projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
bpf: change bpf_probe_write_user to bpf_trace_printk in test_verifier
[linux-2.6-block.git] / tools / testing / selftests / bpf / test_verifier.c
CommitLineData
3c731eba
AS		 1/*
2 * Testsuite for eBPF verifier
3 *
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
9 */
5aa5bd14 10
2c460621 11#include <endian.h>
1da8ac7c
AS		 12#include <asm/types.h>
13#include <linux/types.h>
702498a1 14#include <stdint.h>
3c731eba 15#include <stdio.h>
702498a1 16#include <stdlib.h>
3c731eba 17#include <unistd.h>
3c731eba 18#include <errno.h>
3c731eba 19#include <string.h>
614cd3bd 20#include <stddef.h>
bf508877 21#include <stdbool.h>
5aa5bd14
DB		 22#include <sched.h>
23
d02d8986 24#include <sys/capability.h>
bf508877 25#include <sys/resource.h>
3c731eba 26
5aa5bd14
DB		 27#include <linux/unistd.h>
28#include <linux/filter.h>
29#include <linux/bpf_perf_event.h>
30#include <linux/bpf.h>
31
2ee89fb9
MS		 32#include <bpf/bpf.h>
33
02ea80b1
DB		 34#ifdef HAVE_GENHDR
35# include "autoconf.h"
36#else
37# if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
38# define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
39# endif
40#endif
41
5aa5bd14
DB		 42#include "../../../include/linux/filter.h"
43
5aa5bd14
DB		 44#ifndef ARRAY_SIZE
45# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
46#endif
3c731eba 47
5aa5bd14
DB		 48#define MAX_INSNS 512
49#define MAX_FIXUPS 8
fb30d4b7 50#define MAX_NR_MAPS 4
bf508877 51
02ea80b1 52#define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
614d0d77 53#define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
02ea80b1 54
3c731eba
AS		 55struct bpf_test {
56 const char *descr;
57 struct bpf_insn insns[MAX_INSNS];
5aa5bd14
DB		 58 int fixup_map1[MAX_FIXUPS];
59 int fixup_map2[MAX_FIXUPS];
60 int fixup_prog[MAX_FIXUPS];
fb30d4b7 61 int fixup_map_in_map[MAX_FIXUPS];
3c731eba 62 const char *errstr;
bf508877 63 const char *errstr_unpriv;
3c731eba 64 enum {
bf508877 65 UNDEF,
3c731eba
AS		 66 ACCEPT,
67 REJECT
bf508877 68 } result, result_unpriv;
d691f9e8 69 enum bpf_prog_type prog_type;
02ea80b1 70 uint8_t flags;
3c731eba
AS		 71};
72
48461135
JB		 73/* Note we want this to be 64 bit aligned so that the end of our array is
74 * actually the end of the structure.
75 */
76#define MAX_ENTRIES 11
5aa5bd14 77
48461135 78struct test_val {
5aa5bd14 79 unsigned int index;
48461135
JB		 80 int foo[MAX_ENTRIES];
81};
82
3c731eba
AS		 83static struct bpf_test tests[] = {
84 {
85 "add+sub+mul",
86 .insns = {
87 BPF_MOV64_IMM(BPF_REG_1, 1),
88 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
89 BPF_MOV64_IMM(BPF_REG_2, 3),
90 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
91 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
92 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
93 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
94 BPF_EXIT_INSN(),
95 },
96 .result = ACCEPT,
97 },
98 {
99 "unreachable",
100 .insns = {
101 BPF_EXIT_INSN(),
102 BPF_EXIT_INSN(),
103 },
104 .errstr = "unreachable",
105 .result = REJECT,
106 },
107 {
108 "unreachable2",
109 .insns = {
110 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
111 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
112 BPF_EXIT_INSN(),
113 },
114 .errstr = "unreachable",
115 .result = REJECT,
116 },
117 {
118 "out of range jump",
119 .insns = {
120 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
121 BPF_EXIT_INSN(),
122 },
123 .errstr = "jump out of range",
124 .result = REJECT,
125 },
126 {
127 "out of range jump2",
128 .insns = {
129 BPF_JMP_IMM(BPF_JA, 0, 0, -2),
130 BPF_EXIT_INSN(),
131 },
132 .errstr = "jump out of range",
133 .result = REJECT,
134 },
135 {
136 "test1 ld_imm64",
137 .insns = {
138 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
139 BPF_LD_IMM64(BPF_REG_0, 0),
140 BPF_LD_IMM64(BPF_REG_0, 0),
141 BPF_LD_IMM64(BPF_REG_0, 1),
142 BPF_LD_IMM64(BPF_REG_0, 1),
143 BPF_MOV64_IMM(BPF_REG_0, 2),
144 BPF_EXIT_INSN(),
145 },
146 .errstr = "invalid BPF_LD_IMM insn",
bf508877 147 .errstr_unpriv = "R1 pointer comparison",
3c731eba
AS		 148 .result = REJECT,
149 },
150 {
151 "test2 ld_imm64",
152 .insns = {
153 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
154 BPF_LD_IMM64(BPF_REG_0, 0),
155 BPF_LD_IMM64(BPF_REG_0, 0),
156 BPF_LD_IMM64(BPF_REG_0, 1),
157 BPF_LD_IMM64(BPF_REG_0, 1),
158 BPF_EXIT_INSN(),
159 },
160 .errstr = "invalid BPF_LD_IMM insn",
bf508877 161 .errstr_unpriv = "R1 pointer comparison",
3c731eba
AS		 162 .result = REJECT,
163 },
164 {
165 "test3 ld_imm64",
166 .insns = {
167 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
168 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
169 BPF_LD_IMM64(BPF_REG_0, 0),
170 BPF_LD_IMM64(BPF_REG_0, 0),
171 BPF_LD_IMM64(BPF_REG_0, 1),
172 BPF_LD_IMM64(BPF_REG_0, 1),
173 BPF_EXIT_INSN(),
174 },
175 .errstr = "invalid bpf_ld_imm64 insn",
176 .result = REJECT,
177 },
178 {
179 "test4 ld_imm64",
180 .insns = {
181 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
182 BPF_EXIT_INSN(),
183 },
184 .errstr = "invalid bpf_ld_imm64 insn",
185 .result = REJECT,
186 },
187 {
188 "test5 ld_imm64",
189 .insns = {
190 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
191 },
192 .errstr = "invalid bpf_ld_imm64 insn",
193 .result = REJECT,
194 },
728a853a
DB		 195 {
196 "test6 ld_imm64",
197 .insns = {
198 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
199 BPF_RAW_INSN(0, 0, 0, 0, 0),
200 BPF_EXIT_INSN(),
201 },
202 .result = ACCEPT,
203 },
204 {
205 "test7 ld_imm64",
206 .insns = {
207 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
208 BPF_RAW_INSN(0, 0, 0, 0, 1),
209 BPF_EXIT_INSN(),
210 },
