1 {
2 "valid cgroup storage access",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_2, 0),
5 BPF_LD_MAP_FD(BPF_REG_1, 0),
6 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
7 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
8 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
10 BPF_EXIT_INSN(),
11 },
12 .fixup_cgroup_storage = { 1 },
13 .result = ACCEPT,
14 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
15 },
16 {
17 "invalid cgroup storage access 1",
18 .insns = {
19 BPF_MOV64_IMM(BPF_REG_2, 0),
20 BPF_LD_MAP_FD(BPF_REG_1, 0),
21 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
22 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
23 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
24 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
25 BPF_EXIT_INSN(),
26 },
27 .fixup_map_hash_8b = { 1 },
28 .result = REJECT,
29 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
30 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
31 },
32 {
33 "invalid cgroup storage access 2",
34 .insns = {
35 BPF_MOV64_IMM(BPF_REG_2, 0),
36 BPF_LD_MAP_FD(BPF_REG_1, 1),
37 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
38 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
39 BPF_EXIT_INSN(),
40 },
41 .result = REJECT,
42 .errstr = "fd 1 is not pointing to valid bpf_map",
43 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
44 },
45 {
46 "invalid cgroup storage access 3",
47 .insns = {
48 BPF_MOV64_IMM(BPF_REG_2, 0),
49 BPF_LD_MAP_FD(BPF_REG_1, 0),
50 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
51 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
52 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
53 BPF_MOV64_IMM(BPF_REG_0, 0),
54 BPF_EXIT_INSN(),
55 },
56 .fixup_cgroup_storage = { 1 },
57 .result = REJECT,
58 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
59 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
60 },
61 {
62 "invalid cgroup storage access 4",
63 .insns = {
64 BPF_MOV64_IMM(BPF_REG_2, 0),
65 BPF_LD_MAP_FD(BPF_REG_1, 0),
66 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
67 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
68 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
69 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
70 BPF_EXIT_INSN(),
71 },
72 .fixup_cgroup_storage = { 1 },
73 .result = REJECT,
74 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
75 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
76 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
77 },
78 {
79 "invalid cgroup storage access 5",
80 .insns = {
81 BPF_MOV64_IMM(BPF_REG_2, 7),
82 BPF_LD_MAP_FD(BPF_REG_1, 0),
83 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
84 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
85 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
86 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
87 BPF_EXIT_INSN(),
88 },
89 .fixup_cgroup_storage = { 1 },
90 .result = REJECT,
91 .errstr = "get_local_storage() doesn't support non-zero flags",
92 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
93 },
94 {
95 "invalid cgroup storage access 6",
96 .insns = {
97 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
98 BPF_LD_MAP_FD(BPF_REG_1, 0),
99 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
100 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
101 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
102 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
103 BPF_EXIT_INSN(),
104 },
105 .fixup_cgroup_storage = { 1 },
106 .result = REJECT,
107 .errstr = "get_local_storage() doesn't support non-zero flags",
108 .errstr_unpriv = "R2 leaks addr into helper function",
109 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
110 },
111 {
112 "valid per-cpu cgroup storage access",
113 .insns = {
114 BPF_MOV64_IMM(BPF_REG_2, 0),
115 BPF_LD_MAP_FD(BPF_REG_1, 0),
116 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
117 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
118 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
119 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
120 BPF_EXIT_INSN(),
121 },
122 .fixup_percpu_cgroup_storage = { 1 },
123 .result = ACCEPT,
124 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
125 },
126 {
127 "invalid per-cpu cgroup storage access 1",
128 .insns = {
129 BPF_MOV64_IMM(BPF_REG_2, 0),
130 BPF_LD_MAP_FD(BPF_REG_1, 0),
131 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
132 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
133 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
134 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
135 BPF_EXIT_INSN(),
136 },
137 .fixup_map_hash_8b = { 1 },
138 .result = REJECT,
139 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
140 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
141 },
142 {
143 "invalid per-cpu cgroup storage access 2",
144 .insns = {
145 BPF_MOV64_IMM(BPF_REG_2, 0),
146 BPF_LD_MAP_FD(BPF_REG_1, 1),
147 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
148 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
149 BPF_EXIT_INSN(),
150 },
151 .result = REJECT,
152 .errstr = "fd 1 is not pointing to valid bpf_map",
153 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
154 },
155 {
156 "invalid per-cpu cgroup storage access 3",
157 .insns = {
158 BPF_MOV64_IMM(BPF_REG_2, 0),
159 BPF_LD_MAP_FD(BPF_REG_1, 0),
160 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
161 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
162 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
163 BPF_MOV64_IMM(BPF_REG_0, 0),
164 BPF_EXIT_INSN(),
165 },
166 .fixup_percpu_cgroup_storage = { 1 },
167 .result = REJECT,
168 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
169 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
170 },
171 {
172 "invalid per-cpu cgroup storage access 4",
173 .insns = {
174 BPF_MOV64_IMM(BPF_REG_2, 0),
175 BPF_LD_MAP_FD(BPF_REG_1, 0),
176 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
177 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
178 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
179 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
180 BPF_EXIT_INSN(),
181 },
182 .fixup_cgroup_storage = { 1 },
183 .result = REJECT,
184 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
185 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
186 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
187 },
188 {
189 "invalid per-cpu cgroup storage access 5",
190 .insns = {
191 BPF_MOV64_IMM(BPF_REG_2, 7),
192 BPF_LD_MAP_FD(BPF_REG_1, 0),
193 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
194 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
195 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
196 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
197 BPF_EXIT_INSN(),
198 },
199 .fixup_percpu_cgroup_storage = { 1 },
200 .result = REJECT,
201 .errstr = "get_local_storage() doesn't support non-zero flags",
202 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
203 },
204 {
205 "invalid per-cpu cgroup storage access 6",
206 .insns = {
207 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
208 BPF_LD_MAP_FD(BPF_REG_1, 0),
209 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
210 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
211 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
212 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
213 BPF_EXIT_INSN(),
214 },
215 .fixup_percpu_cgroup_storage = { 1 },
216 .result = REJECT,
217 .errstr = "get_local_storage() doesn't support non-zero flags",
218 .errstr_unpriv = "R2 leaks addr into helper function",
219 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
220 },