1d15f5b68SEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2d15f5b68SEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/var_off.c */
3d15f5b68SEduard Zingerman
4d15f5b68SEduard Zingerman #include <linux/bpf.h>
5d15f5b68SEduard Zingerman #include <bpf/bpf_helpers.h>
6d15f5b68SEduard Zingerman #include "bpf_misc.h"
7d15f5b68SEduard Zingerman
8d15f5b68SEduard Zingerman struct {
9d15f5b68SEduard Zingerman __uint(type, BPF_MAP_TYPE_HASH);
10d15f5b68SEduard Zingerman __uint(max_entries, 1);
11d15f5b68SEduard Zingerman __type(key, long long);
12d15f5b68SEduard Zingerman __type(value, long long);
13d15f5b68SEduard Zingerman } map_hash_8b SEC(".maps");
14d15f5b68SEduard Zingerman
15d15f5b68SEduard Zingerman SEC("lwt_in")
16d15f5b68SEduard Zingerman __description("variable-offset ctx access")
17d15f5b68SEduard Zingerman __failure __msg("variable ctx access var_off=(0x0; 0x4)")
variable_offset_ctx_access(void)18d15f5b68SEduard Zingerman __naked void variable_offset_ctx_access(void)
19d15f5b68SEduard Zingerman {
20d15f5b68SEduard Zingerman asm volatile (" \
21d15f5b68SEduard Zingerman /* Get an unknown value */ \
22d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
23d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned */ \
24d15f5b68SEduard Zingerman r2 &= 4; \
25d15f5b68SEduard Zingerman /* add it to skb. We now have either &skb->len or\
26d15f5b68SEduard Zingerman * &skb->pkt_type, but we don't know which \
27d15f5b68SEduard Zingerman */ \
28d15f5b68SEduard Zingerman r1 += r2; \
29d15f5b68SEduard Zingerman /* dereference it */ \
30d15f5b68SEduard Zingerman r0 = *(u32*)(r1 + 0); \
31d15f5b68SEduard Zingerman exit; \
32d15f5b68SEduard Zingerman " ::: __clobber_all);
33d15f5b68SEduard Zingerman }
34d15f5b68SEduard Zingerman
35d15f5b68SEduard Zingerman SEC("cgroup/skb")
36d15f5b68SEduard Zingerman __description("variable-offset stack read, priv vs unpriv")
37d15f5b68SEduard Zingerman __success __failure_unpriv
38d15f5b68SEduard Zingerman __msg_unpriv("R2 variable stack access prohibited for !root")
39d15f5b68SEduard Zingerman __retval(0)
stack_read_priv_vs_unpriv(void)40d15f5b68SEduard Zingerman __naked void stack_read_priv_vs_unpriv(void)
41d15f5b68SEduard Zingerman {
42d15f5b68SEduard Zingerman asm volatile (" \
43d15f5b68SEduard Zingerman /* Fill the top 8 bytes of the stack */ \
44d15f5b68SEduard Zingerman r0 = 0; \
45d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r0; \
46d15f5b68SEduard Zingerman /* Get an unknown value */ \
47d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
48d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned */ \
49d15f5b68SEduard Zingerman r2 &= 4; \
50d15f5b68SEduard Zingerman r2 -= 8; \
51d15f5b68SEduard Zingerman /* add it to fp. We now have either fp-4 or fp-8, but\
52d15f5b68SEduard Zingerman * we don't know which \
53d15f5b68SEduard Zingerman */ \
54d15f5b68SEduard Zingerman r2 += r10; \
55d15f5b68SEduard Zingerman /* dereference it for a stack read */ \
56d15f5b68SEduard Zingerman r0 = *(u32*)(r2 + 0); \
57d15f5b68SEduard Zingerman r0 = 0; \
58d15f5b68SEduard Zingerman exit; \
59d15f5b68SEduard Zingerman " ::: __clobber_all);
60d15f5b68SEduard Zingerman }
61d15f5b68SEduard Zingerman
62*0954982dSAndrei Matei SEC("cgroup/skb")
63d15f5b68SEduard Zingerman __description("variable-offset stack read, uninitialized")
64*0954982dSAndrei Matei __success
65*0954982dSAndrei Matei __failure_unpriv __msg_unpriv("R2 variable stack access prohibited for !root")
variable_offset_stack_read_uninitialized(void)66d15f5b68SEduard Zingerman __naked void variable_offset_stack_read_uninitialized(void)