211 .result = ACCEPT,
212 },
213 {
214 "test8 ld_imm64",
215 .insns = {
216 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
217 BPF_RAW_INSN(0, 0, 0, 0, 1),
218 BPF_EXIT_INSN(),
219 },
220 .errstr = "uses reserved fields",
221 .result = REJECT,
222 },
223 {
224 "test9 ld_imm64",
225 .insns = {
226 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
227 BPF_RAW_INSN(0, 0, 0, 1, 1),
228 BPF_EXIT_INSN(),
229 },
230 .errstr = "invalid bpf_ld_imm64 insn",
231 .result = REJECT,
232 },
233 {
234 "test10 ld_imm64",
235 .insns = {
236 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
237 BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
238 BPF_EXIT_INSN(),
239 },
240 .errstr = "invalid bpf_ld_imm64 insn",
241 .result = REJECT,
242 },
243 {
244 "test11 ld_imm64",
245 .insns = {
246 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
247 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
248 BPF_EXIT_INSN(),
249 },
250 .errstr = "invalid bpf_ld_imm64 insn",
251 .result = REJECT,
252 },
253 {
254 "test12 ld_imm64",
255 .insns = {
256 BPF_MOV64_IMM(BPF_REG_1, 0),
257 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
258 BPF_RAW_INSN(0, 0, 0, 0, 1),
259 BPF_EXIT_INSN(),
260 },
261 .errstr = "not pointing to valid bpf_map",
262 .result = REJECT,
263 },
264 {
265 "test13 ld_imm64",
266 .insns = {
267 BPF_MOV64_IMM(BPF_REG_1, 0),
268 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
269 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
270 BPF_EXIT_INSN(),
271 },
272 .errstr = "invalid bpf_ld_imm64 insn",
273 .result = REJECT,
274 },
3c731eba
AS		 275 {
276 "no bpf_exit",
277 .insns = {
278 BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
279 },
280 .errstr = "jump out of range",
281 .result = REJECT,
282 },
283 {
284 "loop (back-edge)",
285 .insns = {
286 BPF_JMP_IMM(BPF_JA, 0, 0, -1),
287 BPF_EXIT_INSN(),
288 },
289 .errstr = "back-edge",
290 .result = REJECT,
291 },
292 {
293 "loop2 (back-edge)",
294 .insns = {
295 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
296 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
297 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
298 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
299 BPF_EXIT_INSN(),
300 },
301 .errstr = "back-edge",
302 .result = REJECT,
303 },
304 {
305 "conditional loop",
306 .insns = {
307 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
308 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
309 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
310 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
311 BPF_EXIT_INSN(),
312 },
313 .errstr = "back-edge",
314 .result = REJECT,
315 },
316 {
317 "read uninitialized register",
318 .insns = {
319 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
320 BPF_EXIT_INSN(),
321 },
322 .errstr = "R2 !read_ok",
323 .result = REJECT,
324 },
325 {
326 "read invalid register",
327 .insns = {
328 BPF_MOV64_REG(BPF_REG_0, -1),
329 BPF_EXIT_INSN(),
330 },
331 .errstr = "R15 is invalid",
332 .result = REJECT,
333 },
334 {
335 "program doesn't init R0 before exit",
336 .insns = {
337 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
338 BPF_EXIT_INSN(),
339 },
340 .errstr = "R0 !read_ok",
341 .result = REJECT,
342 },
32bf08a6
AS		 343 {
344 "program doesn't init R0 before exit in all branches",
345 .insns = {
346 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
347 BPF_MOV64_IMM(BPF_REG_0, 1),
348 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
349 BPF_EXIT_INSN(),
350 },
351 .errstr = "R0 !read_ok",
bf508877 352 .errstr_unpriv = "R1 pointer comparison",
32bf08a6
AS		 353 .result = REJECT,
354 },
3c731eba
AS		 355 {
356 "stack out of bounds",
357 .insns = {
358 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
359 BPF_EXIT_INSN(),
360 },
361 .errstr = "invalid stack",
362 .result = REJECT,
363 },
364 {
365 "invalid call insn1",
366 .insns = {
367 BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
368 BPF_EXIT_INSN(),
369 },
370 .errstr = "BPF_CALL uses reserved",
371 .result = REJECT,
372 },
373 {
374 "invalid call insn2",
375 .insns = {
376 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
377 BPF_EXIT_INSN(),
378 },
379 .errstr = "BPF_CALL uses reserved",
380 .result = REJECT,
381 },
382 {
383 "invalid function call",
384 .insns = {
385 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
386 BPF_EXIT_INSN(),
387 },
e00c7b21 388 .errstr = "invalid func unknown#1234567",
3c731eba
AS		 389 .result = REJECT,
390 },
391 {
392 "uninitialized stack1",
393 .insns = {
394 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
395 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
396 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 397 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
398 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 399 BPF_EXIT_INSN(),
400 },
5aa5bd14 401 .fixup_map1 = { 2 },
3c731eba
AS		 402 .errstr = "invalid indirect read from stack",
403 .result = REJECT,
404 },
405 {
406 "uninitialized stack2",
407 .insns = {
408 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
409 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
410 BPF_EXIT_INSN(),
411 },
412 .errstr = "invalid read from stack",
413 .result = REJECT,
414 },
728a853a
DB		 415 {
416 "invalid fp arithmetic",
417 /* If this gets ever changed, make sure JITs can deal with it. */
418 .insns = {
419 BPF_MOV64_IMM(BPF_REG_0, 0),
420 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
421 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
422 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
423 BPF_EXIT_INSN(),
424 },
f65b1849 425 .errstr_unpriv = "R1 subtraction from stack pointer",
