tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1{
2 "check deducing bounds from const, 1",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_0, 1),
5 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
6 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7 BPF_EXIT_INSN(),
8 },
9 .result = REJECT,
10 .errstr = "R0 tried to subtract pointer from scalar",
11},
12{
13 "check deducing bounds from const, 2",
14 .insns = {
15 BPF_MOV64_IMM(BPF_REG_0, 1),
16 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
17 BPF_EXIT_INSN(),
18 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
19 BPF_EXIT_INSN(),
20 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
21 BPF_EXIT_INSN(),
22 },
23 .result = ACCEPT,
24 .retval = 1,
25},
26{
27 "check deducing bounds from const, 3",
28 .insns = {
29 BPF_MOV64_IMM(BPF_REG_0, 0),
30 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
31 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
32 BPF_EXIT_INSN(),
33 },
34 .result = REJECT,
35 .errstr = "R0 tried to subtract pointer from scalar",
36},
37{
38 "check deducing bounds from const, 4",
39 .insns = {
40 BPF_MOV64_IMM(BPF_REG_0, 0),
41 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
42 BPF_EXIT_INSN(),
43 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
44 BPF_EXIT_INSN(),
45 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
46 BPF_EXIT_INSN(),
47 },
48 .result = ACCEPT,
49},
50{
51 "check deducing bounds from const, 5",
52 .insns = {
53 BPF_MOV64_IMM(BPF_REG_0, 0),
54 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
55 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
56 BPF_EXIT_INSN(),
57 },
58 .result = REJECT,
59 .errstr = "R0 tried to subtract pointer from scalar",
60},
61{
62 "check deducing bounds from const, 6",
63 .insns = {
64 BPF_MOV64_IMM(BPF_REG_0, 0),
65 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
66 BPF_EXIT_INSN(),
67 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
68 BPF_EXIT_INSN(),
69 },
70 .result = REJECT,
71 .errstr = "R0 tried to subtract pointer from scalar",
72},
73{
74 "check deducing bounds from const, 7",
75 .insns = {
76 BPF_MOV64_IMM(BPF_REG_0, ~0),
77 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
78 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
79 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
80 offsetof(struct __sk_buff, mark)),
81 BPF_EXIT_INSN(),
82 },
83 .result = REJECT,
84 .errstr = "dereference of modified ctx ptr",
85 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
86},
87{
88 "check deducing bounds from const, 8",
89 .insns = {
90 BPF_MOV64_IMM(BPF_REG_0, ~0),
91 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
92 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
93 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
94 offsetof(struct __sk_buff, mark)),
95 BPF_EXIT_INSN(),
96 },
97 .result = REJECT,
98 .errstr = "dereference of modified ctx ptr",
99 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
100},
101{
102 "check deducing bounds from const, 9",
103 .insns = {
104 BPF_MOV64_IMM(BPF_REG_0, 0),
105 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
106 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
107 BPF_EXIT_INSN(),
108 },
109 .result = REJECT,
110 .errstr = "R0 tried to subtract pointer from scalar",
111},
112{
113 "check deducing bounds from const, 10",
114 .insns = {
115 BPF_MOV64_IMM(BPF_REG_0, 0),
116 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
117 /* Marks reg as unknown. */
118 BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
119 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
120 BPF_EXIT_INSN(),
121 },
122 .result = REJECT,
123 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
124},