tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c
Extension
.c
Size
34769 bytes
Lines
1440
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

struct test_val {
	unsigned int index;
	int foo[MAX_ENTRIES];
};

struct {
	__uint(type, BPF_MAP_TYPE_ARRAY);
	__uint(max_entries, 1);
	__type(key, int);
	__type(value, struct test_val);
} map_array_48b SEC(".maps");

struct other_val {
	long long foo;
	long long bar;
};

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1);
	__type(key, long long);
	__type(value, struct other_val);
} map_hash_16b SEC(".maps");

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1);
	__type(key, long long);
	__type(value, struct test_val);
} map_hash_48b SEC(".maps");

SEC("socket")
__description("map access: known scalar += value_ptr unknown vs const")
__success __failure_unpriv
__msg_unpriv("R1 tried to add from different maps, paths or scalars")
__retval(1)
__naked void value_ptr_unknown_vs_const(void)
{
	asm volatile ("					\
	r0 = *(u32*)(r1 + %[__sk_buff_len]);		\
	r1 = 0;						\
	*(u64*)(r10 - 8) = r1;				\
	r2 = r10;					\
	r2 += -8;					\
	if r0 == 1 goto l0_%=;				\
	r1 = %[map_hash_16b] ll;			\
	if r0 != 1 goto l1_%=;				\
l0_%=:	r1 = %[map_array_48b] ll;			\
l1_%=:	call %[bpf_map_lookup_elem];			\
	if r0 == 0 goto l2_%=;				\
	r4 = *(u8*)(r0 + 0);				\
	if r4 == 1 goto l3_%=;				\
	r1 = 6;						\
	r1 = -r1;					\
	r1 &= 0x7;					\
	goto l4_%=;					\
l3_%=:	r1 = 3;						\
l4_%=:	r1 += r0;					\
	r0 = *(u8*)(r1 + 0);				\
l2_%=:	r0 = 1;						\
	exit;						\
"	:
	: __imm(bpf_map_lookup_elem),
	  __imm_addr(map_array_48b),
	  __imm_addr(map_hash_16b),
	  __imm_const(__sk_buff_len, offsetof(struct __sk_buff, len))
	: __clobber_all);
}

SEC("socket")
__description("map access: known scalar += value_ptr const vs unknown")
__success __failure_unpriv
__msg_unpriv("R1 tried to add from different maps, paths or scalars")
__retval(1)
__naked void value_ptr_const_vs_unknown(void)
{
	asm volatile ("					\
	r0 = *(u32*)(r1 + %[__sk_buff_len]);		\
	r1 = 0;						\
	*(u64*)(r10 - 8) = r1;				\
	r2 = r10;					\
	r2 += -8;					\
	if r0 == 1 goto l0_%=;				\
	r1 = %[map_hash_16b] ll;			\
	if r0 != 1 goto l1_%=;				\
l0_%=:	r1 = %[map_array_48b] ll;			\
l1_%=:	call %[bpf_map_lookup_elem];			\
	if r0 == 0 goto l2_%=;				\
	r4 = *(u8*)(r0 + 0);				\
	if r4 == 1 goto l3_%=;				\

Annotation

Implementation Notes