selftests/bpf: Test indirect var_off stack access in unpriv mode

Test that verifier rejects indirect stack access with variable offset in
unprivileged mode and accepts same code in privileged mode.

Since pointer arithmetics is prohibited in unprivileged mode verifier
should reject the program even before it gets to helper call that uses
variable offset, at the time when that variable offset is trying to be
constructed.

Example of output:
  # ./test_verifier
  ...
  #859/u indirect variable-offset stack access, priv vs unpriv OK
  #859/p indirect variable-offset stack access, priv vs unpriv OK

Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/tools/testing/selftests/bpf/verifier/var_off.c b/tools/testing/selftests/bpf/verifier/var_off.c
index 3840bd16e1739301343f0627fe801697979eebc0..f5d5ff18ef220eb5e125ea9b9e0cce6e2f10d9e9 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/var_off.c
+++ b/tools/testing/selftests/bpf/verifier/var_off.c
@@ -114,6 +114,33 @@
        .result = REJECT,
        .prog_type = BPF_PROG_TYPE_LWT_IN,
 },
+{
+       "indirect variable-offset stack access, priv vs unpriv",
+       .insns = {
+       /* Fill the top 16 bytes of the stack. */
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       /* Get an unknown value. */
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+       /* Make it small and 4-byte aligned. */
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),
+       /* Add it to fp.  We now have either fp-12 or fp-16, we don't know
+        * which, but either way it points to initialized stack.
+        */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
+       /* Dereference it indirectly. */
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 6 },
+       .errstr_unpriv = "R2 stack pointer arithmetic goes out of range, prohibited for !root",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
 {
        "indirect variable-offset stack access, uninitialized",
        .insns = {