1*7605f94bSEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2*7605f94bSEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/bounds_deduction.c */
3*7605f94bSEduard Zingerman
4*7605f94bSEduard Zingerman #include <linux/bpf.h>
5*7605f94bSEduard Zingerman #include <bpf/bpf_helpers.h>
6*7605f94bSEduard Zingerman #include "bpf_misc.h"
7*7605f94bSEduard Zingerman
8*7605f94bSEduard Zingerman SEC("socket")
9*7605f94bSEduard Zingerman __description("check deducing bounds from const, 1")
10*7605f94bSEduard Zingerman __failure __msg("R0 tried to subtract pointer from scalar")
11*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_1(void)12*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_1(void)
13*7605f94bSEduard Zingerman {
14*7605f94bSEduard Zingerman asm volatile (" \
15*7605f94bSEduard Zingerman r0 = 1; \
16*7605f94bSEduard Zingerman if r0 s>= 1 goto l0_%=; \
17*7605f94bSEduard Zingerman l0_%=: r0 -= r1; \
18*7605f94bSEduard Zingerman exit; \
19*7605f94bSEduard Zingerman " ::: __clobber_all);
20*7605f94bSEduard Zingerman }
21*7605f94bSEduard Zingerman
22*7605f94bSEduard Zingerman SEC("socket")
23*7605f94bSEduard Zingerman __description("check deducing bounds from const, 2")
24*7605f94bSEduard Zingerman __success __failure_unpriv
25*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
26*7605f94bSEduard Zingerman __retval(1)
deducing_bounds_from_const_2(void)27*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_2(void)
28*7605f94bSEduard Zingerman {
29*7605f94bSEduard Zingerman asm volatile (" \
30*7605f94bSEduard Zingerman r0 = 1; \
31*7605f94bSEduard Zingerman if r0 s>= 1 goto l0_%=; \
32*7605f94bSEduard Zingerman exit; \
33*7605f94bSEduard Zingerman l0_%=: if r0 s<= 1 goto l1_%=; \
34*7605f94bSEduard Zingerman exit; \
35*7605f94bSEduard Zingerman l1_%=: r1 -= r0; \
36*7605f94bSEduard Zingerman exit; \
37*7605f94bSEduard Zingerman " ::: __clobber_all);
38*7605f94bSEduard Zingerman }
39*7605f94bSEduard Zingerman
40*7605f94bSEduard Zingerman SEC("socket")
41*7605f94bSEduard Zingerman __description("check deducing bounds from const, 3")
42*7605f94bSEduard Zingerman __failure __msg("R0 tried to subtract pointer from scalar")
43*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_3(void)44*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_3(void)
45*7605f94bSEduard Zingerman {
46*7605f94bSEduard Zingerman asm volatile (" \
47*7605f94bSEduard Zingerman r0 = 0; \
48*7605f94bSEduard Zingerman if r0 s<= 0 goto l0_%=; \
49*7605f94bSEduard Zingerman l0_%=: r0 -= r1; \
50*7605f94bSEduard Zingerman exit; \
51*7605f94bSEduard Zingerman " ::: __clobber_all);
52*7605f94bSEduard Zingerman }
53*7605f94bSEduard Zingerman
54*7605f94bSEduard Zingerman SEC("socket")
55*7605f94bSEduard Zingerman __description("check deducing bounds from const, 4")
56*7605f94bSEduard Zingerman __success __failure_unpriv
57*7605f94bSEduard Zingerman __msg_unpriv("R6 has pointer with unsupported alu operation")
58*7605f94bSEduard Zingerman __retval(0)
deducing_bounds_from_const_4(void)59*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_4(void)
60*7605f94bSEduard Zingerman {
61*7605f94bSEduard Zingerman asm volatile (" \
62*7605f94bSEduard Zingerman r6 = r1; \
63*7605f94bSEduard Zingerman r0 = 0; \
64*7605f94bSEduard Zingerman if r0 s<= 0 goto l0_%=; \
65*7605f94bSEduard Zingerman exit; \
66*7605f94bSEduard Zingerman l0_%=: if r0 s>= 0 goto l1_%=; \
67*7605f94bSEduard Zingerman exit; \
68*7605f94bSEduard Zingerman l1_%=: r6 -= r0; \
69*7605f94bSEduard Zingerman exit; \
70*7605f94bSEduard Zingerman " ::: __clobber_all);
71*7605f94bSEduard Zingerman }
72*7605f94bSEduard Zingerman
73*7605f94bSEduard Zingerman SEC("socket")
74*7605f94bSEduard Zingerman __description("check deducing bounds from const, 5")
75*7605f94bSEduard Zingerman __failure __msg("R0 tried to subtract pointer from scalar")
76*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_5(void)77*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_5(void)
78*7605f94bSEduard Zingerman {
79*7605f94bSEduard Zingerman asm volatile (" \
80*7605f94bSEduard Zingerman r0 = 0; \
81*7605f94bSEduard Zingerman if r0 s>= 1 goto l0_%=; \
82*7605f94bSEduard Zingerman r0 -= r1; \
83*7605f94bSEduard Zingerman l0_%=: exit; \
84*7605f94bSEduard Zingerman " ::: __clobber_all);
85*7605f94bSEduard Zingerman }
86*7605f94bSEduard Zingerman
87*7605f94bSEduard Zingerman SEC("socket")
88*7605f94bSEduard Zingerman __description("check deducing bounds from const, 6")
89*7605f94bSEduard Zingerman __failure __msg("R0 tried to subtract pointer from scalar")
