selftests/bpf: Test indirect var_off stack access in unpriv mode

Test that verifier rejects indirect stack access with variable offset in
unprivileged mode and accepts same code in privileged mode.

Since pointer arithmetics is prohibited in unprivileged mode verifier
should reject the program even before it gets to helper call that uses
variable offset, at the time when that variable offset is trying to be
constructed.

Example of output:
  # ./test_verifier
  ...
  #859/u indirect variable-offset stack access, priv vs unpriv OK
  #859/p indirect variable-offset stack access, priv vs unpriv OK

Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

1 files changed, 27 insertions, 0 deletions

diff --git a/tools/testing/selftests/bpf/verifier/var_off.c b/tools/testing/selftests/bpf/verifier/var_off.c
index 3840bd16e173..f5d5ff18ef22 100644
--- a/tools/testing/selftests/bpf/verifier/var_off.c
+++ b/tools/testing/selftests/bpf/verifier/var_off.c
@@ -115,6 +115,33 @@
         .prog_type = BPF_PROG_TYPE_LWT_IN,
 },
 {
+        "indirect variable-offset stack access, priv vs unpriv",
+        .insns = {
+        /* Fill the top 16 bytes of the stack. */
+        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
+        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+        /* Get an unknown value. */
+        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+        /* Make it small and 4-byte aligned. */
+        BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+        BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),
+        /* Add it to fp.  We now have either fp-12 or fp-16, we don't know
+         * which, but either way it points to initialized stack.
+         */
+        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
+        /* Dereference it indirectly. */
+        BPF_LD_MAP_FD(BPF_REG_1, 0),
+        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        },
+        .fixup_map_hash_8b = { 6 },
+        .errstr_unpriv = "R2 stack pointer arithmetic goes out of range, prohibited for !root",
+        .result_unpriv = REJECT,
+        .result = ACCEPT,
+        .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
         "indirect variable-offset stack access, uninitialized",
         .insns = {
         BPF_MOV64_IMM(BPF_REG_2, 6),