tools/testing/selftests/bpf/progs/verifier_stack_ptr.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/bpf/progs/verifier_stack_ptr.c

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/bpf/progs/verifier_stack_ptr.c
Extension
.c
Size
11942 bytes
Lines
537
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

struct test_val {
	unsigned int index;
	int foo[MAX_ENTRIES];
};

struct {
	__uint(type, BPF_MAP_TYPE_ARRAY);
	__uint(max_entries, 1);
	__type(key, int);
	__type(value, struct test_val);
} map_array_48b SEC(".maps");

SEC("socket")
__description("PTR_TO_STACK store/load")
__success __success_unpriv __retval(0xfaceb00c)
__naked void ptr_to_stack_store_load(void)
{
	asm volatile ("					\
	r1 = r10;					\
	r1 += -10;					\
	r0 = 0xfaceb00c;				\
	*(u64*)(r1 + 2) = r0;				\
	r0 = *(u64*)(r1 + 2);				\
	exit;						\
"	::: __clobber_all);
}

SEC("socket")
__description("PTR_TO_STACK store/load - bad alignment on off")
__failure __msg("misaligned stack access off -8+2 size 8")
__failure_unpriv
__naked void load_bad_alignment_on_off(void)
{
	asm volatile ("					\
	r1 = r10;					\
	r1 += -8;					\
	r0 = 0xfaceb00c;				\
	*(u64*)(r1 + 2) = r0;				\
	r0 = *(u64*)(r1 + 2);				\
	exit;						\
"	::: __clobber_all);
}

SEC("socket")
__description("PTR_TO_STACK store/load - bad alignment on reg")
__failure __msg("misaligned stack access off -10+8 size 8")
__failure_unpriv
__naked void load_bad_alignment_on_reg(void)
{
	asm volatile ("					\
	r1 = r10;					\
	r1 += -10;					\
	r0 = 0xfaceb00c;				\
	*(u64*)(r1 + 8) = r0;				\
	r0 = *(u64*)(r1 + 8);				\
	exit;						\
"	::: __clobber_all);
}

SEC("socket")
__description("PTR_TO_STACK store/load - out of bounds low")
__failure __msg("invalid write to stack R1 off=-79992 size=8")
__msg_unpriv("R1 stack pointer arithmetic goes out of range")
__naked void load_out_of_bounds_low(void)
{
	asm volatile ("					\
	r1 = r10;					\
	r1 += -80000;					\
	r0 = 0xfaceb00c;				\
	*(u64*)(r1 + 8) = r0;				\
	r0 = *(u64*)(r1 + 8);				\
	exit;						\
"	::: __clobber_all);
}

SEC("socket")
__description("PTR_TO_STACK store/load - out of bounds high")
__failure __msg("invalid write to stack R1 off=0 size=8")
__failure_unpriv
__naked void load_out_of_bounds_high(void)
{
	asm volatile ("					\
	r1 = r10;					\
	r1 += -8;					\
	r0 = 0xfaceb00c;				\
	*(u64*)(r1 + 8) = r0;				\
	r0 = *(u64*)(r1 + 8);				\
	exit;						\
"	::: __clobber_all);
}

Annotation

Implementation Notes