selftests/bpf: Add test cases to assert proper ID tracking on spill
The previous commit fixed a verifier bypass by ensuring that ID is not preserved on narrowing spills. Add the test cases to check the problematic patterns. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20230607123951.558971-3-maxtram95@gmail.com
This commit is contained in:
parent
713274f1f2
commit
f57ade27fc
|
@ -371,4 +371,83 @@ __naked void and_then_at_fp_8(void)
|
||||||
" ::: __clobber_all);
|
" ::: __clobber_all);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
SEC("xdp")
|
||||||
|
__description("32-bit spill of 64-bit reg should clear ID")
|
||||||
|
__failure __msg("math between ctx pointer and 4294967295 is not allowed")
|
||||||
|
__naked void spill_32bit_of_64bit_fail(void)
|
||||||
|
{
|
||||||
|
asm volatile (" \
|
||||||
|
r6 = r1; \
|
||||||
|
/* Roll one bit to force the verifier to track both branches. */\
|
||||||
|
call %[bpf_get_prandom_u32]; \
|
||||||
|
r0 &= 0x8; \
|
||||||
|
/* Put a large number into r1. */ \
|
||||||
|
r1 = 0xffffffff; \
|
||||||
|
r1 <<= 32; \
|
||||||
|
r1 += r0; \
|
||||||
|
/* Assign an ID to r1. */ \
|
||||||
|
r2 = r1; \
|
||||||
|
/* 32-bit spill r1 to stack - should clear the ID! */\
|
||||||
|
*(u32*)(r10 - 8) = r1; \
|
||||||
|
/* 32-bit fill r2 from stack. */ \
|
||||||
|
r2 = *(u32*)(r10 - 8); \
|
||||||
|
/* Compare r2 with another register to trigger find_equal_scalars.\
|
||||||
|
* Having one random bit is important here, otherwise the verifier cuts\
|
||||||
|
* the corners. If the ID was mistakenly preserved on spill, this would\
|
||||||
|
* cause the verifier to think that r1 is also equal to zero in one of\
|
||||||
|
* the branches, and equal to eight on the other branch.\
|
||||||
|
*/ \
|
||||||
|
r3 = 0; \
|
||||||
|
if r2 != r3 goto l0_%=; \
|
||||||
|
l0_%=: r1 >>= 32; \
|
||||||
|
/* At this point, if the verifier thinks that r1 is 0, an out-of-bounds\
|
||||||
|
* read will happen, because it actually contains 0xffffffff.\
|
||||||
|
*/ \
|
||||||
|
r6 += r1; \
|
||||||
|
r0 = *(u32*)(r6 + 0); \
|
||||||
|
exit; \
|
||||||
|
" :
|
||||||
|
: __imm(bpf_get_prandom_u32)
|
||||||
|
: __clobber_all);
|
||||||
|
}
|
||||||
|
|
||||||
|
SEC("xdp")
|
||||||
|
__description("16-bit spill of 32-bit reg should clear ID")
|
||||||
|
__failure __msg("dereference of modified ctx ptr R6 off=65535 disallowed")
|
||||||
|
__naked void spill_16bit_of_32bit_fail(void)
|
||||||
|
{
|
||||||
|
asm volatile (" \
|
||||||
|
r6 = r1; \
|
||||||
|
/* Roll one bit to force the verifier to track both branches. */\
|
||||||
|
call %[bpf_get_prandom_u32]; \
|
||||||
|
r0 &= 0x8; \
|
||||||
|
/* Put a large number into r1. */ \
|
||||||
|
w1 = 0xffff0000; \
|
||||||
|
r1 += r0; \
|
||||||
|
/* Assign an ID to r1. */ \
|
||||||
|
r2 = r1; \
|
||||||
|
/* 16-bit spill r1 to stack - should clear the ID! */\
|
||||||
|
*(u16*)(r10 - 8) = r1; \
|
||||||
|
/* 16-bit fill r2 from stack. */ \
|
||||||
|
r2 = *(u16*)(r10 - 8); \
|
||||||
|
/* Compare r2 with another register to trigger find_equal_scalars.\
|
||||||
|
* Having one random bit is important here, otherwise the verifier cuts\
|
||||||
|
* the corners. If the ID was mistakenly preserved on spill, this would\
|
||||||
|
* cause the verifier to think that r1 is also equal to zero in one of\
|
||||||
|
* the branches, and equal to eight on the other branch.\
|
||||||
|
*/ \
|
||||||
|
r3 = 0; \
|
||||||
|
if r2 != r3 goto l0_%=; \
|
||||||
|
l0_%=: r1 >>= 16; \
|
||||||
|
/* At this point, if the verifier thinks that r1 is 0, an out-of-bounds\
|
||||||
|
* read will happen, because it actually contains 0xffff.\
|
||||||
|
*/ \
|
||||||
|
r6 += r1; \
|
||||||
|
r0 = *(u32*)(r6 + 0); \
|
||||||
|
exit; \
|
||||||
|
" :
|
||||||
|
: __imm(bpf_get_prandom_u32)
|
||||||
|
: __clobber_all);
|
||||||
|
}
|
||||||
|
|
||||||
char _license[] SEC("license") = "GPL";
|
char _license[] SEC("license") = "GPL";
|
||||||
|
|
Loading…
Reference in New Issue