1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 | // SPDX-License-Identifier: GPL-2.0 /* Converted from tools/testing/selftests/bpf/verifier/basic_stack.c */ #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include "bpf_misc.h" struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 1); __type(key, long long); __type(value, long long); } map_hash_8b SEC(".maps"); SEC("socket") __description("stack out of bounds") __failure __msg("invalid write to stack") __failure_unpriv __naked void stack_out_of_bounds(void) { asm volatile (" \ r1 = 0; \ *(u64*)(r10 + 8) = r1; \ exit; \ " ::: __clobber_all); } SEC("socket") __description("uninitialized stack1") __success __log_level(4) __msg("stack depth 8") __failure_unpriv __msg_unpriv("invalid read from stack") __naked void uninitialized_stack1(void) { asm volatile (" \ r2 = r10; \ r2 += -8; \ r1 = %[map_hash_8b] ll; \ call %[bpf_map_lookup_elem]; \ exit; \ " : : __imm(bpf_map_lookup_elem), __imm_addr(map_hash_8b) : __clobber_all); } SEC("socket") __description("uninitialized stack2") __success __log_level(4) __msg("stack depth 8") __failure_unpriv __msg_unpriv("invalid read from stack") __naked void uninitialized_stack2(void) { asm volatile (" \ r2 = r10; \ r0 = *(u64*)(r2 - 8); \ exit; \ " ::: __clobber_all); } SEC("socket") __description("invalid fp arithmetic") __failure __msg("R1 subtraction from stack pointer") __failure_unpriv __naked void invalid_fp_arithmetic(void) { /* If this gets ever changed, make sure JITs can deal with it. */ asm volatile (" \ r0 = 0; \ r1 = r10; \ r1 -= 8; \ *(u64*)(r1 + 0) = r0; \ exit; \ " ::: __clobber_all); } SEC("socket") __description("non-invalid fp arithmetic") __success __success_unpriv __retval(0) __naked void non_invalid_fp_arithmetic(void) { asm volatile (" \ r0 = 0; \ *(u64*)(r10 - 8) = r0; \ exit; \ " ::: __clobber_all); } SEC("socket") __description("misaligned read from stack") __failure __msg("misaligned stack access") __failure_unpriv __naked void misaligned_read_from_stack(void) { asm volatile (" \ r2 = r10; \ r0 = *(u64*)(r2 - 4); \ exit; \ " ::: __clobber_all); } SEC("socket") __description("stack pointer arithmetic preserves frame number") __failure __msg("R7 invalid mem access 'scalar'") __naked void stack_ptr_arith_preserves_frameno(void) { asm volatile ("\ r3 = 0; \ *(u64 *)(r10 - 8) = r3; \ r1 = %[map_hash_8b] ll; \ r2 = r10; \ r2 += -8; \ call %[bpf_map_lookup_elem]; \ if r0 != 0 goto +2; \ r0 = 0; \ exit; \ r1 = r0; \ r2 = 0; \ r3 = 0; \ call stack_ptr_arith_preserves_frameno_subprog;\ r0 = 0; \ exit; \ ": : __imm(bpf_map_lookup_elem), __imm_addr(map_hash_8b) : __clobber_all); } static __used __naked void stack_ptr_arith_preserves_frameno_subprog(void) { asm volatile ("\ *(u64 *)(r10 - 8) = r1; \ r6 = -8; \ r6 += r10; \ *(u64 *)(r6 + 0) = r2; \ r7 = *(u64 *)(r10 - 8); \ *(u64 *)(r7 + 0) = r3; \ r0 = 0; \ exit; \ "::: __clobber_all); } char _license[] SEC("license") = "GPL"; |