1 // SPDX-License-Identifier: GPL-2.0
2 /* Converted from tools/testing/selftests/bpf/verifier/sock.c */
3
4 #include <linux/bpf.h>
5 #include <bpf/bpf_helpers.h>
6 #include "bpf_misc.h"
7
8 #define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
9 #define offsetofend(TYPE, MEMBER) \
10 (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
11
12 struct {
13 __uint(type, BPF_MAP_TYPE_REUSEPORT_SOCKARRAY);
14 __uint(max_entries, 1);
15 __type(key, __u32);
16 __type(value, __u64);
17 } map_reuseport_array SEC(".maps");
18
19 struct {
20 __uint(type, BPF_MAP_TYPE_SOCKHASH);
21 __uint(max_entries, 1);
22 __type(key, int);
23 __type(value, int);
24 } map_sockhash SEC(".maps");
25
26 struct {
27 __uint(type, BPF_MAP_TYPE_SOCKMAP);
28 __uint(max_entries, 1);
29 __type(key, int);
30 __type(value, int);
31 } map_sockmap SEC(".maps");
32
33 struct {
34 __uint(type, BPF_MAP_TYPE_XSKMAP);
35 __uint(max_entries, 1);
36 __type(key, int);
37 __type(value, int);
38 } map_xskmap SEC(".maps");
39
40 struct val {
41 int cnt;
42 struct bpf_spin_lock l;
43 };
44
45 struct {
46 __uint(type, BPF_MAP_TYPE_SK_STORAGE);
47 __uint(max_entries, 0);
48 __type(key, int);
49 __type(value, struct val);
50 __uint(map_flags, BPF_F_NO_PREALLOC);
51 } sk_storage_map SEC(".maps");
52
53 SEC("cgroup/skb")
54 __description("skb->sk: no NULL check")
55 __failure __msg("invalid mem access 'sock_common_or_null'")
56 __failure_unpriv
skb_sk_no_null_check(void)57 __naked void skb_sk_no_null_check(void)
58 {
59 asm volatile (" \
60 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
61 r0 = *(u32*)(r1 + 0); \
62 r0 = 0; \
63 exit; \
64 " :
65 : __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
66 : __clobber_all);
67 }
68
69 SEC("cgroup/skb")
70 __description("skb->sk: sk->family [non fullsock field]")
71 __success __success_unpriv __retval(0)
sk_family_non_fullsock_field_1(void)72 __naked void sk_family_non_fullsock_field_1(void)
73 {
74 asm volatile (" \
75 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
76 if r1 != 0 goto l0_%=; \
77 r0 = 0; \
78 exit; \
79 l0_%=: r0 = *(u32*)(r1 + %[bpf_sock_family]); \
80 r0 = 0; \
81 exit; \
82 " :
83 : __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
84 __imm_const(bpf_sock_family, offsetof(struct bpf_sock, family))
85 : __clobber_all);
86 }
87
88 SEC("cgroup/skb")
89 __description("skb->sk: sk->type [fullsock field]")
90 __failure __msg("invalid sock_common access")
91 __failure_unpriv
sk_sk_type_fullsock_field_1(void)92 __naked void sk_sk_type_fullsock_field_1(void)
93 {
94 asm volatile (" \
95 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
96 if r1 != 0 goto l0_%=; \
97 r0 = 0; \
98 exit; \
99 l0_%=: r0 = *(u32*)(r1 + %[bpf_sock_type]); \
100 r0 = 0; \
101 exit; \
102 " :
103 : __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
104 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
105 : __clobber_all);
106 }
107
108 SEC("cgroup/skb")
109 __description("bpf_sk_fullsock(skb->sk): no !skb->sk check")
110 __failure __msg("type=sock_common_or_null expected=sock_common")
111 __failure_unpriv
sk_no_skb_sk_check_1(void)112 __naked void sk_no_skb_sk_check_1(void)
113 {
114 asm volatile (" \
115 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
116 call %[bpf_sk_fullsock]; \
117 r0 = 0; \
118 exit; \
119 " :
120 : __imm(bpf_sk_fullsock),
121 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
122 : __clobber_all);
123 }
124
125 SEC("cgroup/skb")
126 __description("sk_fullsock(skb->sk): no NULL check on ret")
