aboutsummaryrefslogtreecommitdiffstats
path: root/tools/testing
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2017-07-20 19:33:39 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2017-07-20 19:33:39 -0400
commit96080f697786e0a30006fcbcc5b53f350fcb3e9f (patch)
tree77b130e0e7714a55ce2a579f9524173e151e3b2d /tools/testing
parent63a86362130f4c17eaa57f3ef5171ec43111a54e (diff)
parentcbf5ecb305601d063dc94a57680dfbc3f96c188d (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) BPF verifier signed/unsigned value tracking fix, from Daniel Borkmann, Edward Cree, and Josef Bacik. 2) Fix memory allocation length when setting up calls to ->ndo_set_mac_address, from Cong Wang. 3) Add a new cxgb4 device ID, from Ganesh Goudar. 4) Fix FIB refcount handling, we have to set it's initial value before the configure callback (which can bump it). From David Ahern. 5) Fix double-free in qcom/emac driver, from Timur Tabi. 6) A bunch of gcc-7 string format overflow warning fixes from Arnd Bergmann. 7) Fix link level headroom tests in ip_do_fragment(), from Vasily Averin. 8) Fix chunk walking in SCTP when iterating over error and parameter headers. From Alexander Potapenko. 9) TCP BBR congestion control fixes from Neal Cardwell. 10) Fix SKB fragment handling in bcmgenet driver, from Doug Berger. 11) BPF_CGROUP_RUN_PROG_SOCK_OPS needs to check for null __sk, from Cong Wang. 12) xmit_recursion in ppp driver needs to be per-device not per-cpu, from Gao Feng. 13) Cannot release skb->dst in UDP if IP options processing needs it. From Paolo Abeni. 14) Some netdev ioctl ifr_name[] NULL termination fixes. From Alexander Levin and myself. 15) Revert some rtnetlink notification changes that are causing regressions, from David Ahern. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (83 commits) net: bonding: Fix transmit load balancing in balance-alb mode rds: Make sure updates to cp_send_gen can be observed net: ethernet: ti: cpsw: Push the request_irq function to the end of probe ipv4: initialize fib_trie prior to register_netdev_notifier call. rtnetlink: allocate more memory for dev_set_mac_address() net: dsa: b53: Add missing ARL entries for BCM53125 bpf: more tests for mixed signed and unsigned bounds checks bpf: add test for mixed signed and unsigned bounds checks bpf: fix up test cases with mixed signed/unsigned bounds bpf: allow to specify log level and reduce it for test_verifier bpf: fix mixed signed/unsigned derived min/max value bounds ipv6: avoid overflow of offset in ip6_find_1stfragopt net: tehuti: don't process data if it has not been copied from userspace Revert "rtnetlink: Do not generate notifications for CHANGEADDR event" net: dsa: mv88e6xxx: Enable CMODE config support for 6390X dt-binding: ptp: Add SoC compatibility strings for dte ptp clock NET: dwmac: Make dwmac reset unconditional net: Zero terminate ifr_name in dev_ifname(). wireless: wext: terminate ifr name coming from userspace netfilter: fix netfilter_net_init() return ...
