1 // SPDX-License-Identifier: GPL-2.0 2 /* Converted from tools/testing/selftests/bpf/verifier/map_ptr.c */ 3 4 #include <linux/bpf.h> 5 #include <bpf/bpf_helpers.h> 6 #include "bpf_misc.h" 7 8 #define MAX_ENTRIES 11 9 10 struct test_val { 11 unsigned int index; 12 int foo[MAX_ENTRIES]; 13 }; 14 15 struct { 16 __uint(type, BPF_MAP_TYPE_ARRAY); 17 __uint(max_entries, 1); 18 __type(key, int); 19 __type(value, struct test_val); 20 } map_array_48b SEC(".maps"); 21 22 struct other_val { 23 long long foo; 24 long long bar; 25 }; 26 27 struct { 28 __uint(type, BPF_MAP_TYPE_HASH); 29 __uint(max_entries, 1); 30 __type(key, long long); 31 __type(value, struct other_val); 32 } map_hash_16b SEC(".maps"); 33 34 SEC("socket") 35 __description("bpf_map_ptr: read with negative offset rejected") 36 __failure __msg("R1 is bpf_array invalid negative access: off=-8") 37 __failure_unpriv 38 __msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN") 39 __naked void read_with_negative_offset_rejected(void) 40 { 41 asm volatile (" \ 42 r1 = r10; \ 43 r1 = %[map_array_48b] ll; \ 44 r6 = *(u64*)(r1 - 8); \ 45 r0 = 1; \ 46 exit; \ 47 " : 48 : __imm_addr(map_array_48b) 49 : __clobber_all); 50 } 51 52 SEC("socket") 53 __description("bpf_map_ptr: write rejected") 54 __failure __msg("only read from bpf_array is supported") 55 __failure_unpriv 56 __msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN") 57 __naked void bpf_map_ptr_write_rejected(void) 58 { 59 asm volatile (" \ 60 r0 = 0; \ 61 *(u64*)(r10 - 8) = r0; \ 62 r2 = r10; \ 63 r2 += -8; \ 64 r1 = %[map_array_48b] ll; \ 65 *(u64*)(r1 + 0) = r2; \ 66 r0 = 1; \ 67 exit; \ 68 " : 69 : __imm_addr(map_array_48b) 70 : __clobber_all); 71 } 72 73 /* 74 * struct bpf_map starts with the SHA256 hash sha[32] at offset 0 (a readable 75 * byte array), followed by the ops pointer at offset 32 and the inner_map_meta 76 * pointer at offset 40. Reading a u32 at offset 41 reaches into the middle of 77 * the inner_map_meta pointer, i.e. a partial pointer access, which is 78 * rejected. 79 */ 80 SEC("socket") 81 __description("bpf_map_ptr: read non-existent field rejected") 82 __failure 83 __msg("cannot access ptr member inner_map_meta with moff 40 in struct bpf_map with off 41 size 4") 84 __failure_unpriv 85 __msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN") 86 __flag(BPF_F_ANY_ALIGNMENT) 87 __naked void read_non_existent_field_rejected(void) 88 { 89 asm volatile (" \ 90 r6 = 0; \ 91 r1 = %[map_array_48b] ll; \ 92 r6 = *(u32*)(r1 + 41); \ 93 r0 = 1; \ 94 exit; \ 95 " : 96 : __imm_addr(map_array_48b) 97 : __clobber_all); 98 } 99 100 /* 101 * The sha byte array spans offsets 0..31 (mend 32). Reading a u32 at offset 102 * 30 starts inside sha but extends past its end, which the verifier rejects 103 * as an out-of-bounds scalar access. 104 */ 105 SEC("socket") 106 __description("bpf_map_ptr: read beyond sha field rejected") 107 __failure 108 __msg("access beyond the end of member sha (mend:32) in struct bpf_map with off 30 size 4") 109 __failure_unpriv 110 __msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN") 111 __flag(BPF_F_ANY_ALIGNMENT) 112 __naked void read_beyond_sha_field_rejected(void) 113 { 114 asm volatile (" \ 115 r6 = 0; \ 116 r1 = %[map_array_48b] ll; \ 117 r6 = *(u32*)(r1 + 30); \ 118 r0 = 1; \ 119 exit; \ 120 " : 121 : __imm_addr(map_array_48b) 122 : __clobber_all); 123 } 124 125 SEC("socket") 126 __description("bpf_map_ptr: read ops field accepted") 127 __success __failure_unpriv 128 __msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN") 129 __retval(1) 130 __naked void ptr_read_ops_field_accepted(void) 131 { 132 asm volatile (" \ 133 r6 = 0; \ 134 r1 = %[map_array_48b] ll; \ 135 r6 = *(u64*)(r1 + 32); \ 136 r0 = 1; \ 137 exit; \ 138 " : 139 : __imm_addr(map_array_48b) 140 : __clobber_all); 141 } 142 143 SEC("socket") 144 __description("bpf_map_ptr: r = 0, map_ptr = map_ptr + r") 145 __success __failure_unpriv 146 __msg_unpriv("R1 has pointer with unsupported alu operation") 147 __retval(0) 148 __naked void map_ptr_map_ptr_r(void) 149 { 150 asm volatile (" \ 151 r0 = 0; \ 152 *(u64*)(r10 - 8) = r0; \ 153 r2 = r10; \ 154 r2 += -8; \ 155 r0 = 0; \ 156 r1 = %[map_hash_16b] ll; \ 157 r1 += r0; \ 158 call %[bpf_map_lookup_elem]; \ 159 r0 = 0; \ 160 exit; \ 161 " : 162 : __imm(bpf_map_lookup_elem), 163 __imm_addr(map_hash_16b) 164 : __clobber_all); 165 } 166 167 SEC("socket") 168 __description("bpf_map_ptr: r = 0, r = r + map_ptr") 169 __success __failure_unpriv 170 __msg_unpriv("R0 has pointer with unsupported alu operation") 171 __retval(0) 172 __naked void _0_r_r_map_ptr(void) 173 { 174 asm volatile (" \ 175 r0 = 0; \ 176 *(u64*)(r10 - 8) = r0; \ 177 r2 = r10; \ 178 r2 += -8; \ 179 r1 = 0; \ 180 r0 = %[map_hash_16b] ll; \ 181 r1 += r0; \ 182 call %[bpf_map_lookup_elem]; \ 183 r0 = 0; \ 184 exit; \ 185 " : 186 : __imm(bpf_map_lookup_elem), 187 __imm_addr(map_hash_16b) 188 : __clobber_all); 189 } 190 191 char _license[] SEC("license") = "GPL"; 192