1 { 2 "ringbuf: invalid reservation offset 1", 3 .insns = { 4 /* reserve 8 byte ringbuf memory */ 5 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 6 BPF_LD_MAP_FD(BPF_REG_1, 0), 7 BPF_MOV64_IMM(BPF_REG_2, 8), 8 BPF_MOV64_IMM(BPF_REG_3, 0), 9 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve), 10 /* store a pointer to the reserved memory in R6 */ 11 BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), 12 /* check whether the reservation was successful */ 13 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 14 /* spill R6(mem) into the stack */ 15 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8), 16 /* fill it back in R7 */ 17 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_10, -8), 18 /* should be able to access *(R7) = 0 */ 19 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0), 20 /* submit the reserved ringbuf memory */ 21 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 22 /* add invalid offset to reserved ringbuf memory */ 23 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xcafe), 24 BPF_MOV64_IMM(BPF_REG_2, 0), 25 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit), 26 BPF_MOV64_IMM(BPF_REG_0, 0), 27 BPF_EXIT_INSN(), 28 }, 29 .fixup_map_ringbuf = { 1 }, 30 .result = REJECT, 31 .errstr = "dereference of modified alloc_mem ptr R1", 32 }, 33 { 34 "ringbuf: invalid reservation offset 2", 35 .insns = { 36 /* reserve 8 byte ringbuf memory */ 37 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 38 BPF_LD_MAP_FD(BPF_REG_1, 0), 39 BPF_MOV64_IMM(BPF_REG_2, 8), 40 BPF_MOV64_IMM(BPF_REG_3, 0), 41 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve), 42 /* store a pointer to the reserved memory in R6 */ 43 BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), 44 /* check whether the reservation was successful */ 45 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 46 /* spill R6(mem) into the stack */ 47 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8), 48 /* fill it back in R7 */ 49 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_10, -8), 50 /* add invalid offset to reserved ringbuf memory */ 51 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 0xcafe), 52 /* should be able to access *(R7) = 0 */ 53 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0), 54 /* submit the reserved ringbuf memory */ 55 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 56 BPF_MOV64_IMM(BPF_REG_2, 0), 57 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit), 58 BPF_MOV64_IMM(BPF_REG_0, 0), 59 BPF_EXIT_INSN(), 60 }, 61 .fixup_map_ringbuf = { 1 }, 62 .result = REJECT, 63 .errstr = "R7 min value is outside of the allowed memory range", 64 }, 65 { 66 "ringbuf: check passing rb mem to helpers", 67 .insns = { 68 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 69 /* reserve 8 byte ringbuf memory */ 70 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 71 BPF_LD_MAP_FD(BPF_REG_1, 0), 72 BPF_MOV64_IMM(BPF_REG_2, 8), 73 BPF_MOV64_IMM(BPF_REG_3, 0), 74 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve), 75 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), 76 /* check whether the reservation was successful */ 77 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 78 BPF_EXIT_INSN(), 79 /* pass allocated ring buffer memory to fib lookup */ 80 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 81 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), 82 BPF_MOV64_IMM(BPF_REG_3, 8), 83 BPF_MOV64_IMM(BPF_REG_4, 0), 84 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_fib_lookup), 85 /* submit the ringbuf memory */ 86 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 87 BPF_MOV64_IMM(BPF_REG_2, 0), 88 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_submit), 89 BPF_MOV64_IMM(BPF_REG_0, 0), 90 BPF_EXIT_INSN(), 91 }, 92 .fixup_map_ringbuf = { 2 }, 93 .prog_type = BPF_PROG_TYPE_XDP, 94 .result = ACCEPT, 95 }, 96
