bpf/verifier/ringbuf.c

0001 {
0002     "ringbuf: invalid reservation offset 1",
0003     .insns = {
0004     /* reserve 8 byte ringbuf memory */
0005     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0006     BPF_LD_MAP_FD(BPF_REG_1, 0),
0007     BPF_MOV64_IMM(BPF_REG_2, 8),
0008     BPF_MOV64_IMM(BPF_REG_3, 0),
0009     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
0010     /* store a pointer to the reserved memory in R6 */
0011     BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
0012     /* check whether the reservation was successful */
0013     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
0014     /* spill R6(mem) into the stack */
0015     BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
0016     /* fill it back in R7 */
0017     BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_10, -8),
0018     /* should be able to access *(R7) = 0 */
0019     BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0),
0020     /* submit the reserved ringbuf memory */
0021     BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0022     /* add invalid offset to reserved ringbuf memory */
0023     BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xcafe),
0024     BPF_MOV64_IMM(BPF_REG_2, 0),
0025     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit),
0026     BPF_MOV64_IMM(BPF_REG_0, 0),
0027     BPF_EXIT_INSN(),
0028     },
0029     .fixup_map_ringbuf = { 1 },
0030     .result = REJECT,
0031     .errstr = "dereference of modified alloc_mem ptr R1",
0032 },
0033 {
0034     "ringbuf: invalid reservation offset 2",
0035     .insns = {
0036     /* reserve 8 byte ringbuf memory */
0037     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0038     BPF_LD_MAP_FD(BPF_REG_1, 0),
0039     BPF_MOV64_IMM(BPF_REG_2, 8),
0040     BPF_MOV64_IMM(BPF_REG_3, 0),
0041     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
0042     /* store a pointer to the reserved memory in R6 */
0043     BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
0044     /* check whether the reservation was successful */
0045     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
0046     /* spill R6(mem) into the stack */
0047     BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
0048     /* fill it back in R7 */
0049     BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_10, -8),
0050     /* add invalid offset to reserved ringbuf memory */
0051     BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 0xcafe),
0052     /* should be able to access *(R7) = 0 */
0053     BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0),
0054     /* submit the reserved ringbuf memory */
0055     BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0056     BPF_MOV64_IMM(BPF_REG_2, 0),
0057     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit),
0058     BPF_MOV64_IMM(BPF_REG_0, 0),
0059     BPF_EXIT_INSN(),
0060     },
0061     .fixup_map_ringbuf = { 1 },
0062     .result = REJECT,
0063     .errstr = "R7 min value is outside of the allowed memory range",
0064 },
0065 {
0066     "ringbuf: check passing rb mem to helpers",
0067     .insns = {
0068     BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
0069     /* reserve 8 byte ringbuf memory */
0070     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0071     BPF_LD_MAP_FD(BPF_REG_1, 0),
0072     BPF_MOV64_IMM(BPF_REG_2, 8),
0073     BPF_MOV64_IMM(BPF_REG_3, 0),
0074     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
0075     BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
0076     /* check whether the reservation was successful */
0077     BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
0078     BPF_EXIT_INSN(),
0079     /* pass allocated ring buffer memory to fib lookup */
0080     BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0081     BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
0082     BPF_MOV64_IMM(BPF_REG_3, 8),
0083     BPF_MOV64_IMM(BPF_REG_4, 0),
0084     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_fib_lookup),
0085     /* submit the ringbuf memory */
0086     BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0087     BPF_MOV64_IMM(BPF_REG_2, 0),
0088     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit),
0089     BPF_MOV64_IMM(BPF_REG_0, 0),
0090     BPF_EXIT_INSN(),
0091     },
0092     .fixup_map_ringbuf = { 2 },
0093     .prog_type = BPF_PROG_TYPE_XDP,
0094     .result = ACCEPT,
0095 },