aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Borkmann <daniel@iogearbox.net>2018-10-31 19:05:54 -0400
committerAlexei Starovoitov <ast@kernel.org>2018-10-31 19:53:17 -0400
commit2683f4128c8730699296827d3209d2de80fa1d6c (patch)
tree245cff931a2c5c971defc51c0a7364963d6c76e7
parent4d31f30148cea6e97e42616231eed55295117fe7 (diff)
bpf: add various test cases to test_verifier
Add some more map related test cases to test_verifier kselftest to improve test coverage. Summary: 1012 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat
-rw-r--r--tools/testing/selftests/bpf/test_verifier.c250
1 files changed, 250 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 36f3d3009d1a..4c7445d4b3e6 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6455,6 +6455,256 @@ static struct bpf_test tests[] = {
6455 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 6455 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6456 }, 6456 },
6457 { 6457 {
6458 "map access: known scalar += value_ptr",
6459 .insns = {
6460 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6461 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6462 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6463 BPF_LD_MAP_FD(BPF_REG_1, 0),
6464 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6465 BPF_FUNC_map_lookup_elem),
6466 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6467 BPF_MOV64_IMM(BPF_REG_1, 4),
6468 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
6469 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6470 BPF_MOV64_IMM(BPF_REG_0, 1),
6471 BPF_EXIT_INSN(),
6472 },
6473 .fixup_map_array_48b = { 3 },
6474 .result = ACCEPT,
6475 .retval = 1,
6476 },
6477 {
6478 "map access: value_ptr += known scalar",
6479 .insns = {
6480 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6481 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6482 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6483 BPF_LD_MAP_FD(BPF_REG_1, 0),
6484 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6485 BPF_FUNC_map_lookup_elem),
6486 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6487 BPF_MOV64_IMM(BPF_REG_1, 4),
6488 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6489 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6490 BPF_MOV64_IMM(BPF_REG_0, 1),
6491 BPF_EXIT_INSN(),
6492 },
6493 .fixup_map_array_48b = { 3 },
6494 .result = ACCEPT,
6495 .retval = 1,
6496 },
6497 {
6498 "map access: unknown scalar += value_ptr",
6499 .insns = {
6500 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6501 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6502 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6503 BPF_LD_MAP_FD(BPF_REG_1, 0),
6504 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6505 BPF_FUNC_map_lookup_elem),
6506 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6507 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6508 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6509 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
6510 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6511 BPF_MOV64_IMM(BPF_REG_0, 1),
6512 BPF_EXIT_INSN(),
6513 },
6514 .fixup_map_array_48b = { 3 },
6515 .result = ACCEPT,
6516 .retval = 1,
6517 },
6518 {
6519 "map access: value_ptr += unknown scalar",
6520 .insns = {
6521 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6522 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6523 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6524 BPF_LD_MAP_FD(BPF_REG_1, 0),
6525 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6526 BPF_FUNC_map_lookup_elem),
6527 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6528 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6529 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6530 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6531 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6532 BPF_MOV64_IMM(BPF_REG_0, 1),
6533 BPF_EXIT_INSN(),
6534 },
6535 .fixup_map_array_48b = { 3 },
6536 .result = ACCEPT,
6537 .retval = 1,
6538 },
6539 {
6540 "map access: value_ptr += value_ptr",
6541 .insns = {
6542 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6543 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6544 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6545 BPF_LD_MAP_FD(BPF_REG_1, 0),
6546 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6547 BPF_FUNC_map_lookup_elem),
6548 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6549 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),
6550 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6551 BPF_MOV64_IMM(BPF_REG_0, 1),
6552 BPF_EXIT_INSN(),
6553 },
6554 .fixup_map_array_48b = { 3 },
6555 .result = REJECT,
6556 .errstr = "R0 pointer += pointer prohibited",
6557 },
6558 {
6559 "map access: known scalar -= value_ptr",
6560 .insns = {
6561 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6562 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6563 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6564 BPF_LD_MAP_FD(BPF_REG_1, 0),
6565 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6566 BPF_FUNC_map_lookup_elem),
6567 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6568 BPF_MOV64_IMM(BPF_REG_1, 4),
6569 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
6570 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6571 BPF_MOV64_IMM(BPF_REG_0, 1),
6572 BPF_EXIT_INSN(),
6573 },
6574 .fixup_map_array_48b = { 3 },
6575 .result = REJECT,
