diff options
| author | Jiri Kosina <jkosina@suse.cz> | 2022-01-10 09:56:57 +0100 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2022-01-10 09:56:57 +0100 |
| commit | 3551a3ff8229e15d2a4b47b8234923bc72da65ef (patch) | |
| tree | a62465753397b0268529a5d0b9ab43a8840069ad /tools/testing/selftests/bpf/verifier/value_ptr_arith.c | |
| parent | 906095af85e8b2e53ee9f8c50b3dff365aa09df8 (diff) | |
| parent | 33a5c2793451770cb6dcf0cc35c76cfd4b045513 (diff) | |
| download | linux-3551a3ff8229e15d2a4b47b8234923bc72da65ef.tar.gz linux-3551a3ff8229e15d2a4b47b8234923bc72da65ef.tar.bz2 linux-3551a3ff8229e15d2a4b47b8234923bc72da65ef.zip | |
Merge branch 'for-5.17/letsketch' into for-linus
- new driver to support for LetSketch device (Hans de Goede)
Diffstat (limited to 'tools/testing/selftests/bpf/verifier/value_ptr_arith.c')
| -rw-r--r-- | tools/testing/selftests/bpf/verifier/value_ptr_arith.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c index 2debba4e8a3a..4d347bc53aa2 100644 --- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c @@ -1078,6 +1078,29 @@ .errstr_unpriv = "R0 pointer -= pointer prohibited", }, { + "map access: trying to leak tained dst reg", + .insns = { + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), + BPF_LD_MAP_FD(BPF_REG_1, 0), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), + BPF_EXIT_INSN(), + BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), + BPF_MOV32_IMM(BPF_REG_1, 0xFFFFFFFF), + BPF_MOV32_REG(BPF_REG_1, BPF_REG_1), + BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1), + BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .fixup_map_array_48b = { 4 }, + .result = REJECT, + .errstr = "math between map_value pointer and 4294967295 is not allowed", +}, +{ "32bit pkt_ptr -= scalar", .insns = { BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1, |