1*35150203SEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2*35150203SEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/prevent_map_lookup.c */
3*35150203SEduard Zingerman
4*35150203SEduard Zingerman #include <linux/bpf.h>
5*35150203SEduard Zingerman #include <bpf/bpf_helpers.h>
6*35150203SEduard Zingerman #include "bpf_misc.h"
7*35150203SEduard Zingerman
8*35150203SEduard Zingerman struct {
9*35150203SEduard Zingerman __uint(type, BPF_MAP_TYPE_STACK_TRACE);
10*35150203SEduard Zingerman __uint(max_entries, 1);
11*35150203SEduard Zingerman __type(key, __u32);
12*35150203SEduard Zingerman __type(value, __u64);
13*35150203SEduard Zingerman } map_stacktrace SEC(".maps");
14*35150203SEduard Zingerman
15*35150203SEduard Zingerman struct {
16*35150203SEduard Zingerman __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
17*35150203SEduard Zingerman __uint(max_entries, 8);
18*35150203SEduard Zingerman __uint(key_size, sizeof(int));
19*35150203SEduard Zingerman __array(values, void (void));
20*35150203SEduard Zingerman } map_prog2_socket SEC(".maps");
21*35150203SEduard Zingerman
22*35150203SEduard Zingerman SEC("perf_event")
23*35150203SEduard Zingerman __description("prevent map lookup in stack trace")
24*35150203SEduard Zingerman __failure __msg("cannot pass map_type 7 into func bpf_map_lookup_elem")
map_lookup_in_stack_trace(void)25*35150203SEduard Zingerman __naked void map_lookup_in_stack_trace(void)
26*35150203SEduard Zingerman {
27*35150203SEduard Zingerman asm volatile (" \
28*35150203SEduard Zingerman r1 = 0; \
29*35150203SEduard Zingerman *(u64*)(r10 - 8) = r1; \
30*35150203SEduard Zingerman r2 = r10; \
31*35150203SEduard Zingerman r2 += -8; \
32*35150203SEduard Zingerman r1 = %[map_stacktrace] ll; \
33*35150203SEduard Zingerman call %[bpf_map_lookup_elem]; \
34*35150203SEduard Zingerman exit; \
35*35150203SEduard Zingerman " :
36*35150203SEduard Zingerman : __imm(bpf_map_lookup_elem),
37*35150203SEduard Zingerman __imm_addr(map_stacktrace)
38*35150203SEduard Zingerman : __clobber_all);
39*35150203SEduard Zingerman }
40*35150203SEduard Zingerman
41*35150203SEduard Zingerman SEC("socket")
42*35150203SEduard Zingerman __description("prevent map lookup in prog array")
43*35150203SEduard Zingerman __failure __msg("cannot pass map_type 3 into func bpf_map_lookup_elem")
44*35150203SEduard Zingerman __failure_unpriv
map_lookup_in_prog_array(void)45*35150203SEduard Zingerman __naked void map_lookup_in_prog_array(void)
46*35150203SEduard Zingerman {
47*35150203SEduard Zingerman asm volatile (" \
48*35150203SEduard Zingerman r1 = 0; \
49*35150203SEduard Zingerman *(u64*)(r10 - 8) = r1; \
50*35150203SEduard Zingerman r2 = r10; \
51*35150203SEduard Zingerman r2 += -8; \
52*35150203SEduard Zingerman r1 = %[map_prog2_socket] ll; \
53*35150203SEduard Zingerman call %[bpf_map_lookup_elem]; \
54*35150203SEduard Zingerman exit; \
55*35150203SEduard Zingerman " :
56*35150203SEduard Zingerman : __imm(bpf_map_lookup_elem),
57*35150203SEduard Zingerman __imm_addr(map_prog2_socket)
58*35150203SEduard Zingerman : __clobber_all);
59*35150203SEduard Zingerman }
60*35150203SEduard Zingerman
61*35150203SEduard Zingerman char _license[] SEC("license") = "GPL";
62