67d15f5b68SEduard Zingerman {
68d15f5b68SEduard Zingerman asm volatile (" \
69d15f5b68SEduard Zingerman /* Get an unknown value */ \
70d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
71d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned */ \
72d15f5b68SEduard Zingerman r2 &= 4; \
73d15f5b68SEduard Zingerman r2 -= 8; \
74d15f5b68SEduard Zingerman /* add it to fp. We now have either fp-4 or fp-8, but\
75d15f5b68SEduard Zingerman * we don't know which \
76d15f5b68SEduard Zingerman */ \
77d15f5b68SEduard Zingerman r2 += r10; \
78d15f5b68SEduard Zingerman /* dereference it for a stack read */ \
79d15f5b68SEduard Zingerman r0 = *(u32*)(r2 + 0); \
80d15f5b68SEduard Zingerman r0 = 0; \
81d15f5b68SEduard Zingerman exit; \
82d15f5b68SEduard Zingerman " ::: __clobber_all);
83d15f5b68SEduard Zingerman }
84d15f5b68SEduard Zingerman
85d15f5b68SEduard Zingerman SEC("socket")
86d15f5b68SEduard Zingerman __description("variable-offset stack write, priv vs unpriv")
87*0954982dSAndrei Matei __success
88*0954982dSAndrei Matei /* Check that the maximum stack depth is correctly maintained according to the
89*0954982dSAndrei Matei * maximum possible variable offset.
90*0954982dSAndrei Matei */
91*0954982dSAndrei Matei __log_level(4) __msg("stack depth 16")
92*0954982dSAndrei Matei __failure_unpriv
93d15f5b68SEduard Zingerman /* Variable stack access is rejected for unprivileged.
94d15f5b68SEduard Zingerman */
95d15f5b68SEduard Zingerman __msg_unpriv("R2 variable stack access prohibited for !root")
96d15f5b68SEduard Zingerman __retval(0)
stack_write_priv_vs_unpriv(void)97d15f5b68SEduard Zingerman __naked void stack_write_priv_vs_unpriv(void)
98d15f5b68SEduard Zingerman {
99d15f5b68SEduard Zingerman asm volatile (" \
100d15f5b68SEduard Zingerman /* Get an unknown value */ \
101d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
102d15f5b68SEduard Zingerman /* Make it small and 8-byte aligned */ \
103d15f5b68SEduard Zingerman r2 &= 8; \
104d15f5b68SEduard Zingerman r2 -= 16; \
105*0954982dSAndrei Matei /* Add it to fp. We now have either fp-8 or \
106*0954982dSAndrei Matei * fp-16, but we don't know which \
107*0954982dSAndrei Matei */ \
108*0954982dSAndrei Matei r2 += r10; \
109*0954982dSAndrei Matei /* Dereference it for a stack write */ \
110*0954982dSAndrei Matei r0 = 0; \
111*0954982dSAndrei Matei *(u64*)(r2 + 0) = r0; \
112*0954982dSAndrei Matei exit; \
113*0954982dSAndrei Matei " ::: __clobber_all);
114*0954982dSAndrei Matei }
115*0954982dSAndrei Matei
116*0954982dSAndrei Matei /* Similar to the previous test, but this time also perform a read from the
117*0954982dSAndrei Matei * address written to with a variable offset. The read is allowed, showing that,
118*0954982dSAndrei Matei * after a variable-offset write, a priviledged program can read the slots that
119*0954982dSAndrei Matei * were in the range of that write (even if the verifier doesn't actually know if
120*0954982dSAndrei Matei * the slot being read was really written to or not.
121*0954982dSAndrei Matei *
122*0954982dSAndrei Matei * Despite this test being mostly a superset, the previous test is also kept for
123*0954982dSAndrei Matei * the sake of it checking the stack depth in the case where there is no read.
124*0954982dSAndrei Matei */
125*0954982dSAndrei Matei SEC("socket")
126*0954982dSAndrei Matei __description("variable-offset stack write followed by read")
127*0954982dSAndrei Matei __success
128*0954982dSAndrei Matei /* Check that the maximum stack depth is correctly maintained according to the
129*0954982dSAndrei Matei * maximum possible variable offset.