127 __failure __msg("invalid mem access 'sock_or_null'")
128 __failure_unpriv
no_null_check_on_ret_1(void)129 __naked void no_null_check_on_ret_1(void)
130 {
131 asm volatile (" \
132 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
133 if r1 != 0 goto l0_%=; \
134 r0 = 0; \
135 exit; \
136 l0_%=: call %[bpf_sk_fullsock]; \
137 r0 = *(u32*)(r0 + %[bpf_sock_type]); \
138 r0 = 0; \
139 exit; \
140 " :
141 : __imm(bpf_sk_fullsock),
142 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
143 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
144 : __clobber_all);
145 }
146
147 SEC("cgroup/skb")
148 __description("sk_fullsock(skb->sk): sk->type [fullsock field]")
149 __success __success_unpriv __retval(0)
sk_sk_type_fullsock_field_2(void)150 __naked void sk_sk_type_fullsock_field_2(void)
151 {
152 asm volatile (" \
153 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
154 if r1 != 0 goto l0_%=; \
155 r0 = 0; \
156 exit; \
157 l0_%=: call %[bpf_sk_fullsock]; \
158 if r0 != 0 goto l1_%=; \
159 r0 = 0; \
160 exit; \
161 l1_%=: r0 = *(u32*)(r0 + %[bpf_sock_type]); \
162 r0 = 0; \
163 exit; \
164 " :
165 : __imm(bpf_sk_fullsock),
166 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
167 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
168 : __clobber_all);
169 }
170
171 SEC("cgroup/skb")
172 __description("sk_fullsock(skb->sk): sk->family [non fullsock field]")
173 __success __success_unpriv __retval(0)
sk_family_non_fullsock_field_2(void)174 __naked void sk_family_non_fullsock_field_2(void)
175 {
176 asm volatile (" \
177 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
178 if r1 != 0 goto l0_%=; \
179 r0 = 0; \
180 exit; \
181 l0_%=: call %[bpf_sk_fullsock]; \
182 if r0 != 0 goto l1_%=; \
183 exit; \
184 l1_%=: r0 = *(u32*)(r0 + %[bpf_sock_family]); \
185 r0 = 0; \
186 exit; \
187 " :
188 : __imm(bpf_sk_fullsock),
189 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
190 __imm_const(bpf_sock_family, offsetof(struct bpf_sock, family))
191 : __clobber_all);
192 }
193
194 SEC("cgroup/skb")
195 __description("sk_fullsock(skb->sk): sk->state [narrow load]")
196 __success __success_unpriv __retval(0)
sk_sk_state_narrow_load(void)197 __naked void sk_sk_state_narrow_load(void)
198 {
199 asm volatile (" \
200 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
201 if r1 != 0 goto l0_%=; \
202 r0 = 0; \
203 exit; \
204 l0_%=: call %[bpf_sk_fullsock]; \
205 if r0 != 0 goto l1_%=; \
206 r0 = 0; \
207 exit; \
208 l1_%=: r0 = *(u8*)(r0 + %[bpf_sock_state]); \
209 r0 = 0; \
210 exit; \
211 " :
212 : __imm(bpf_sk_fullsock),
213 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
214 __imm_const(bpf_sock_state, offsetof(struct bpf_sock, state))
215 : __clobber_all);
216 }
217
218 SEC("cgroup/skb")
219 __description("sk_fullsock(skb->sk): sk->dst_port [word load] (backward compatibility)")
220 __success __success_unpriv __retval(0)
port_word_load_backward_compatibility(void)221 __naked void port_word_load_backward_compatibility(void)
222 {
223 asm volatile (" \
224 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
225 if r1 != 0 goto l0_%=; \
226 r0 = 0; \
227 exit; \
228 l0_%=: call %[bpf_sk_fullsock]; \
229 if r0 != 0 goto l1_%=; \
230 r0 = 0; \
231 exit; \
232 l1_%=: r0 = *(u32*)(r0 + %[bpf_sock_dst_port]); \
233 r0 = 0; \
234 exit; \
235 " :
236 : __imm(bpf_sk_fullsock),
237 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
238 __imm_const(bpf_sock_dst_port, offsetof(struct bpf_sock, dst_port))
239 : __clobber_all);
240 }
241
242 SEC("cgroup/skb")
