xref: /linux/tools/testing/selftests/bpf/verifier/direct_value_access.c (revision 26fbb4c8c7c3ee9a4c3b4de555a8587b5a19154e) 
1 {
2 	"direct map access, write test 1",
3 	.insns = {
4 	BPF_MOV64_IMM(BPF_REG_0, 1),
5 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
6 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
7 	BPF_EXIT_INSN(),
8 	},
9 	.fixup_map_array_48b = { 1 },
10 	.result = ACCEPT,
11 	.retval = 1,
12 },
13 {
14 	"direct map access, write test 2",
15 	.insns = {
16 	BPF_MOV64_IMM(BPF_REG_0, 1),
17 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
18 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
19 	BPF_EXIT_INSN(),
20 	},
21 	.fixup_map_array_48b = { 1 },
22 	.result = ACCEPT,
23 	.retval = 1,
24 },
25 {
26 	"direct map access, write test 3",
27 	.insns = {
28 	BPF_MOV64_IMM(BPF_REG_0, 1),
29 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
30 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
31 	BPF_EXIT_INSN(),
32 	},
33 	.fixup_map_array_48b = { 1 },
34 	.result = ACCEPT,
35 	.retval = 1,
36 },
37 {
38 	"direct map access, write test 4",
39 	.insns = {
40 	BPF_MOV64_IMM(BPF_REG_0, 1),
41 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
42 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
43 	BPF_EXIT_INSN(),
44 	},
45 	.fixup_map_array_48b = { 1 },
46 	.result = ACCEPT,
47 	.retval = 1,
48 },
49 {
50 	"direct map access, write test 5",
51 	.insns = {
52 	BPF_MOV64_IMM(BPF_REG_0, 1),
53 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),
54 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
55 	BPF_EXIT_INSN(),
56 	},
57 	.fixup_map_array_48b = { 1 },
58 	.result = ACCEPT,
59 	.retval = 1,
60 },
61 {
62 	"direct map access, write test 6",
63 	.insns = {
64 	BPF_MOV64_IMM(BPF_REG_0, 1),
65 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
66 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
67 	BPF_EXIT_INSN(),
68 	},
69 	.fixup_map_array_48b = { 1 },
70 	.result = REJECT,
71 	.errstr = "R1 min value is outside of the allowed memory range",
72 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
73 },
74 {
75 	"direct map access, write test 7",
76 	.insns = {
77 	BPF_MOV64_IMM(BPF_REG_0, 1),
78 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),
79 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
80 	BPF_EXIT_INSN(),
81 	},
82 	.fixup_map_array_48b = { 1 },
83 	.result = REJECT,
84 	.errstr = "direct value offset of 4294967295 is not allowed",
85 },
86 {
87 	"direct map access, write test 8",
88 	.insns = {
89 	BPF_MOV64_IMM(BPF_REG_0, 1),
90 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
91 	BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),
92 	BPF_EXIT_INSN(),
93 	},
94 	.fixup_map_array_48b = { 1 },
95 	.result = ACCEPT,
96 	.retval = 1,
97 },
98 {
99 	"direct map access, write test 9",
100 	.insns = {
101 	BPF_MOV64_IMM(BPF_REG_0, 1),
102 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
103 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
104 	BPF_EXIT_INSN(),
105 	},
106 	.fixup_map_array_48b = { 1 },
107 	.result = REJECT,
108 	.errstr = "invalid access to map value pointer",
109 },
110 {
111 	"direct map access, write test 10",
112 	.insns = {
113 	BPF_MOV64_IMM(BPF_REG_0, 1),
114 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
115 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
116 	BPF_EXIT_INSN(),
117 	},
118 	.fixup_map_array_48b = { 1 },
119 	.result = ACCEPT,
120 	.retval = 1,
121 },
122 {
123 	"direct map access, write test 11",
124 	.insns = {
125 	BPF_MOV64_IMM(BPF_REG_0, 1),
126 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
127 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
128 	BPF_EXIT_INSN(),
129 	},
130 	.fixup_map_array_48b = { 1 },
131 	.result = REJECT,
132 	.errstr = "invalid access to map value pointer",
133 },
134 {
135 	"direct map access, write test 12",
136 	.insns = {
137 	BPF_MOV64_IMM(BPF_REG_0, 1),
138 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),
139 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
140 	BPF_EXIT_INSN(),
141 	},
142 	.fixup_map_array_48b = { 1 },
143 	.result = REJECT,
144 	.errstr = "direct value offset of 536870912 is not allowed",
145 },
146 {
147 	"direct map access, write test 13",
148 	.insns = {
149 	BPF_MOV64_IMM(BPF_REG_0, 1),
150 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),
151 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
152 	BPF_EXIT_INSN(),
153 	},
154 	.fixup_map_array_48b = { 1 },
155 	.result = REJECT,
156 	.errstr = "invalid access to map value pointer, value_size=48 off=536870911",
157 },
158 {
159 	"direct map access, write test 14",
160 	.insns = {
161 	BPF_MOV64_IMM(BPF_REG_0, 1),
162 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
163 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
164 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
165 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
166 	BPF_EXIT_INSN(),
167 	},
168 	.fixup_map_array_48b = { 1, 3 },
169 	.result = ACCEPT,
170 	.retval = 0xff,
171 },
172 {
173 	"direct map access, write test 15",
174 	.insns = {
175 	BPF_MOV64_IMM(BPF_REG_0, 1),
176 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
