bpf/verifier/map_ptr_mixing.c

0001 {
0002     "calls: two calls returning different map pointers for lookup (hash, array)",
0003     .insns = {
0004     /* main prog */
0005     BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
0006     BPF_CALL_REL(11),
0007     BPF_JMP_IMM(BPF_JA, 0, 0, 1),
0008     BPF_CALL_REL(12),
0009     BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
0010     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0011     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0012     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0013     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0014     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0015     BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
0016     BPF_MOV64_IMM(BPF_REG_0, 1),
0017     BPF_EXIT_INSN(),
0018     /* subprog 1 */
0019     BPF_LD_MAP_FD(BPF_REG_0, 0),
0020     BPF_EXIT_INSN(),
0021     /* subprog 2 */
0022     BPF_LD_MAP_FD(BPF_REG_0, 0),
0023     BPF_EXIT_INSN(),
0024     },
0025     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0026     .fixup_map_hash_48b = { 13 },
0027     .fixup_map_array_48b = { 16 },
0028     .result = ACCEPT,
0029     .retval = 1,
0030 },
0031 {
0032     "calls: two calls returning different map pointers for lookup (hash, map in map)",
0033     .insns = {
0034     /* main prog */
0035     BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
0036     BPF_CALL_REL(11),
0037     BPF_JMP_IMM(BPF_JA, 0, 0, 1),
0038     BPF_CALL_REL(12),
0039     BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
0040     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0041     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0042     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0043     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0044     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0045     BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
0046     BPF_MOV64_IMM(BPF_REG_0, 1),
0047     BPF_EXIT_INSN(),
0048     /* subprog 1 */
0049     BPF_LD_MAP_FD(BPF_REG_0, 0),
0050     BPF_EXIT_INSN(),
0051     /* subprog 2 */
0052     BPF_LD_MAP_FD(BPF_REG_0, 0),
0053     BPF_EXIT_INSN(),
0054     },
0055     .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0056     .fixup_map_in_map = { 16 },
0057     .fixup_map_array_48b = { 13 },
0058     .result = REJECT,
0059     .errstr = "only read from bpf_array is supported",
0060 },
0061 {
0062     "cond: two branches returning different map pointers for lookup (tail, tail)",
0063     .insns = {
0064     BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0065             offsetof(struct __sk_buff, mark)),
0066     BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
0067     BPF_LD_MAP_FD(BPF_REG_2, 0),
0068     BPF_JMP_IMM(BPF_JA, 0, 0, 2),
0069     BPF_LD_MAP_FD(BPF_REG_2, 0),
0070     BPF_MOV64_IMM(BPF_REG_3, 7),
0071     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
0072     BPF_MOV64_IMM(BPF_REG_0, 1),
0073     BPF_EXIT_INSN(),
0074     },
0075     .fixup_prog1 = { 5 },
0076     .fixup_prog2 = { 2 },
0077     .result_unpriv = REJECT,
0078     .errstr_unpriv = "tail_call abusing map_ptr",
0079     .result = ACCEPT,
0080     .retval = 42,
0081 },
0082 {
0083     "cond: two branches returning same map pointers for lookup (tail, tail)",
0084     .insns = {
0085     BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0086             offsetof(struct __sk_buff, mark)),
0087     BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
0088     BPF_LD_MAP_FD(BPF_REG_2, 0),
0089     BPF_JMP_IMM(BPF_JA, 0, 0, 2),
0090     BPF_LD_MAP_FD(BPF_REG_2, 0),
0091     BPF_MOV64_IMM(BPF_REG_3, 7),
0092     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
0093     BPF_MOV64_IMM(BPF_REG_0, 1),
0094     BPF_EXIT_INSN(),
0095     },
0096     .fixup_prog2 = { 2, 5 },
0097     .result_unpriv = ACCEPT,
0098     .result = ACCEPT,
0099     .retval = 42,
0100 },