ebpf: Allow dereferences of PTR_TO_STACK registers

mov %rsp, %r1           ; r1 = rsp
        add $-8, %r1            ; r1 = rsp - 8
        store_q $123, -8(%rsp)  ; *(u64*)r1 = 123  <- valid
        store_q $123, (%r1)     ; *(u64*)r1 = 123  <- previously invalid
        mov $0, %r0
        exit                    ; Always need to exit

And we'd get the following error:

	0: (bf) r1 = r10
	1: (07) r1 += -8
	2: (7a) *(u64 *)(r10 -8) = 999
	3: (7a) *(u64 *)(r1 +0) = 999
	R1 invalid mem access 'fp'

	Unable to load program

We already know that a register is a stack address and the appropriate
offset, so we should be able to validate those references as well.

Signed-off-by: Alex Gartrell <agartrell@fb.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 59 insertions, 0 deletions

diff --git a/samples/bpf/test_verifier.c b/samples/bpf/test_verifier.c
index 693605997abc..ee0f110c9c54 100644
--- a/samples/bpf/test_verifier.c
+++ b/samples/bpf/test_verifier.c
@@ -822,6 +822,65 @@ static struct bpf_test tests[] = {
                 .result = ACCEPT,
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
+        {
+                "PTR_TO_STACK store/load",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "PTR_TO_STACK store/load - bad alignment on off",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "misaligned access off -6 size 8",
+        },
+        {
+                "PTR_TO_STACK store/load - bad alignment on reg",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "misaligned access off -2 size 8",
+        },
+        {
+                "PTR_TO_STACK store/load - out of bounds low",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "invalid stack off=-79992 size=8",
+        },
+        {
+                "PTR_TO_STACK store/load - out of bounds high",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "invalid stack off=0 size=8",
+        },
 };
 
 static int probe_filter_length(struct bpf_insn *fp)