130*0954982dSAndrei Matei */
131*0954982dSAndrei Matei __log_level(4) __msg("stack depth 16")
132*0954982dSAndrei Matei __failure_unpriv
133*0954982dSAndrei Matei __msg_unpriv("R2 variable stack access prohibited for !root")
134*0954982dSAndrei Matei __retval(0)
stack_write_followed_by_read(void)135*0954982dSAndrei Matei __naked void stack_write_followed_by_read(void)
136*0954982dSAndrei Matei {
137*0954982dSAndrei Matei asm volatile (" \
138*0954982dSAndrei Matei /* Get an unknown value */ \
139*0954982dSAndrei Matei r2 = *(u32*)(r1 + 0); \
140*0954982dSAndrei Matei /* Make it small and 8-byte aligned */ \
141*0954982dSAndrei Matei r2 &= 8; \
142*0954982dSAndrei Matei r2 -= 16; \
143d15f5b68SEduard Zingerman /* Add it to fp. We now have either fp-8 or fp-16, but\
144d15f5b68SEduard Zingerman * we don't know which \
145d15f5b68SEduard Zingerman */ \
146d15f5b68SEduard Zingerman r2 += r10; \
147d15f5b68SEduard Zingerman /* Dereference it for a stack write */ \
148d15f5b68SEduard Zingerman r0 = 0; \
149d15f5b68SEduard Zingerman *(u64*)(r2 + 0) = r0; \
150*0954982dSAndrei Matei /* Now read from the address we just wrote. */ \
151d15f5b68SEduard Zingerman r3 = *(u64*)(r2 + 0); \
152d15f5b68SEduard Zingerman r0 = 0; \
153d15f5b68SEduard Zingerman exit; \
154d15f5b68SEduard Zingerman " ::: __clobber_all);
155d15f5b68SEduard Zingerman }
156d15f5b68SEduard Zingerman
157d15f5b68SEduard Zingerman SEC("socket")
158d15f5b68SEduard Zingerman __description("variable-offset stack write clobbers spilled regs")
159d15f5b68SEduard Zingerman __failure
160d15f5b68SEduard Zingerman /* In the priviledged case, dereferencing a spilled-and-then-filled
161d15f5b68SEduard Zingerman * register is rejected because the previous variable offset stack
162d15f5b68SEduard Zingerman * write might have overwritten the spilled pointer (i.e. we lose track
163d15f5b68SEduard Zingerman * of the spilled register when we analyze the write).
164d15f5b68SEduard Zingerman */
165d15f5b68SEduard Zingerman __msg("R2 invalid mem access 'scalar'")
166d15f5b68SEduard Zingerman __failure_unpriv
167d15f5b68SEduard Zingerman /* The unprivileged case is not too interesting; variable
168d15f5b68SEduard Zingerman * stack access is rejected.
169d15f5b68SEduard Zingerman */
170d15f5b68SEduard Zingerman __msg_unpriv("R2 variable stack access prohibited for !root")
stack_write_clobbers_spilled_regs(void)171d15f5b68SEduard Zingerman __naked void stack_write_clobbers_spilled_regs(void)
172d15f5b68SEduard Zingerman {
173d15f5b68SEduard Zingerman asm volatile (" \
174d15f5b68SEduard Zingerman /* Dummy instruction; needed because we need to patch the next one\
175d15f5b68SEduard Zingerman * and we can't patch the first instruction. \
176d15f5b68SEduard Zingerman */ \
177d15f5b68SEduard Zingerman r6 = 0; \
178d15f5b68SEduard Zingerman /* Make R0 a map ptr */ \
179d15f5b68SEduard Zingerman r0 = %[map_hash_8b] ll; \
180d15f5b68SEduard Zingerman /* Get an unknown value */ \
181d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
182d15f5b68SEduard Zingerman /* Make it small and 8-byte aligned */ \
183d15f5b68SEduard Zingerman r2 &= 8; \
184d15f5b68SEduard Zingerman r2 -= 16; \
185d15f5b68SEduard Zingerman /* Add it to fp. We now have either fp-8 or fp-16, but\
186d15f5b68SEduard Zingerman * we don't know which. \
187d15f5b68SEduard Zingerman */ \
188d15f5b68SEduard Zingerman r2 += r10; \
189d15f5b68SEduard Zingerman /* Spill R0(map ptr) into stack */ \
190d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r0; \
191d15f5b68SEduard Zingerman /* Dereference the unknown value for a stack write */\
