bpf, selftests: Add test case trying to taint map value pointer

[linux-2.6-microblaze.git] / tools / testing / selftests / bpf / verifier / value_ptr_arith.c

diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
index 2debba4..4d347bc 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
@@ -1077,6 +1077,29 @@
        .errstr = "R0 invalid mem access 'inv'",
        .errstr_unpriv = "R0 pointer -= pointer prohibited",
 },
+{
+       "map access: trying to leak tained dst reg",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV32_IMM(BPF_REG_1, 0xFFFFFFFF),
+       BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 4 },
+       .result = REJECT,
+       .errstr = "math between map_value pointer and 4294967295 is not allowed",
+},
 {
        "32bit pkt_ptr -= scalar",
        .insns = {