6576 .errstr = "R1 tried to subtract pointer from scalar",
6577 },
6578 {
6579 "map access: value_ptr -= known scalar",
6580 .insns = {
6581 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6582 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6583 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6584 BPF_LD_MAP_FD(BPF_REG_1, 0),
6585 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6586 BPF_FUNC_map_lookup_elem),
6587 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6588 BPF_MOV64_IMM(BPF_REG_1, 4),
6589 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6590 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6591 BPF_MOV64_IMM(BPF_REG_0, 1),
6592 BPF_EXIT_INSN(),
6593 },
6594 .fixup_map_array_48b = { 3 },
6595 .result = REJECT,
6596 .errstr = "R0 min value is outside of the array range",
6597 },
6598 {
6599 "map access: value_ptr -= known scalar, 2",
6600 .insns = {
6601 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6602 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6603 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6604 BPF_LD_MAP_FD(BPF_REG_1, 0),
6605 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6606 BPF_FUNC_map_lookup_elem),
6607 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6608 BPF_MOV64_IMM(BPF_REG_1, 6),
6609 BPF_MOV64_IMM(BPF_REG_2, 4),
6610 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6611 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
6612 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6613 BPF_MOV64_IMM(BPF_REG_0, 1),
6614 BPF_EXIT_INSN(),
6615 },
6616 .fixup_map_array_48b = { 3 },
6617 .result = ACCEPT,
6618 .retval = 1,
6619 },
6620 {
6621 "map access: unknown scalar -= value_ptr",
6622 .insns = {
6623 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6624 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6625 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6626 BPF_LD_MAP_FD(BPF_REG_1, 0),
6627 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6628 BPF_FUNC_map_lookup_elem),
6629 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6630 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6631 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6632 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
6633 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6634 BPF_MOV64_IMM(BPF_REG_0, 1),
6635 BPF_EXIT_INSN(),
6636 },
6637 .fixup_map_array_48b = { 3 },
6638 .result = REJECT,
6639 .errstr = "R1 tried to subtract pointer from scalar",
6640 },
6641 {
6642 "map access: value_ptr -= unknown scalar",
6643 .insns = {
6644 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6645 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6646 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6647 BPF_LD_MAP_FD(BPF_REG_1, 0),
6648 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6649 BPF_FUNC_map_lookup_elem),
6650 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6651 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6652 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6653 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6654 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6655 BPF_MOV64_IMM(BPF_REG_0, 1),
6656 BPF_EXIT_INSN(),
6657 },
6658 .fixup_map_array_48b = { 3 },
6659 .result = REJECT,
6660 .errstr = "R0 min value is negative",
6661 },
6662 {
6663 "map access: value_ptr -= unknown scalar, 2",
6664 .insns = {
6665 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6666 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6667 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6668 BPF_LD_MAP_FD(BPF_REG_1, 0),
6669 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6670 BPF_FUNC_map_lookup_elem),
6671 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6672 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6673 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6674 BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),
6675 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6676 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6677 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
6678 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6679 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6680 BPF_MOV64_IMM(BPF_REG_0, 1),
6681 BPF_EXIT_INSN(),
6682 },
6683 .fixup_map_array_48b = { 3 },
6684 .result = ACCEPT,
6685 .retval = 1,
6686 },
6687 {
6688 "map access: value_ptr -= value_ptr",
6689 .insns = {
6690 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6691 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6692 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6693 BPF_LD_MAP_FD(BPF_REG_1, 0),
6694 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6695 BPF_FUNC_map_lookup_elem),
6696 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6697 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),
6698 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6699 BPF_MOV64_IMM(BPF_REG_0, 1),
6700 BPF_EXIT_INSN(),
6701 },
6702 .fixup_map_array_48b = { 3 },
6703 .result = REJECT,
6704 .errstr = "R0 invalid mem access 'inv'",
6705 .errstr_unpriv = "R0 pointer -= pointer prohibited",
6706 },
6707 {
6458 "map lookup helper access to map", 6708 "map lookup helper access to map",
6459 .insns = { 6709 .insns = {
6460 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 6710 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-23 21:31:41 -0400