192d15f5b68SEduard Zingerman r0 = 0; \
193d15f5b68SEduard Zingerman *(u64*)(r2 + 0) = r0; \
194d15f5b68SEduard Zingerman /* Fill the register back into R2 */ \
195d15f5b68SEduard Zingerman r2 = *(u64*)(r10 - 8); \
196d15f5b68SEduard Zingerman /* Try to dereference R2 for a memory load */ \
197d15f5b68SEduard Zingerman r0 = *(u64*)(r2 + 8); \
198d15f5b68SEduard Zingerman exit; \
199d15f5b68SEduard Zingerman " :
200d15f5b68SEduard Zingerman : __imm_addr(map_hash_8b)
201d15f5b68SEduard Zingerman : __clobber_all);
202d15f5b68SEduard Zingerman }
203d15f5b68SEduard Zingerman
204d15f5b68SEduard Zingerman SEC("sockops")
205d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, unbounded")
206d15f5b68SEduard Zingerman __failure __msg("invalid unbounded variable-offset indirect access to stack R4")
variable_offset_stack_access_unbounded(void)207d15f5b68SEduard Zingerman __naked void variable_offset_stack_access_unbounded(void)
208d15f5b68SEduard Zingerman {
209d15f5b68SEduard Zingerman asm volatile (" \
210d15f5b68SEduard Zingerman r2 = 6; \
211d15f5b68SEduard Zingerman r3 = 28; \
212d15f5b68SEduard Zingerman /* Fill the top 16 bytes of the stack. */ \
213d15f5b68SEduard Zingerman r4 = 0; \
214d15f5b68SEduard Zingerman *(u64*)(r10 - 16) = r4; \
215d15f5b68SEduard Zingerman r4 = 0; \
216d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r4; \
217d15f5b68SEduard Zingerman /* Get an unknown value. */ \
218d15f5b68SEduard Zingerman r4 = *(u64*)(r1 + %[bpf_sock_ops_bytes_received]);\
219d15f5b68SEduard Zingerman /* Check the lower bound but don't check the upper one. */\
220d15f5b68SEduard Zingerman if r4 s< 0 goto l0_%=; \
221d15f5b68SEduard Zingerman /* Point the lower bound to initialized stack. Offset is now in range\
222d15f5b68SEduard Zingerman * from fp-16 to fp+0x7fffffffffffffef, i.e. max value is unbounded.\
223d15f5b68SEduard Zingerman */ \
224d15f5b68SEduard Zingerman r4 -= 16; \
225d15f5b68SEduard Zingerman r4 += r10; \
226d15f5b68SEduard Zingerman r5 = 8; \
227d15f5b68SEduard Zingerman /* Dereference it indirectly. */ \
228d15f5b68SEduard Zingerman call %[bpf_getsockopt]; \
229d15f5b68SEduard Zingerman l0_%=: r0 = 0; \
230d15f5b68SEduard Zingerman exit; \
231d15f5b68SEduard Zingerman " :
232d15f5b68SEduard Zingerman : __imm(bpf_getsockopt),
233d15f5b68SEduard Zingerman __imm_const(bpf_sock_ops_bytes_received, offsetof(struct bpf_sock_ops, bytes_received))
234d15f5b68SEduard Zingerman : __clobber_all);
235d15f5b68SEduard Zingerman }
236d15f5b68SEduard Zingerman
237d15f5b68SEduard Zingerman SEC("lwt_in")
238d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, max out of bound")
239d15f5b68SEduard Zingerman __failure __msg("invalid variable-offset indirect access to stack R2")
access_max_out_of_bound(void)240d15f5b68SEduard Zingerman __naked void access_max_out_of_bound(void)
241d15f5b68SEduard Zingerman {
242d15f5b68SEduard Zingerman asm volatile (" \
243d15f5b68SEduard Zingerman /* Fill the top 8 bytes of the stack */ \
244d15f5b68SEduard Zingerman r2 = 0; \
245d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r2; \
246d15f5b68SEduard Zingerman /* Get an unknown value */ \
247d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
248d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned */ \
249d15f5b68SEduard Zingerman r2 &= 4; \
250d15f5b68SEduard Zingerman r2 -= 8; \
251d15f5b68SEduard Zingerman /* add it to fp. We now have either fp-4 or fp-8, but\
252d15f5b68SEduard Zingerman * we don't know which \
253d15f5b68SEduard Zingerman */ \
254d15f5b68SEduard Zingerman r2 += r10; \
255d15f5b68SEduard Zingerman /* dereference it indirectly */ \
