tools/testing/selftests/bpf/verifier/leak_ptr.c

   1 {
   2         "leak pointer into ctx 1",
   3         .insns = {
   4         BPF_MOV64_IMM(BPF_REG_0, 0),
   5         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
   6                     offsetof(struct __sk_buff, cb[0])),
   7         BPF_LD_MAP_FD(BPF_REG_2, 0),
   8         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
   9                       offsetof(struct __sk_buff, cb[0])),
  10         BPF_EXIT_INSN(),
  11         },
  12         .fixup_map_hash_8b = { 2 },
  13         .errstr_unpriv = "R2 leaks addr into mem",
  14         .result_unpriv = REJECT,
  15         .result = REJECT,
  16         .errstr = "BPF_XADD stores into R1 ctx is not allowed",
  17 },
  18 {
  19         "leak pointer into ctx 2",
  20         .insns = {
  21         BPF_MOV64_IMM(BPF_REG_0, 0),
  22         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
  23                     offsetof(struct __sk_buff, cb[0])),
  24         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
  25                       offsetof(struct __sk_buff, cb[0])),
  26         BPF_EXIT_INSN(),
  27         },
  28         .errstr_unpriv = "R10 leaks addr into mem",
  29         .result_unpriv = REJECT,
  30         .result = REJECT,
  31         .errstr = "BPF_XADD stores into R1 ctx is not allowed",
  32 },
  33 {
  34         "leak pointer into ctx 3",
  35         .insns = {
  36         BPF_MOV64_IMM(BPF_REG_0, 0),
  37         BPF_LD_MAP_FD(BPF_REG_2, 0),
  38         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
  39                       offsetof(struct __sk_buff, cb[0])),
  40         BPF_EXIT_INSN(),
  41         },
  42         .fixup_map_hash_8b = { 1 },
  43         .errstr_unpriv = "R2 leaks addr into ctx",
  44         .result_unpriv = REJECT,
  45         .result = ACCEPT,
  46 },
  47 {
  48         "leak pointer into map val",
  49         .insns = {
  50         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  51         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  52         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  53         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  54         BPF_LD_MAP_FD(BPF_REG_1, 0),
  55         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  56         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
  57         BPF_MOV64_IMM(BPF_REG_3, 0),
  58         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
  59         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
  60         BPF_MOV64_IMM(BPF_REG_0, 0),
  61         BPF_EXIT_INSN(),
  62         },
  63         .fixup_map_hash_8b = { 4 },
  64         .errstr_unpriv = "R6 leaks addr into mem",
  65         .result_unpriv = REJECT,
  66         .result = ACCEPT,
  67 },