tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1{
2 "map in map access",
3 .insns = {
4 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7 BPF_LD_MAP_FD(BPF_REG_1, 0),
8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
10 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
11 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
13 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
14 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
15 BPF_MOV64_IMM(BPF_REG_0, 0),
16 BPF_EXIT_INSN(),
17 },
18 .fixup_map_in_map = { 3 },
19 .result = ACCEPT,
20},
21{
22 "map in map state pruning",
23 .insns = {
24 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
25 BPF_MOV64_REG(BPF_REG_6, BPF_REG_10),
26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -4),
27 BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
28 BPF_LD_MAP_FD(BPF_REG_1, 0),
29 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
30 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
31 BPF_EXIT_INSN(),
32 BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
33 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
34 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
35 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 11),
36 BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
37 BPF_LD_MAP_FD(BPF_REG_1, 0),
38 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
39 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
40 BPF_EXIT_INSN(),
41 BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
42 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
43 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
44 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
45 BPF_EXIT_INSN(),
46 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
47 BPF_EXIT_INSN(),
48 },
49 .fixup_map_in_map = { 4, 14 },
50 .flags = BPF_F_TEST_STATE_FREQ,
51 .result = VERBOSE_ACCEPT,
52 .errstr = "processed 25 insns",
53 .prog_type = BPF_PROG_TYPE_XDP,
54},
55{
56 "invalid inner map pointer",
57 .insns = {
58 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
59 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
60 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
61 BPF_LD_MAP_FD(BPF_REG_1, 0),
62 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
63 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
64 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
65 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
66 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
67 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
68 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
69 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
70 BPF_MOV64_IMM(BPF_REG_0, 0),
71 BPF_EXIT_INSN(),
72 },
73 .fixup_map_in_map = { 3 },
74 .errstr = "R1 pointer arithmetic on map_ptr prohibited",
75 .result = REJECT,
76},
77{
78 "forgot null checking on the inner map pointer",
79 .insns = {
80 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
81 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
82 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
83 BPF_LD_MAP_FD(BPF_REG_1, 0),
84 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
85 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
86 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
87 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
88 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
89 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
90 BPF_MOV64_IMM(BPF_REG_0, 0),
91 BPF_EXIT_INSN(),
92 },
93 .fixup_map_in_map = { 3 },
94 .errstr = "R1 type=map_value_or_null expected=map_ptr",
95 .result = REJECT,
96},