1 // SPDX-License-Identifier: GPL-2.0
2 /* Converted from tools/testing/selftests/bpf/verifier/bounds_deduction.c */
3
4 #include <linux/bpf.h>
5 #include <bpf/bpf_helpers.h>
6 #include "bpf_misc.h"
7
8 SEC("socket")
9 __description("check deducing bounds from const, 1")
10 __failure __msg("R0 tried to subtract pointer from scalar")
11 __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_1(void)12 __naked void deducing_bounds_from_const_1(void)
13 {
14 asm volatile (" \
15 r0 = 1; \
16 if r0 s>= 1 goto l0_%=; \
17 l0_%=: r0 -= r1; \
18 exit; \
19 " ::: __clobber_all);
20 }
21
22 SEC("socket")
23 __description("check deducing bounds from const, 2")
24 __success __failure_unpriv
25 __msg_unpriv("R1 has pointer with unsupported alu operation")
26 __retval(1)
deducing_bounds_from_const_2(void)27 __naked void deducing_bounds_from_const_2(void)
28 {
29 asm volatile (" \
30 r0 = 1; \
31 if r0 s>= 1 goto l0_%=; \
32 exit; \
33 l0_%=: if r0 s<= 1 goto l1_%=; \
34 exit; \
35 l1_%=: r1 -= r0; \
36 exit; \
37 " ::: __clobber_all);
38 }
39
40 SEC("socket")
41 __description("check deducing bounds from const, 3")
42 __failure __msg("R0 tried to subtract pointer from scalar")
43 __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_3(void)44 __naked void deducing_bounds_from_const_3(void)
45 {
46 asm volatile (" \
47 r0 = 0; \
48 if r0 s<= 0 goto l0_%=; \
49 l0_%=: r0 -= r1; \
50 exit; \
51 " ::: __clobber_all);
52 }
53
54 SEC("socket")
55 __description("check deducing bounds from const, 4")
56 __success __failure_unpriv
57 __msg_unpriv("R6 has pointer with unsupported alu operation")
58 __retval(0)
deducing_bounds_from_const_4(void)59 __naked void deducing_bounds_from_const_4(void)
60 {
61 asm volatile (" \
62 r6 = r1; \
63 r0 = 0; \
64 if r0 s<= 0 goto l0_%=; \
65 exit; \
66 l0_%=: if r0 s>= 0 goto l1_%=; \
67 exit; \
68 l1_%=: r6 -= r0; \
69 exit; \
70 " ::: __clobber_all);
71 }
72
73 SEC("socket")
74 __description("check deducing bounds from const, 5")
75 __failure __msg("R0 tried to subtract pointer from scalar")
76 __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_5(void)77 __naked void deducing_bounds_from_const_5(void)
78 {
79 asm volatile (" \
80 r0 = 0; \
81 if r0 s>= 1 goto l0_%=; \
82 r0 -= r1; \
83 l0_%=: exit; \
84 " ::: __clobber_all);
85 }
86
87 SEC("socket")
88 __description("check deducing bounds from const, 6")
89 __failure __msg("R0 tried to subtract pointer from scalar")
90 __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_6(void)91 __naked void deducing_bounds_from_const_6(void)
92 {
93 asm volatile (" \
94 r0 = 0; \
95 if r0 s>= 0 goto l0_%=; \
96 exit; \
97 l0_%=: r0 -= r1; \
98 exit; \
99 " ::: __clobber_all);
100 }
101
102 SEC("socket")
103 __description("check deducing bounds from const, 7")
104 __failure __msg("dereference of modified ctx ptr")
105 __msg_unpriv("R1 has pointer with unsupported alu operation")
__flag(BPF_F_ANY_ALIGNMENT)106 __flag(BPF_F_ANY_ALIGNMENT)
107 __naked void deducing_bounds_from_const_7(void)
108 {
109 asm volatile (" \
110 r0 = %[__imm_0]; \
111 if r0 s>= 0 goto l0_%=; \
112 l0_%=: r1 -= r0; \
113 r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
114 exit; \
115 " :
116 : __imm_const(__imm_0, ~0),
117 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
118 : __clobber_all);
119 }
120
121 SEC("socket")
122 __description("check deducing bounds from const, 8")
123 __failure __msg("negative offset ctx ptr R1 off=-1 disallowed")
124 __msg_unpriv("R1 has pointer with unsupported alu operation")
__flag(BPF_F_ANY_ALIGNMENT)125 __flag(BPF_F_ANY_ALIGNMENT)
126 __naked void deducing_bounds_from_const_8(void)
127 {
128 asm volatile (" \
129 r0 = %[__imm_0]; \
130 if r0 s>= 0 goto l0_%=; \
131 r1 += r0; \
132 l0_%=: r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
133 exit; \
134 " :
135 : __imm_const(__imm_0, ~0),
136 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
137 : __clobber_all);
138 }
139
140 SEC("socket")
141 __description("check deducing bounds from const, 9")
142 __failure __msg("R0 tried to subtract pointer from scalar")
143 __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_9(void)144 __naked void deducing_bounds_from_const_9(void)
145 {
146 asm volatile (" \
147 r0 = 0; \
148 if r0 s>= 0 goto l0_%=; \
149 l0_%=: r0 -= r1; \
150 exit; \
151 " ::: __clobber_all);
152 }
153
154 SEC("socket")
155 __description("check deducing bounds from const, 10")
156 __failure
157 __msg("math between ctx pointer and register with unbounded min value is not allowed")
158 __failure_unpriv
deducing_bounds_from_const_10(void)159 __naked void deducing_bounds_from_const_10(void)
160 {
161 asm volatile (" \
162 r0 = 0; \
163 if r0 s<= 0 goto l0_%=; \
164 l0_%=: /* Marks reg as unknown. */ \
165 r0 = -r0; \
166 r0 -= r1; \
167 exit; \
168 " ::: __clobber_all);
169 }
170
171 char _license[] SEC("license") = "GPL";
172