256d15f5b68SEduard Zingerman r1 = %[map_hash_8b] ll; \
257d15f5b68SEduard Zingerman call %[bpf_map_lookup_elem]; \
258d15f5b68SEduard Zingerman r0 = 0; \
259d15f5b68SEduard Zingerman exit; \
260d15f5b68SEduard Zingerman " :
261d15f5b68SEduard Zingerman : __imm(bpf_map_lookup_elem),
262d15f5b68SEduard Zingerman __imm_addr(map_hash_8b)
263d15f5b68SEduard Zingerman : __clobber_all);
264d15f5b68SEduard Zingerman }
265d15f5b68SEduard Zingerman
266d15f5b68SEduard Zingerman SEC("lwt_in")
267d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, min out of bound")
268d15f5b68SEduard Zingerman __failure __msg("invalid variable-offset indirect access to stack R2")
access_min_out_of_bound(void)269d15f5b68SEduard Zingerman __naked void access_min_out_of_bound(void)
270d15f5b68SEduard Zingerman {
271d15f5b68SEduard Zingerman asm volatile (" \
272d15f5b68SEduard Zingerman /* Fill the top 8 bytes of the stack */ \
273d15f5b68SEduard Zingerman r2 = 0; \
274d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r2; \
275d15f5b68SEduard Zingerman /* Get an unknown value */ \
276d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
277d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned */ \
278d15f5b68SEduard Zingerman r2 &= 4; \
279d15f5b68SEduard Zingerman r2 -= 516; \
280d15f5b68SEduard Zingerman /* add it to fp. We now have either fp-516 or fp-512, but\
281d15f5b68SEduard Zingerman * we don't know which \
282d15f5b68SEduard Zingerman */ \
283d15f5b68SEduard Zingerman r2 += r10; \
284d15f5b68SEduard Zingerman /* dereference it indirectly */ \
285d15f5b68SEduard Zingerman r1 = %[map_hash_8b] ll; \
286d15f5b68SEduard Zingerman call %[bpf_map_lookup_elem]; \
287d15f5b68SEduard Zingerman r0 = 0; \
288d15f5b68SEduard Zingerman exit; \
289d15f5b68SEduard Zingerman " :
290d15f5b68SEduard Zingerman : __imm(bpf_map_lookup_elem),
291d15f5b68SEduard Zingerman __imm_addr(map_hash_8b)
292d15f5b68SEduard Zingerman : __clobber_all);
293d15f5b68SEduard Zingerman }
294d15f5b68SEduard Zingerman
295*0954982dSAndrei Matei SEC("cgroup/skb")
296d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, min_off < min_initialized")
297*0954982dSAndrei Matei __success
298*0954982dSAndrei Matei __failure_unpriv __msg_unpriv("R2 variable stack access prohibited for !root")
access_min_off_min_initialized(void)299d15f5b68SEduard Zingerman __naked void access_min_off_min_initialized(void)
300d15f5b68SEduard Zingerman {
301d15f5b68SEduard Zingerman asm volatile (" \
302d15f5b68SEduard Zingerman /* Fill only the top 8 bytes of the stack. */ \
303d15f5b68SEduard Zingerman r2 = 0; \
304d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r2; \
305d15f5b68SEduard Zingerman /* Get an unknown value */ \
306d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
307d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned. */ \
308d15f5b68SEduard Zingerman r2 &= 4; \
309d15f5b68SEduard Zingerman r2 -= 16; \
310d15f5b68SEduard Zingerman /* Add it to fp. We now have either fp-12 or fp-16, but we don't know\
311d15f5b68SEduard Zingerman * which. fp-16 size 8 is partially uninitialized stack.\
312d15f5b68SEduard Zingerman */ \
313d15f5b68SEduard Zingerman r2 += r10; \
314d15f5b68SEduard Zingerman /* Dereference it indirectly. */ \
315d15f5b68SEduard Zingerman r1 = %[map_hash_8b] ll; \
316d15f5b68SEduard Zingerman call %[bpf_map_lookup_elem]; \
317d15f5b68SEduard Zingerman r0 = 0; \
318d15f5b68SEduard Zingerman exit; \
319d15f5b68SEduard Zingerman " :
320d15f5b68SEduard Zingerman : __imm(bpf_map_lookup_elem),
321d15f5b68SEduard Zingerman __imm_addr(map_hash_8b)
322d15f5b68SEduard Zingerman : __clobber_all);