Diffstat (limited to 'tools/testing')
-rw-r--r--tools/testing/selftests/bpf/test_align.c2
-rw-r--r--tools/testing/selftests/bpf/test_verifier.c480
2 files changed, 476 insertions, 6 deletions
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
index bccebd935907..29793694cbc7 100644
--- a/tools/testing/selftests/bpf/test_align.c
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -380,7 +380,7 @@ static int do_test_single(struct bpf_align_test *test)
380 prog_len = probe_filter_length(prog); 380 prog_len = probe_filter_length(prog);
381 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER, 381 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
382 prog, prog_len, 1, "GPL", 0, 382 prog, prog_len, 1, "GPL", 0,
383 bpf_vlog, sizeof(bpf_vlog)); 383 bpf_vlog, sizeof(bpf_vlog), 2);
384 if (fd_prog < 0) { 384 if (fd_prog < 0) {
385 printf("Failed to load program.\n"); 385 printf("Failed to load program.\n");
386 printf("%s", bpf_vlog); 386 printf("%s", bpf_vlog);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 404aec520812..af7d173910f4 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -4969,7 +4969,7 @@ static struct bpf_test tests[] = {
4969 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 4969 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4970 sizeof(struct test_val), 4), 4970 sizeof(struct test_val), 4),
4971 BPF_MOV64_IMM(BPF_REG_4, 0), 4971 BPF_MOV64_IMM(BPF_REG_4, 0),
4972 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2), 4972 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
4973 BPF_MOV64_IMM(BPF_REG_3, 0), 4973 BPF_MOV64_IMM(BPF_REG_3, 0),
4974 BPF_EMIT_CALL(BPF_FUNC_probe_read), 4974 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4975 BPF_MOV64_IMM(BPF_REG_0, 0), 4975 BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -4995,7 +4995,7 @@ static struct bpf_test tests[] = {
4995 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 4995 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4996 sizeof(struct test_val) + 1, 4), 4996 sizeof(struct test_val) + 1, 4),
4997 BPF_MOV64_IMM(BPF_REG_4, 0), 4997 BPF_MOV64_IMM(BPF_REG_4, 0),
4998 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2), 4998 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
4999 BPF_MOV64_IMM(BPF_REG_3, 0), 4999 BPF_MOV64_IMM(BPF_REG_3, 0),
5000 BPF_EMIT_CALL(BPF_FUNC_probe_read), 5000 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5001 BPF_MOV64_IMM(BPF_REG_0, 0), 5001 BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5023,7 +5023,7 @@ static struct bpf_test tests[] = {
5023 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 5023 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5024 sizeof(struct test_val) - 20, 4), 5024 sizeof(struct test_val) - 20, 4),
5025 BPF_MOV64_IMM(BPF_REG_4, 0), 5025 BPF_MOV64_IMM(BPF_REG_4, 0),
5026 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2), 5026 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5027 BPF_MOV64_IMM(BPF_REG_3, 0), 5027 BPF_MOV64_IMM(BPF_REG_3, 0),
5028 BPF_EMIT_CALL(BPF_FUNC_probe_read), 5028 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5029 BPF_MOV64_IMM(BPF_REG_0, 0), 5029 BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5050,7 +5050,7 @@ static struct bpf_test tests[] = {
5050 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 5050 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5051 sizeof(struct test_val) - 19, 4), 5051 sizeof(struct test_val) - 19, 4),
5052 BPF_MOV64_IMM(BPF_REG_4, 0), 5052 BPF_MOV64_IMM(BPF_REG_4, 0),
5053 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2), 5053 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5054 BPF_MOV64_IMM(BPF_REG_3, 0), 5054 BPF_MOV64_IMM(BPF_REG_3, 0),
5055 BPF_EMIT_CALL(BPF_FUNC_probe_read), 5055 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5056 BPF_MOV64_IMM(BPF_REG_0, 0), 5056 BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5510,6 +5510,476 @@ static struct bpf_test tests[] = {
5510 .errstr = "invalid bpf_context access", 5510 .errstr = "invalid bpf_context access",
5511 .prog_type = BPF_PROG_TYPE_LWT_IN, 5511 .prog_type = BPF_PROG_TYPE_LWT_IN,
5512 }, 5512 },
5513 {
5514 "bounds checks mixing signed and unsigned, positive bounds",
5515 .insns = {
5516 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5517 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5518 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5519 BPF_LD_MAP_FD(BPF_REG_1, 0),
5520 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5521 BPF_FUNC_map_lookup_elem),
5522 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5523 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5524 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5525 BPF_MOV64_IMM(BPF_REG_2, 2),
5526 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
5527 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
5528 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5529 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5530 BPF_MOV64_IMM(BPF_REG_0, 0),
5531 BPF_EXIT_INSN(),
5532 },
5533 .fixup_map1 = { 3 },
5534 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5535 .errstr = "R0 min value is negative",
5536 .result = REJECT,
5537 .result_unpriv = REJECT,
5538 },
5539 {
5540 "bounds checks mixing signed and unsigned",
5541 .insns = {
5542 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5543 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5544 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5545 BPF_LD_MAP_FD(BPF_REG_1, 0),
5546 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5547 BPF_FUNC_map_lookup_elem),
5548 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5549 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5550 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5551 BPF_MOV64_IMM(BPF_REG_2, -1),
5552 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
5553 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5554 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5555 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5556 BPF_MOV64_IMM(BPF_REG_0, 0),
5557 BPF_EXIT_INSN(),
