tools/testing/selftests/bpf/verifier/value_illegal_alu.c

   1 {
   2         "map element value illegal alu op, 1",
   3         .insns = {
   4         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
   5         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
   6         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
   7         BPF_LD_MAP_FD(BPF_REG_1, 0),
   8         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
   9         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  10         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
  11         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
  12         BPF_EXIT_INSN(),
  13         },
  14         .fixup_map_hash_48b = { 3 },
  15         .errstr = "R0 bitwise operator &= on pointer",
  16         .result = REJECT,
  17 },
  18 {
  19         "map element value illegal alu op, 2",
  20         .insns = {
  21         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  22         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  23         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
  24         BPF_LD_MAP_FD(BPF_REG_1, 0),
  25         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
  26         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  27         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
  28         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
  29         BPF_EXIT_INSN(),
  30         },
  31         .fixup_map_hash_48b = { 3 },
  32         .errstr = "R0 32-bit pointer arithmetic prohibited",
  33         .result = REJECT,
  34 },
  35 {
  36         "map element value illegal alu op, 3",
  37         .insns = {
  38         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  39         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  40         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
  41         BPF_LD_MAP_FD(BPF_REG_1, 0),
  42         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
  43         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  44         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
  45         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
  46         BPF_EXIT_INSN(),
  47         },
  48         .fixup_map_hash_48b = { 3 },
  49         .errstr = "R0 pointer arithmetic with /= operator",
  50         .result = REJECT,
  51 },
  52 {
  53         "map element value illegal alu op, 4",
  54         .insns = {
  55         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  56         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  57         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
  58         BPF_LD_MAP_FD(BPF_REG_1, 0),
  59         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
  60         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  61         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
  62         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
  63         BPF_EXIT_INSN(),
  64         },
  65         .fixup_map_hash_48b = { 3 },
  66         .errstr_unpriv = "R0 pointer arithmetic prohibited",
  67         .errstr = "invalid mem access 'inv'",
  68         .result = REJECT,
  69         .result_unpriv = REJECT,
  70         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
  71 },
  72 {
  73         "map element value illegal alu op, 5",
  74         .insns = {
  75         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  76         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  77         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
  78         BPF_LD_MAP_FD(BPF_REG_1, 0),
  79         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
  80         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
  81         BPF_MOV64_IMM(BPF_REG_3, 4096),
  82         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  83         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  84         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
  85         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
  86         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
  87         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
  88         BPF_EXIT_INSN(),
  89         },
  90         .fixup_map_hash_48b = { 3 },
  91         .errstr_unpriv = "leaking pointer from stack off -8",
  92         .errstr = "R0 invalid mem access 'inv'",
  93         .result = REJECT,
  94         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
  95 },