323d15f5b68SEduard Zingerman }
324d15f5b68SEduard Zingerman
325d15f5b68SEduard Zingerman SEC("cgroup/skb")
326d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, priv vs unpriv")
327d15f5b68SEduard Zingerman __success __failure_unpriv
328d15f5b68SEduard Zingerman __msg_unpriv("R2 variable stack access prohibited for !root")
329d15f5b68SEduard Zingerman __retval(0)
stack_access_priv_vs_unpriv(void)330d15f5b68SEduard Zingerman __naked void stack_access_priv_vs_unpriv(void)
331d15f5b68SEduard Zingerman {
332d15f5b68SEduard Zingerman asm volatile (" \
333d15f5b68SEduard Zingerman /* Fill the top 16 bytes of the stack. */ \
334d15f5b68SEduard Zingerman r2 = 0; \
335d15f5b68SEduard Zingerman *(u64*)(r10 - 16) = r2; \
336d15f5b68SEduard Zingerman r2 = 0; \
337d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r2; \
338d15f5b68SEduard Zingerman /* Get an unknown value. */ \
339d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
340d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned. */ \
341d15f5b68SEduard Zingerman r2 &= 4; \
342d15f5b68SEduard Zingerman r2 -= 16; \
343d15f5b68SEduard Zingerman /* Add it to fp. We now have either fp-12 or fp-16, we don't know\
344d15f5b68SEduard Zingerman * which, but either way it points to initialized stack.\
345d15f5b68SEduard Zingerman */ \
346d15f5b68SEduard Zingerman r2 += r10; \
347d15f5b68SEduard Zingerman /* Dereference it indirectly. */ \
348d15f5b68SEduard Zingerman r1 = %[map_hash_8b] ll; \
349d15f5b68SEduard Zingerman call %[bpf_map_lookup_elem]; \
350d15f5b68SEduard Zingerman r0 = 0; \
351d15f5b68SEduard Zingerman exit; \
352d15f5b68SEduard Zingerman " :
353d15f5b68SEduard Zingerman : __imm(bpf_map_lookup_elem),
354d15f5b68SEduard Zingerman __imm_addr(map_hash_8b)
355d15f5b68SEduard Zingerman : __clobber_all);
356d15f5b68SEduard Zingerman }
357d15f5b68SEduard Zingerman
358d15f5b68SEduard Zingerman SEC("lwt_in")
359d15f5b68SEduard Zingerman __description("indirect variable-offset stack access, ok")
360d15f5b68SEduard Zingerman __success __retval(0)
variable_offset_stack_access_ok(void)361d15f5b68SEduard Zingerman __naked void variable_offset_stack_access_ok(void)
362d15f5b68SEduard Zingerman {
363d15f5b68SEduard Zingerman asm volatile (" \
364d15f5b68SEduard Zingerman /* Fill the top 16 bytes of the stack. */ \
365d15f5b68SEduard Zingerman r2 = 0; \
366d15f5b68SEduard Zingerman *(u64*)(r10 - 16) = r2; \
367d15f5b68SEduard Zingerman r2 = 0; \
368d15f5b68SEduard Zingerman *(u64*)(r10 - 8) = r2; \
369d15f5b68SEduard Zingerman /* Get an unknown value. */ \
370d15f5b68SEduard Zingerman r2 = *(u32*)(r1 + 0); \
371d15f5b68SEduard Zingerman /* Make it small and 4-byte aligned. */ \
372d15f5b68SEduard Zingerman r2 &= 4; \
373d15f5b68SEduard Zingerman r2 -= 16; \
374d15f5b68SEduard Zingerman /* Add it to fp. We now have either fp-12 or fp-16, we don't know\
375d15f5b68SEduard Zingerman * which, but either way it points to initialized stack.\
376d15f5b68SEduard Zingerman */ \
377d15f5b68SEduard Zingerman r2 += r10; \
378d15f5b68SEduard Zingerman /* Dereference it indirectly. */ \
379d15f5b68SEduard Zingerman r1 = %[map_hash_8b] ll; \
380d15f5b68SEduard Zingerman call %[bpf_map_lookup_elem]; \
381d15f5b68SEduard Zingerman r0 = 0; \
382d15f5b68SEduard Zingerman exit; \
383d15f5b68SEduard Zingerman " :
384d15f5b68SEduard Zingerman : __imm(bpf_map_lookup_elem),
385d15f5b68SEduard Zingerman __imm_addr(map_hash_8b)
386d15f5b68SEduard Zingerman : __clobber_all);
387d15f5b68SEduard Zingerman }
388d15f5b68SEduard Zingerman
389d15f5b68SEduard Zingerman char _license[] SEC("license") = "GPL";
390