728a853a
DB		 426 .result_unpriv = REJECT,
427 .errstr = "R1 invalid mem access",
428 .result = REJECT,
429 },
430 {
431 "non-invalid fp arithmetic",
432 .insns = {
433 BPF_MOV64_IMM(BPF_REG_0, 0),
434 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
435 BPF_EXIT_INSN(),
436 },
437 .result = ACCEPT,
438 },
7d95b0ab
DB		 439 {
440 "invalid argument register",
441 .insns = {
5aa5bd14
DB		 442 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
443 BPF_FUNC_get_cgroup_classid),
444 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
445 BPF_FUNC_get_cgroup_classid),
7d95b0ab
DB		 446 BPF_EXIT_INSN(),
447 },
448 .errstr = "R1 !read_ok",
449 .result = REJECT,
450 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
451 },
452 {
453 "non-invalid argument register",
454 .insns = {
455 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
5aa5bd14
DB		 456 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
457 BPF_FUNC_get_cgroup_classid),
7d95b0ab 458 BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
5aa5bd14
DB		 459 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
460 BPF_FUNC_get_cgroup_classid),
7d95b0ab
DB		 461 BPF_EXIT_INSN(),
462 },
463 .result = ACCEPT,
464 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
465 },
3c731eba
AS		 466 {
467 "check valid spill/fill",
468 .insns = {
469 /* spill R1(ctx) into stack */
470 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3c731eba
AS		 471 /* fill it back into R2 */
472 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3c731eba 473 /* should be able to access R0 = *(R2 + 8) */
f91fe17e
DB		 474 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
475 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3c731eba
AS		 476 BPF_EXIT_INSN(),
477 },
bf508877 478 .errstr_unpriv = "R0 leaks addr",
3c731eba 479 .result = ACCEPT,
bf508877 480 .result_unpriv = REJECT,
3c731eba 481 },
3f2050e2
DB		 482 {
483 "check valid spill/fill, skb mark",
484 .insns = {
485 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
486 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
487 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
488 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
489 offsetof(struct __sk_buff, mark)),
490 BPF_EXIT_INSN(),
491 },
492 .result = ACCEPT,
493 .result_unpriv = ACCEPT,
494 },
3c731eba
AS		 495 {
496 "check corrupted spill/fill",
497 .insns = {
498 /* spill R1(ctx) into stack */
499 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3c731eba
AS		 500 /* mess up with R1 pointer on stack */
501 BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
3c731eba
AS		 502 /* fill back into R0 should fail */
503 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3c731eba
AS		 504 BPF_EXIT_INSN(),
505 },
bf508877 506 .errstr_unpriv = "attempt to corrupt spilled",
3c731eba
AS		 507 .errstr = "corrupted spill",
508 .result = REJECT,
509 },
510 {
511 "invalid src register in STX",
512 .insns = {
513 BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
514 BPF_EXIT_INSN(),
515 },
516 .errstr = "R15 is invalid",
517 .result = REJECT,
518 },
519 {
520 "invalid dst register in STX",
521 .insns = {
522 BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
523 BPF_EXIT_INSN(),
524 },
525 .errstr = "R14 is invalid",
526 .result = REJECT,
527 },
528 {
529 "invalid dst register in ST",
530 .insns = {
531 BPF_ST_MEM(BPF_B, 14, -1, -1),
532 BPF_EXIT_INSN(),
533 },
534 .errstr = "R14 is invalid",
535 .result = REJECT,
536 },
537 {
538 "invalid src register in LDX",
539 .insns = {
540 BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
541 BPF_EXIT_INSN(),
542 },
543 .errstr = "R12 is invalid",
544 .result = REJECT,
545 },
546 {
547 "invalid dst register in LDX",
548 .insns = {
549 BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
550 BPF_EXIT_INSN(),
551 },
552 .errstr = "R11 is invalid",
553 .result = REJECT,
554 },
555 {
556 "junk insn",
557 .insns = {
558 BPF_RAW_INSN(0, 0, 0, 0, 0),
559 BPF_EXIT_INSN(),
560 },
561 .errstr = "invalid BPF_LD_IMM",
562 .result = REJECT,
563 },
564 {
565 "junk insn2",
566 .insns = {
567 BPF_RAW_INSN(1, 0, 0, 0, 0),
568 BPF_EXIT_INSN(),
569 },
570 .errstr = "BPF_LDX uses reserved fields",
571 .result = REJECT,
572 },
573 {
574 "junk insn3",
575 .insns = {
576 BPF_RAW_INSN(-1, 0, 0, 0, 0),
577 BPF_EXIT_INSN(),
578 },
579 .errstr = "invalid BPF_ALU opcode f0",
580 .result = REJECT,
581 },
582 {
583 "junk insn4",
584 .insns = {
585 BPF_RAW_INSN(-1, -1, -1, -1, -1),
586 BPF_EXIT_INSN(),
587 },
588 .errstr = "invalid BPF_ALU opcode f0",
589 .result = REJECT,
590 },
591 {
592 "junk insn5",
593 .insns = {
594 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
595 BPF_EXIT_INSN(),
596 },
597 .errstr = "BPF_ALU uses reserved fields",
598 .result = REJECT,
599 },
600 {
601 "misaligned read from stack",
602 .insns = {
603 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
604 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
605 BPF_EXIT_INSN(),
606 },
f65b1849 607 .errstr = "misaligned stack access",
3c731eba 608 .result = REJECT,
f65b1849 609 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3c731eba
AS		 610 },
611 {
612 "invalid map_fd for function call",
613 .insns = {
614 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
615 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
616 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
617 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 618 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
619 BPF_FUNC_map_delete_elem),
3c731eba
AS		 620 BPF_EXIT_INSN(),
621 },
622 .errstr = "fd 0 is not pointing to valid bpf_map",
623 .result = REJECT,
624 },
625 {
