1*35150203SEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2*35150203SEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/prevent_map_lookup.c */
3*35150203SEduard Zingerman 
4*35150203SEduard Zingerman #include <linux/bpf.h>
5*35150203SEduard Zingerman #include <bpf/bpf_helpers.h>
6*35150203SEduard Zingerman #include "bpf_misc.h"
7*35150203SEduard Zingerman 
8*35150203SEduard Zingerman struct {
9*35150203SEduard Zingerman 	__uint(type, BPF_MAP_TYPE_STACK_TRACE);
10*35150203SEduard Zingerman 	__uint(max_entries, 1);
11*35150203SEduard Zingerman 	__type(key, __u32);
12*35150203SEduard Zingerman 	__type(value, __u64);
13*35150203SEduard Zingerman } map_stacktrace SEC(".maps");
14*35150203SEduard Zingerman 
15*35150203SEduard Zingerman struct {
16*35150203SEduard Zingerman 	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
17*35150203SEduard Zingerman 	__uint(max_entries, 8);
18*35150203SEduard Zingerman 	__uint(key_size, sizeof(int));
19*35150203SEduard Zingerman 	__array(values, void (void));
20*35150203SEduard Zingerman } map_prog2_socket SEC(".maps");
21*35150203SEduard Zingerman 
22*35150203SEduard Zingerman SEC("perf_event")
23*35150203SEduard Zingerman __description("prevent map lookup in stack trace")
24*35150203SEduard Zingerman __failure __msg("cannot pass map_type 7 into func bpf_map_lookup_elem")
map_lookup_in_stack_trace(void)25*35150203SEduard Zingerman __naked void map_lookup_in_stack_trace(void)
26*35150203SEduard Zingerman {
27*35150203SEduard Zingerman 	asm volatile ("					\
28*35150203SEduard Zingerman 	r1 = 0;						\
29*35150203SEduard Zingerman 	*(u64*)(r10 - 8) = r1;				\
30*35150203SEduard Zingerman 	r2 = r10;					\
31*35150203SEduard Zingerman 	r2 += -8;					\
32*35150203SEduard Zingerman 	r1 = %[map_stacktrace] ll;			\
33*35150203SEduard Zingerman 	call %[bpf_map_lookup_elem];			\
34*35150203SEduard Zingerman 	exit;						\
35*35150203SEduard Zingerman "	:
36*35150203SEduard Zingerman 	: __imm(bpf_map_lookup_elem),
37*35150203SEduard Zingerman 	  __imm_addr(map_stacktrace)
38*35150203SEduard Zingerman 	: __clobber_all);
39*35150203SEduard Zingerman }
40*35150203SEduard Zingerman 
41*35150203SEduard Zingerman SEC("socket")
42*35150203SEduard Zingerman __description("prevent map lookup in prog array")
43*35150203SEduard Zingerman __failure __msg("cannot pass map_type 3 into func bpf_map_lookup_elem")
44*35150203SEduard Zingerman __failure_unpriv
map_lookup_in_prog_array(void)45*35150203SEduard Zingerman __naked void map_lookup_in_prog_array(void)
46*35150203SEduard Zingerman {
47*35150203SEduard Zingerman 	asm volatile ("					\
48*35150203SEduard Zingerman 	r1 = 0;						\
49*35150203SEduard Zingerman 	*(u64*)(r10 - 8) = r1;				\
50*35150203SEduard Zingerman 	r2 = r10;					\
51*35150203SEduard Zingerman 	r2 += -8;					\
52*35150203SEduard Zingerman 	r1 = %[map_prog2_socket] ll;			\
53*35150203SEduard Zingerman 	call %[bpf_map_lookup_elem];			\
54*35150203SEduard Zingerman 	exit;						\
55*35150203SEduard Zingerman "	:
56*35150203SEduard Zingerman 	: __imm(bpf_map_lookup_elem),
57*35150203SEduard Zingerman 	  __imm_addr(map_prog2_socket)
58*35150203SEduard Zingerman 	: __clobber_all);
59*35150203SEduard Zingerman }
60*35150203SEduard Zingerman 
61*35150203SEduard Zingerman char _license[] SEC("license") = "GPL";
62