243 __description("sk_fullsock(skb->sk): sk->dst_port [half load]")
244 __success __success_unpriv __retval(0)
sk_dst_port_half_load(void)245 __naked void sk_dst_port_half_load(void)
246 {
247 asm volatile (" \
248 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
249 if r1 != 0 goto l0_%=; \
250 r0 = 0; \
251 exit; \
252 l0_%=: call %[bpf_sk_fullsock]; \
253 if r0 != 0 goto l1_%=; \
254 r0 = 0; \
255 exit; \
256 l1_%=: r0 = *(u16*)(r0 + %[bpf_sock_dst_port]); \
257 r0 = 0; \
258 exit; \
259 " :
260 : __imm(bpf_sk_fullsock),
261 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
262 __imm_const(bpf_sock_dst_port, offsetof(struct bpf_sock, dst_port))
263 : __clobber_all);
264 }
265
266 SEC("cgroup/skb")
267 __description("sk_fullsock(skb->sk): sk->dst_port [half load] (invalid)")
268 __failure __msg("invalid sock access")
269 __failure_unpriv
dst_port_half_load_invalid_1(void)270 __naked void dst_port_half_load_invalid_1(void)
271 {
272 asm volatile (" \
273 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
274 if r1 != 0 goto l0_%=; \
275 r0 = 0; \
276 exit; \
277 l0_%=: call %[bpf_sk_fullsock]; \
278 if r0 != 0 goto l1_%=; \
279 r0 = 0; \
280 exit; \
281 l1_%=: r0 = *(u16*)(r0 + %[__imm_0]); \
282 r0 = 0; \
283 exit; \
284 " :
285 : __imm(bpf_sk_fullsock),
286 __imm_const(__imm_0, offsetof(struct bpf_sock, dst_port) + 2),
287 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
288 : __clobber_all);
289 }
290
291 SEC("cgroup/skb")
292 __description("sk_fullsock(skb->sk): sk->dst_port [byte load]")
293 __success __success_unpriv __retval(0)
sk_dst_port_byte_load(void)294 __naked void sk_dst_port_byte_load(void)
295 {
296 asm volatile (" \
297 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
298 if r1 != 0 goto l0_%=; \
299 r0 = 0; \
300 exit; \
301 l0_%=: call %[bpf_sk_fullsock]; \
302 if r0 != 0 goto l1_%=; \
303 r0 = 0; \
304 exit; \
305 l1_%=: r2 = *(u8*)(r0 + %[bpf_sock_dst_port]); \
306 r2 = *(u8*)(r0 + %[__imm_0]); \
307 r0 = 0; \
308 exit; \
309 " :
310 : __imm(bpf_sk_fullsock),
311 __imm_const(__imm_0, offsetof(struct bpf_sock, dst_port) + 1),
312 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
313 __imm_const(bpf_sock_dst_port, offsetof(struct bpf_sock, dst_port))
314 : __clobber_all);
315 }
316
317 SEC("cgroup/skb")
318 __description("sk_fullsock(skb->sk): sk->dst_port [byte load] (invalid)")
319 __failure __msg("invalid sock access")
320 __failure_unpriv
dst_port_byte_load_invalid(void)321 __naked void dst_port_byte_load_invalid(void)
322 {
323 asm volatile (" \
324 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
325 if r1 != 0 goto l0_%=; \
326 r0 = 0; \
327 exit; \
328 l0_%=: call %[bpf_sk_fullsock]; \
329 if r0 != 0 goto l1_%=; \
330 r0 = 0; \
331 exit; \
332 l1_%=: r0 = *(u8*)(r0 + %[__imm_0]); \
333 r0 = 0; \
334 exit; \
335 " :
336 : __imm(bpf_sk_fullsock),
337 __imm_const(__imm_0, offsetof(struct bpf_sock, dst_port) + 2),
338 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
339 : __clobber_all);
340 }
341
342 SEC("cgroup/skb")
343 __description("sk_fullsock(skb->sk): past sk->dst_port [half load] (invalid)")
344 __failure __msg("invalid sock access")
345 __failure_unpriv
dst_port_half_load_invalid_2(void)346 __naked void dst_port_half_load_invalid_2(void)
347 {
348 asm volatile (" \
349 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
350 if r1 != 0 goto l0_%=; \
351 r0 = 0; \
352 exit; \
353 l0_%=: call %[bpf_sk_fullsock]; \
354 if r0 != 0 goto l1_%=; \
355 r0 = 0; \
356 exit; \
