1// SPDX-License-Identifier: GPL-2.0
2/* Converted from tools/testing/selftests/bpf/verifier/bounds_deduction.c */
3
4#include <linux/bpf.h>
5#include <bpf/bpf_helpers.h>
6#include "bpf_misc.h"
7
8SEC("socket")
9__description("check deducing bounds from const, 1")
10__failure __msg("R0 tried to subtract pointer from scalar")
11__msg_unpriv("R1 has pointer with unsupported alu operation")
12__naked void deducing_bounds_from_const_1(void)
13{
14 asm volatile (" \
15 r0 = 1; \
16 if r0 s>= 1 goto l0_%=; \
17l0_%=: r0 -= r1; \
18 exit; \
19" ::: __clobber_all);
20}
21
22SEC("socket")
23__description("check deducing bounds from const, 2")
24__success __failure_unpriv
25__msg_unpriv("R1 has pointer with unsupported alu operation")
26__retval(1)
27__naked void deducing_bounds_from_const_2(void)
28{
29 asm volatile (" \
30 r0 = 1; \
31 if r0 s>= 1 goto l0_%=; \
32 exit; \
33l0_%=: if r0 s<= 1 goto l1_%=; \
34 exit; \
35l1_%=: r1 -= r0; \
36 exit; \
37" ::: __clobber_all);
38}
39
40SEC("socket")
41__description("check deducing bounds from const, 3")
42__failure __msg("R0 tried to subtract pointer from scalar")
43__msg_unpriv("R1 has pointer with unsupported alu operation")
44__naked void deducing_bounds_from_const_3(void)
45{
46 asm volatile (" \
47 r0 = 0; \
48 if r0 s<= 0 goto l0_%=; \
49l0_%=: r0 -= r1; \
50 exit; \
51" ::: __clobber_all);
52}
53
54SEC("socket")
55__description("check deducing bounds from const, 4")
56__success __failure_unpriv
57__msg_unpriv("R6 has pointer with unsupported alu operation")
58__retval(0)
59__naked void deducing_bounds_from_const_4(void)
60{
61 asm volatile (" \
62 r6 = r1; \
63 r0 = 0; \
64 if r0 s<= 0 goto l0_%=; \
65 exit; \
66l0_%=: if r0 s>= 0 goto l1_%=; \
67 exit; \
68l1_%=: r6 -= r0; \
69 exit; \
70" ::: __clobber_all);
71}
72
73SEC("socket")
74__description("check deducing bounds from const, 5")
75__failure __msg("R0 tried to subtract pointer from scalar")
76__msg_unpriv("R1 has pointer with unsupported alu operation")
77__naked void deducing_bounds_from_const_5(void)
78{
79 asm volatile (" \
80 r0 = 0; \
81 if r0 s>= 1 goto l0_%=; \
82 r0 -= r1; \
83l0_%=: exit; \
84" ::: __clobber_all);
85}
86
87SEC("socket")
88__description("check deducing bounds from const, 6")
89__failure __msg("R0 tried to subtract pointer from scalar")
90__msg_unpriv("R1 has pointer with unsupported alu operation")
91__naked void deducing_bounds_from_const_6(void)
92{
93 asm volatile (" \
94 r0 = 0; \
95 if r0 s>= 0 goto l0_%=; \
96 exit; \
97l0_%=: r0 -= r1; \
98 exit; \
99" ::: __clobber_all);
100}
101
102SEC("socket")
103__description("check deducing bounds from const, 7")
104__failure __msg("dereference of modified ctx ptr")
105__msg_unpriv("R1 has pointer with unsupported alu operation")
106__flag(BPF_F_ANY_ALIGNMENT)
107__naked void deducing_bounds_from_const_7(void)
108{
109 asm volatile (" \
110 r0 = %[__imm_0]; \
111 if r0 s>= 0 goto l0_%=; \
112l0_%=: r1 -= r0; \
113 r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
114 exit; \
115" :
116 : __imm_const(__imm_0, ~0),
117 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
118 : __clobber_all);
119}
120
121SEC("socket")
122__description("check deducing bounds from const, 8")
123__failure __msg("negative offset ctx ptr R1 off=-1 disallowed")
124__msg_unpriv("R1 has pointer with unsupported alu operation")
125__flag(BPF_F_ANY_ALIGNMENT)
126__naked void deducing_bounds_from_const_8(void)
127{
128 asm volatile (" \
129 r0 = %[__imm_0]; \
130 if r0 s>= 0 goto l0_%=; \
131 r1 += r0; \
132l0_%=: r0 = *(u32*)(r1 + %[__sk_buff_mark]); \
133 exit; \
134" :
135 : __imm_const(__imm_0, ~0),
136 __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
137 : __clobber_all);
138}
139
140SEC("socket")
141__description("check deducing bounds from const, 9")
142__failure __msg("R0 tried to subtract pointer from scalar")
143__msg_unpriv("R1 has pointer with unsupported alu operation")
144__naked void deducing_bounds_from_const_9(void)
145{
146 asm volatile (" \
147 r0 = 0; \
148 if r0 s>= 0 goto l0_%=; \
149l0_%=: r0 -= r1; \
150 exit; \
151" ::: __clobber_all);
152}
153
154SEC("socket")
155__description("check deducing bounds from const, 10")
156__failure
157__msg("math between ctx pointer and register with unbounded min value is not allowed")
158__failure_unpriv
159__naked void deducing_bounds_from_const_10(void)
160{
161 asm volatile (" \
162 r0 = 0; \
163 if r0 s<= 0 goto l0_%=; \
164l0_%=: /* Marks reg as unknown. */ \
165 r0 = -r0; \
166 r0 -= r1; \
167 exit; \
168" ::: __clobber_all);
169}
170
171char _license[] SEC("license") = "GPL";
172

source code of linux/tools/testing/selftests/bpf/progs/verifier_bounds_deduction.c