177 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
178 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
179 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
180 	BPF_EXIT_INSN(),
181 	},
182 	.fixup_map_array_48b = { 1, 3 },
183 	.result = ACCEPT,
184 	.retval = 0xffff,
185 },
186 {
187 	"direct map access, write test 16",
188 	.insns = {
189 	BPF_MOV64_IMM(BPF_REG_0, 1),
190 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
191 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),
192 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
193 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
194 	BPF_EXIT_INSN(),
195 	},
196 	.fixup_map_array_48b = { 1, 3 },
197 	.result = REJECT,
198 	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
199 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
200 },
201 {
202 	"direct map access, write test 17",
203 	.insns = {
204 	BPF_MOV64_IMM(BPF_REG_0, 1),
205 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
206 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
207 	BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),
208 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
209 	BPF_EXIT_INSN(),
210 	},
211 	.fixup_map_array_48b = { 1, 3 },
212 	.result = REJECT,
213 	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
214 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
215 },
216 {
217 	"direct map access, write test 18",
218 	.insns = {
219 	BPF_MOV64_IMM(BPF_REG_0, 1),
220 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
221 	BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),
222 	BPF_EXIT_INSN(),
223 	},
224 	.fixup_map_array_small = { 1 },
225 	.result = REJECT,
226 	.errstr = "R1 min value is outside of the allowed memory range",
227 },
228 {
229 	"direct map access, write test 19",
230 	.insns = {
231 	BPF_MOV64_IMM(BPF_REG_0, 1),
232 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
233 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
234 	BPF_EXIT_INSN(),
235 	},
236 	.fixup_map_array_small = { 1 },
237 	.result = ACCEPT,
238 	.retval = 1,
239 },
240 {
241 	"direct map access, write test 20",
242 	.insns = {
243 	BPF_MOV64_IMM(BPF_REG_0, 1),
244 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
245 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
246 	BPF_EXIT_INSN(),
247 	},
248 	.fixup_map_array_small = { 1 },
249 	.result = REJECT,
250 	.errstr = "invalid access to map value pointer",
251 },
252 {
253 	"direct map access, invalid insn test 1",
254 	.insns = {
255 	BPF_MOV64_IMM(BPF_REG_0, 1),
256 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),
257 	BPF_EXIT_INSN(),
258 	},
259 	.fixup_map_array_48b = { 1 },
260 	.result = REJECT,
261 	.errstr = "invalid bpf_ld_imm64 insn",
262 },
263 {
264 	"direct map access, invalid insn test 2",
265 	.insns = {
266 	BPF_MOV64_IMM(BPF_REG_0, 1),
267 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),
268 	BPF_EXIT_INSN(),
269 	},
270 	.fixup_map_array_48b = { 1 },
271 	.result = REJECT,
272 	.errstr = "BPF_LD_IMM64 uses reserved fields",
273 },
274 {
275 	"direct map access, invalid insn test 3",
276 	.insns = {
277 	BPF_MOV64_IMM(BPF_REG_0, 1),
278 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),
279 	BPF_EXIT_INSN(),
280 	},
281 	.fixup_map_array_48b = { 1 },
282 	.result = REJECT,
283 	.errstr = "BPF_LD_IMM64 uses reserved fields",
284 },
285 {
286 	"direct map access, invalid insn test 4",
287 	.insns = {
288 	BPF_MOV64_IMM(BPF_REG_0, 1),
289 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),
290 	BPF_EXIT_INSN(),
291 	},
292 	.fixup_map_array_48b = { 1 },
293 	.result = REJECT,
294 	.errstr = "invalid bpf_ld_imm64 insn",
295 },
296 {
297 	"direct map access, invalid insn test 5",
298 	.insns = {
299 	BPF_MOV64_IMM(BPF_REG_0, 1),
300 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),
301 	BPF_EXIT_INSN(),
302 	},
303 	.fixup_map_array_48b = { 1 },
304 	.result = REJECT,
305 	.errstr = "invalid bpf_ld_imm64 insn",
306 },
307 {
308 	"direct map access, invalid insn test 6",
309 	.insns = {
310 	BPF_MOV64_IMM(BPF_REG_0, 1),
311 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
312 	BPF_EXIT_INSN(),
313 	},
314 	.fixup_map_array_48b = { 1 },
315 	.result = REJECT,
316 	.errstr = "BPF_LD_IMM64 uses reserved fields",
317 },
318 {
319 	"direct map access, invalid insn test 7",
320 	.insns = {
321 	BPF_MOV64_IMM(BPF_REG_0, 1),
322 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
323 	BPF_EXIT_INSN(),
324 	},
325 	.fixup_map_array_48b = { 1 },
326 	.result = REJECT,
327 	.errstr = "invalid bpf_ld_imm64 insn",
328 },
329 {
330 	"direct map access, invalid insn test 8",
331 	.insns = {
332 	BPF_MOV64_IMM(BPF_REG_0, 1),
333 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
334 	BPF_EXIT_INSN(),
335 	},
336 	.fixup_map_array_48b = { 1 },
337 	.result = REJECT,
338 	.errstr = "invalid bpf_ld_imm64 insn",
339 },
340 {
341 	"direct map access, invalid insn test 9",
342 	.insns = {
343 	BPF_MOV64_IMM(BPF_REG_0, 1),
344 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
345 	BPF_EXIT_INSN(),
346 	},
347 	.fixup_map_array_48b = { 1 },
348 	.result = REJECT,
349 	.errstr = "unrecognized bpf_ld_imm64 insn",
350 },
351