bpf/verifier/atomic_fetch_add.c

0001 {
0002     "BPF_ATOMIC_FETCH_ADD smoketest - 64bit",
0003     .insns = {
0004         BPF_MOV64_IMM(BPF_REG_0, 0),
0005         /* Write 3 to stack */
0006         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
0007         /* Put a 1 in R1, add it to the 3 on the stack, and load the value back into R1 */
0008         BPF_MOV64_IMM(BPF_REG_1, 1),
0009         BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_1, -8),
0010         /* Check the value we loaded back was 3 */
0011         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
0012         BPF_MOV64_IMM(BPF_REG_0, 1),
0013         BPF_EXIT_INSN(),
0014         /* Load value from stack */
0015         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -8),
0016         /* Check value loaded from stack was 4 */
0017         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
0018         BPF_MOV64_IMM(BPF_REG_0, 2),
0019         BPF_EXIT_INSN(),
0020     },
0021     .result = ACCEPT,
0022 },
0023 {
0024     "BPF_ATOMIC_FETCH_ADD smoketest - 32bit",
0025     .insns = {
0026         BPF_MOV64_IMM(BPF_REG_0, 0),
0027         /* Write 3 to stack */
0028         BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 3),
0029         /* Put a 1 in R1, add it to the 3 on the stack, and load the value back into R1 */
0030         BPF_MOV32_IMM(BPF_REG_1, 1),
0031         BPF_ATOMIC_OP(BPF_W, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_1, -4),
0032         /* Check the value we loaded back was 3 */
0033         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
0034         BPF_MOV64_IMM(BPF_REG_0, 1),
0035         BPF_EXIT_INSN(),
0036         /* Load value from stack */
0037         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_10, -4),
0038         /* Check value loaded from stack was 4 */
0039         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
0040         BPF_MOV64_IMM(BPF_REG_0, 2),
0041         BPF_EXIT_INSN(),
0042     },
0043     .result = ACCEPT,
0044 },
0045 {
0046     "Can't use ATM_FETCH_ADD on frame pointer",
0047     .insns = {
0048         BPF_MOV64_IMM(BPF_REG_0, 0),
0049         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
0050         BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_10, -8),
0051         BPF_EXIT_INSN(),
0052     },
0053     .result = REJECT,
0054     .errstr_unpriv = "R10 leaks addr into mem",
0055     .errstr = "frame pointer is read only",
0056 },
0057 {
0058     "Can't use ATM_FETCH_ADD on uninit src reg",
0059     .insns = {
0060         BPF_MOV64_IMM(BPF_REG_0, 0),
0061         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
0062         BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_2, -8),
0063         BPF_EXIT_INSN(),
0064     },
0065     .result = REJECT,
0066     /* It happens that the address leak check is first, but it would also be
0067      * complain about the fact that we're trying to modify R10.
0068      */
0069     .errstr = "!read_ok",
0070 },
0071 {
0072     "Can't use ATM_FETCH_ADD on uninit dst reg",
0073     .insns = {
0074         BPF_MOV64_IMM(BPF_REG_0, 0),
0075         BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_2, BPF_REG_0, -8),
0076         BPF_EXIT_INSN(),
0077     },
0078     .result = REJECT,
0079     /* It happens that the address leak check is first, but it would also be
0080      * complain about the fact that we're trying to modify R10.
0081      */
0082     .errstr = "!read_ok",
0083 },
0084 {
0085     "Can't use ATM_FETCH_ADD on kernel memory",
0086     .insns = {
0087         /* This is an fentry prog, context is array of the args of the
0088          * kernel function being called. Load first arg into R2.
0089          */
0090         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 0),
0091         /* First arg of bpf_fentry_test7 is a pointer to a struct.
0092          * Attempt to modify that struct. Verifier shouldn't let us
0093          * because it's kernel memory.
0094          */
0095         BPF_MOV64_IMM(BPF_REG_3, 1),
0096         BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_2, BPF_REG_3, 0),
0097         /* Done */
0098         BPF_MOV64_IMM(BPF_REG_0, 0),
0099         BPF_EXIT_INSN(),
0100     },
0101     .prog_type = BPF_PROG_TYPE_TRACING,
0102     .expected_attach_type = BPF_TRACE_FENTRY,
0103     .kfunc = "bpf_fentry_test7",
0104     .result = REJECT,
0105     .errstr = "only read is supported",
0106 },