1*583c7ce5SEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2*583c7ce5SEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/leak_ptr.c */
3*583c7ce5SEduard Zingerman
4*583c7ce5SEduard Zingerman #include <linux/bpf.h>
5*583c7ce5SEduard Zingerman #include <bpf/bpf_helpers.h>
6*583c7ce5SEduard Zingerman #include "bpf_misc.h"
7*583c7ce5SEduard Zingerman
8*583c7ce5SEduard Zingerman struct {
9*583c7ce5SEduard Zingerman __uint(type, BPF_MAP_TYPE_HASH);
10*583c7ce5SEduard Zingerman __uint(max_entries, 1);
11*583c7ce5SEduard Zingerman __type(key, long long);
12*583c7ce5SEduard Zingerman __type(value, long long);
13*583c7ce5SEduard Zingerman } map_hash_8b SEC(".maps");
14*583c7ce5SEduard Zingerman
15*583c7ce5SEduard Zingerman SEC("socket")
16*583c7ce5SEduard Zingerman __description("leak pointer into ctx 1")
17*583c7ce5SEduard Zingerman __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")
18*583c7ce5SEduard Zingerman __failure_unpriv __msg_unpriv("R2 leaks addr into mem")
leak_pointer_into_ctx_1(void)19*583c7ce5SEduard Zingerman __naked void leak_pointer_into_ctx_1(void)
20*583c7ce5SEduard Zingerman {
21*583c7ce5SEduard Zingerman asm volatile (" \
22*583c7ce5SEduard Zingerman r0 = 0; \
23*583c7ce5SEduard Zingerman *(u64*)(r1 + %[__sk_buff_cb_0]) = r0; \
24*583c7ce5SEduard Zingerman r2 = %[map_hash_8b] ll; \
25*583c7ce5SEduard Zingerman lock *(u64 *)(r1 + %[__sk_buff_cb_0]) += r2; \
26*583c7ce5SEduard Zingerman exit; \
27*583c7ce5SEduard Zingerman " :
28*583c7ce5SEduard Zingerman : __imm_addr(map_hash_8b),
29*583c7ce5SEduard Zingerman __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0]))
30*583c7ce5SEduard Zingerman : __clobber_all);
31*583c7ce5SEduard Zingerman }
32*583c7ce5SEduard Zingerman
33*583c7ce5SEduard Zingerman SEC("socket")
34*583c7ce5SEduard Zingerman __description("leak pointer into ctx 2")
35*583c7ce5SEduard Zingerman __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")
36*583c7ce5SEduard Zingerman __failure_unpriv __msg_unpriv("R10 leaks addr into mem")
leak_pointer_into_ctx_2(void)37*583c7ce5SEduard Zingerman __naked void leak_pointer_into_ctx_2(void)
38*583c7ce5SEduard Zingerman {
39*583c7ce5SEduard Zingerman asm volatile (" \
40*583c7ce5SEduard Zingerman r0 = 0; \
41*583c7ce5SEduard Zingerman *(u64*)(r1 + %[__sk_buff_cb_0]) = r0; \
42*583c7ce5SEduard Zingerman lock *(u64 *)(r1 + %[__sk_buff_cb_0]) += r10; \
43*583c7ce5SEduard Zingerman exit; \
44*583c7ce5SEduard Zingerman " :
45*583c7ce5SEduard Zingerman : __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0]))
46*583c7ce5SEduard Zingerman : __clobber_all);
47*583c7ce5SEduard Zingerman }
48*583c7ce5SEduard Zingerman
49*583c7ce5SEduard Zingerman SEC("socket")
50*583c7ce5SEduard Zingerman __description("leak pointer into ctx 3")
51*583c7ce5SEduard Zingerman __success __failure_unpriv __msg_unpriv("R2 leaks addr into ctx")
52*583c7ce5SEduard Zingerman __retval(0)
leak_pointer_into_ctx_3(void)53*583c7ce5SEduard Zingerman __naked void leak_pointer_into_ctx_3(void)
54*583c7ce5SEduard Zingerman {
55*583c7ce5SEduard Zingerman asm volatile (" \
56*583c7ce5SEduard Zingerman r0 = 0; \
57*583c7ce5SEduard Zingerman r2 = %[map_hash_8b] ll; \
58*583c7ce5SEduard Zingerman *(u64*)(r1 + %[__sk_buff_cb_0]) = r2; \
59*583c7ce5SEduard Zingerman exit; \
60*583c7ce5SEduard Zingerman " :
61*583c7ce5SEduard Zingerman : __imm_addr(map_hash_8b),
62*583c7ce5SEduard Zingerman __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0]))
63*583c7ce5SEduard Zingerman : __clobber_all);
64*583c7ce5SEduard Zingerman }
65*583c7ce5SEduard Zingerman
66*583c7ce5SEduard Zingerman SEC("socket")
67*583c7ce5SEduard Zingerman __description("leak pointer into map val")
68*583c7ce5SEduard Zingerman __success __failure_unpriv __msg_unpriv("R6 leaks addr into mem")
69*583c7ce5SEduard Zingerman __retval(0)
leak_pointer_into_map_val(void)70*583c7ce5SEduard Zingerman __naked void leak_pointer_into_map_val(void)
71*583c7ce5SEduard Zingerman {
72*583c7ce5SEduard Zingerman asm volatile (" \
73*583c7ce5SEduard Zingerman r6 = r1; \
74*583c7ce5SEduard Zingerman r1 = 0; \
75*583c7ce5SEduard Zingerman *(u64*)(r10 - 8) = r1; \
76*583c7ce5SEduard Zingerman r2 = r10; \
77*583c7ce5SEduard Zingerman r2 += -8; \
78*583c7ce5SEduard Zingerman r1 = %[map_hash_8b] ll; \
79*583c7ce5SEduard Zingerman call %[bpf_map_lookup_elem]; \
80*583c7ce5SEduard Zingerman if r0 == 0 goto l0_%=; \
81*583c7ce5SEduard Zingerman r3 = 0; \
82*583c7ce5SEduard Zingerman *(u64*)(r0 + 0) = r3; \
83*583c7ce5SEduard Zingerman lock *(u64 *)(r0 + 0) += r6; \
84*583c7ce5SEduard Zingerman l0_%=: r0 = 0; \
85*583c7ce5SEduard Zingerman exit; \
86*583c7ce5SEduard Zingerman " :
87*583c7ce5SEduard Zingerman : __imm(bpf_map_lookup_elem),
88*583c7ce5SEduard Zingerman __imm_addr(map_hash_8b)
89*583c7ce5SEduard Zingerman : __clobber_all);
90*583c7ce5SEduard Zingerman }
91*583c7ce5SEduard Zingerman
92*583c7ce5SEduard Zingerman char _license[] SEC("license") = "GPL";
93