 },
  45 {
  46         "invalid cgroup storage access 3",
  47         .insns = {
  48         BPF_MOV64_IMM(BPF_REG_2, 0),
  49         BPF_LD_MAP_FD(BPF_REG_1, 0),
  50         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  51         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
  52         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
  53         BPF_MOV64_IMM(BPF_REG_0, 0),
  54         BPF_EXIT_INSN(),
  55         },
  56         .fixup_cgroup_storage = { 1 },
  57         .result = REJECT,
  58         .errstr = "invalid access to map value, value_size=64 off=256 size=4",
  59         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  60 },
  61 {
  62         "invalid cgroup storage access 4",
  63         .insns = {
  64         BPF_MOV64_IMM(BPF_REG_2, 0),
  65         BPF_LD_MAP_FD(BPF_REG_1, 0),
  66         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  67         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
  68         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
  69         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
  70         BPF_EXIT_INSN(),
  71         },
  72         .fixup_cgroup_storage = { 1 },
  73         .result = REJECT,
  74         .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
  75         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  76         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
  77 },
  78 {
  79         "invalid cgroup storage access 5",
  80         .insns = {
  81         BPF_MOV64_IMM(BPF_REG_2, 7),
  82         BPF_LD_MAP_FD(BPF_REG_1, 0),
  83         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
  84         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
  85         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
  86         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
  87         BPF_EXIT_INSN(),
  88         },
  89         .fixup_cgroup_storage = { 1 },
  90         .result = REJECT,
  91         .errstr = "get_local_storage() doesn't support non-zero flags",
  92         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  93 },
  94 {
  95         "invalid cgroup storage access 6",
  96         .insns = {
  97         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
  98         BPF_LD_MAP_FD(BPF_REG_1, 0),
  99         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 100         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
 101         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 102         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 103         BPF_EXIT_INSN(),
 104         },
 105         .fixup_cgroup_storage = { 1 },
 106         .result = REJECT,
 107         .errstr = "get_local_storage() doesn't support non-zero flags",
 108         .errstr_unpriv = "R2 leaks addr into helper function",
 109         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 110 },
 111 {
 112         "valid per-cpu cgroup storage access",
 113         .insns = {
 114         BPF_MOV64_IMM(BPF_REG_2, 0),
 115         BPF_LD_MAP_FD(BPF_REG_1, 0),
 116         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 117         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
 118         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 119         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 120         BPF_EXIT_INSN(),
 121         },
 122         .fixup_percpu_cgroup_storage = { 1 },
 123         .result = ACCEPT,
 124         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 125 },
 126 {
 127         "invalid per-cpu cgroup storage access 1",
 128         .insns = {
 129         BPF_MOV64_IMM(BPF_REG_2, 0),
 130         BPF_LD_MAP_FD(BPF_REG_1, 0),
 131         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 132         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
 133         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 134         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 135         BPF_EXIT_INSN(),
 136         },
 137         .fixup_map_hash_8b = { 1 },
 138         .result = REJECT,
 139         .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
 140         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 141 },
 142 {
 143         "invalid per-cpu cgroup storage access 2",
 144         .insns = {
 145         BPF_MOV64_IMM(BPF_REG_2, 0),
 146         BPF_LD_MAP_FD(BPF_REG_1, 1),
 147         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 148         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 149         BPF_EXIT_INSN(),
 150         },
 151         .result = REJECT,
 152         .errstr = "fd 1 is not pointing to valid bpf_map",
 153         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 154 },
 155 {
 156         "invalid per-cpu cgroup storage access 3",
 157         .insns = {
 158         BPF_MOV64_IMM(BPF_REG_2, 0),
 159         BPF_LD_MAP_FD(BPF_REG_1, 0),
 160         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 161         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
 162         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
 163         BPF_MOV64_IMM(BPF_REG_0, 0),
 164         BPF_EXIT_INSN(),
 165         },
 166         .fixup_percpu_cgroup_storage = { 1 },
 167         .result = REJECT,
 168         .errstr = "invalid access to map value, value_size=64 off=256 size=4",
 169         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 170 },
 171 {
 172         "invalid per-cpu cgroup storage access 4",
 173         .insns = {
 174         BPF_MOV64_IMM(BPF_REG_2, 0),
 175         BPF_LD_MAP_FD(BPF_REG_1, 0),
 176         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 177         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
 178         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 179         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
 180         BPF_EXIT_INSN(),
 181         },
 182         .fixup_cgroup_storage = { 1 },
 183         .result = REJECT,
 184         .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
 185         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 186         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 187 },
 188 {
 189         "invalid per-cpu cgroup storage access 5",
 190         .insns = {
 191         BPF_MOV64_IMM(BPF_REG_2, 7),
 192         BPF_LD_MAP_FD(BPF_REG_1, 0),
 193         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 194         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
 195         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 196         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 197         BPF_EXIT_INSN(),
 198         },
 199         .fixup_percpu_cgroup_storage = { 1 },
 200         .result = REJECT,
 201         .errstr = "get_local_storage() doesn't support non-zero flags",
 202         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 203 },
 204 {
 205         "invalid per-cpu cgroup storage access 6",
 206         .insns = {
 207         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
 208         BPF_LD_MAP_FD(BPF_REG_1, 0),
 209         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
 210         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
 211         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 212         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
 213         BPF_EXIT_INSN(),
 214         },
 215         .fixup_percpu_cgroup_storage = { 1 },
 216         .result = REJECT,
 217         .errstr = "get_local_storage() doesn't support non-zero flags",
 218         .errstr_unpriv = "R2 leaks addr into helper function",
 219         .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 220 },