bpf/verifier/and.c

0001 {
0002     "invalid and of negative number",
0003     .insns = {
0004     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0005     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0006     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0007     BPF_LD_MAP_FD(BPF_REG_1, 0),
0008     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0009     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
0010     BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
0011     BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
0012     BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
0013     BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
0014     BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
0015     BPF_EXIT_INSN(),
0016     },
0017     .fixup_map_hash_48b = { 3 },
0018     .errstr = "R0 max value is outside of the allowed memory range",
0019     .result = REJECT,
0020     .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0021 },
0022 {
0023     "invalid range check",
0024     .insns = {
0025     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0026     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0027     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0028     BPF_LD_MAP_FD(BPF_REG_1, 0),
0029     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0030     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
0031     BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
0032     BPF_MOV64_IMM(BPF_REG_9, 1),
0033     BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
0034     BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
0035     BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
0036     BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
0037     BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
0038     BPF_MOV32_IMM(BPF_REG_3, 1),
0039     BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
0040     BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
0041     BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
0042     BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
0043     BPF_MOV64_REG(BPF_REG_0, 0),
0044     BPF_EXIT_INSN(),
0045     },
0046     .fixup_map_hash_48b = { 3 },
0047     .errstr = "R0 max value is outside of the allowed memory range",
0048     .result = REJECT,
0049     .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0050 },
0051 {
0052     "check known subreg with unknown reg",
0053     .insns = {
0054     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
0055     BPF_ALU64_IMM(BPF_LSH, BPF_REG_0, 32),
0056     BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
0057     BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xFFFF1234),
0058     /* Upper bits are unknown but AND above masks out 1 zero'ing lower bits */
0059     BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 1, 1),
0060     BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 512),
0061     BPF_MOV64_IMM(BPF_REG_0, 0),
0062     BPF_EXIT_INSN(),
0063     },
0064     .errstr_unpriv = "R1 !read_ok",
0065     .result_unpriv = REJECT,
0066     .result = ACCEPT,
0067     .retval = 0
0068 },