Commit fcd36964 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

selftests/bpf: verifier/ctx converted to inline assembly 



Test verifier/ctx automatically converted to use inline assembly.

Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230421174234.2391278-6-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 37467c79

tools/testing/selftests/bpf/prog_tests/verifier.c

+2 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include "verifier_cgroup_skb.skel.h"

#include "verifier_cgroup_storage.skel.h"

#include "verifier_const_or.skel.h"

#include "verifier_ctx.skel.h"

#include "verifier_ctx_sk_msg.skel.h"

#include "verifier_direct_stack_access_wraparound.skel.h"

#include "verifier_div0.skel.h"
@@ -96,6 +97,7 @@ void test_verifier_cgroup_inv_retcode(void) { RUN(verifier_cgroup_inv_retcode) 
void test_verifier_cgroup_skb(void)           { RUN(verifier_cgroup_skb); }

void test_verifier_cgroup_storage(void)       { RUN(verifier_cgroup_storage); }

void test_verifier_const_or(void)             { RUN(verifier_const_or); }

void test_verifier_ctx(void)                  { RUN(verifier_ctx); }

void test_verifier_ctx_sk_msg(void)           { RUN(verifier_ctx_sk_msg); }

void test_verifier_direct_stack_access_wraparound(void) { RUN(verifier_direct_stack_access_wraparound); }

void test_verifier_div0(void)                 { RUN(verifier_div0); }

tools/testing/selftests/bpf/progs/verifier_ctx.c

0 → 100644
+221 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Converted from tools/testing/selftests/bpf/verifier/ctx.c */



#include <linux/bpf.h>

#include <bpf/bpf_helpers.h>

#include "bpf_misc.h"



SEC("tc")

__description("context stores via BPF_ATOMIC")

__failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")

__naked void context_stores_via_bpf_atomic(void)

{

	asm volatile ("					\

	r0 = 0;						\

	lock *(u32 *)(r1 + %[__sk_buff_mark]) += w0;	\

	exit;						\

"	:

	: __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))

	: __clobber_all);

}



SEC("tc")

__description("arithmetic ops make PTR_TO_CTX unusable")

__failure __msg("dereference of modified ctx ptr")

__naked void make_ptr_to_ctx_unusable(void)

{

	asm volatile ("					\

	r1 += %[__imm_0];				\

	r0 = *(u32*)(r1 + %[__sk_buff_mark]);		\

	exit;						\

"	:

	: __imm_const(__imm_0,

		      offsetof(struct __sk_buff, data) - offsetof(struct __sk_buff, mark)),

	  __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))

	: __clobber_all);

}



SEC("tc")

__description("pass unmodified ctx pointer to helper")

__success __retval(0)

__naked void unmodified_ctx_pointer_to_helper(void)

{

	asm volatile ("					\

	r2 = 0;						\

	call %[bpf_csum_update];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_csum_update)

	: __clobber_all);

}



SEC("tc")

__description("pass modified ctx pointer to helper, 1")

__failure __msg("negative offset ctx ptr R1 off=-612 disallowed")

__naked void ctx_pointer_to_helper_1(void)

{

	asm volatile ("					\

	r1 += -612;					\

	r2 = 0;						\

	call %[bpf_csum_update];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_csum_update)

	: __clobber_all);

}



SEC("socket")

__description("pass modified ctx pointer to helper, 2")

__failure __msg("negative offset ctx ptr R1 off=-612 disallowed")

__failure_unpriv __msg_unpriv("negative offset ctx ptr R1 off=-612 disallowed")

__naked void ctx_pointer_to_helper_2(void)

{

	asm volatile ("					\

	r1 += -612;					\

	call %[bpf_get_socket_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_socket_cookie)

	: __clobber_all);

}



SEC("tc")

__description("pass modified ctx pointer to helper, 3")

__failure __msg("variable ctx access var_off=(0x0; 0x4)")

__naked void ctx_pointer_to_helper_3(void)

{

	asm volatile ("					\

	r3 = *(u32*)(r1 + 0);				\

	r3 &= 4;					\

	r1 += r3;					\

	r2 = 0;						\

	call %[bpf_csum_update];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_csum_update)

	: __clobber_all);

}



SEC("cgroup/sendmsg6")

__description("pass ctx or null check, 1: ctx")

__success

__naked void or_null_check_1_ctx(void)

{

	asm volatile ("					\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/sendmsg6")

__description("pass ctx or null check, 2: null")

__success

__naked void or_null_check_2_null(void)

{

	asm volatile ("					\

	r1 = 0;						\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/sendmsg6")

__description("pass ctx or null check, 3: 1")

__failure __msg("R1 type=scalar expected=ctx")

__naked void or_null_check_3_1(void)

{

	asm volatile ("					\

	r1 = 1;						\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/sendmsg6")

