tools/testing/selftests/bpf/verifier/direct_value_access.c

   1 {
   2         "direct map access, write test 1",
   3         .insns = {
   4         BPF_MOV64_IMM(BPF_REG_0, 1),
   5         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
   6         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
   7         BPF_EXIT_INSN(),
   8         },
   9         .fixup_map_array_48b = { 1 },
  10         .result = ACCEPT,
  11         .retval = 1,
  12 },
  13 {
  14         "direct map access, write test 2",
  15         .insns = {
  16         BPF_MOV64_IMM(BPF_REG_0, 1),
  17         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
  18         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
  19         BPF_EXIT_INSN(),
  20         },
  21         .fixup_map_array_48b = { 1 },
  22         .result = ACCEPT,
  23         .retval = 1,
  24 },
  25 {
  26         "direct map access, write test 3",
  27         .insns = {
  28         BPF_MOV64_IMM(BPF_REG_0, 1),
  29         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
  30         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
  31         BPF_EXIT_INSN(),
  32         },
  33         .fixup_map_array_48b = { 1 },
  34         .result = ACCEPT,
  35         .retval = 1,
  36 },
  37 {
  38         "direct map access, write test 4",
  39         .insns = {
  40         BPF_MOV64_IMM(BPF_REG_0, 1),
  41         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
  42         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
  43         BPF_EXIT_INSN(),
  44         },
  45         .fixup_map_array_48b = { 1 },
  46         .result = ACCEPT,
  47         .retval = 1,
  48 },
  49 {
  50         "direct map access, write test 5",
  51         .insns = {
  52         BPF_MOV64_IMM(BPF_REG_0, 1),
  53         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),
  54         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
  55         BPF_EXIT_INSN(),
  56         },
  57         .fixup_map_array_48b = { 1 },
  58         .result = ACCEPT,
  59         .retval = 1,
  60 },
  61 {
  62         "direct map access, write test 6",
  63         .insns = {
  64         BPF_MOV64_IMM(BPF_REG_0, 1),
  65         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
  66         BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
  67         BPF_EXIT_INSN(),
  68         },
  69         .fixup_map_array_48b = { 1 },
  70         .result = REJECT,
  71         .errstr = "R1 min value is outside of the allowed memory range",
  72         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
  73 },
  74 {
  75         "direct map access, write test 7",
  76         .insns = {
  77         BPF_MOV64_IMM(BPF_REG_0, 1),
  78         BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),
  79         BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
  80         BPF_EXIT_INSN(),
  81         },
  82         .fixup_map_array_48b = { 1 },
  83         .result = REJECT,
  84         .errstr = "direct value offset of 4294967295 is not allowed",
  85 },
  86 {
  87         "direct map access, write test 8",
  88         .insns = {
  89         BPF_MOV64_IMM(BPF_REG_0, 1),
  90         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
  91         BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),
  92         BPF_EXIT_INSN(),
  93         },
  94         .fixup_map_array_48b = { 1 },
  95         .result = ACCEPT,
  96         .retval = 1,
  97 },
  98 {
  99         "direct map access, write test 9",
 100         .insns = {
 101         BPF_MOV64_IMM(BPF_REG_0, 1),
 102         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
 103         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
 104         BPF_EXIT_INSN(),
 105         },
 106         .fixup_map_array_48b = { 1 },
 107         .result = REJECT,
 108         .errstr = "invalid access to map value pointer",
 109 },
 110 {
 111         "direct map access, write test 10",
 112         .insns = {
 113         BPF_MOV64_IMM(BPF_REG_0, 1),
 114         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
 115         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
 116         BPF_EXIT_INSN(),
 117         },
 118         .fixup_map_array_48b = { 1 },
 119         .result = ACCEPT,
 120         .retval = 1,
 121 },
 122 {
 123         "direct map access, write test 11",
 124         .insns = {
 125         BPF_MOV64_IMM(BPF_REG_0, 1),
 126         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
 127         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
 128         BPF_EXIT_INSN(),
 129         },
 130         .fixup_map_array_48b = { 1 },
 131         .result = REJECT,
 132         .errstr = "invalid access to map value pointer",
 133 },
 134 {
 135         "direct map access, write test 12",
 136         .insns = {
 137         BPF_MOV64_IMM(BPF_REG_0, 1),
 138         BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),
 139         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
 140         BPF_EXIT_INSN(),
 141         },
 142         .fixup_map_array_48b = { 1 },
 143         .result = REJECT,
 144         .errstr = "direct value offset of 536870912 is not allowed",
 145 },
 146 {
 147         "direct map access, write test 13",
 148         .insns = {
 149         BPF_MOV64_IMM(BPF_REG_0, 1),
 150         BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),
 151         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
 152         BPF_EXIT_INSN(),
 153         },
 154         .fixup_map_array_48b = { 1 },
 155         .result = REJECT,
 156         .errstr = "invalid access to map value pointer, value_size=48 off=536870911",
 157 },
 158 {
 159         "direct map access, write test 14",
 160         .insns = {
 161         BPF_MOV64_IMM(BPF_REG_0, 1),
 162         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
 163         BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
 164         BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
 165         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
 166         BPF_EXIT_INSN(),
 167         },
 168         .fixup_map_array_48b = { 1, 3 },
 169         .result = ACCEPT,
 170         .retval = 0xff,
 171 },
 172 {
 173         "direct map access, write test 15",
 174         .insns = {
 175         BPF_MOV64_IMM(BPF_REG_0, 1),
 176         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
