tools/testing/selftests/bpf/progs/verifier_map_in_map.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /* Converted from tools/testing/selftests/bpf/verifier/map_in_map.c */
   3
   4 #include <linux/bpf.h>
   5 #include <bpf/bpf_helpers.h>
   6 #include "bpf_misc.h"
   7
   8 struct {
   9         __uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
  10         __uint(max_entries, 1);
  11         __type(key, int);
  12         __type(value, int);
  13         __array(values, struct {
  14                 __uint(type, BPF_MAP_TYPE_ARRAY);
  15                 __uint(max_entries, 1);
  16                 __type(key, int);
  17                 __type(value, int);
  18         });
  19 } map_in_map SEC(".maps");
  20
  21 SEC("socket")
  22 __description("map in map access")
  23 __success __success_unpriv __retval(0)
  24 __naked void map_in_map_access(void)
  25 {
  26         asm volatile ("                                 \
  27         r1 = 0;                                         \
  28         *(u32*)(r10 - 4) = r1;                          \
  29         r2 = r10;                                       \
  30         r2 += -4;                                       \
  31         r1 = %[map_in_map] ll;                          \
  32         call %[bpf_map_lookup_elem];                    \
  33         if r0 == 0 goto l0_%=;                          \
  34         r1 = 0;                                         \
  35         *(u32*)(r10 - 4) = r1;                          \
  36         r2 = r10;                                       \
  37         r2 += -4;                                       \
  38         r1 = r0;                                        \
  39         call %[bpf_map_lookup_elem];                    \
  40 l0_%=:  r0 = 0;                                         \
  41         exit;                                           \
  42 "       :
  43         : __imm(bpf_map_lookup_elem),
  44           __imm_addr(map_in_map)
  45         : __clobber_all);
  46 }
  47
  48 SEC("xdp")
  49 __description("map in map state pruning")
  50 __success __msg("processed 26 insns")
  51 __log_level(2) __retval(0) __flag(BPF_F_TEST_STATE_FREQ)
  52 __naked void map_in_map_state_pruning(void)
  53 {
  54         asm volatile ("                                 \
  55         r1 = 0;                                         \
  56         *(u32*)(r10 - 4) = r1;                          \
  57         r6 = r10;                                       \
  58         r6 += -4;                                       \
  59         r2 = r6;                                        \
  60         r1 = %[map_in_map] ll;                          \
  61         call %[bpf_map_lookup_elem];                    \
  62         if r0 != 0 goto l0_%=;                          \
  63         exit;                                           \
  64 l0_%=:  r2 = r6;                                        \
  65         r1 = r0;                                        \
  66         call %[bpf_map_lookup_elem];                    \
  67         if r0 != 0 goto l1_%=;                          \
  68         r2 = r6;                                        \
  69         r1 = %[map_in_map] ll;                          \
  70         call %[bpf_map_lookup_elem];                    \
  71         if r0 != 0 goto l2_%=;                          \
  72         exit;                                           \
  73 l2_%=:  r2 = r6;                                        \
  74         r1 = r0;                                        \
  75         call %[bpf_map_lookup_elem];                    \
  76         if r0 != 0 goto l1_%=;                          \
  77         exit;                                           \
  78 l1_%=:  r0 = *(u32*)(r0 + 0);                           \
  79         exit;                                           \
  80 "       :
  81         : __imm(bpf_map_lookup_elem),
  82           __imm_addr(map_in_map)
  83         : __clobber_all);
  84 }
  85
  86 SEC("socket")
  87 __description("invalid inner map pointer")
  88 __failure __msg("R1 pointer arithmetic on map_ptr prohibited")
  89 __failure_unpriv
  90 __naked void invalid_inner_map_pointer(void)
  91 {
  92         asm volatile ("                                 \
  93         r1 = 0;                                         \
  94         *(u32*)(r10 - 4) = r1;                          \
  95         r2 = r10;                                       \
  96         r2 += -4;                                       \
  97         r1 = %[map_in_map] ll;                          \
  98         call %[bpf_map_lookup_elem];                    \
  99         if r0 == 0 goto l0_%=;                          \
 100         r1 = 0;                                         \
 101         *(u32*)(r10 - 4) = r1;                          \
 102         r2 = r10;                                       \
 103         r2 += -4;                                       \
 104         r1 = r0;                                        \
 105         r1 += 8;                                        \
 106         call %[bpf_map_lookup_elem];                    \
 107 l0_%=:  r0 = 0;                                         \
 108         exit;                                           \
 109 "       :
 110         : __imm(bpf_map_lookup_elem),
 111           __imm_addr(map_in_map)
 112         : __clobber_all);
 113 }
 114
 115 SEC("socket")
 116 __description("forgot null checking on the inner map pointer")
 117 __failure __msg("R1 type=map_value_or_null expected=map_ptr")
 118 __failure_unpriv
 119 __naked void on_the_inner_map_pointer(void)
 120 {
 121         asm volatile ("                                 \
 122         r1 = 0;                                         \
 123         *(u32*)(r10 - 4) = r1;                          \
 124         r2 = r10;                                       \
 125         r2 += -4;                                       \
 126         r1 = %[map_in_map] ll;                          \
 127         call %[bpf_map_lookup_elem];                    \
 128         r1 = 0;                                         \
 129         *(u32*)(r10 - 4) = r1;                          \
 130         r2 = r10;                                       \
 131         r2 += -4;                                       \
 132         r1 = r0;                                        \
 133         call %[bpf_map_lookup_elem];                    \
 134         r0 = 0;                                         \
 135         exit;                                           \
 136 "       :
 137         : __imm(bpf_map_lookup_elem),
 138           __imm_addr(map_in_map)
 139         : __clobber_all);
 140 }
 141
 142 char _license[] SEC("license") = "GPL";