selftests/bpf: variable offset negative tests
Variable ctx accesses and stack accesses aren't allowed, because we can't determine what type of value will be read. Signed-off-by: Edward Cree <ecree@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
f999d64c34
commit
69c4e8ada6
|
@ -5980,6 +5980,47 @@ static struct bpf_test tests[] = {
|
||||||
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
||||||
.result = REJECT,
|
.result = REJECT,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"variable-offset ctx access",
|
||||||
|
.insns = {
|
||||||
|
/* Get an unknown value */
|
||||||
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
|
||||||
|
/* Make it small and 4-byte aligned */
|
||||||
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
|
||||||
|
/* add it to skb. We now have either &skb->len or
|
||||||
|
* &skb->pkt_type, but we don't know which
|
||||||
|
*/
|
||||||
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
|
||||||
|
/* dereference it */
|
||||||
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.errstr = "variable ctx access var_off=(0x0; 0x4)",
|
||||||
|
.result = REJECT,
|
||||||
|
.prog_type = BPF_PROG_TYPE_LWT_IN,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"variable-offset stack access",
|
||||||
|
.insns = {
|
||||||
|
/* Fill the top 8 bytes of the stack */
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||||
|
/* Get an unknown value */
|
||||||
|
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
|
||||||
|
/* Make it small and 4-byte aligned */
|
||||||
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
|
||||||
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
|
||||||
|
/* add it to fp. We now have either fp-4 or fp-8, but
|
||||||
|
* we don't know which
|
||||||
|
*/
|
||||||
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
|
||||||
|
/* dereference it */
|
||||||
|
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
|
||||||
|
.result = REJECT,
|
||||||
|
.prog_type = BPF_PROG_TYPE_LWT_IN,
|
||||||
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
static int probe_filter_length(const struct bpf_insn *fp)
|
static int probe_filter_length(const struct bpf_insn *fp)
|
||||||
|
|
Loading…
Reference in a new issue