lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 2 Mar 2019 00:27:15 +0100 From: Daniel Borkmann <daniel@...earbox.net> To: Song Liu <liu.song.a23@...il.com> Cc: Alexei Starovoitov <ast@...com>, afabre@...udflare.com, Marek Majkowski <marek@...udflare.com>, bpf@...r.kernel.org, Networking <netdev@...r.kernel.org> Subject: Re: [PATCH bpf-next] bpf: add test cases for non-pointer sanitiation logic On 03/02/2019 12:22 AM, Song Liu wrote: > On Fri, Mar 1, 2019 at 1:10 PM Daniel Borkmann <daniel@...earbox.net> wrote: >> >> Add two additional tests for further asserting the >> BPF_ALU_NON_POINTER logic with cases that were missed >> previously. >> >> Signed-off-by: Daniel Borkmann <daniel@...earbox.net> >> Cc: Marek Majkowski <marek@...udflare.com> >> Cc: Arthur Fabre <afabre@...udflare.com> >> --- >> .../selftests/bpf/verifier/value_ptr_arith.c | 44 ++++++++++++++++++- >> 1 file changed, 43 insertions(+), 1 deletion(-) >> >> diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c >> index 4b721a77bebb..c3de1a2c9dc5 100644 >> --- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c >> +++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c >> @@ -173,7 +173,7 @@ >> .retval = 0, >> }, >> { >> - "sanitation: alu with different scalars", >> + "sanitation: alu with different scalars 1", >> .insns = { >> BPF_MOV64_IMM(BPF_REG_0, 1), >> BPF_LD_MAP_FD(BPF_REG_ARG1, 0), >> @@ -198,6 +198,48 @@ >> .result = ACCEPT, >> .retval = 0x100000, >> }, >> +{ >> + "sanitation: alu with different scalars 2", >> + .insns = { >> + BPF_MOV64_IMM(BPF_REG_0, 1), >> + BPF_LD_MAP_FD(BPF_REG_1, 0), >> + BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), >> + BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP), >> + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), >> + BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0), >> + BPF_EMIT_CALL(BPF_FUNC_map_delete_elem), >> + BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), >> + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), >> + BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP), >> + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), >> + BPF_EMIT_CALL(BPF_FUNC_map_delete_elem), >> + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), >> + BPF_MOV64_REG(BPF_REG_8, BPF_REG_6), >> + BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7), >> + BPF_MOV64_REG(BPF_REG_0, BPF_REG_8), >> + BPF_EXIT_INSN(), >> + }, >> + .fixup_map_array_48b = { 1 }, >> + .result = ACCEPT, >> + .retval = -EINVAL * 2, > > Why "-EINVAL * 2" here? This is array map so deletion will return -EINVAL, basically I wanted to get a test case under socket filters where helper returns a stable value which is then unknown scalar to do some alu64 op with where sanitation logic triggers. So map_delete_elem() came in handy for that test. Thanks, Daniel
Powered by blists - more mailing lists