1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Converted from tools/testing/selftests/bpf/verifier/raw_tp_writable.c */ |
3 | |
4 | #include <linux/bpf.h> |
5 | #include <bpf/bpf_helpers.h> |
6 | #include "bpf_misc.h" |
7 | |
8 | struct { |
9 | __uint(type, BPF_MAP_TYPE_HASH); |
10 | __uint(max_entries, 1); |
11 | __type(key, long long); |
12 | __type(value, long long); |
13 | } map_hash_8b SEC(".maps" ); |
14 | |
15 | SEC("raw_tracepoint.w" ) |
16 | __description("raw_tracepoint_writable: reject variable offset" ) |
17 | __failure |
18 | __msg("R6 invalid variable buffer offset: off=0, var_off=(0x0; 0xffffffff)" ) |
19 | __flag(BPF_F_ANY_ALIGNMENT) |
20 | __naked void tracepoint_writable_reject_variable_offset(void) |
21 | { |
22 | asm volatile (" \ |
23 | /* r6 is our tp buffer */ \ |
24 | r6 = *(u64*)(r1 + 0); \ |
25 | r1 = %[map_hash_8b] ll; \ |
26 | /* move the key (== 0) to r10-8 */ \ |
27 | w0 = 0; \ |
28 | r2 = r10; \ |
29 | r2 += -8; \ |
30 | *(u64*)(r2 + 0) = r0; \ |
31 | /* lookup in the map */ \ |
32 | call %[bpf_map_lookup_elem]; \ |
33 | /* exit clean if null */ \ |
34 | if r0 != 0 goto l0_%=; \ |
35 | exit; \ |
36 | l0_%=: /* shift the buffer pointer to a variable location */\ |
37 | r0 = *(u32*)(r0 + 0); \ |
38 | r6 += r0; \ |
39 | /* clobber whatever's there */ \ |
40 | r7 = 4242; \ |
41 | *(u64*)(r6 + 0) = r7; \ |
42 | r0 = 0; \ |
43 | exit; \ |
44 | " : |
45 | : __imm(bpf_map_lookup_elem), |
46 | __imm_addr(map_hash_8b) |
47 | : __clobber_all); |
48 | } |
49 | |
50 | char _license[] SEC("license" ) = "GPL" ; |
51 | |