1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Converted from tools/testing/selftests/bpf/verifier/value_adj_spill.c */ |
3 | |
4 | #include <linux/bpf.h> |
5 | #include <bpf/bpf_helpers.h> |
6 | #include "bpf_misc.h" |
7 | |
8 | #define MAX_ENTRIES 11 |
9 | |
10 | struct test_val { |
11 | unsigned int index; |
12 | int foo[MAX_ENTRIES]; |
13 | }; |
14 | |
15 | struct { |
16 | __uint(type, BPF_MAP_TYPE_HASH); |
17 | __uint(max_entries, 1); |
18 | __type(key, long long); |
19 | __type(value, struct test_val); |
20 | } map_hash_48b SEC(".maps" ); |
21 | |
22 | SEC("socket" ) |
23 | __description("map element value is preserved across register spilling" ) |
24 | __success __failure_unpriv __msg_unpriv("R0 leaks addr" ) |
25 | __retval(0) |
26 | __naked void is_preserved_across_register_spilling(void) |
27 | { |
28 | asm volatile (" \ |
29 | r2 = r10; \ |
30 | r2 += -8; \ |
31 | r1 = 0; \ |
32 | *(u64*)(r2 + 0) = r1; \ |
33 | r1 = %[map_hash_48b] ll; \ |
34 | call %[bpf_map_lookup_elem]; \ |
35 | if r0 == 0 goto l0_%=; \ |
36 | r1 = 42; \ |
37 | *(u64*)(r0 + 0) = r1; \ |
38 | r1 = r10; \ |
39 | r1 += -184; \ |
40 | *(u64*)(r1 + 0) = r0; \ |
41 | r3 = *(u64*)(r1 + 0); \ |
42 | r1 = 42; \ |
43 | *(u64*)(r3 + 0) = r1; \ |
44 | l0_%=: exit; \ |
45 | " : |
46 | : __imm(bpf_map_lookup_elem), |
47 | __imm_addr(map_hash_48b) |
48 | : __clobber_all); |
49 | } |
50 | |
51 | SEC("socket" ) |
52 | __description("map element value or null is marked on register spilling" ) |
53 | __success __failure_unpriv __msg_unpriv("R0 leaks addr" ) |
54 | __retval(0) |
55 | __naked void is_marked_on_register_spilling(void) |
56 | { |
57 | asm volatile (" \ |
58 | r2 = r10; \ |
59 | r2 += -8; \ |
60 | r1 = 0; \ |
61 | *(u64*)(r2 + 0) = r1; \ |
62 | r1 = %[map_hash_48b] ll; \ |
63 | call %[bpf_map_lookup_elem]; \ |
64 | r1 = r10; \ |
65 | r1 += -152; \ |
66 | *(u64*)(r1 + 0) = r0; \ |
67 | if r0 == 0 goto l0_%=; \ |
68 | r3 = *(u64*)(r1 + 0); \ |
69 | r1 = 42; \ |
70 | *(u64*)(r3 + 0) = r1; \ |
71 | l0_%=: exit; \ |
72 | " : |
73 | : __imm(bpf_map_lookup_elem), |
74 | __imm_addr(map_hash_48b) |
75 | : __clobber_all); |
76 | } |
77 | |
78 | char _license[] SEC("license" ) = "GPL" ; |
79 | |