357 l1_%=: r0 = *(u16*)(r0 + %[bpf_sock_dst_port__end]); \
358 r0 = 0; \
359 exit; \
360 " :
361 : __imm(bpf_sk_fullsock),
362 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
363 __imm_const(bpf_sock_dst_port__end, offsetofend(struct bpf_sock, dst_port))
364 : __clobber_all);
365 }
366
367 SEC("cgroup/skb")
368 __description("sk_fullsock(skb->sk): sk->dst_ip6 [load 2nd byte]")
369 __success __success_unpriv __retval(0)
dst_ip6_load_2nd_byte(void)370 __naked void dst_ip6_load_2nd_byte(void)
371 {
372 asm volatile (" \
373 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
374 if r1 != 0 goto l0_%=; \
375 r0 = 0; \
376 exit; \
377 l0_%=: call %[bpf_sk_fullsock]; \
378 if r0 != 0 goto l1_%=; \
379 r0 = 0; \
380 exit; \
381 l1_%=: r0 = *(u8*)(r0 + %[__imm_0]); \
382 r0 = 0; \
383 exit; \
384 " :
385 : __imm(bpf_sk_fullsock),
386 __imm_const(__imm_0, offsetof(struct bpf_sock, dst_ip6[0]) + 1),
387 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
388 : __clobber_all);
389 }
390
391 SEC("cgroup/skb")
392 __description("sk_fullsock(skb->sk): sk->type [narrow load]")
393 __success __success_unpriv __retval(0)
sk_sk_type_narrow_load(void)394 __naked void sk_sk_type_narrow_load(void)
395 {
396 asm volatile (" \
397 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
398 if r1 != 0 goto l0_%=; \
399 r0 = 0; \
400 exit; \
401 l0_%=: call %[bpf_sk_fullsock]; \
402 if r0 != 0 goto l1_%=; \
403 r0 = 0; \
404 exit; \
405 l1_%=: r0 = *(u8*)(r0 + %[bpf_sock_type]); \
406 r0 = 0; \
407 exit; \
408 " :
409 : __imm(bpf_sk_fullsock),
410 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
411 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
412 : __clobber_all);
413 }
414
415 SEC("cgroup/skb")
416 __description("sk_fullsock(skb->sk): sk->protocol [narrow load]")
417 __success __success_unpriv __retval(0)
sk_sk_protocol_narrow_load(void)418 __naked void sk_sk_protocol_narrow_load(void)
419 {
420 asm volatile (" \
421 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
422 if r1 != 0 goto l0_%=; \
423 r0 = 0; \
424 exit; \
425 l0_%=: call %[bpf_sk_fullsock]; \
426 if r0 != 0 goto l1_%=; \
427 r0 = 0; \
428 exit; \
429 l1_%=: r0 = *(u8*)(r0 + %[bpf_sock_protocol]); \
430 r0 = 0; \
431 exit; \
432 " :
433 : __imm(bpf_sk_fullsock),
434 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
435 __imm_const(bpf_sock_protocol, offsetof(struct bpf_sock, protocol))
436 : __clobber_all);
437 }
438
439 SEC("cgroup/skb")
440 __description("sk_fullsock(skb->sk): beyond last field")
441 __failure __msg("invalid sock access")
442 __failure_unpriv
skb_sk_beyond_last_field_1(void)443 __naked void skb_sk_beyond_last_field_1(void)
444 {
445 asm volatile (" \
446 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
447 if r1 != 0 goto l0_%=; \
448 r0 = 0; \
449 exit; \
450 l0_%=: call %[bpf_sk_fullsock]; \
451 if r0 != 0 goto l1_%=; \
452 r0 = 0; \
453 exit; \
454 l1_%=: r0 = *(u32*)(r0 + %[bpf_sock_rx_queue_mapping__end]);\
455 r0 = 0; \
456 exit; \
457 " :
458 : __imm(bpf_sk_fullsock),
459 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
460 __imm_const(bpf_sock_rx_queue_mapping__end, offsetofend(struct bpf_sock, rx_queue_mapping))
461 : __clobber_all);
462 }
463
464 SEC("cgroup/skb")
465 __description("bpf_tcp_sock(skb->sk): no !skb->sk check")
466 __failure __msg("type=sock_common_or_null expected=sock_common")
467 __failure_unpriv
sk_no_skb_sk_check_2(void)468 __naked void sk_no_skb_sk_check_2(void)
469 {
470 asm volatile (" \
471 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