5558 },
5559 .fixup_map1 = { 3 },
5560 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5561 .errstr = "R0 min value is negative",
5562 .result = REJECT,
5563 .result_unpriv = REJECT,
5564 },
5565 {
5566 "bounds checks mixing signed and unsigned, variant 2",
5567 .insns = {
5568 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5569 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5570 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5571 BPF_LD_MAP_FD(BPF_REG_1, 0),
5572 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5573 BPF_FUNC_map_lookup_elem),
5574 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5575 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5576 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5577 BPF_MOV64_IMM(BPF_REG_2, -1),
5578 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
5579 BPF_MOV64_IMM(BPF_REG_8, 0),
5580 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
5581 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
5582 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
5583 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
5584 BPF_MOV64_IMM(BPF_REG_0, 0),
5585 BPF_EXIT_INSN(),
5586 },
5587 .fixup_map1 = { 3 },
5588 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5589 .errstr = "R8 invalid mem access 'inv'",
5590 .result = REJECT,
5591 .result_unpriv = REJECT,
5592 },
5593 {
5594 "bounds checks mixing signed and unsigned, variant 3",
5595 .insns = {
5596 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5597 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5598 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5599 BPF_LD_MAP_FD(BPF_REG_1, 0),
5600 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5601 BPF_FUNC_map_lookup_elem),
5602 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
5603 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5604 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5605 BPF_MOV64_IMM(BPF_REG_2, -1),
5606 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
5607 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
5608 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
5609 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
5610 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
5611 BPF_MOV64_IMM(BPF_REG_0, 0),
5612 BPF_EXIT_INSN(),
5613 },
5614 .fixup_map1 = { 3 },
5615 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5616 .errstr = "R8 invalid mem access 'inv'",
5617 .result = REJECT,
5618 .result_unpriv = REJECT,
5619 },
5620 {
5621 "bounds checks mixing signed and unsigned, variant 4",
5622 .insns = {
5623 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5624 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5625 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5626 BPF_LD_MAP_FD(BPF_REG_1, 0),
5627 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5628 BPF_FUNC_map_lookup_elem),
5629 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5630 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5631 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5632 BPF_MOV64_IMM(BPF_REG_2, 1),
5633 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
5634 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5635 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5636 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5637 BPF_MOV64_IMM(BPF_REG_0, 0),
5638 BPF_EXIT_INSN(),
5639 },
5640 .fixup_map1 = { 3 },
5641 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5642 .errstr = "R0 min value is negative",
5643 .result = REJECT,
5644 .result_unpriv = REJECT,
5645 },
5646 {
5647 "bounds checks mixing signed and unsigned, variant 5",
5648 .insns = {
5649 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5650 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5651 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5652 BPF_LD_MAP_FD(BPF_REG_1, 0),
5653 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5654 BPF_FUNC_map_lookup_elem),
5655 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5656 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5657 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5658 BPF_MOV64_IMM(BPF_REG_2, -1),
5659 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
5660 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
5661 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
5662 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
5663 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5664 BPF_MOV64_IMM(BPF_REG_0, 0),
5665 BPF_EXIT_INSN(),
5666 },
5667 .fixup_map1 = { 3 },
5668 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5669 .errstr = "R0 invalid mem access",
5670 .result = REJECT,
5671 .result_unpriv = REJECT,
5672 },
5673 {
5674 "bounds checks mixing signed and unsigned, variant 6",
5675 .insns = {
5676 BPF_MOV64_IMM(BPF_REG_2, 0),
5677 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
5678 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
5679 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5680 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
5681 BPF_MOV64_IMM(BPF_REG_6, -1),
5682 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
5683 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
5684 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
5685 BPF_MOV64_IMM(BPF_REG_5, 0),
5686 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
5687 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5688 BPF_FUNC_skb_load_bytes),
5689 BPF_MOV64_IMM(BPF_REG_0, 0),
5690 BPF_EXIT_INSN(),
5691 },
5692 .errstr_unpriv = "R4 min value is negative, either use unsigned",
5693 .errstr = "R4 min value is negative, either use unsigned",
5694 .result = REJECT,
5695 .result_unpriv = REJECT,
5696 },
5697 {
5698 "bounds checks mixing signed and unsigned, variant 7",
5699 .insns = {
5700 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5701 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5702 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5703 BPF_LD_MAP_FD(BPF_REG_1, 0),
5704 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5705 BPF_FUNC_map_lookup_elem),
