mirror of
https://github.com/raspberrypi/linux.git
synced 2025-12-29 05:23:37 +00:00
30ea1c5352
commit 973377ffe8 upstream
In almost all cases from test_verifier that have been changed in here, we've
had an unreachable path with a load from a register which has an invalid
address on purpose. This was basically to make sure that we never walk this
path and to have the verifier complain if it would otherwise. Change it to
match on the right error for unprivileged given we now test these paths
under speculative execution.
There's one case where we match on exact # of insns_processed. Due to the
extra path, this will of course mismatch on unprivileged. Thus, restrict the
test->insn_processed check to privileged-only.
In one other case, we result in a 'pointer comparison prohibited' error. This
is similarly due to verifying an 'invalid' branch where we end up with a value
pointer on one side of the comparison.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
162 lines
3.6 KiB
C
162 lines
3.6 KiB
C
{
|
|
"dead code: start",
|
|
.insns = {
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, -4),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "R9 !read_ok",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: mid 1",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: mid 2",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
|
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 4),
|
|
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.retval = 1,
|
|
},
|
|
{
|
|
"dead code: end 1",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: end 2",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 12),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: end 3",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
|
BPF_MOV64_IMM(BPF_REG_0, 12),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, -5),
|
|
},
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: tail of main + func",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 12),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "function calls to other bpf functions are allowed for",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: tail of main + two functions",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 12),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "function calls to other bpf functions are allowed for",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: function in the middle and mid of another func",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 7),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 12),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_IMM(BPF_REG_0, 7),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 7, 1),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "function calls to other bpf functions are allowed for",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 7,
|
|
},
|
|
{
|
|
"dead code: middle of main before call",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 2),
|
|
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 2, 1),
|
|
BPF_MOV64_IMM(BPF_REG_1, 5),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "function calls to other bpf functions are allowed for",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 2,
|
|
},
|
|
{
|
|
"dead code: start of a function",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 2),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.errstr_unpriv = "function calls to other bpf functions are allowed for",
|
|
.result_unpriv = REJECT,
|
|
.result = ACCEPT,
|
|
.retval = 2,
|
|
},
|