tools/testing/selftests/bpf/progs/verifier_var_off.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/bpf/progs/verifier_var_off.c

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/bpf/progs/verifier_var_off.c
Extension
.c
Size
12532 bytes
Lines
419
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

// SPDX-License-Identifier: GPL-2.0
/* Converted from tools/testing/selftests/bpf/verifier/var_off.c */

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1);
	__type(key, long long);
	__type(value, long long);
} map_hash_8b SEC(".maps");

SEC("lwt_in")
__description("variable-offset ctx access")
__failure __msg("variable ctx access var_off=(0x0; 0x4)")
__naked void variable_offset_ctx_access(void)
{
	asm volatile ("					\
	/* Get an unknown value */			\
	r2 = *(u32*)(r1 + 0);				\
	/* Make it small and 4-byte aligned */		\
	r2 &= 4;					\
	/* add it to skb.  We now have either &skb->len or\
	 * &skb->pkt_type, but we don't know which	\
	 */						\
	r1 += r2;					\
	/* dereference it */				\
	r0 = *(u32*)(r1 + 0);				\
	exit;						\
"	::: __clobber_all);
}

SEC("cgroup/skb")
__description("variable-offset stack read, priv vs unpriv")
__success __failure_unpriv
__msg_unpriv("R2 variable stack access prohibited for !root")
__retval(0)
__naked void stack_read_priv_vs_unpriv(void)
{
	asm volatile ("					\
	/* Fill the top 8 bytes of the stack */		\
	r0 = 0;						\
	*(u64*)(r10 - 8) = r0;				\
	/* Get an unknown value */			\
	r2 = *(u32*)(r1 + 0);				\
	/* Make it small and 4-byte aligned */		\
	r2 &= 4;					\
	r2 -= 8;					\
	/* add it to fp.  We now have either fp-4 or fp-8, but\
	 * we don't know which				\
	 */						\
	r2 += r10;					\
	/* dereference it for a stack read */		\
	r0 = *(u32*)(r2 + 0);				\
	r0 = 0;						\
	exit;						\
"	::: __clobber_all);
}

SEC("cgroup/skb")
__description("variable-offset stack read, uninitialized")
__success
__failure_unpriv __msg_unpriv("R2 variable stack access prohibited for !root")
__naked void variable_offset_stack_read_uninitialized(void)
{
	asm volatile ("					\
	/* Get an unknown value */			\
	r2 = *(u32*)(r1 + 0);				\
	/* Make it small and 4-byte aligned */		\
	r2 &= 4;					\
	r2 -= 8;					\
	/* add it to fp.  We now have either fp-4 or fp-8, but\
	 * we don't know which				\
	 */						\
	r2 += r10;					\
	/* dereference it for a stack read */		\
	r0 = *(u32*)(r2 + 0);				\
	r0 = 0;						\
	exit;						\
"	::: __clobber_all);
}

SEC("socket")
__description("variable-offset stack write, priv vs unpriv")
__success
/* Check that the maximum stack depth is correctly maintained according to the
 * maximum possible variable offset.
 */

Annotation

Implementation Notes