__description("pass ctx or null check, 4: ctx - const")

__failure __msg("negative offset ctx ptr R1 off=-612 disallowed")

__naked void null_check_4_ctx_const(void)

{

	asm volatile ("					\

	r1 += -612;					\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/connect4")

__description("pass ctx or null check, 5: null (connect)")

__success

__naked void null_check_5_null_connect(void)

{

	asm volatile ("					\

	r1 = 0;						\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/post_bind4")

__description("pass ctx or null check, 6: null (bind)")

__success

__naked void null_check_6_null_bind(void)

{

	asm volatile ("					\

	r1 = 0;						\

	call %[bpf_get_netns_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_netns_cookie)

	: __clobber_all);

}



SEC("cgroup/post_bind4")

__description("pass ctx or null check, 7: ctx (bind)")

__success

__naked void null_check_7_ctx_bind(void)

{

	asm volatile ("					\

	call %[bpf_get_socket_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_socket_cookie)

	: __clobber_all);

}



SEC("cgroup/post_bind4")

__description("pass ctx or null check, 8: null (bind)")

__failure __msg("R1 type=scalar expected=ctx")

__naked void null_check_8_null_bind(void)

{

	asm volatile ("					\

	r1 = 0;						\

	call %[bpf_get_socket_cookie];			\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_socket_cookie)

	: __clobber_all);

}



char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/verifier/ctx.c

deleted100644 → 0
+0 −186
Original line number Diff line number Diff line 
{

	"context stores via BPF_ATOMIC",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_ATOMIC_OP(BPF_W, BPF_ADD, BPF_REG_1, BPF_REG_0, offsetof(struct __sk_buff, mark)),

	BPF_EXIT_INSN(),

	},

	.errstr = "BPF_ATOMIC stores into R1 ctx is not allowed",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

},

{

	"arithmetic ops make PTR_TO_CTX unusable",

	.insns = {

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,

			      offsetof(struct __sk_buff, data) -

			      offsetof(struct __sk_buff, mark)),

		BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

			    offsetof(struct __sk_buff, mark)),

		BPF_EXIT_INSN(),

	},

	.errstr = "dereference of modified ctx ptr",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

},

{

	"pass unmodified ctx pointer to helper",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_2, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_csum_update),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = ACCEPT,

},

{

	"pass modified ctx pointer to helper, 1",

	.insns = {

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),

		BPF_MOV64_IMM(BPF_REG_2, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_csum_update),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = REJECT,

	.errstr = "negative offset ctx ptr R1 off=-612 disallowed",

},

{

	"pass modified ctx pointer to helper, 2",

	.insns = {

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_socket_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.result_unpriv = REJECT,

	.result = REJECT,

	.errstr_unpriv = "negative offset ctx ptr R1 off=-612 disallowed",

	.errstr = "negative offset ctx ptr R1 off=-612 disallowed",

},

{

	"pass modified ctx pointer to helper, 3",

	.insns = {

		BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),

		BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),

		BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),

		BPF_MOV64_IMM(BPF_REG_2, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_csum_update),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = REJECT,

	.errstr = "variable ctx access var_off=(0x0; 0x4)",

},

{

	"pass ctx or null check, 1: ctx",

	.insns = {

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR,

	.expected_attach_type = BPF_CGROUP_UDP6_SENDMSG,

	.result = ACCEPT,

},

{

	"pass ctx or null check, 2: null",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_1, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR,

	.expected_attach_type = BPF_CGROUP_UDP6_SENDMSG,

	.result = ACCEPT,

},

{

	"pass ctx or null check, 3: 1",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_1, 1),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR,

	.expected_attach_type = BPF_CGROUP_UDP6_SENDMSG,

	.result = REJECT,

	.errstr = "R1 type=scalar expected=ctx",

},

{

	"pass ctx or null check, 4: ctx - const",

	.insns = {

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR,

	.expected_attach_type = BPF_CGROUP_UDP6_SENDMSG,

	.result = REJECT,

	.errstr = "negative offset ctx ptr R1 off=-612 disallowed",

},

{

	"pass ctx or null check, 5: null (connect)",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_1, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK_ADDR,

	.expected_attach_type = BPF_CGROUP_INET4_CONNECT,

	.result = ACCEPT,

},

{

	"pass ctx or null check, 6: null (bind)",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_1, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_netns_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,

	.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

	.result = ACCEPT,

},

{

	"pass ctx or null check, 7: ctx (bind)",

	.insns = {

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_socket_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,

	.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

	.result = ACCEPT,

},

{

	"pass ctx or null check, 8: null (bind)",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_1, 0),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_socket_cookie),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,

	.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

	.result = REJECT,

	.errstr = "R1 type=scalar expected=ctx",

},