Commit 98583812 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

bpf: add various test cases for backward jumps 



Add a couple of tests to make sure branch(/call) offset adjustments
are correctly performed.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent af959b18

tools/testing/selftests/bpf/verifier/jump.c

+195 −0
Original line number Diff line number Diff line
@@ -178,3 +178,198 @@ 
	.result_unpriv = REJECT,

	.result = ACCEPT,

},

{

	"jump test 6",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_MOV64_IMM(BPF_REG_1, 2),

	BPF_JMP_IMM(BPF_JA, 0, 0, 2),

	BPF_MOV64_IMM(BPF_REG_0, 2),

	BPF_EXIT_INSN(),

	BPF_JMP_REG(BPF_JNE, BPF_REG_0, BPF_REG_1, 16),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, 0),

	BPF_JMP_IMM(BPF_JA, 0, 0, -20),

	},

	.result = ACCEPT,

	.retval = 2,

},

{

	"jump test 7",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JA, 0, 0, 2),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 2, 16),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_JMP_IMM(BPF_JA, 0, 0, -20),

	},

	.result = ACCEPT,

	.retval = 3,

},

{

	"jump test 8",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_MOV64_IMM(BPF_REG_1, 2),

	BPF_JMP_IMM(BPF_JA, 0, 0, 2),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_JMP_REG(BPF_JNE, BPF_REG_0, BPF_REG_1, 16),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_JMP_IMM(BPF_JA, 0, 0, -20),

	},

	.result = ACCEPT,

	.retval = 3,

},

{

	"jump/call test 9",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JA, 0, 0, 2),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 2, 16),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -20),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = REJECT,

	.errstr = "jump out of range from insn 1 to 4",

},

{

	"jump/call test 10",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 2, 16),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -20),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = REJECT,

	.errstr = "last insn is not an exit or jmp",

},

{

	"jump/call test 11",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_MOV64_IMM(BPF_REG_0, 3),

	BPF_EXIT_INSN(),

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 2, 26),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 42),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -31),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = ACCEPT,

	.retval = 3,

},

CRA Git | Maintained and supported by SUSTech CRA and CCSE