626 "don't check return value before access",
627 .insns = {
628 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
629 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
630 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
631 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 632 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
633 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 634 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
635 BPF_EXIT_INSN(),
636 },
5aa5bd14 637 .fixup_map1 = { 3 },
3c731eba
AS		 638 .errstr = "R0 invalid mem access 'map_value_or_null'",
639 .result = REJECT,
640 },
641 {
642 "access memory with incorrect alignment",
643 .insns = {
644 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
645 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
646 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
647 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 648 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
649 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 650 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
651 BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
652 BPF_EXIT_INSN(),
653 },
5aa5bd14 654 .fixup_map1 = { 3 },
f65b1849 655 .errstr = "misaligned value access",
3c731eba 656 .result = REJECT,
f65b1849 657 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3c731eba
AS		 658 },
659 {
660 "sometimes access memory with incorrect alignment",
661 .insns = {
662 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
663 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
664 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
665 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 666 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
667 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 668 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
669 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
670 BPF_EXIT_INSN(),
671 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
672 BPF_EXIT_INSN(),
673 },
5aa5bd14 674 .fixup_map1 = { 3 },
3c731eba 675 .errstr = "R0 invalid mem access",
bf508877 676 .errstr_unpriv = "R0 leaks addr",
3c731eba 677 .result = REJECT,
f65b1849 678 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3c731eba 679 },
fd10c2ef
AS		 680 {
681 "jump test 1",
682 .insns = {
683 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
684 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
685 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
686 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
687 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
688 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
689 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
690 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
691 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
692 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
693 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
694 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
695 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
696 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
697 BPF_MOV64_IMM(BPF_REG_0, 0),
698 BPF_EXIT_INSN(),
699 },
bf508877
AS		 700 .errstr_unpriv = "R1 pointer comparison",
701 .result_unpriv = REJECT,
fd10c2ef
AS		 702 .result = ACCEPT,
703 },
704 {
705 "jump test 2",
706 .insns = {
707 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
708 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
709 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
710 BPF_JMP_IMM(BPF_JA, 0, 0, 14),
711 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
712 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
713 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
714 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
715 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
716 BPF_JMP_IMM(BPF_JA, 0, 0, 8),
717 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
718 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
719 BPF_JMP_IMM(BPF_JA, 0, 0, 5),
720 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
721 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
722 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
723 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
724 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
725 BPF_MOV64_IMM(BPF_REG_0, 0),
726 BPF_EXIT_INSN(),
727 },
bf508877
AS		 728 .errstr_unpriv = "R1 pointer comparison",
729 .result_unpriv = REJECT,
fd10c2ef
AS		 730 .result = ACCEPT,
731 },
732 {
733 "jump test 3",
734 .insns = {
735 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
736 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
737 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
738 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
739 BPF_JMP_IMM(BPF_JA, 0, 0, 19),
740 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
741 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
742 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
743 BPF_JMP_IMM(BPF_JA, 0, 0, 15),
744 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
745 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
746 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
747 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
748 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
749 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
750 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
751 BPF_JMP_IMM(BPF_JA, 0, 0, 7),
752 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
753 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
755 BPF_JMP_IMM(BPF_JA, 0, 0, 3),