5706 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5707 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5708 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5709 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
5710 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
5711 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5712 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5713 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5714 BPF_MOV64_IMM(BPF_REG_0, 0),
5715 BPF_EXIT_INSN(),
5716 },
5717 .fixup_map1 = { 3 },
5718 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5719 .errstr = "R0 min value is negative",
5720 .result = REJECT,
5721 .result_unpriv = REJECT,
5722 },
5723 {
5724 "bounds checks mixing signed and unsigned, variant 8",
5725 .insns = {
5726 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5727 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5728 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5729 BPF_LD_MAP_FD(BPF_REG_1, 0),
5730 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5731 BPF_FUNC_map_lookup_elem),
5732 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5733 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5734 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5735 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024 + 1),
5736 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
5737 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5738 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5739 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5740 BPF_MOV64_IMM(BPF_REG_0, 0),
5741 BPF_EXIT_INSN(),
5742 },
5743 .fixup_map1 = { 3 },
5744 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5745 .errstr = "R0 min value is negative",
5746 .result = REJECT,
5747 .result_unpriv = REJECT,
5748 },
5749 {
5750 "bounds checks mixing signed and unsigned, variant 9",
5751 .insns = {
5752 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5753 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5755 BPF_LD_MAP_FD(BPF_REG_1, 0),
5756 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5757 BPF_FUNC_map_lookup_elem),
5758 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5759 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5760 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5761 BPF_MOV64_IMM(BPF_REG_2, -1),
5762 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
5763 BPF_MOV64_IMM(BPF_REG_0, 0),
5764 BPF_EXIT_INSN(),
5765 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5766 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5767 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5768 BPF_MOV64_IMM(BPF_REG_0, 0),
5769 BPF_EXIT_INSN(),
5770 },
5771 .fixup_map1 = { 3 },
5772 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5773 .errstr = "R0 min value is negative",
5774 .result = REJECT,
5775 .result_unpriv = REJECT,
5776 },
5777 {
5778 "bounds checks mixing signed and unsigned, variant 10",
5779 .insns = {
5780 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5781 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5782 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5783 BPF_LD_MAP_FD(BPF_REG_1, 0),
5784 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5785 BPF_FUNC_map_lookup_elem),
5786 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5787 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5788 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5789 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
5790 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
5791 BPF_MOV64_IMM(BPF_REG_0, 0),
5792 BPF_EXIT_INSN(),
5793 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5794 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5795 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5796 BPF_MOV64_IMM(BPF_REG_0, 0),
5797 BPF_EXIT_INSN(),
5798 },
5799 .fixup_map1 = { 3 },
5800 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5801 .errstr = "R0 min value is negative",
5802 .result = REJECT,
5803 .result_unpriv = REJECT,
5804 },
5805 {
5806 "bounds checks mixing signed and unsigned, variant 11",
5807 .insns = {
5808 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5809 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5810 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5811 BPF_LD_MAP_FD(BPF_REG_1, 0),
5812 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5813 BPF_FUNC_map_lookup_elem),
5814 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5815 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5816 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5817 BPF_MOV64_IMM(BPF_REG_2, 0),
5818 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
5819 BPF_MOV64_IMM(BPF_REG_0, 0),
5820 BPF_EXIT_INSN(),
5821 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5822 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5823 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5824 BPF_MOV64_IMM(BPF_REG_0, 0),
5825 BPF_EXIT_INSN(),
5826 },
5827 .fixup_map1 = { 3 },
5828 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5829 .errstr = "R0 min value is negative",
5830 .result = REJECT,
5831 .result_unpriv = REJECT,
5832 },
5833 {
5834 "bounds checks mixing signed and unsigned, variant 12",
5835 .insns = {
5836 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5837 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5838 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5839 BPF_LD_MAP_FD(BPF_REG_1, 0),
5840 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5841 BPF_FUNC_map_lookup_elem),
5842 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5843 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5844 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5845 BPF_MOV64_IMM(BPF_REG_2, -1),
5846 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
5847 /* Dead branch. */
5848 BPF_MOV64_IMM(BPF_REG_0, 0),
5849 BPF_EXIT_INSN(),
5850 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5851 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5852 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5853 BPF_MOV64_IMM(BPF_REG_0, 0),
