9e7f74e64a
Adding test to verify that when called from outside of the trampoline provided by kernel, the uretprobe syscall will cause calling process to receive SIGILL signal and the attached bpf program is not executed. Link: https://lore.kernel.org/all/20240611112158.40795-8-jolsa@kernel.org/ Acked-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
17 lines
273 B
C
17 lines
273 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <string.h>
|
|
|
|
struct pt_regs regs;
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
int executed = 0;
|
|
|
|
SEC("uretprobe.multi")
|
|
int test(struct pt_regs *regs)
|
|
{
|
|
executed = 1;
|
|
return 0;
|
|
}
|