1 // SPDX-License-Identifier: GPL-2.0 2 /* Converted from tools/testing/selftests/bpf/verifier/leak_ptr.c */ 3 4 #include <linux/bpf.h> 5 #include <bpf/bpf_helpers.h> 6 #include "bpf_misc.h" 7 8 struct { 9 __uint(type, BPF_MAP_TYPE_HASH); 10 __uint(max_entries, 1); 11 __type(key, long long); 12 __type(value, long long); 13 } map_hash_8b SEC(".maps"); 14 15 SEC("socket") 16 __description("leak pointer into ctx 1") 17 __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed") 18 __failure_unpriv __msg_unpriv("R2 leaks addr into mem") 19 __naked void leak_pointer_into_ctx_1(void) 20 { 21 asm volatile (" \ 22 r0 = 0; \ 23 *(u64*)(r1 + %[__sk_buff_cb_0]) = r0; \ 24 r2 = %[map_hash_8b] ll; \ 25 lock *(u64 *)(r1 + %[__sk_buff_cb_0]) += r2; \ 26 exit; \ 27 " : 28 : __imm_addr(map_hash_8b), 29 __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0])) 30 : __clobber_all); 31 } 32 33 SEC("socket") 34 __description("leak pointer into ctx 2") 35 __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed") 36 __failure_unpriv __msg_unpriv("R10 leaks addr into mem") 37 __naked void leak_pointer_into_ctx_2(void) 38 { 39 asm volatile (" \ 40 r0 = 0; \ 41 *(u64*)(r1 + %[__sk_buff_cb_0]) = r0; \ 42 lock *(u64 *)(r1 + %[__sk_buff_cb_0]) += r10; \ 43 exit; \ 44 " : 45 : __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0])) 46 : __clobber_all); 47 } 48 49 SEC("socket") 50 __description("leak pointer into ctx 3") 51 __success __failure_unpriv __msg_unpriv("R2 leaks addr into ctx") 52 __retval(0) 53 __naked void leak_pointer_into_ctx_3(void) 54 { 55 asm volatile (" \ 56 r0 = 0; \ 57 r2 = %[map_hash_8b] ll; \ 58 *(u64*)(r1 + %[__sk_buff_cb_0]) = r2; \ 59 exit; \ 60 " : 61 : __imm_addr(map_hash_8b), 62 __imm_const(__sk_buff_cb_0, offsetof(struct __sk_buff, cb[0])) 63 : __clobber_all); 64 } 65 66 SEC("socket") 67 __description("leak pointer into map val") 68 __success __failure_unpriv __msg_unpriv("R6 leaks addr into mem") 69 __retval(0) 70 __naked void leak_pointer_into_map_val(void) 71 { 72 asm volatile (" \ 73 r6 = r1; \ 74 r1 = 0; \ 75 *(u64*)(r10 - 8) = r1; \ 76 r2 = r10; \ 77 r2 += -8; \ 78 r1 = %[map_hash_8b] ll; \ 79 call %[bpf_map_lookup_elem]; \ 80 if r0 == 0 goto l0_%=; \ 81 r3 = 0; \ 82 *(u64*)(r0 + 0) = r3; \ 83 lock *(u64 *)(r0 + 0) += r6; \ 84 l0_%=: r0 = 0; \ 85 exit; \ 86 " : 87 : __imm(bpf_map_lookup_elem), 88 __imm_addr(map_hash_8b) 89 : __clobber_all); 90 } 91 92 char _license[] SEC("license") = "GPL"; 93