90*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_6(void)91*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_6(void)
92*7605f94bSEduard Zingerman {
93*7605f94bSEduard Zingerman asm volatile (" \
94*7605f94bSEduard Zingerman r0 = 0; \
95*7605f94bSEduard Zingerman if r0 s>= 0 goto l0_%=; \
96*7605f94bSEduard Zingerman exit; \
97*7605f94bSEduard Zingerman l0_%=: r0 -= r1; \
98*7605f94bSEduard Zingerman exit; \
99*7605f94bSEduard Zingerman " ::: __clobber_all);
100*7605f94bSEduard Zingerman }
101*7605f94bSEduard Zingerman
102*7605f94bSEduard Zingerman SEC("socket")
103*7605f94bSEduard Zingerman __description("check deducing bounds from const, 7")
104*7605f94bSEduard Zingerman __failure __msg("dereference of modified ctx ptr")
105*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
__flag(BPF_F_ANY_ALIGNMENT)106*7605f94bSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
107*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_7(void)
108*7605f94bSEduard Zingerman {
109*7605f94bSEduard Zingerman asm volatile (" \
110*7605f94bSEduard Zingerman r0 = %[__imm_0]; \
111*7605f94bSEduard Zingerman if r0 s>= 0 goto l0_%=; \
112*7605f94bSEduard Zingerman l0_%=: r1 -= r0; \
113*7605f94bSEduard Zingerman r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
114*7605f94bSEduard Zingerman exit; \
115*7605f94bSEduard Zingerman " :
116*7605f94bSEduard Zingerman : __imm_const(__imm_0, ~0),
117*7605f94bSEduard Zingerman __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
118*7605f94bSEduard Zingerman : __clobber_all);
119*7605f94bSEduard Zingerman }
120*7605f94bSEduard Zingerman
121*7605f94bSEduard Zingerman SEC("socket")
122*7605f94bSEduard Zingerman __description("check deducing bounds from const, 8")
123*7605f94bSEduard Zingerman __failure __msg("negative offset ctx ptr R1 off=-1 disallowed")
124*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
__flag(BPF_F_ANY_ALIGNMENT)125*7605f94bSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
126*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_8(void)
127*7605f94bSEduard Zingerman {
128*7605f94bSEduard Zingerman asm volatile (" \
129*7605f94bSEduard Zingerman r0 = %[__imm_0]; \
130*7605f94bSEduard Zingerman if r0 s>= 0 goto l0_%=; \
131*7605f94bSEduard Zingerman r1 += r0; \
132*7605f94bSEduard Zingerman l0_%=: r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
133*7605f94bSEduard Zingerman exit; \
134*7605f94bSEduard Zingerman " :
135*7605f94bSEduard Zingerman : __imm_const(__imm_0, ~0),
136*7605f94bSEduard Zingerman __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
137*7605f94bSEduard Zingerman : __clobber_all);
138*7605f94bSEduard Zingerman }
139*7605f94bSEduard Zingerman
140*7605f94bSEduard Zingerman SEC("socket")
141*7605f94bSEduard Zingerman __description("check deducing bounds from const, 9")
142*7605f94bSEduard Zingerman __failure __msg("R0 tried to subtract pointer from scalar")
143*7605f94bSEduard Zingerman __msg_unpriv("R1 has pointer with unsupported alu operation")
deducing_bounds_from_const_9(void)144*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_9(void)
145*7605f94bSEduard Zingerman {
146*7605f94bSEduard Zingerman asm volatile (" \
147*7605f94bSEduard Zingerman r0 = 0; \
148*7605f94bSEduard Zingerman if r0 s>= 0 goto l0_%=; \
149*7605f94bSEduard Zingerman l0_%=: r0 -= r1; \
150*7605f94bSEduard Zingerman exit; \
151*7605f94bSEduard Zingerman " ::: __clobber_all);
152*7605f94bSEduard Zingerman }
153*7605f94bSEduard Zingerman
154*7605f94bSEduard Zingerman SEC("socket")
155*7605f94bSEduard Zingerman __description("check deducing bounds from const, 10")
156*7605f94bSEduard Zingerman __failure
157*7605f94bSEduard Zingerman __msg("math between ctx pointer and register with unbounded min value is not allowed")
158*7605f94bSEduard Zingerman __failure_unpriv
deducing_bounds_from_const_10(void)159*7605f94bSEduard Zingerman __naked void deducing_bounds_from_const_10(void)
160*7605f94bSEduard Zingerman {
161*7605f94bSEduard Zingerman asm volatile (" \
162*7605f94bSEduard Zingerman r0 = 0; \
163*7605f94bSEduard Zingerman if r0 s<= 0 goto l0_%=; \
164*7605f94bSEduard Zingerman l0_%=: /* Marks reg as unknown. */ \
165*7605f94bSEduard Zingerman r0 = -r0; \
166*7605f94bSEduard Zingerman r0 -= r1; \
167*7605f94bSEduard Zingerman exit; \
168*7605f94bSEduard Zingerman " ::: __clobber_all);
169*7605f94bSEduard Zingerman }
170*7605f94bSEduard Zingerman
171*7605f94bSEduard Zingerman char _license[] SEC("license") = "GPL";
172