756 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
757 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
758 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
759 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 760 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
761 BPF_FUNC_map_delete_elem),
fd10c2ef
AS		 762 BPF_EXIT_INSN(),
763 },
5aa5bd14 764 .fixup_map1 = { 24 },
bf508877
AS		 765 .errstr_unpriv = "R1 pointer comparison",
766 .result_unpriv = REJECT,
fd10c2ef
AS		 767 .result = ACCEPT,
768 },
769 {
770 "jump test 4",
771 .insns = {
772 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
773 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
774 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
775 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
776 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
777 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
778 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
779 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
780 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
781 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
782 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
783 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
784 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
785 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
786 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
787 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
788 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
789 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
790 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
791 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
792 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
793 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
794 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
796 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
798 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
799 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
800 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
801 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
802 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
803 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
804 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
805 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
806 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
807 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
808 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
809 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
810 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
811 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
812 BPF_MOV64_IMM(BPF_REG_0, 0),
813 BPF_EXIT_INSN(),
814 },
bf508877
AS		 815 .errstr_unpriv = "R1 pointer comparison",
816 .result_unpriv = REJECT,
fd10c2ef
AS		 817 .result = ACCEPT,
818 },
342ded40
AS		 819 {
820 "jump test 5",
821 .insns = {
822 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
823 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
824 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
825 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
826 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
827 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
828 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
829 BPF_MOV64_IMM(BPF_REG_0, 0),
830 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
831 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
832 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
833 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
834 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
835 BPF_MOV64_IMM(BPF_REG_0, 0),
836 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
837 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
838 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
839 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
840 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
841 BPF_MOV64_IMM(BPF_REG_0, 0),
842 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
843 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
844 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
845 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
846 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
847 BPF_MOV64_IMM(BPF_REG_0, 0),
848 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
849 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
850 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
851 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
852 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
853 BPF_MOV64_IMM(BPF_REG_0, 0),
854 BPF_EXIT_INSN(),
855 },
bf508877
AS		 856 .errstr_unpriv = "R1 pointer comparison",
857 .result_unpriv = REJECT,
342ded40
AS		 858 .result = ACCEPT,
859 },
614cd3bd
AS		 860 {
861 "access skb fields ok",
862 .insns = {
863 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
864 offsetof(struct __sk_buff, len)),
865 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
866 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
867 offsetof(struct __sk_buff, mark)),
868 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
869 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
870 offsetof(struct __sk_buff, pkt_type)),
871 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
872 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
873 offsetof(struct __sk_buff, queue_mapping)),
874 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
c2497395
AS		 875 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