472 call %[bpf_tcp_sock]; \
473 r0 = 0; \
474 exit; \
475 " :
476 : __imm(bpf_tcp_sock),
477 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
478 : __clobber_all);
479 }
480
481 SEC("cgroup/skb")
482 __description("bpf_tcp_sock(skb->sk): no NULL check on ret")
483 __failure __msg("invalid mem access 'tcp_sock_or_null'")
484 __failure_unpriv
no_null_check_on_ret_2(void)485 __naked void no_null_check_on_ret_2(void)
486 {
487 asm volatile (" \
488 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
489 if r1 != 0 goto l0_%=; \
490 r0 = 0; \
491 exit; \
492 l0_%=: call %[bpf_tcp_sock]; \
493 r0 = *(u32*)(r0 + %[bpf_tcp_sock_snd_cwnd]); \
494 r0 = 0; \
495 exit; \
496 " :
497 : __imm(bpf_tcp_sock),
498 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
499 __imm_const(bpf_tcp_sock_snd_cwnd, offsetof(struct bpf_tcp_sock, snd_cwnd))
500 : __clobber_all);
501 }
502
503 SEC("cgroup/skb")
504 __description("bpf_tcp_sock(skb->sk): tp->snd_cwnd")
505 __success __success_unpriv __retval(0)
skb_sk_tp_snd_cwnd_1(void)506 __naked void skb_sk_tp_snd_cwnd_1(void)
507 {
508 asm volatile (" \
509 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
510 if r1 != 0 goto l0_%=; \
511 r0 = 0; \
512 exit; \
513 l0_%=: call %[bpf_tcp_sock]; \
514 if r0 != 0 goto l1_%=; \
515 exit; \
516 l1_%=: r0 = *(u32*)(r0 + %[bpf_tcp_sock_snd_cwnd]); \
517 r0 = 0; \
518 exit; \
519 " :
520 : __imm(bpf_tcp_sock),
521 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
522 __imm_const(bpf_tcp_sock_snd_cwnd, offsetof(struct bpf_tcp_sock, snd_cwnd))
523 : __clobber_all);
524 }
525
526 SEC("cgroup/skb")
527 __description("bpf_tcp_sock(skb->sk): tp->bytes_acked")
528 __success __success_unpriv __retval(0)
skb_sk_tp_bytes_acked(void)529 __naked void skb_sk_tp_bytes_acked(void)
530 {
531 asm volatile (" \
532 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
533 if r1 != 0 goto l0_%=; \
534 r0 = 0; \
535 exit; \
536 l0_%=: call %[bpf_tcp_sock]; \
537 if r0 != 0 goto l1_%=; \
538 exit; \
539 l1_%=: r0 = *(u64*)(r0 + %[bpf_tcp_sock_bytes_acked]); \
540 r0 = 0; \
541 exit; \
542 " :
543 : __imm(bpf_tcp_sock),
544 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
545 __imm_const(bpf_tcp_sock_bytes_acked, offsetof(struct bpf_tcp_sock, bytes_acked))
546 : __clobber_all);
547 }
548
549 SEC("cgroup/skb")
550 __description("bpf_tcp_sock(skb->sk): beyond last field")
551 __failure __msg("invalid tcp_sock access")
552 __failure_unpriv
skb_sk_beyond_last_field_2(void)553 __naked void skb_sk_beyond_last_field_2(void)
554 {
555 asm volatile (" \
556 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
557 if r1 != 0 goto l0_%=; \
558 r0 = 0; \
559 exit; \
560 l0_%=: call %[bpf_tcp_sock]; \
561 if r0 != 0 goto l1_%=; \
562 exit; \
563 l1_%=: r0 = *(u64*)(r0 + %[bpf_tcp_sock_bytes_acked__end]);\
564 r0 = 0; \
565 exit; \
566 " :
567 : __imm(bpf_tcp_sock),
568 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
569 __imm_const(bpf_tcp_sock_bytes_acked__end, offsetofend(struct bpf_tcp_sock, bytes_acked))
570 : __clobber_all);
571 }
572
573 SEC("cgroup/skb")
574 __description("bpf_tcp_sock(bpf_sk_fullsock(skb->sk)): tp->snd_cwnd")
575 __success __success_unpriv __retval(0)
skb_sk_tp_snd_cwnd_2(void)576 __naked void skb_sk_tp_snd_cwnd_2(void)
577 {
578 asm volatile (" \
579 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
580 if r1 != 0 goto l0_%=; \
581 r0 = 0; \
582 exit; \
583 l0_%=: call %[bpf_sk_fullsock]; \
584 if r0 != 0 goto l1_%=; \
585 exit; \
586 l1_%=: r1 = r0; \
587 call %[bpf_tcp_sock]; \
