bpf/progs/verifier_ref_tracking.c

1 // SPDX-License-Identifier: GPL-2.0
12 	"*(u32*)(r10 - 8) = r2;"	\
13 	"*(u64*)(r10 - 16) = r2;"	\
14 	"*(u64*)(r10 - 24) = r2;"	\
15 	"*(u64*)(r10 - 32) = r2;"	\
16 	"*(u64*)(r10 - 40) = r2;"	\
17 	"*(u64*)(r10 - 48) = r2;"	\
20 	"r2 += -48;"			\
28 extern void bpf_key_put(struct bpf_key *key) __ksym;
54 	__type(key, int);
148 	r4 += -8;					\  in leak_potential_reference_on_stack()
166 	r4 += -8;					\  in potential_reference_on_stack_2()
226 __description("reference tracking: acquire/release user key reference")
231 	r1 = -3;					\  in acquire_release_user_key_reference()
246 __description("reference tracking: acquire/release system key reference")
265 __description("reference tracking: release user key reference without check")
270 	r1 = -3;					\  in user_key_reference_without_check()
284 __description("reference tracking: release system key reference without check")
302 __description("reference tracking: release with NULL key pointer")
317 __description("reference tracking: leak potential reference to user key")
322 	r1 = -3;					\  in potential_reference_to_user_key()
332 __description("reference tracking: leak potential reference to system key")
346 __description("reference tracking: release reference without check")
365 __description("reference tracking: release reference to sock_common without check")
384 __description("reference tracking: release reference")
402 __description("reference tracking: release reference to sock_common")
420 __description("reference tracking: release reference 2")
439 __description("reference tracking: release reference twice")
460 __description("reference tracking: release reference twice inside branch")
619 	r4 += -8;					\  in alloc_leak_reference_in_subprog()
645 __description("reference tracking in call: alloc in subprog, release outside")
681 	r4 += -8;					\  in ptr_leak_into_caller_stack()
694 	r5 += -8;					\  in ptr_leak_into_caller_stack__1()
699 	r5 += -8;					\  in ptr_leak_into_caller_stack__1()
726 	r4 += -8;					\  in ptr_spill_into_caller_stack()
739 	r5 += -8;					\  in ptr_spill_into_caller_stack__1()
744 	r5 += -8;					\  in ptr_spill_into_caller_stack__1()
833 	  __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000))  in reference_tracking_allow_ld_ind()
857 	  __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000))  in ld_ind_while_holding_reference()
891 __description("reference tracking: release reference then tail call")
979 __description("reference tracking: mangle and release sock_or_null")
998 __description("reference tracking: mangle and release sock")
1061 __description("reference tracking: invalid 64-bit access of member")
1081 __description("reference tracking: access after release")
1111 	/* sk = sk_lookup_tcp(ctx, skb->data, ...) */	\  in tracking_direct_access_for_lookup()
1132 __description("reference tracking: use ptr from bpf_tcp_sock() after release")
1163 __description("reference tracking: use ptr from bpf_sk_fullsock() after release")
1194 __description("reference tracking: use ptr from bpf_sk_fullsock(tp) after release")
1291 __failure __msg("R1 must be referenced when passed to release function")
1322 __description("reference tracking: tp->snd_cwnd after bpf_sk_fullsock(sk) and bpf_tcp_sock(sk)")
1428 __description("reference tracking: use ptr from bpf_skc_to_tcp_sock() after release")
1464 	*(u32*)(r10 - 4) = r0;				\  in to_leak_released_ptr_reg()
1466 	r2 += -4;					\  in to_leak_released_ptr_reg()