1 {
2 "leak pointer into ctx 1",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_0, 0),
5 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
6 offsetof(struct __sk_buff, cb[0])),
7 BPF_LD_MAP_FD(BPF_REG_2, 0),
8 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
9 offsetof(struct __sk_buff, cb[0])),
10 BPF_EXIT_INSN(),
11 },
12 .fixup_map_hash_8b = { 2 },
13 .errstr_unpriv = "R2 leaks addr into mem",
14 .result_unpriv = REJECT,
15 .result = REJECT,
16 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
17 },
18 {
19 "leak pointer into ctx 2",
20 .insns = {
21 BPF_MOV64_IMM(BPF_REG_0, 0),
22 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
23 offsetof(struct __sk_buff, cb[0])),
24 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
25 offsetof(struct __sk_buff, cb[0])),
26 BPF_EXIT_INSN(),
27 },
28 .errstr_unpriv = "R10 leaks addr into mem",
29 .result_unpriv = REJECT,
30 .result = REJECT,
31 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
32 },
33 {
34 "leak pointer into ctx 3",
35 .insns = {
36 BPF_MOV64_IMM(BPF_REG_0, 0),
37 BPF_LD_MAP_FD(BPF_REG_2, 0),
38 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
39 offsetof(struct __sk_buff, cb[0])),
40 BPF_EXIT_INSN(),
41 },
42 .fixup_map_hash_8b = { 1 },
43 .errstr_unpriv = "R2 leaks addr into ctx",
44 .result_unpriv = REJECT,
45 .result = ACCEPT,
46 },
47 {
48 "leak pointer into map val",
49 .insns = {
50 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
51 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
52 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
53 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
54 BPF_LD_MAP_FD(BPF_REG_1, 0),
55 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
56 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
57 BPF_MOV64_IMM(BPF_REG_3, 0),
58 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
59 BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
60 BPF_MOV64_IMM(BPF_REG_0, 0),
61 BPF_EXIT_INSN(),
62 },
63 .fixup_map_hash_8b = { 4 },
64 .errstr_unpriv = "R6 leaks addr into mem",
65 .result_unpriv = REJECT,
66 .result = ACCEPT,
67 },