blob: a0a5efd1caa106646d2c48189224b117501c087c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
#include <stdbool.h>
#include <errno.h>
#include <string.h>
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
int arr[1];
int unkn_idx;
__noinline long global_bad(void)
{
return arr[unkn_idx]; /* BOOM */
}
__noinline long global_good(void)
{
return arr[0];
}
__noinline long global_calls_bad(void)
{
return global_good() + global_bad() /* does BOOM indirectly */;
}
__noinline long global_calls_good_only(void)
{
return global_good();
}
SEC("?raw_tp")
__success __log_level(2)
/* main prog is validated completely first */
__msg("('global_calls_good_only') is global and assumed valid.")
__msg("1: (95) exit")
/* eventually global_good() is transitively validated as well */
__msg("Validating global_good() func")
__msg("('global_good') is safe for any args that match its prototype")
int chained_global_func_calls_success(void)
{
return global_calls_good_only();
}
SEC("?raw_tp")
__failure __log_level(2)
/* main prog validated successfully first */
__msg("1: (95) exit")
/* eventually we validate global_bad() and fail */
__msg("Validating global_bad() func")
__msg("math between map_value pointer and register") /* BOOM */
int chained_global_func_calls_bad(void)
{
return global_calls_bad();
}
/* do out of bounds access forcing verifier to fail verification if this
* global func is called
*/
__noinline int global_unsupp(const int *mem)
{
if (!mem)
return 0;
return mem[100]; /* BOOM */
}
const volatile bool skip_unsupp_global = true;
SEC("?raw_tp")
__success
int guarded_unsupp_global_called(void)
{
if (!skip_unsupp_global)
return global_unsupp(NULL);
return 0;
}
SEC("?raw_tp")
__failure __log_level(2)
__msg("Func#1 ('global_unsupp') is global and assumed valid.")
__msg("Validating global_unsupp() func#1...")
__msg("value is outside of the allowed memory range")
int unguarded_unsupp_global_called(void)
{
int x = 0;
return global_unsupp(&x);
}
char _license[] SEC("license") = "GPL";
|
