Eduard Zingerman | 18cdc2b | 2023-03-25 04:55:13 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 |
| 2 | /* Converted from tools/testing/selftests/bpf/verifier/raw_tp_writable.c */ |
| 3 | |
| 4 | #include <linux/bpf.h> |
| 5 | #include <bpf/bpf_helpers.h> |
| 6 | #include "bpf_misc.h" |
| 7 | |
| 8 | struct { |
| 9 | __uint(type, BPF_MAP_TYPE_HASH); |
| 10 | __uint(max_entries, 1); |
| 11 | __type(key, long long); |
| 12 | __type(value, long long); |
| 13 | } map_hash_8b SEC(".maps"); |
| 14 | |
| 15 | SEC("raw_tracepoint.w") |
| 16 | __description("raw_tracepoint_writable: reject variable offset") |
| 17 | __failure |
| 18 | __msg("R6 invalid variable buffer offset: off=0, var_off=(0x0; 0xffffffff)") |
| 19 | __flag(BPF_F_ANY_ALIGNMENT) |
| 20 | __naked void tracepoint_writable_reject_variable_offset(void) |
| 21 | { |
| 22 | asm volatile (" \ |
| 23 | /* r6 is our tp buffer */ \ |
| 24 | r6 = *(u64*)(r1 + 0); \ |
| 25 | r1 = %[map_hash_8b] ll; \ |
| 26 | /* move the key (== 0) to r10-8 */ \ |
| 27 | w0 = 0; \ |
| 28 | r2 = r10; \ |
| 29 | r2 += -8; \ |
| 30 | *(u64*)(r2 + 0) = r0; \ |
| 31 | /* lookup in the map */ \ |
| 32 | call %[bpf_map_lookup_elem]; \ |
| 33 | /* exit clean if null */ \ |
| 34 | if r0 != 0 goto l0_%=; \ |
| 35 | exit; \ |
| 36 | l0_%=: /* shift the buffer pointer to a variable location */\ |
| 37 | r0 = *(u32*)(r0 + 0); \ |
| 38 | r6 += r0; \ |
| 39 | /* clobber whatever's there */ \ |
| 40 | r7 = 4242; \ |
| 41 | *(u64*)(r6 + 0) = r7; \ |
| 42 | r0 = 0; \ |
| 43 | exit; \ |
| 44 | " : |
| 45 | : __imm(bpf_map_lookup_elem), |
| 46 | __imm_addr(map_hash_8b) |
| 47 | : __clobber_all); |
| 48 | } |
| 49 | |
| 50 | char _license[] SEC("license") = "GPL"; |