1 // SPDX-License-Identifier: GPL-2.0
2 /* Converted from tools/testing/selftests/bpf/verifier/value_adj_spill.c */
3
4 #include <linux/bpf.h>
5 #include <bpf/bpf_helpers.h>
6 #include "bpf_misc.h"
7
8 #define MAX_ENTRIES 11
9
10 struct test_val {
11 unsigned int index;
12 int foo[MAX_ENTRIES];
13 };
14
15 struct {
16 __uint(type, BPF_MAP_TYPE_HASH);
17 __uint(max_entries, 1);
18 __type(key, long long);
19 __type(value, struct test_val);
20 } map_hash_48b SEC(".maps");
21
22 SEC("socket")
23 __description("map element value is preserved across register spilling")
24 __success __failure_unpriv __msg_unpriv("R0 leaks addr")
25 __retval(0)
26 __naked void is_preserved_across_register_spilling(void)
27 {
28 asm volatile (" \
29 r2 = r10; \
30 r2 += -8; \
31 r1 = 0; \
32 *(u64*)(r2 + 0) = r1; \
33 r1 = %[map_hash_48b] ll; \
34 call %[bpf_map_lookup_elem]; \
35 if r0 == 0 goto l0_%=; \
36 r1 = 42; \
37 *(u64*)(r0 + 0) = r1; \
38 r1 = r10; \
39 r1 += -184; \
40 *(u64*)(r1 + 0) = r0; \
41 r3 = *(u64*)(r1 + 0); \
42 r1 = 42; \
43 *(u64*)(r3 + 0) = r1; \
44 l0_%=: exit; \
45 " :
46 : __imm(bpf_map_lookup_elem),
47 __imm_addr(map_hash_48b)
48 : __clobber_all);
49 }
50
51 SEC("socket")
52 __description("map element value or null is marked on register spilling")
53 __success __failure_unpriv __msg_unpriv("R0 leaks addr")
54 __retval(0)
55 __naked void is_marked_on_register_spilling(void)
56 {
57 asm volatile (" \
58 r2 = r10; \
59 r2 += -8; \
60 r1 = 0; \
61 *(u64*)(r2 + 0) = r1; \
62 r1 = %[map_hash_48b] ll; \
63 call %[bpf_map_lookup_elem]; \
64 r1 = r10; \
65 r1 += -152; \
66 *(u64*)(r1 + 0) = r0; \
67 if r0 == 0 goto l0_%=; \
68 r3 = *(u64*)(r1 + 0); \
69 r1 = 42; \
70 *(u64*)(r3 + 0) = r1; \
71 l0_%=: exit; \
72 " :
73 : __imm(bpf_map_lookup_elem),
74 __imm_addr(map_hash_48b)
75 : __clobber_all);
76 }
77
78 char _license[] SEC("license") = "GPL";
79
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.