mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-31 16:38:12 +00:00
8b08807d03
test_global_func9 - check valid pointer's scenarios
test_global_func10 - check that a smaller type cannot be passed as a
larger one
test_global_func11 - check that CTX pointer cannot be passed
test_global_func12 - check access to a null pointer
test_global_func13 - check access to an arbitrary pointer value
test_global_func14 - check that an opaque pointer cannot be passed
test_global_func15 - check that a variable has an unknown value after
it was passed to a global function by pointer
test_global_func16 - check access to uninitialized stack memory
test_global_func_args - check read and write operations through a pointer
Signed-off-by: Dmitrii Banshchikov <me@ubique.spb.ru>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210212205642.620788-5-me@ubique.spb.ru
132 lines
1.5 KiB
C
132 lines
1.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
#include <stddef.h>
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
|
|
struct S {
|
|
int x;
|
|
};
|
|
|
|
struct C {
|
|
int x;
|
|
int y;
|
|
};
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, struct S);
|
|
} map SEC(".maps");
|
|
|
|
enum E {
|
|
E_ITEM
|
|
};
|
|
|
|
static int global_data_x = 100;
|
|
static int volatile global_data_y = 500;
|
|
|
|
__noinline int foo(const struct S *s)
|
|
{
|
|
if (s)
|
|
return bpf_get_prandom_u32() < s->x;
|
|
|
|
return 0;
|
|
}
|
|
|
|
__noinline int bar(int *x)
|
|
{
|
|
if (x)
|
|
*x &= bpf_get_prandom_u32();
|
|
|
|
return 0;
|
|
}
|
|
__noinline int baz(volatile int *x)
|
|
{
|
|
if (x)
|
|
*x &= bpf_get_prandom_u32();
|
|
|
|
return 0;
|
|
}
|
|
|
|
__noinline int qux(enum E *e)
|
|
{
|
|
if (e)
|
|
return *e;
|
|
|
|
return 0;
|
|
}
|
|
|
|
__noinline int quux(int (*arr)[10])
|
|
{
|
|
if (arr)
|
|
return (*arr)[9];
|
|
|
|
return 0;
|
|
}
|
|
|
|
__noinline int quuz(int **p)
|
|
{
|
|
if (p)
|
|
*p = NULL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
SEC("cgroup_skb/ingress")
|
|
int test_cls(struct __sk_buff *skb)
|
|
{
|
|
int result = 0;
|
|
|
|
{
|
|
const struct S s = {.x = skb->len };
|
|
|
|
result |= foo(&s);
|
|
}
|
|
|
|
{
|
|
const __u32 key = 1;
|
|
const struct S *s = bpf_map_lookup_elem(&map, &key);
|
|
|
|
result |= foo(s);
|
|
}
|
|
|
|
{
|
|
const struct C c = {.x = skb->len, .y = skb->family };
|
|
|
|
result |= foo((const struct S *)&c);
|
|
}
|
|
|
|
{
|
|
result |= foo(NULL);
|
|
}
|
|
|
|
{
|
|
bar(&result);
|
|
bar(&global_data_x);
|
|
}
|
|
|
|
{
|
|
result |= baz(&global_data_y);
|
|
}
|
|
|
|
{
|
|
enum E e = E_ITEM;
|
|
|
|
result |= qux(&e);
|
|
}
|
|
|
|
{
|
|
int array[10] = {0};
|
|
|
|
result |= quux(&array);
|
|
}
|
|
|
|
{
|
|
int *p;
|
|
|
|
result |= quuz(&p);
|
|
}
|
|
|
|
return result ? 1 : 0;
|
|
}
|