bpf/verifier/div_overflow.c

0001 /* Just make sure that JITs used udiv/umod as otherwise we get
0002  * an exception from INT_MIN/-1 overflow similarly as with div
0003  * by zero.
0004  */
0005 {
0006     "DIV32 overflow, check 1",
0007     .insns = {
0008     BPF_MOV32_IMM(BPF_REG_1, -1),
0009     BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
0010     BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
0011     BPF_EXIT_INSN(),
0012     },
0013     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0014     .result = ACCEPT,
0015     .retval = 0,
0016 },
0017 {
0018     "DIV32 overflow, check 2",
0019     .insns = {
0020     BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
0021     BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
0022     BPF_EXIT_INSN(),
0023     },
0024     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0025     .result = ACCEPT,
0026     .retval = 0,
0027 },
0028 {
0029     "DIV64 overflow, check 1",
0030     .insns = {
0031     BPF_MOV64_IMM(BPF_REG_1, -1),
0032     BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
0033     BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
0034     BPF_MOV32_IMM(BPF_REG_0, 0),
0035     BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 1),
0036     BPF_MOV32_IMM(BPF_REG_0, 1),
0037     BPF_EXIT_INSN(),
0038     },
0039     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0040     .result = ACCEPT,
0041     .retval = 0,
0042 },
0043 {
0044     "DIV64 overflow, check 2",
0045     .insns = {
0046     BPF_LD_IMM64(BPF_REG_1, LLONG_MIN),
0047     BPF_ALU64_IMM(BPF_DIV, BPF_REG_1, -1),
0048     BPF_MOV32_IMM(BPF_REG_0, 0),
0049     BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_1, 1),
0050     BPF_MOV32_IMM(BPF_REG_0, 1),
0051     BPF_EXIT_INSN(),
0052     },
0053     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0054     .result = ACCEPT,
0055     .retval = 0,
0056 },
0057 {
0058     "MOD32 overflow, check 1",
0059     .insns = {
0060     BPF_MOV32_IMM(BPF_REG_1, -1),
0061     BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
0062     BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
0063     BPF_EXIT_INSN(),
0064     },
0065     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0066     .result = ACCEPT,
0067     .retval = INT_MIN,
0068 },
0069 {
0070     "MOD32 overflow, check 2",
0071     .insns = {
0072     BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
0073     BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
0074     BPF_EXIT_INSN(),
0075     },
0076     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0077     .result = ACCEPT,
0078     .retval = INT_MIN,
0079 },
0080 {
0081     "MOD64 overflow, check 1",
0082     .insns = {
0083     BPF_MOV64_IMM(BPF_REG_1, -1),
0084     BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
0085     BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
0086     BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
0087     BPF_MOV32_IMM(BPF_REG_0, 0),
0088     BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
0089     BPF_MOV32_IMM(BPF_REG_0, 1),
0090     BPF_EXIT_INSN(),
0091     },
0092     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0093     .result = ACCEPT,
0094     .retval = 1,
0095 },
0096 {
0097     "MOD64 overflow, check 2",
0098     .insns = {
0099     BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
0100     BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
0101     BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
0102     BPF_MOV32_IMM(BPF_REG_0, 0),
0103     BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
0104     BPF_MOV32_IMM(BPF_REG_0, 1),
0105     BPF_EXIT_INSN(),
0106     },
0107     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0108     .result = ACCEPT,
0109     .retval = 1,
0110 },