588 if r0 != 0 goto l2_%=; \
589 exit; \
590 l2_%=: r0 = *(u32*)(r0 + %[bpf_tcp_sock_snd_cwnd]); \
591 r0 = 0; \
592 exit; \
593 " :
594 : __imm(bpf_sk_fullsock),
595 __imm(bpf_tcp_sock),
596 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk)),
597 __imm_const(bpf_tcp_sock_snd_cwnd, offsetof(struct bpf_tcp_sock, snd_cwnd))
598 : __clobber_all);
599 }
600
601 SEC("tc")
602 __description("bpf_sk_release(skb->sk)")
603 __failure __msg("R1 must be referenced when passed to release function")
bpf_sk_release_skb_sk(void)604 __naked void bpf_sk_release_skb_sk(void)
605 {
606 asm volatile (" \
607 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
608 if r1 == 0 goto l0_%=; \
609 call %[bpf_sk_release]; \
610 l0_%=: r0 = 0; \
611 exit; \
612 " :
613 : __imm(bpf_sk_release),
614 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
615 : __clobber_all);
616 }
617
618 SEC("tc")
619 __description("bpf_sk_release(bpf_sk_fullsock(skb->sk))")
620 __failure __msg("R1 must be referenced when passed to release function")
bpf_sk_fullsock_skb_sk(void)621 __naked void bpf_sk_fullsock_skb_sk(void)
622 {
623 asm volatile (" \
624 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
625 if r1 != 0 goto l0_%=; \
626 r0 = 0; \
627 exit; \
628 l0_%=: call %[bpf_sk_fullsock]; \
629 if r0 != 0 goto l1_%=; \
630 exit; \
631 l1_%=: r1 = r0; \
632 call %[bpf_sk_release]; \
633 r0 = 1; \
634 exit; \
635 " :
636 : __imm(bpf_sk_fullsock),
637 __imm(bpf_sk_release),
638 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
639 : __clobber_all);
640 }
641
642 SEC("tc")
643 __description("bpf_sk_release(bpf_tcp_sock(skb->sk))")
644 __failure __msg("R1 must be referenced when passed to release function")
bpf_tcp_sock_skb_sk(void)645 __naked void bpf_tcp_sock_skb_sk(void)
646 {
647 asm volatile (" \
648 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
649 if r1 != 0 goto l0_%=; \
650 r0 = 0; \
651 exit; \
652 l0_%=: call %[bpf_tcp_sock]; \
653 if r0 != 0 goto l1_%=; \
654 exit; \
655 l1_%=: r1 = r0; \
656 call %[bpf_sk_release]; \
657 r0 = 1; \
658 exit; \
659 " :
660 : __imm(bpf_sk_release),
661 __imm(bpf_tcp_sock),
662 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
663 : __clobber_all);
664 }
665
666 SEC("tc")
667 __description("sk_storage_get(map, skb->sk, NULL, 0): value == NULL")
668 __success __retval(0)
sk_null_0_value_null(void)669 __naked void sk_null_0_value_null(void)
670 {
671 asm volatile (" \
672 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
673 if r1 != 0 goto l0_%=; \
674 r0 = 0; \
675 exit; \
676 l0_%=: call %[bpf_sk_fullsock]; \
677 if r0 != 0 goto l1_%=; \
678 r0 = 0; \
679 exit; \
680 l1_%=: r4 = 0; \
681 r3 = 0; \
682 r2 = r0; \
683 r1 = %[sk_storage_map] ll; \
684 call %[bpf_sk_storage_get]; \
685 r0 = 0; \
686 exit; \
687 " :
688 : __imm(bpf_sk_fullsock),
689 __imm(bpf_sk_storage_get),
690 __imm_addr(sk_storage_map),
691 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
692 : __clobber_all);
693 }
694
695 SEC("tc")
696 __description("sk_storage_get(map, skb->sk, 1, 1): value == 1")
697 __failure __msg("R3 type=scalar expected=fp")
sk_1_1_value_1(void)698 __naked void sk_1_1_value_1(void)
699 {
700 asm volatile (" \
701 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
702 if r1 != 0 goto l0_%=; \
703 r0 = 0; \
704 exit; \
705 l0_%=: call %[bpf_sk_fullsock]; \
706 if r0 != 0 goto l1_%=; \
707 r0 = 0; \
708 exit; \
709 l1_%=: r4 = 1; \
710 r3 = 1; \
711 r2 = r0; \
712 r1 = %[sk_storage_map] ll; \
713 call %[bpf_sk_storage_get]; \
