root/tools/testing/selftests/bpf/verifier/value_adj_spill.c

   1 {
   2         "map element value is preserved across register spilling",
   3         .insns = {
   4         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
   5         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
   6         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
   7         BPF_LD_MAP_FD(BPF_REG_1, 0),
   8         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
   9         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
  10         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
  11         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
  12         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
  13         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
  14         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
  15         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
  16         BPF_EXIT_INSN(),
  17         },
  18         .fixup_map_hash_48b = { 3 },
  19         .errstr_unpriv = "R0 leaks addr",
  20         .result = ACCEPT,
  21         .result_unpriv = REJECT,
  22 },
  23 {
  24         "map element value or null is marked on register spilling",
  25         .insns = {
  26         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  27         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  28         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
  29         BPF_LD_MAP_FD(BPF_REG_1, 0),
  30         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
  31         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
  32         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
  33         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
  34         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  35         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
  36         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
  37         BPF_EXIT_INSN(),
  38         },
  39         .fixup_map_hash_48b = { 3 },
  40         .errstr_unpriv = "R0 leaks addr",
  41         .result = ACCEPT,
  42         .result_unpriv = REJECT,
  43 },