876 offsetof(struct __sk_buff, protocol)),
877 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
878 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
879 offsetof(struct __sk_buff, vlan_present)),
880 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
881 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
882 offsetof(struct __sk_buff, vlan_tci)),
883 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
b1d9fc41
DB		 884 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
885 offsetof(struct __sk_buff, napi_id)),
886 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
614cd3bd
AS		 887 BPF_EXIT_INSN(),
888 },
889 .result = ACCEPT,
890 },
891 {
892 "access skb fields bad1",
893 .insns = {
894 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
895 BPF_EXIT_INSN(),
896 },
897 .errstr = "invalid bpf_context access",
898 .result = REJECT,
899 },
900 {
901 "access skb fields bad2",
902 .insns = {
903 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
904 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
905 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
906 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
907 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 908 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
909 BPF_FUNC_map_lookup_elem),
614cd3bd
AS		 910 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
911 BPF_EXIT_INSN(),
912 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
913 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
914 offsetof(struct __sk_buff, pkt_type)),
915 BPF_EXIT_INSN(),
916 },
5aa5bd14 917 .fixup_map1 = { 4 },
614cd3bd 918 .errstr = "different pointers",
bf508877 919 .errstr_unpriv = "R1 pointer comparison",
614cd3bd
AS		 920 .result = REJECT,
921 },
922 {
923 "access skb fields bad3",
924 .insns = {
925 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
926 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
927 offsetof(struct __sk_buff, pkt_type)),
928 BPF_EXIT_INSN(),
929 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
930 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
931 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
932 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 933 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
934 BPF_FUNC_map_lookup_elem),
614cd3bd
AS		 935 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
936 BPF_EXIT_INSN(),
937 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
938 BPF_JMP_IMM(BPF_JA, 0, 0, -12),
939 },
5aa5bd14 940 .fixup_map1 = { 6 },
614cd3bd 941 .errstr = "different pointers",
bf508877 942 .errstr_unpriv = "R1 pointer comparison",
614cd3bd
AS		 943 .result = REJECT,
944 },
725f9dcd
AS		 945 {
946 "access skb fields bad4",
947 .insns = {
948 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
949 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
950 offsetof(struct __sk_buff, len)),
951 BPF_MOV64_IMM(BPF_REG_0, 0),
952 BPF_EXIT_INSN(),
953 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
954 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
955 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
956 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 957 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
958 BPF_FUNC_map_lookup_elem),
725f9dcd
AS		 959 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
960 BPF_EXIT_INSN(),
961 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
962 BPF_JMP_IMM(BPF_JA, 0, 0, -13),
963 },
5aa5bd14 964 .fixup_map1 = { 7 },
725f9dcd 965 .errstr = "different pointers",
bf508877 966 .errstr_unpriv = "R1 pointer comparison",
725f9dcd
AS		 967 .result = REJECT,
968 },
41bc94f5
JF		 969 {
970 "invalid access __sk_buff family",
971 .insns = {
972 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
973 offsetof(struct __sk_buff, family)),
974 BPF_EXIT_INSN(),
975 },
976 .errstr = "invalid bpf_context access",
977 .result = REJECT,
978 },
979 {
980 "invalid access __sk_buff remote_ip4",
981 .insns = {
982 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
983 offsetof(struct __sk_buff, remote_ip4)),
984 BPF_EXIT_INSN(),
985 },
986 .errstr = "invalid bpf_context access",
987 .result = REJECT,
988 },
989 {
990 "invalid access __sk_buff local_ip4",
991 .insns = {
992 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
993 offsetof(struct __sk_buff, local_ip4)),
994 BPF_EXIT_INSN(),
995 },
996 .errstr = "invalid bpf_context access",
997 .result = REJECT,
998 },
999 {
1000 "invalid access __sk_buff remote_ip6",
1001 .insns = {
1002 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1003 offsetof(struct __sk_buff, remote_ip6)),
1004 BPF_EXIT_INSN(),
1005 },
1006 .errstr = "invalid bpf_context access",
1007 .result = REJECT,
1008 },
1009 {
1010 "invalid access __sk_buff local_ip6",
1011 .insns = {
1012 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1013 offsetof(struct __sk_buff, local_ip6)),
1014 BPF_EXIT_INSN(),
1015 },
1016 .errstr = "invalid bpf_context access",
1017 .result = REJECT,
1018 },
1019 {
1020 "invalid access __sk_buff remote_port",
1021 .insns = {
1022 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1023 offsetof(struct __sk_buff, remote_port)),
1024 BPF_EXIT_INSN(),
1025 },
1026 .errstr = "invalid bpf_context access",
1027 .result = REJECT,
1028 },
1029 {
1030 "invalid access __sk_buff remote_port",
1031 .insns = {
1032 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1033 offsetof(struct __sk_buff, local_port)),
1034 BPF_EXIT_INSN(),
1035 },
1036 .errstr = "invalid bpf_context access",
1037 .result = REJECT,
1038 },
1039 {
1040 "valid access __sk_buff family",
1041 .insns = {