714 r0 = 0; \
715 exit; \
716 " :
717 : __imm(bpf_sk_fullsock),
718 __imm(bpf_sk_storage_get),
719 __imm_addr(sk_storage_map),
720 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
721 : __clobber_all);
722 }
723
724 SEC("tc")
725 __description("sk_storage_get(map, skb->sk, &stack_value, 1): stack_value")
726 __success __retval(0)
stack_value_1_stack_value(void)727 __naked void stack_value_1_stack_value(void)
728 {
729 asm volatile (" \
730 r2 = 0; \
731 *(u64*)(r10 - 8) = r2; \
732 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
733 if r1 != 0 goto l0_%=; \
734 r0 = 0; \
735 exit; \
736 l0_%=: call %[bpf_sk_fullsock]; \
737 if r0 != 0 goto l1_%=; \
738 r0 = 0; \
739 exit; \
740 l1_%=: r4 = 1; \
741 r3 = r10; \
742 r3 += -8; \
743 r2 = r0; \
744 r1 = %[sk_storage_map] ll; \
745 call %[bpf_sk_storage_get]; \
746 r0 = 0; \
747 exit; \
748 " :
749 : __imm(bpf_sk_fullsock),
750 __imm(bpf_sk_storage_get),
751 __imm_addr(sk_storage_map),
752 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
753 : __clobber_all);
754 }
755
756 SEC("tc")
757 __description("bpf_map_lookup_elem(smap, &key)")
758 __failure __msg("cannot pass map_type 24 into func bpf_map_lookup_elem")
map_lookup_elem_smap_key(void)759 __naked void map_lookup_elem_smap_key(void)
760 {
761 asm volatile (" \
762 r1 = 0; \
763 *(u32*)(r10 - 4) = r1; \
764 r2 = r10; \
765 r2 += -4; \
766 r1 = %[sk_storage_map] ll; \
767 call %[bpf_map_lookup_elem]; \
768 r0 = 0; \
769 exit; \
770 " :
771 : __imm(bpf_map_lookup_elem),
772 __imm_addr(sk_storage_map)
773 : __clobber_all);
774 }
775
776 SEC("xdp")
777 __description("bpf_map_lookup_elem(xskmap, &key); xs->queue_id")
778 __success __retval(0)
xskmap_key_xs_queue_id(void)779 __naked void xskmap_key_xs_queue_id(void)
780 {
781 asm volatile (" \
782 r1 = 0; \
783 *(u32*)(r10 - 8) = r1; \
784 r2 = r10; \
785 r2 += -8; \
786 r1 = %[map_xskmap] ll; \
787 call %[bpf_map_lookup_elem]; \
788 if r0 != 0 goto l0_%=; \
789 exit; \
790 l0_%=: r0 = *(u32*)(r0 + %[bpf_xdp_sock_queue_id]); \
791 r0 = 0; \
792 exit; \
793 " :
794 : __imm(bpf_map_lookup_elem),
795 __imm_addr(map_xskmap),
796 __imm_const(bpf_xdp_sock_queue_id, offsetof(struct bpf_xdp_sock, queue_id))
797 : __clobber_all);
798 }
799
800 SEC("sk_skb")
801 __description("bpf_map_lookup_elem(sockmap, &key)")
802 __failure __msg("Unreleased reference id=2 alloc_insn=6")
map_lookup_elem_sockmap_key(void)803 __naked void map_lookup_elem_sockmap_key(void)
804 {
805 asm volatile (" \
806 r1 = 0; \
807 *(u32*)(r10 - 4) = r1; \
808 r2 = r10; \
809 r2 += -4; \
810 r1 = %[map_sockmap] ll; \
811 call %[bpf_map_lookup_elem]; \
812 r0 = 0; \
813 exit; \
814 " :
815 : __imm(bpf_map_lookup_elem),
816 __imm_addr(map_sockmap)
817 : __clobber_all);
818 }
819
820 SEC("sk_skb")
821 __description("bpf_map_lookup_elem(sockhash, &key)")
822 __failure __msg("Unreleased reference id=2 alloc_insn=6")
map_lookup_elem_sockhash_key(void)823 __naked void map_lookup_elem_sockhash_key(void)
824 {
825 asm volatile (" \
826 r1 = 0; \
827 *(u32*)(r10 - 4) = r1; \
828 r2 = r10; \
829 r2 += -4; \
830 r1 = %[map_sockhash] ll; \
831 call %[bpf_map_lookup_elem]; \
832 r0 = 0; \
833 exit; \
834 " :
835 : __imm(bpf_map_lookup_elem),
836 __imm_addr(map_sockhash)
837 : __clobber_all);
838 }
839
840 SEC("sk_skb")
841 __description("bpf_map_lookup_elem(sockmap, &key); sk->type [fullsock field]; bpf_sk_release(sk)")
842 __success
field_bpf_sk_release_sk_1(void)843 __naked void field_bpf_sk_release_sk_1(void)
844 {
845 asm volatile (" \
846 r1 = 0; \