 177         BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
 178         BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
 179         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
 180         BPF_EXIT_INSN(),
 181         },
 182         .fixup_map_array_48b = { 1, 3 },
 183         .result = ACCEPT,
 184         .retval = 0xffff,
 185 },
 186 {
 187         "direct map access, write test 16",
 188         .insns = {
 189         BPF_MOV64_IMM(BPF_REG_0, 1),
 190         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
 191         BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),
 192         BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
 193         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
 194         BPF_EXIT_INSN(),
 195         },
 196         .fixup_map_array_48b = { 1, 3 },
 197         .result = REJECT,
 198         .errstr = "invalid access to map value, value_size=48 off=47 size=2",
 199         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 200 },
 201 {
 202         "direct map access, write test 17",
 203         .insns = {
 204         BPF_MOV64_IMM(BPF_REG_0, 1),
 205         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
 206         BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
 207         BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),
 208         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
 209         BPF_EXIT_INSN(),
 210         },
 211         .fixup_map_array_48b = { 1, 3 },
 212         .result = REJECT,
 213         .errstr = "invalid access to map value, value_size=48 off=47 size=2",
 214         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 215 },
 216 {
 217         "direct map access, write test 18",
 218         .insns = {
 219         BPF_MOV64_IMM(BPF_REG_0, 1),
 220         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
 221         BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),
 222         BPF_EXIT_INSN(),
 223         },
 224         .fixup_map_array_small = { 1 },
 225         .result = REJECT,
 226         .errstr = "R1 min value is outside of the allowed memory range",
 227 },
 228 {
 229         "direct map access, write test 19",
 230         .insns = {
 231         BPF_MOV64_IMM(BPF_REG_0, 1),
 232         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
 233         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
 234         BPF_EXIT_INSN(),
 235         },
 236         .fixup_map_array_small = { 1 },
 237         .result = ACCEPT,
 238         .retval = 1,
 239 },
 240 {
 241         "direct map access, write test 20",
 242         .insns = {
 243         BPF_MOV64_IMM(BPF_REG_0, 1),
 244         BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
 245         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
 246         BPF_EXIT_INSN(),
 247         },
 248         .fixup_map_array_small = { 1 },
 249         .result = REJECT,
 250         .errstr = "invalid access to map value pointer",
 251 },
 252 {
 253         "direct map access, invalid insn test 1",
 254         .insns = {
 255         BPF_MOV64_IMM(BPF_REG_0, 1),
 256         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),
 257         BPF_EXIT_INSN(),
 258         },
 259         .fixup_map_array_48b = { 1 },
 260         .result = REJECT,
 261         .errstr = "invalid bpf_ld_imm64 insn",
 262 },
 263 {
 264         "direct map access, invalid insn test 2",
 265         .insns = {
 266         BPF_MOV64_IMM(BPF_REG_0, 1),
 267         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),
 268         BPF_EXIT_INSN(),
 269         },
 270         .fixup_map_array_48b = { 1 },
 271         .result = REJECT,
 272         .errstr = "BPF_LD_IMM64 uses reserved fields",
 273 },
 274 {
 275         "direct map access, invalid insn test 3",
 276         .insns = {
 277         BPF_MOV64_IMM(BPF_REG_0, 1),
 278         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),
 279         BPF_EXIT_INSN(),
 280         },
 281         .fixup_map_array_48b = { 1 },
 282         .result = REJECT,
 283         .errstr = "BPF_LD_IMM64 uses reserved fields",
 284 },
 285 {
 286         "direct map access, invalid insn test 4",
 287         .insns = {
 288         BPF_MOV64_IMM(BPF_REG_0, 1),
 289         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),
 290         BPF_EXIT_INSN(),
 291         },
 292         .fixup_map_array_48b = { 1 },
 293         .result = REJECT,
 294         .errstr = "invalid bpf_ld_imm64 insn",
 295 },
 296 {
 297         "direct map access, invalid insn test 5",
 298         .insns = {
 299         BPF_MOV64_IMM(BPF_REG_0, 1),
 300         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),
 301         BPF_EXIT_INSN(),
 302         },
 303         .fixup_map_array_48b = { 1 },
 304         .result = REJECT,
 305         .errstr = "invalid bpf_ld_imm64 insn",
 306 },
 307 {
 308         "direct map access, invalid insn test 6",
 309         .insns = {
 310         BPF_MOV64_IMM(BPF_REG_0, 1),
 311         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
 312         BPF_EXIT_INSN(),
 313         },
 314         .fixup_map_array_48b = { 1 },
 315         .result = REJECT,
 316         .errstr = "BPF_LD_IMM64 uses reserved fields",
 317 },
 318 {
 319         "direct map access, invalid insn test 7",
 320         .insns = {
 321         BPF_MOV64_IMM(BPF_REG_0, 1),
 322         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
 323         BPF_EXIT_INSN(),
 324         },
 325         .fixup_map_array_48b = { 1 },
 326         .result = REJECT,
 327         .errstr = "invalid bpf_ld_imm64 insn",
 328 },
 329 {
 330         "direct map access, invalid insn test 8",
 331         .insns = {
 332         BPF_MOV64_IMM(BPF_REG_0, 1),
 333         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
 334         BPF_EXIT_INSN(),
 335         },
 336         .fixup_map_array_48b = { 1 },
 337         .result = REJECT,
 338         .errstr = "invalid bpf_ld_imm64 insn",
 339 },
 340 {
 341         "direct map access, invalid insn test 9",
 342         .insns = {
 343         BPF_MOV64_IMM(BPF_REG_0, 1),
 344         BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
 345         BPF_EXIT_INSN(),
 346         },
 347         .fixup_map_array_48b = { 1 },
 348         .result = REJECT,
 349         .errstr = "unrecognized bpf_ld_imm64 insn",
 350 },