Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626// SPDX-License-Identifier: GPL-2.0/* Converted from tools/testing/selftests/bpf/verifier/stack_ptr.c */
#include <linux/bpf.h>#include <bpf/bpf_helpers.h>#include <limits.h>#include "bpf_misc.h"
#define MAX_ENTRIES 11
struct test_val { unsigned int index; int foo[MAX_ENTRIES];};
struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 1); __type(key, int); __type(value, struct test_val);} map_array_48b SEC(".maps");
SEC("socket")__description("PTR_TO_STACK store/load")__success __success_unpriv __retval(0xfaceb00c)__naked void ptr_to_stack_store_load(void){ asm volatile (" \ r1 = r10; \ r1 += -10; \ r0 = 0xfaceb00c; \ *(u64*)(r1 + 2) = r0; \ r0 = *(u64*)(r1 + 2); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK store/load - bad alignment on off")__failure __msg("misaligned stack access off -8+2 size 8")__failure_unpriv__naked void load_bad_alignment_on_off(void){ asm volatile (" \ r1 = r10; \ r1 += -8; \ r0 = 0xfaceb00c; \ *(u64*)(r1 + 2) = r0; \ r0 = *(u64*)(r1 + 2); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK store/load - bad alignment on reg")__failure __msg("misaligned stack access off -10+8 size 8")__failure_unpriv__naked void load_bad_alignment_on_reg(void){ asm volatile (" \ r1 = r10; \ r1 += -10; \ r0 = 0xfaceb00c; \ *(u64*)(r1 + 8) = r0; \ r0 = *(u64*)(r1 + 8); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK store/load - out of bounds low")__failure __msg("invalid write to stack R1 off=-79992 size=8")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void load_out_of_bounds_low(void){ asm volatile (" \ r1 = r10; \ r1 += -80000; \ r0 = 0xfaceb00c; \ *(u64*)(r1 + 8) = r0; \ r0 = *(u64*)(r1 + 8); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK store/load - out of bounds high")__failure __msg("invalid write to stack R1 off=0 size=8")__failure_unpriv__naked void load_out_of_bounds_high(void){ asm volatile (" \ r1 = r10; \ r1 += -8; \ r0 = 0xfaceb00c; \ *(u64*)(r1 + 8) = r0; \ r0 = *(u64*)(r1 + 8); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 1")__success __success_unpriv __retval(42)__naked void to_stack_check_high_1(void){ asm volatile (" \ r1 = r10; \ r1 += -1; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 2")__success __success_unpriv __retval(42)__naked void to_stack_check_high_2(void){ asm volatile (" \ r1 = r10; \ r0 = 42; \ *(u8*)(r1 - 1) = r0; \ r0 = *(u8*)(r1 - 1); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 3")__success __failure_unpriv__msg_unpriv("R1 stack pointer arithmetic goes out of range")__retval(42)__naked void to_stack_check_high_3(void){ asm volatile (" \ r1 = r10; \ r1 += 0; \ r0 = 42; \ *(u8*)(r1 - 1) = r0; \ r0 = *(u8*)(r1 - 1); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 4")__failure __msg("invalid write to stack R1 off=0 size=1")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_high_4(void){ asm volatile (" \ r1 = r10; \ r1 += 0; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 5")__failure __msg("invalid write to stack R1")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_high_5(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" : : __imm_const(__imm_0, (1 << 29) - 1) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 6")__failure __msg("invalid write to stack")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_high_6(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 + %[shrt_max]) = r0; \ r0 = *(u8*)(r1 + %[shrt_max]); \ exit; \" : : __imm_const(__imm_0, (1 << 29) - 1), __imm_const(shrt_max, SHRT_MAX) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check high 7")__failure __msg("fp pointer offset")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_high_7(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 + %[shrt_max]) = r0; \ r0 = *(u8*)(r1 + %[shrt_max]); \ exit; \" : : __imm_const(__imm_0, (1 << 29) - 1), __imm_const(shrt_max, SHRT_MAX) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 1")__success __success_unpriv __retval(42)__naked void to_stack_check_low_1(void){ asm volatile (" \ r1 = r10; \ r1 += -512; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 2")__load_if_no_large_stack()__success __failure_unpriv__msg_unpriv("R1 stack pointer arithmetic goes out of range")__retval(42)__naked void to_stack_check_low_2(void){ asm volatile (" \ r1 = r10; \ r1 += -513; \ r0 = 42; \ *(u8*)(r1 + 1) = r0; \ r0 = *(u8*)(r1 + 1); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 2, large stack")__load_if_large_stack()__success __failure_unpriv__msg_unpriv("R1 stack pointer arithmetic goes out of range")__retval(42)__naked void to_stack_check_low_2_large(void){ asm volatile (" \ r1 = r10; \ r1 += -2049; \ r0 = 42; \ *(u8*)(r1 + 1) = r0; \ r0 = *(u8*)(r1 + 1); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 3")__load_if_no_large_stack()__failure __msg("invalid write to stack R1 off=-513 size=1")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_low_3(void){ asm volatile (" \ r1 = r10; \ r1 += -513; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 3, large stack")__load_if_large_stack()__failure __msg("invalid write to stack R1 off=-2049 size=1")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_low_3_large(void){ asm volatile (" \ r1 = r10; \ r1 += -2049; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 4")__failure __msg("math between fp pointer")__failure_unpriv__naked void to_stack_check_low_4(void){ asm volatile (" \ r1 = r10; \ r1 += %[int_min]; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" : : __imm_const(int_min, INT_MIN) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 5")__failure __msg("invalid write to stack")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_low_5(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" : : __imm_const(__imm_0, -((1 << 29) - 1)) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 6")__failure __msg("invalid write to stack")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_low_6(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 %[shrt_min]) = r0; \ r0 = *(u8*)(r1 %[shrt_min]); \ exit; \" : : __imm_const(__imm_0, -((1 << 29) - 1)), __imm_const(shrt_min, SHRT_MIN) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK check low 7")__failure __msg("fp pointer offset")__msg_unpriv("R1 stack pointer arithmetic goes out of range")__naked void to_stack_check_low_7(void){ asm volatile (" \ r1 = r10; \ r1 += %[__imm_0]; \ r1 += %[__imm_0]; \ r0 = 42; \ *(u8*)(r1 %[shrt_min]) = r0; \ r0 = *(u8*)(r1 %[shrt_min]); \ exit; \" : : __imm_const(__imm_0, -((1 << 29) - 1)), __imm_const(shrt_min, SHRT_MIN) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK mixed reg/k, 1")__success __success_unpriv __retval(42)__naked void stack_mixed_reg_k_1(void){ asm volatile (" \ r1 = r10; \ r1 += -3; \ r2 = -3; \ r1 += r2; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK mixed reg/k, 2")__success __success_unpriv __retval(42)__naked void stack_mixed_reg_k_2(void){ asm volatile (" \ r0 = 0; \ *(u64*)(r10 - 8) = r0; \ r0 = 0; \ *(u64*)(r10 - 16) = r0; \ r1 = r10; \ r1 += -3; \ r2 = -3; \ r1 += r2; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r5 = r10; \ r0 = *(u8*)(r5 - 6); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK mixed reg/k, 3")__success __success_unpriv __retval(-3)__naked void stack_mixed_reg_k_3(void){ asm volatile (" \ r1 = r10; \ r1 += -3; \ r2 = -3; \ r1 += r2; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = r2; \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK reg")__success __success_unpriv __retval(42)__naked void ptr_to_stack_reg(void){ asm volatile (" \ r1 = r10; \ r2 = -3; \ r1 += r2; \ r0 = 42; \ *(u8*)(r1 + 0) = r0; \ r0 = *(u8*)(r1 + 0); \ exit; \" ::: __clobber_all);}