5854 BPF_EXIT_INSN(),
5855 },
5856 .fixup_map1 = { 3 },
5857 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5858 .errstr = "R0 min value is negative",
5859 .result = REJECT,
5860 .result_unpriv = REJECT,
5861 },
5862 {
5863 "bounds checks mixing signed and unsigned, variant 13",
5864 .insns = {
5865 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5866 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5867 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5868 BPF_LD_MAP_FD(BPF_REG_1, 0),
5869 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5870 BPF_FUNC_map_lookup_elem),
5871 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5872 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5873 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5874 BPF_MOV64_IMM(BPF_REG_2, -6),
5875 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
5876 BPF_MOV64_IMM(BPF_REG_0, 0),
5877 BPF_EXIT_INSN(),
5878 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5879 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5880 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5881 BPF_MOV64_IMM(BPF_REG_0, 0),
5882 BPF_EXIT_INSN(),
5883 },
5884 .fixup_map1 = { 3 },
5885 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5886 .errstr = "R0 min value is negative",
5887 .result = REJECT,
5888 .result_unpriv = REJECT,
5889 },
5890 {
5891 "bounds checks mixing signed and unsigned, variant 14",
5892 .insns = {
5893 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5894 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5896 BPF_LD_MAP_FD(BPF_REG_1, 0),
5897 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5898 BPF_FUNC_map_lookup_elem),
5899 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5900 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5901 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5902 BPF_MOV64_IMM(BPF_REG_2, 2),
5903 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
5904 BPF_MOV64_IMM(BPF_REG_7, 1),
5905 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
5906 BPF_MOV64_IMM(BPF_REG_0, 0),
5907 BPF_EXIT_INSN(),
5908 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
5909 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
5910 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
5911 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5912 BPF_MOV64_IMM(BPF_REG_0, 0),
5913 BPF_EXIT_INSN(),
5914 },
5915 .fixup_map1 = { 3 },
5916 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5917 .errstr = "R0 min value is negative",
5918 .result = REJECT,
5919 .result_unpriv = REJECT,
5920 },
5921 {
5922 "bounds checks mixing signed and unsigned, variant 15",
5923 .insns = {
5924 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
5925 offsetof(struct __sk_buff, mark)),
5926 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5927 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5928 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5929 BPF_LD_MAP_FD(BPF_REG_1, 0),
5930 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5931 BPF_FUNC_map_lookup_elem),
5932 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
5933 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5934 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5935 BPF_MOV64_IMM(BPF_REG_2, -1),
5936 BPF_MOV64_IMM(BPF_REG_8, 2),
5937 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
5938 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
5939 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
5940 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5941 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5942 BPF_MOV64_IMM(BPF_REG_0, 0),
5943 BPF_EXIT_INSN(),
5944 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
5945 BPF_JMP_IMM(BPF_JA, 0, 0, -7),
5946 },
5947 .fixup_map1 = { 4 },
5948 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5949 .errstr = "R0 min value is negative",
5950 .result = REJECT,
5951 .result_unpriv = REJECT,
5952 },
5953 {
5954 "bounds checks mixing signed and unsigned, variant 16",
5955 .insns = {
5956 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5957 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5958 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5959 BPF_LD_MAP_FD(BPF_REG_1, 0),
5960 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5961 BPF_FUNC_map_lookup_elem),
5962 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5963 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
5964 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5965 BPF_MOV64_IMM(BPF_REG_2, -6),
5966 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
5967 BPF_MOV64_IMM(BPF_REG_0, 0),
5968 BPF_EXIT_INSN(),
5969 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5970 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
5971 BPF_MOV64_IMM(BPF_REG_0, 0),
5972 BPF_EXIT_INSN(),
5973 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
5974 BPF_MOV64_IMM(BPF_REG_0, 0),
5975 BPF_EXIT_INSN(),
5976 },
5977 .fixup_map1 = { 3 },
5978 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5979 .errstr = "R0 min value is negative",
5980 .result = REJECT,
5981 .result_unpriv = REJECT,
5982 },
5513}; 5983};
5514 5984
5515static int probe_filter_length(const struct bpf_insn *fp) 5985static int probe_filter_length(const struct bpf_insn *fp)
@@ -5633,7 +6103,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
5633 6103
5634 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER, 6104 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
5635 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT, 6105 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
5636 "GPL", 0, bpf_vlog, sizeof(bpf_vlog)); 6106 "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
5637 6107
5638 expected_ret = unpriv && test->result_unpriv != UNDEF ? 6108 expected_ret = unpriv && test->result_unpriv != UNDEF ?
5639 test->result_unpriv : test->result; 6109 test->result_unpriv : test->result;
generated by cgit v1.2.2 (git 2.25.0) at 2026-03-11 10:35:04 -0400