bpf/verifier/bounds_deduction.c

0001 {
0002     "check deducing bounds from const, 1",
0003     .insns = {
0004         BPF_MOV64_IMM(BPF_REG_0, 1),
0005         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
0006         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0007         BPF_EXIT_INSN(),
0008     },
0009     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0010     .errstr = "R0 tried to subtract pointer from scalar",
0011     .result = REJECT,
0012 },
0013 {
0014     "check deducing bounds from const, 2",
0015     .insns = {
0016         BPF_MOV64_IMM(BPF_REG_0, 1),
0017         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
0018         BPF_EXIT_INSN(),
0019         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
0020         BPF_EXIT_INSN(),
0021         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
0022         BPF_EXIT_INSN(),
0023     },
0024     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0025     .result_unpriv = REJECT,
0026     .result = ACCEPT,
0027     .retval = 1,
0028 },
0029 {
0030     "check deducing bounds from const, 3",
0031     .insns = {
0032         BPF_MOV64_IMM(BPF_REG_0, 0),
0033         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
0034         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0035         BPF_EXIT_INSN(),
0036     },
0037     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0038     .errstr = "R0 tried to subtract pointer from scalar",
0039     .result = REJECT,
0040 },
0041 {
0042     "check deducing bounds from const, 4",
0043     .insns = {
0044         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
0045         BPF_MOV64_IMM(BPF_REG_0, 0),
0046         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
0047         BPF_EXIT_INSN(),
0048         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
0049         BPF_EXIT_INSN(),
0050         BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0),
0051         BPF_EXIT_INSN(),
0052     },
0053     .errstr_unpriv = "R6 has pointer with unsupported alu operation",
0054     .result_unpriv = REJECT,
0055     .result = ACCEPT,
0056 },
0057 {
0058     "check deducing bounds from const, 5",
0059     .insns = {
0060         BPF_MOV64_IMM(BPF_REG_0, 0),
0061         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
0062         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0063         BPF_EXIT_INSN(),
0064     },
0065     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0066     .errstr = "R0 tried to subtract pointer from scalar",
0067     .result = REJECT,
0068 },
0069 {
0070     "check deducing bounds from const, 6",
0071     .insns = {
0072         BPF_MOV64_IMM(BPF_REG_0, 0),
0073         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
0074         BPF_EXIT_INSN(),
0075         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0076         BPF_EXIT_INSN(),
0077     },
0078     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0079     .errstr = "R0 tried to subtract pointer from scalar",
0080     .result = REJECT,
0081 },
0082 {
0083     "check deducing bounds from const, 7",
0084     .insns = {
0085         BPF_MOV64_IMM(BPF_REG_0, ~0),
0086         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
0087         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
0088         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
0089                 offsetof(struct __sk_buff, mark)),
0090         BPF_EXIT_INSN(),
0091     },
0092     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0093     .errstr = "dereference of modified ctx ptr",
0094     .result = REJECT,
0095     .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0096 },
0097 {
0098     "check deducing bounds from const, 8",
0099     .insns = {
0100         BPF_MOV64_IMM(BPF_REG_0, ~0),
0101         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
0102         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
0103         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
0104                 offsetof(struct __sk_buff, mark)),
0105         BPF_EXIT_INSN(),
0106     },
0107     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0108     .errstr = "negative offset ctx ptr R1 off=-1 disallowed",
0109     .result = REJECT,
0110     .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0111 },
0112 {
0113     "check deducing bounds from const, 9",
0114     .insns = {
0115         BPF_MOV64_IMM(BPF_REG_0, 0),
0116         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
0117         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0118         BPF_EXIT_INSN(),
0119     },
0120     .errstr_unpriv = "R1 has pointer with unsupported alu operation",
0121     .errstr = "R0 tried to subtract pointer from scalar",
0122     .result = REJECT,
0123 },
0124 {
0125     "check deducing bounds from const, 10",
0126     .insns = {
0127         BPF_MOV64_IMM(BPF_REG_0, 0),
0128         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
0129         /* Marks reg as unknown. */
0130         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
0131         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
0132         BPF_EXIT_INSN(),
0133     },
0134     .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
0135     .result = REJECT,
0136 },