SEC("socket")__description("stack pointer arithmetic")__success __success_unpriv __retval(0)__naked void stack_pointer_arithmetic(void){ asm volatile (" \ r1 = 4; \ goto l0_%=; \l0_%=: r7 = r10; \ r7 += -10; \ r7 += -10; \ r2 = r7; \ r2 += r1; \ r0 = 0; \ *(u32*)(r2 + 4) = r0; \ r2 = r7; \ r2 += 8; \ r0 = 0; \ *(u32*)(r2 + 4) = r0; \ r0 = 0; \ exit; \" ::: __clobber_all);}
SEC("tc")__description("store PTR_TO_STACK in R10 to array map using BPF_B")__success __retval(42)__naked void array_map_using_bpf_b(void){ asm volatile (" \ /* Load pointer to map. */ \ r2 = r10; \ r2 += -8; \ r1 = 0; \ *(u64*)(r2 + 0) = r1; \ r1 = %[map_array_48b] ll; \ call %[bpf_map_lookup_elem]; \ if r0 != 0 goto l0_%=; \ r0 = 2; \ exit; \l0_%=: r1 = r0; \ /* Copy R10 to R9. */ \ r9 = r10; \ /* Pollute other registers with unaligned values. */\ r2 = -1; \ r3 = -1; \ r4 = -1; \ r5 = -1; \ r6 = -1; \ r7 = -1; \ r8 = -1; \ /* Store both R9 and R10 with BPF_B and read back. */\ *(u8*)(r1 + 0) = r10; \ r2 = *(u8*)(r1 + 0); \ *(u8*)(r1 + 0) = r9; \ r3 = *(u8*)(r1 + 0); \ /* Should read back as same value. */ \ if r2 == r3 goto l1_%=; \ r0 = 1; \ exit; \l1_%=: r0 = 42; \ exit; \" : : __imm(bpf_map_lookup_elem), __imm_addr(map_array_48b) : __clobber_all);}
SEC("socket")__description("PTR_TO_STACK stack size > 512")__load_if_no_large_stack()__failure __msg("invalid write to stack R1 off=-520 size=8")__naked void stack_check_size_gt_512(void){ asm volatile (" \ r1 = r10; \ r1 += -520; \ r0 = 42; \ *(u64*)(r1 + 0) = r0; \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK stack size > 2048")__load_if_large_stack()__failure __msg("invalid write to stack R1 off=-2056 size=8")__naked void stack_check_size_gt_2048(void){ asm volatile (" \ r1 = r10; \ r1 += -2056; \ r0 = 42; \ *(u64*)(r1 + 0) = r0; \ exit; \" ::: __clobber_all);}
#ifdef __BPF_FEATURE_MAY_GOTOSEC("socket")__description("PTR_TO_STACK stack size 512 with may_goto with jit")__load_if_JITed()__success __retval(42)__naked void stack_check_size_512_with_may_goto_jit(void){ asm volatile (" \ r1 = r10; \ r1 += -512; \ r0 = 42; \ *(u32*)(r1 + 0) = r0; \ may_goto l0_%=; \ r2 = 100; \ l0_%=: \ exit; \" ::: __clobber_all);}
SEC("socket")__description("PTR_TO_STACK stack size 512 with may_goto without jit")__load_if_no_JITed()__failure __msg("stack size 520(extra 8) is too large")__naked void stack_check_size_512_with_may_goto(void){ asm volatile (" \ r1 = r10; \ r1 += -512; \ r0 = 42; \ *(u32*)(r1 + 0) = r0; \ may_goto l0_%=; \ r2 = 100; \ l0_%=: \ exit; \" ::: __clobber_all);}#endif
/* * Verify that old PTR_TO_STACK state is considered a super-set of * new PTR_TO_STACK state when new variable range is a sub-range * of the old range, e.g. old [-72, -16] vs new [-64, -16]. */SEC("socket")__success__log_level(2)__flag(BPF_F_TEST_STATE_FREQ)/* * r7 is widened to [-72, -16] at the loop header (insn 3), * the loop body sees [-64, -8] after 'r7 += 8' */__msg("loop header at 3, widening r7 to -72..-16 step 8")__msg("R7=fp(smin=smin32=-64,smax=smax32=-8")/* * back-edge state is clamped to the remaining iterations and pruned * at the header, because [-64, -16] is within the widened [-72, -16] */__msg("loop header at 3, clamping r7 to -64..-16 (s32 -64..-8) step 8")__msg("from 5 to 3: safe")__msg("processed 9 insns")__naked void stack_ptr_subrange_in_loop(void){ asm volatile (" \ r7 = r10; \ r7 += -72; \ r6 = 0; \ r7 += 8; \ r6 += 1; \ if r6 < 8 goto -3; \ r0 = 0; \ exit; \" ::: __clobber_all);}
char _license[] SEC("license") = "GPL";