1// SPDX-License-Identifier: GPL-2.0 2/* Converted from tools/testing/selftests/bpf/verifier/bounds_deduction.c */ 3 4#include <linux/bpf.h> 5#include <bpf/bpf_helpers.h> 6#include "bpf_misc.h" 7 8SEC("socket") 9__description("check deducing bounds from const, 1") 10__failure __msg("R0 tried to subtract pointer from scalar") 11__msg_unpriv("R1 has pointer with unsupported alu operation") 12__naked void deducing_bounds_from_const_1(void) 13{ 14 asm volatile (" \ 15 r0 = 1; \ 16 if r0 s>= 1 goto l0_%=; \ 17l0_%=: r0 -= r1; \ 18 exit; \ 19" ::: __clobber_all); 20} 21 22SEC("socket") 23__description("check deducing bounds from const, 2") 24__success __failure_unpriv 25__msg_unpriv("R1 has pointer with unsupported alu operation") 26__retval(1) 27__naked void deducing_bounds_from_const_2(void) 28{ 29 asm volatile (" \ 30 r0 = 1; \ 31 if r0 s>= 1 goto l0_%=; \ 32 exit; \ 33l0_%=: if r0 s<= 1 goto l1_%=; \ 34 exit; \ 35l1_%=: r1 -= r0; \ 36 exit; \ 37" ::: __clobber_all); 38} 39 40SEC("socket") 41__description("check deducing bounds from const, 3") 42__failure __msg("R0 tried to subtract pointer from scalar") 43__msg_unpriv("R1 has pointer with unsupported alu operation") 44__naked void deducing_bounds_from_const_3(void) 45{ 46 asm volatile (" \ 47 r0 = 0; \ 48 if r0 s<= 0 goto l0_%=; \ 49l0_%=: r0 -= r1; \ 50 exit; \ 51" ::: __clobber_all); 52} 53 54SEC("socket") 55__description("check deducing bounds from const, 4") 56__success __failure_unpriv 57__msg_unpriv("R6 has pointer with unsupported alu operation") 58__retval(0) 59__naked void deducing_bounds_from_const_4(void) 60{ 61 asm volatile (" \ 62 r6 = r1; \ 63 r0 = 0; \ 64 if r0 s<= 0 goto l0_%=; \ 65 exit; \ 66l0_%=: if r0 s>= 0 goto l1_%=; \ 67 exit; \ 68l1_%=: r6 -= r0; \ 69 exit; \ 70" ::: __clobber_all); 71} 72 73SEC("socket") 74__description("check deducing bounds from const, 5") 75__failure __msg("R0 tried to subtract pointer from scalar") 76__msg_unpriv("R1 has pointer with unsupported alu operation") 77__naked void deducing_bounds_from_const_5(void) 78{ 79 asm volatile (" \ 80 r0 = 0; \ 81 if r0 s>= 1 goto l0_%=; \ 82 r0 -= r1; \ 83l0_%=: exit; \ 84" ::: __clobber_all); 85} 86 87SEC("socket") 88__description("check deducing bounds from const, 6") 89__failure __msg("R0 tried to subtract pointer from scalar") 90__msg_unpriv("R1 has pointer with unsupported alu operation") 91__naked void deducing_bounds_from_const_6(void) 92{ 93 asm volatile (" \ 94 r0 = 0; \ 95 if r0 s>= 0 goto l0_%=; \ 96 exit; \ 97l0_%=: r0 -= r1; \ 98 exit; \ 99" ::: __clobber_all); 100} 101 102SEC("socket") 103__description("check deducing bounds from const, 7") 104__failure __msg("dereference of modified ctx ptr") 105__msg_unpriv("R1 has pointer with unsupported alu operation") 106__flag(BPF_F_ANY_ALIGNMENT) 107__naked void deducing_bounds_from_const_7(void) 108{ 109 asm volatile (" \ 110 r0 = %[__imm_0]; \ 111 if r0 s>= 0 goto l0_%=; \ 112l0_%=: r1 -= r0; \ 113 r0 = *(u32*)(r1 + %[__sk_buff_mark]); \ 114 exit; \ 115" : 116 : __imm_const(__imm_0, ~0), 117 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark)) 118 : __clobber_all); 119} 120 121SEC("socket") 122__description("check deducing bounds from const, 8") 123__failure __msg("negative offset ctx ptr R1 off=-1 disallowed") 124__msg_unpriv("R1 has pointer with unsupported alu operation") 125__flag(BPF_F_ANY_ALIGNMENT) 126__naked void deducing_bounds_from_const_8(void) 127{ 128 asm volatile (" \ 129 r0 = %[__imm_0]; \ 130 if r0 s>= 0 goto l0_%=; \ 131 r1 += r0; \ 132l0_%=: r0 = *(u32*)(r1 + %[__sk_buff_mark]); \ 133 exit; \ 134" : 135 : __imm_const(__imm_0, ~0), 136 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark)) 137 : __clobber_all); 138} 139 140SEC("socket") 141__description("check deducing bounds from const, 9") 142__failure __msg("R0 tried to subtract pointer from scalar") 143__msg_unpriv("R1 has pointer with unsupported alu operation") 144__naked void deducing_bounds_from_const_9(void) 145{ 146 asm volatile (" \ 147 r0 = 0; \ 148 if r0 s>= 0 goto l0_%=; \ 149l0_%=: r0 -= r1; \ 150 exit; \ 151" ::: __clobber_all); 152} 153 154SEC("socket") 155__description("check deducing bounds from const, 10") 156__failure 157__msg("math between ctx pointer and register with unbounded min value is not allowed") 158__failure_unpriv 159__naked void deducing_bounds_from_const_10(void) 160{ 161 asm volatile (" \ 162 r0 = 0; \ 163 if r0 s<= 0 goto l0_%=; \ 164l0_%=: /* Marks reg as unknown. */ \ 165 r0 = -r0; \ 166 r0 -= r1; \ 167 exit; \ 168" ::: __clobber_all); 169} 170 171char _license[] SEC("license") = "GPL"; 172