root/tools/testing/selftests/bpf/verifier/raw_tp_writable.c

   1 {
   2         "raw_tracepoint_writable: reject variable offset",
   3         .insns = {
   4                 /* r6 is our tp buffer */
   5                 BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
   6 
   7                 BPF_LD_MAP_FD(BPF_REG_1, 0),
   8                 /* move the key (== 0) to r10-8 */
   9                 BPF_MOV32_IMM(BPF_REG_0, 0),
  10                 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  11                 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  12                 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
  13                 /* lookup in the map */
  14                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
  15                              BPF_FUNC_map_lookup_elem),
  16 
  17                 /* exit clean if null */
  18                 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
  19                 BPF_EXIT_INSN(),
  20 
  21                 /* shift the buffer pointer to a variable location */
  22                 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
  23                 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_0),
  24                 /* clobber whatever's there */
  25                 BPF_MOV64_IMM(BPF_REG_7, 4242),
  26                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_7, 0),
  27 
  28                 BPF_MOV64_IMM(BPF_REG_0, 0),
  29                 BPF_EXIT_INSN(),
  30         },
  31         .fixup_map_hash_8b = { 1, },
  32         .prog_type = BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE,
  33         .errstr = "R6 invalid variable buffer offset: off=0, var_off=(0x0; 0xffffffff)",
  34 },