Daniel Borkmann 0612679e48 bpf, selftests: Add test case trying to taint map value pointer ...

commit b1a7288dedc6caf9023f2676b4f5ed34cf0d4029 upstream.

Add a test case which tries to taint map value pointer arithmetic into a
unknown scalar with subsequent export through the map.

Before fix:

  # ./test_verifier 1186
  #1186/u map access: trying to leak tained dst reg FAIL
  Unexpected success to load!
  verification time 24 usec
  stack depth 8
  processed 15 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1
  #1186/p map access: trying to leak tained dst reg FAIL
  Unexpected success to load!
  verification time 8 usec
  stack depth 8
  processed 15 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1
  Summary: 0 PASSED, 0 SKIPPED, 2 FAILED

After fix:

  # ./test_verifier 1186
  #1186/u map access: trying to leak tained dst reg OK
  #1186/p map access: trying to leak tained dst reg OK
  Summary: 2 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-12-22 09:30:51 +01:00

..

.gitignore

.gitignore: add SPDX License Identifier

2020-03-25 11:50:48 +01:00

and.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

array_access.c

bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.

2021-11-18 14:04:13 +01:00

basic_call.c

…

basic_instr.c

selftests: bpf: add tests for shifts by zero

2019-07-03 11:14:28 +02:00

basic_stack.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

basic_stx_ldx.c

…

basic.c

selftests/bpf: Fix test_verifier after introducing resolve_pseudo_ldimm64

2020-10-06 20:16:57 -07:00

bounds_deduction.c

bpf: Update selftests to reflect new error states

2021-08-08 09:05:24 +02:00

bounds_mix_sign_unsign.c

bpf: Update selftests to reflect new error states

2021-08-08 09:05:24 +02:00

bounds.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

bpf_get_stack.c

bpf: Test_verifier, bpf_get_stack return value add <0

2020-03-30 15:00:30 -07:00

calls.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

cfg.c

selftests/bpf: fix tests

2019-06-19 02:22:52 +02:00

cgroup_inv_retcode.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

cgroup_skb.c

…

cgroup_storage.c

…

const_or.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

ctx_sk_lookup.c

selftests/bpf: Add verifier tests for bpf_sk_lookup context access

2020-07-17 20:18:17 -07:00

ctx_sk_msg.c

selftests/bpf: add "any alignment" annotation for some tests

2019-02-05 16:56:10 +01:00

ctx_skb.c

selftests/bpf: Test new __sk_buff field gso_size

2020-03-03 16:23:59 -08:00

ctx.c

bpf: Add selftest cases for ctx_or_null argument type

2020-03-27 19:40:39 -07:00

d_path.c

selftests/bpf: Add verifier test for d_path helper

2020-08-25 15:41:15 -07:00

dead_code.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

direct_packet_access.c

bpf: Propagate scalar ranges through register assignments.

2020-10-09 22:03:06 +02:00

direct_stack_access_wraparound.c

…

direct_value_access.c

bpf: Implement BPF ring buffer and verifier support for it

2020-06-01 14:38:22 -07:00

div0.c

…

div_overflow.c

bpf: fix div64 overflow tests to properly detect errors

2019-06-13 23:07:00 +02:00

event_output.c

selftests/bpf: Fix cgroup sockopt verifier test

2020-07-11 01:32:15 +02:00

helper_access_var_len.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

helper_packet_access.c

…

helper_value_access.c

bpf, selftests: Use bpf_probe_read_kernel

2020-06-02 21:04:04 +02:00

int_ptr.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

jit.c

bpf, x32: Fix bug for BPF_JMP | {BPF_JSGT, BPF_JSLE, BPF_JSLT, BPF_JSGE}

2019-05-01 23:32:16 +02:00

jmp32.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

jset.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

jump.c

bpf: add various test cases for backward jumps

2019-05-13 01:08:55 +02:00

junk_insn.c

…

ld_abs.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

ld_dw.c

selftests/bpf: synthetic tests to push verifier limits

2019-04-04 01:27:38 +02:00

ld_imm64.c

selftests/bpf: Fix test_verifier after introducing resolve_pseudo_ldimm64

2020-10-06 20:16:57 -07:00

ld_ind.c

…

leak_ptr.c

…

loops1.c

bpf: Add loop test case with 32 bit reg comparison against 0

2019-10-04 12:27:36 -07:00

lwt.c

…

map_in_map.c

…

map_ptr_mixing.c

bpf: Support access to bpf map fields

2020-06-22 22:22:58 +02:00

map_ptr.c

bpf: Update selftests to reflect new error states

2021-08-08 09:05:24 +02:00

map_ret_val.c

…

masking.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

meta_access.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

perf_event_sample_period.c

…

precise.c

bpf, selftests: Use bpf_probe_read_kernel

2020-06-02 21:04:04 +02:00

prevent_map_lookup.c

selftests/bpf: Test that lookup on SOCKMAP/SOCKHASH is allowed

2020-04-29 23:30:59 +02:00

raw_stack.c

selftest/bpf: Adjust expected verifier errors

2021-08-08 09:05:24 +02:00

raw_tp_writable.c

selftests: bpf: test writable buffers in raw tps

2019-04-26 19:04:19 -07:00

ref_tracking.c

bpf: selftest: Add ref_tracking verifier test for bpf_skc casting

2020-09-25 13:58:02 -07:00

regalloc.c

bpf: Fix register equivalence tracking.

2020-10-15 16:05:31 +02:00

runtime_jit.c

bpf: Add further test_verifier cases for record_func_key

2019-12-19 13:39:22 -08:00

scale.c

selftests/bpf: two scale tests

2019-04-16 10:18:15 +02:00

search_pruning.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

sock.c

bpf: selftest: Ensure the return value of bpf_skc_to helpers must be checked

2020-10-19 15:57:42 -07:00

spill_fill.c

selftests/bpf: add "any alignment" annotation for some tests

2019-02-05 16:56:10 +01:00

spin_lock.c

selftests/bpf: add "any alignment" annotation for some tests

2019-02-05 16:56:10 +01:00

stack_ptr.c

bpf, selftests: Adjust few selftest result_unpriv outcomes

2021-08-08 09:05:24 +02:00

subreg.c

selftests: bpf: complete sub-register zero extension checks

2019-05-29 13:31:05 +02:00

uninit.c

…

unpriv.c

bpf, selftests: Adjust few selftest outcomes wrt unreachable code

2021-08-08 09:05:24 +02:00

value_adj_spill.c

…

value_illegal_alu.c

bpf: Forbid XADD on spilled pointers for unprivileged users

2020-04-20 18:41:34 -07:00

value_or_null.c

bpf: Selftests, verifier case for non null pointer map value branch

2020-05-21 17:44:25 -07:00

value_ptr_arith.c

bpf, selftests: Add test case trying to taint map value pointer

2021-12-22 09:30:51 +01:00

value.c

…

var_off.c

selftest/bpf: Verifier tests for var-off access

2021-08-08 09:05:24 +02:00

wide_access.c

selftests/bpf: add selftests for wide loads

2019-07-15 23:15:53 +02:00

xadd.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00

xdp_direct_packet_access.c

bpf: Add selftests to cover packet access corner cases

2021-12-14 11:32:46 +01:00

xdp.c

selftests: bpf: break up the rest of test_verifier

2019-01-27 21:37:45 -08:00