0001 {
0002 "map element value is preserved across register spilling",
0003 .insns = {
0004 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0005 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0006 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0007 BPF_LD_MAP_FD(BPF_REG_1, 0),
0008 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0009 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
0010 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
0011 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
0012 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
0013 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
0014 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
0015 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
0016 BPF_EXIT_INSN(),
0017 },
0018 .fixup_map_hash_48b = { 3 },
0019 .errstr_unpriv = "R0 leaks addr",
0020 .result = ACCEPT,
0021 .result_unpriv = REJECT,
0022 },
0023 {
0024 "map element value or null is marked on register spilling",
0025 .insns = {
0026 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0027 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0028 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0029 BPF_LD_MAP_FD(BPF_REG_1, 0),
0030 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0031 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
0032 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
0033 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
0034 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0035 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
0036 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
0037 BPF_EXIT_INSN(),
0038 },
0039 .fixup_map_hash_48b = { 3 },
0040 .errstr_unpriv = "R0 leaks addr",
0041 .result = ACCEPT,
0042 .result_unpriv = REJECT,
0043 },