1042 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1043 offsetof(struct __sk_buff, family)),
1044 BPF_EXIT_INSN(),
1045 },
1046 .result = ACCEPT,
1047 .prog_type = BPF_PROG_TYPE_SK_SKB,
1048 },
1049 {
1050 "valid access __sk_buff remote_ip4",
1051 .insns = {
1052 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1053 offsetof(struct __sk_buff, remote_ip4)),
1054 BPF_EXIT_INSN(),
1055 },
1056 .result = ACCEPT,
1057 .prog_type = BPF_PROG_TYPE_SK_SKB,
1058 },
1059 {
1060 "valid access __sk_buff local_ip4",
1061 .insns = {
1062 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1063 offsetof(struct __sk_buff, local_ip4)),
1064 BPF_EXIT_INSN(),
1065 },
1066 .result = ACCEPT,
1067 .prog_type = BPF_PROG_TYPE_SK_SKB,
1068 },
1069 {
1070 "valid access __sk_buff remote_ip6",
1071 .insns = {
1072 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1073 offsetof(struct __sk_buff, remote_ip6[0])),
1074 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1075 offsetof(struct __sk_buff, remote_ip6[1])),
1076 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1077 offsetof(struct __sk_buff, remote_ip6[2])),
1078 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1079 offsetof(struct __sk_buff, remote_ip6[3])),
1080 BPF_EXIT_INSN(),
1081 },
1082 .result = ACCEPT,
1083 .prog_type = BPF_PROG_TYPE_SK_SKB,
1084 },
1085 {
1086 "valid access __sk_buff local_ip6",
1087 .insns = {
1088 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1089 offsetof(struct __sk_buff, local_ip6[0])),
1090 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1091 offsetof(struct __sk_buff, local_ip6[1])),
1092 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1093 offsetof(struct __sk_buff, local_ip6[2])),
1094 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1095 offsetof(struct __sk_buff, local_ip6[3])),
1096 BPF_EXIT_INSN(),
1097 },
1098 .result = ACCEPT,
1099 .prog_type = BPF_PROG_TYPE_SK_SKB,
1100 },
1101 {
1102 "valid access __sk_buff remote_port",
1103 .insns = {
1104 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1105 offsetof(struct __sk_buff, remote_port)),
1106 BPF_EXIT_INSN(),
1107 },
1108 .result = ACCEPT,
1109 .prog_type = BPF_PROG_TYPE_SK_SKB,
1110 },
1111 {
1112 "valid access __sk_buff remote_port",
1113 .insns = {
1114 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1115 offsetof(struct __sk_buff, local_port)),
1116 BPF_EXIT_INSN(),
1117 },
1118 .result = ACCEPT,
1119 .prog_type = BPF_PROG_TYPE_SK_SKB,
1120 },
ed85054d
JF		 1121 {
1122 "invalid access of tc_classid for SK_SKB",
1123 .insns = {
1124 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1125 offsetof(struct __sk_buff, tc_classid)),
1126 BPF_EXIT_INSN(),
1127 },
1128 .result = REJECT,
1129 .prog_type = BPF_PROG_TYPE_SK_SKB,
1130 .errstr = "invalid bpf_context access",
1131 },
1132 {
f7e9cb1e
JF		 1133 "invalid access of skb->mark for SK_SKB",
1134 .insns = {
1135 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1136 offsetof(struct __sk_buff, mark)),
1137 BPF_EXIT_INSN(),
1138 },
1139 .result = REJECT,
1140 .prog_type = BPF_PROG_TYPE_SK_SKB,
1141 .errstr = "invalid bpf_context access",
1142 },
1143 {
1144 "check skb->mark is not writeable by SK_SKB",
ed85054d
JF		 1145 .insns = {
1146 BPF_MOV64_IMM(BPF_REG_0, 0),
1147 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1148 offsetof(struct __sk_buff, mark)),
1149 BPF_EXIT_INSN(),
1150 },
f7e9cb1e 1151 .result = REJECT,
ed85054d 1152 .prog_type = BPF_PROG_TYPE_SK_SKB,
f7e9cb1e 1153 .errstr = "invalid bpf_context access",
ed85054d
JF		 1154 },
1155 {
1156 "check skb->tc_index is writeable by SK_SKB",
1157 .insns = {
1158 BPF_MOV64_IMM(BPF_REG_0, 0),
1159 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1160 offsetof(struct __sk_buff, tc_index)),
1161 BPF_EXIT_INSN(),
1162 },
1163 .result = ACCEPT,
1164 .prog_type = BPF_PROG_TYPE_SK_SKB,
1165 },
1166 {
1167 "check skb->priority is writeable by SK_SKB",
1168 .insns = {
1169 BPF_MOV64_IMM(BPF_REG_0, 0),
1170 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1171 offsetof(struct __sk_buff, priority)),
1172 BPF_EXIT_INSN(),
1173 },
1174 .result = ACCEPT,
1175 .prog_type = BPF_PROG_TYPE_SK_SKB,
1176 },
1177 {
1178 "direct packet read for SK_SKB",
1179 .insns = {
1180 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1181 offsetof(struct __sk_buff, data)),
1182 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1183 offsetof(struct __sk_buff, data_end)),
1184 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1185 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1186 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1187 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1188 BPF_MOV64_IMM(BPF_REG_0, 0),
1189 BPF_EXIT_INSN(),
1190 },
1191 .result = ACCEPT,
1192 .prog_type = BPF_PROG_TYPE_SK_SKB,
1193 },
1194 {
1195 "direct packet write for SK_SKB",
1196 .insns = {
1197 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1198 offsetof(struct __sk_buff, data)),
1199 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1200 offsetof(struct __sk_buff, data_end)),
1201 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1202 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1203 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1204 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1205 BPF_MOV64_IMM(BPF_REG_0, 0),
1206 BPF_EXIT_INSN(),
1207 },
1208 .result = ACCEPT,
1209 .prog_type = BPF_PROG_TYPE_SK_SKB,
1210 },
1211 {
1212 "overlapping checks for direct packet access SK_SKB",
1213 .insns = {
1214 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1215 offsetof(struct __sk_buff, data)),
1216 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1217 offsetof(struct __sk_buff, data_end)),