847 *(u32*)(r10 - 4) = r1; \
848 r2 = r10; \
849 r2 += -4; \
850 r1 = %[map_sockmap] ll; \
851 call %[bpf_map_lookup_elem]; \
852 if r0 != 0 goto l0_%=; \
853 exit; \
854 l0_%=: r1 = r0; \
855 r0 = *(u32*)(r0 + %[bpf_sock_type]); \
856 call %[bpf_sk_release]; \
857 exit; \
858 " :
859 : __imm(bpf_map_lookup_elem),
860 __imm(bpf_sk_release),
861 __imm_addr(map_sockmap),
862 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
863 : __clobber_all);
864 }
865
866 SEC("sk_skb")
867 __description("bpf_map_lookup_elem(sockhash, &key); sk->type [fullsock field]; bpf_sk_release(sk)")
868 __success
field_bpf_sk_release_sk_2(void)869 __naked void field_bpf_sk_release_sk_2(void)
870 {
871 asm volatile (" \
872 r1 = 0; \
873 *(u32*)(r10 - 4) = r1; \
874 r2 = r10; \
875 r2 += -4; \
876 r1 = %[map_sockhash] ll; \
877 call %[bpf_map_lookup_elem]; \
878 if r0 != 0 goto l0_%=; \
879 exit; \
880 l0_%=: r1 = r0; \
881 r0 = *(u32*)(r0 + %[bpf_sock_type]); \
882 call %[bpf_sk_release]; \
883 exit; \
884 " :
885 : __imm(bpf_map_lookup_elem),
886 __imm(bpf_sk_release),
887 __imm_addr(map_sockhash),
888 __imm_const(bpf_sock_type, offsetof(struct bpf_sock, type))
889 : __clobber_all);
890 }
891
892 SEC("sk_reuseport")
893 __description("bpf_sk_select_reuseport(ctx, reuseport_array, &key, flags)")
894 __success
ctx_reuseport_array_key_flags(void)895 __naked void ctx_reuseport_array_key_flags(void)
896 {
897 asm volatile (" \
898 r4 = 0; \
899 r2 = 0; \
900 *(u32*)(r10 - 4) = r2; \
901 r3 = r10; \
902 r3 += -4; \
903 r2 = %[map_reuseport_array] ll; \
904 call %[bpf_sk_select_reuseport]; \
905 exit; \
906 " :
907 : __imm(bpf_sk_select_reuseport),
908 __imm_addr(map_reuseport_array)
909 : __clobber_all);
910 }
911
912 SEC("sk_reuseport")
913 __description("bpf_sk_select_reuseport(ctx, sockmap, &key, flags)")
914 __success
reuseport_ctx_sockmap_key_flags(void)915 __naked void reuseport_ctx_sockmap_key_flags(void)
916 {
917 asm volatile (" \
918 r4 = 0; \
919 r2 = 0; \
920 *(u32*)(r10 - 4) = r2; \
921 r3 = r10; \
922 r3 += -4; \
923 r2 = %[map_sockmap] ll; \
924 call %[bpf_sk_select_reuseport]; \
925 exit; \
926 " :
927 : __imm(bpf_sk_select_reuseport),
928 __imm_addr(map_sockmap)
929 : __clobber_all);
930 }
931
932 SEC("sk_reuseport")
933 __description("bpf_sk_select_reuseport(ctx, sockhash, &key, flags)")
934 __success
reuseport_ctx_sockhash_key_flags(void)935 __naked void reuseport_ctx_sockhash_key_flags(void)
936 {
937 asm volatile (" \
938 r4 = 0; \
939 r2 = 0; \
940 *(u32*)(r10 - 4) = r2; \
941 r3 = r10; \
942 r3 += -4; \
943 r2 = %[map_sockmap] ll; \
944 call %[bpf_sk_select_reuseport]; \
945 exit; \
946 " :
947 : __imm(bpf_sk_select_reuseport),
948 __imm_addr(map_sockmap)
949 : __clobber_all);
950 }
951
952 SEC("tc")
953 __description("mark null check on return value of bpf_skc_to helpers")
954 __failure __msg("invalid mem access")
of_bpf_skc_to_helpers(void)955 __naked void of_bpf_skc_to_helpers(void)
956 {
957 asm volatile (" \
958 r1 = *(u64*)(r1 + %[__sk_buff_sk]); \
959 if r1 != 0 goto l0_%=; \
960 r0 = 0; \
961 exit; \
962 l0_%=: r6 = r1; \
963 call %[bpf_skc_to_tcp_sock]; \
964 r7 = r0; \
965 r1 = r6; \
966 call %[bpf_skc_to_tcp_request_sock]; \
967 r8 = r0; \
968 if r8 != 0 goto l1_%=; \
969 r0 = 0; \
970 exit; \
971 l1_%=: r0 = *(u8*)(r7 + 0); \
972 exit; \
973 " :
974 : __imm(bpf_skc_to_tcp_request_sock),
975 __imm(bpf_skc_to_tcp_sock),
976 __imm_const(__sk_buff_sk, offsetof(struct __sk_buff, sk))
977 : __clobber_all);
978 }
979
980 char _license[] SEC("license") = "GPL";
981
