xref: /OK3568_Linux_fs/kernel/tools/testing/selftests/bpf/verifier/div_overflow.c (revision 4882a59341e53eb6f0b4789bf948001014eff981) 
1*4882a593Smuzhiyun /* Just make sure that JITs used udiv/umod as otherwise we get
2*4882a593Smuzhiyun  * an exception from INT_MIN/-1 overflow similarly as with div
3*4882a593Smuzhiyun  * by zero.
4*4882a593Smuzhiyun  */
5*4882a593Smuzhiyun {
6*4882a593Smuzhiyun 	"DIV32 overflow, check 1",
7*4882a593Smuzhiyun 	.insns = {
8*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_1, -1),
9*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
10*4882a593Smuzhiyun 	BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
11*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
12*4882a593Smuzhiyun 	},
13*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
14*4882a593Smuzhiyun 	.result = ACCEPT,
15*4882a593Smuzhiyun 	.retval = 0,
16*4882a593Smuzhiyun },
17*4882a593Smuzhiyun {
18*4882a593Smuzhiyun 	"DIV32 overflow, check 2",
19*4882a593Smuzhiyun 	.insns = {
20*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
21*4882a593Smuzhiyun 	BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
22*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
23*4882a593Smuzhiyun 	},
24*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
25*4882a593Smuzhiyun 	.result = ACCEPT,
26*4882a593Smuzhiyun 	.retval = 0,
27*4882a593Smuzhiyun },
28*4882a593Smuzhiyun {
29*4882a593Smuzhiyun 	"DIV64 overflow, check 1",
30*4882a593Smuzhiyun 	.insns = {
31*4882a593Smuzhiyun 	BPF_MOV64_IMM(BPF_REG_1, -1),
32*4882a593Smuzhiyun 	BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
33*4882a593Smuzhiyun 	BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
34*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 0),
35*4882a593Smuzhiyun 	BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 1),
36*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 1),
37*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
38*4882a593Smuzhiyun 	},
39*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
40*4882a593Smuzhiyun 	.result = ACCEPT,
41*4882a593Smuzhiyun 	.retval = 0,
42*4882a593Smuzhiyun },
43*4882a593Smuzhiyun {
44*4882a593Smuzhiyun 	"DIV64 overflow, check 2",
45*4882a593Smuzhiyun 	.insns = {
46*4882a593Smuzhiyun 	BPF_LD_IMM64(BPF_REG_1, LLONG_MIN),
47*4882a593Smuzhiyun 	BPF_ALU64_IMM(BPF_DIV, BPF_REG_1, -1),
48*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 0),
49*4882a593Smuzhiyun 	BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_1, 1),
50*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 1),
51*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
52*4882a593Smuzhiyun 	},
53*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
54*4882a593Smuzhiyun 	.result = ACCEPT,
55*4882a593Smuzhiyun 	.retval = 0,
56*4882a593Smuzhiyun },
57*4882a593Smuzhiyun {
58*4882a593Smuzhiyun 	"MOD32 overflow, check 1",
59*4882a593Smuzhiyun 	.insns = {
60*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_1, -1),
61*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
62*4882a593Smuzhiyun 	BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
63*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
64*4882a593Smuzhiyun 	},
65*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
66*4882a593Smuzhiyun 	.result = ACCEPT,
67*4882a593Smuzhiyun 	.retval = INT_MIN,
68*4882a593Smuzhiyun },
69*4882a593Smuzhiyun {
70*4882a593Smuzhiyun 	"MOD32 overflow, check 2",
71*4882a593Smuzhiyun 	.insns = {
72*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
73*4882a593Smuzhiyun 	BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
74*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
75*4882a593Smuzhiyun 	},
76*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
77*4882a593Smuzhiyun 	.result = ACCEPT,
78*4882a593Smuzhiyun 	.retval = INT_MIN,
79*4882a593Smuzhiyun },
80*4882a593Smuzhiyun {
81*4882a593Smuzhiyun 	"MOD64 overflow, check 1",
82*4882a593Smuzhiyun 	.insns = {
83*4882a593Smuzhiyun 	BPF_MOV64_IMM(BPF_REG_1, -1),
84*4882a593Smuzhiyun 	BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
85*4882a593Smuzhiyun 	BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
86*4882a593Smuzhiyun 	BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
87*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 0),
88*4882a593Smuzhiyun 	BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
89*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 1),
90*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
91*4882a593Smuzhiyun 	},
92*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
93*4882a593Smuzhiyun 	.result = ACCEPT,
94*4882a593Smuzhiyun 	.retval = 1,
95*4882a593Smuzhiyun },
96*4882a593Smuzhiyun {
97*4882a593Smuzhiyun 	"MOD64 overflow, check 2",
98*4882a593Smuzhiyun 	.insns = {
99*4882a593Smuzhiyun 	BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
100*4882a593Smuzhiyun 	BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
101*4882a593Smuzhiyun 	BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
102*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 0),
103*4882a593Smuzhiyun 	BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
104*4882a593Smuzhiyun 	BPF_MOV32_IMM(BPF_REG_0, 1),
105*4882a593Smuzhiyun 	BPF_EXIT_INSN(),
106*4882a593Smuzhiyun 	},
107*4882a593Smuzhiyun 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
108*4882a593Smuzhiyun 	.result = ACCEPT,
109*4882a593Smuzhiyun 	.retval = 1,
110*4882a593Smuzhiyun },
111