1218 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1219 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1220 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1221 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1222 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1223 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1224 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1225 BPF_MOV64_IMM(BPF_REG_0, 0),
1226 BPF_EXIT_INSN(),
1227 },
1228 .result = ACCEPT,
1229 .prog_type = BPF_PROG_TYPE_SK_SKB,
1230 },
d691f9e8
AS		 1231 {
1232 "check skb->mark is not writeable by sockets",
1233 .insns = {
1234 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1235 offsetof(struct __sk_buff, mark)),
1236 BPF_EXIT_INSN(),
1237 },
1238 .errstr = "invalid bpf_context access",
bf508877 1239 .errstr_unpriv = "R1 leaks addr",
d691f9e8
AS		 1240 .result = REJECT,
1241 },
1242 {
1243 "check skb->tc_index is not writeable by sockets",
1244 .insns = {
1245 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1246 offsetof(struct __sk_buff, tc_index)),
1247 BPF_EXIT_INSN(),
1248 },
1249 .errstr = "invalid bpf_context access",
bf508877 1250 .errstr_unpriv = "R1 leaks addr",
d691f9e8
AS		 1251 .result = REJECT,
1252 },
1253 {
62c7989b 1254 "check cb access: byte",
d691f9e8 1255 .insns = {
62c7989b
DB		 1256 BPF_MOV64_IMM(BPF_REG_0, 0),
1257 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1258 offsetof(struct __sk_buff, cb[0])),
1259 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1260 offsetof(struct __sk_buff, cb[0]) + 1),
1261 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1262 offsetof(struct __sk_buff, cb[0]) + 2),
1263 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1264 offsetof(struct __sk_buff, cb[0]) + 3),
1265 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1266 offsetof(struct __sk_buff, cb[1])),
1267 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1268 offsetof(struct __sk_buff, cb[1]) + 1),
1269 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1270 offsetof(struct __sk_buff, cb[1]) + 2),
1271 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1272 offsetof(struct __sk_buff, cb[1]) + 3),
1273 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1274 offsetof(struct __sk_buff, cb[2])),
1275 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1276 offsetof(struct __sk_buff, cb[2]) + 1),
1277 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1278 offsetof(struct __sk_buff, cb[2]) + 2),
1279 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1280 offsetof(struct __sk_buff, cb[2]) + 3),
1281 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1282 offsetof(struct __sk_buff, cb[3])),
1283 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1284 offsetof(struct __sk_buff, cb[3]) + 1),
1285 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1286 offsetof(struct __sk_buff, cb[3]) + 2),
1287 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1288 offsetof(struct __sk_buff, cb[3]) + 3),
1289 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1290 offsetof(struct __sk_buff, cb[4])),
1291 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1292 offsetof(struct __sk_buff, cb[4]) + 1),
1293 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1294 offsetof(struct __sk_buff, cb[4]) + 2),
1295 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1296 offsetof(struct __sk_buff, cb[4]) + 3),
1297 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1298 offsetof(struct __sk_buff, cb[0])),
1299 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1300 offsetof(struct __sk_buff, cb[0]) + 1),
1301 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1302 offsetof(struct __sk_buff, cb[0]) + 2),
1303 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1304 offsetof(struct __sk_buff, cb[0]) + 3),
1305 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1306 offsetof(struct __sk_buff, cb[1])),
1307 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1308 offsetof(struct __sk_buff, cb[1]) + 1),
1309 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1310 offsetof(struct __sk_buff, cb[1]) + 2),
1311 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1312 offsetof(struct __sk_buff, cb[1]) + 3),
1313 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1314 offsetof(struct __sk_buff, cb[2])),
1315 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1316 offsetof(struct __sk_buff, cb[2]) + 1),
1317 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1318 offsetof(struct __sk_buff, cb[2]) + 2),
1319 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1320 offsetof(struct __sk_buff, cb[2]) + 3),
1321 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1322 offsetof(struct __sk_buff, cb[3])),
1323 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1324 offsetof(struct __sk_buff, cb[3]) + 1),
1325 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1326 offsetof(struct __sk_buff, cb[3]) + 2),
1327 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1328 offsetof(struct __sk_buff, cb[3]) + 3),
1329 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1330 offsetof(struct __sk_buff, cb[4])),
1331 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1332 offsetof(struct __sk_buff, cb[4]) + 1),
1333 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1334 offsetof(struct __sk_buff, cb[4]) + 2),
1335 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1336 offsetof(struct __sk_buff, cb[4]) + 3),
1337 BPF_EXIT_INSN(),
1338 },
1339 .result = ACCEPT,
1340 },
1341 {
31fd8581 1342 "__sk_buff->hash, offset 0, byte store not permitted",
62c7989b
DB		 1343 .insns = {
1344 BPF_MOV64_IMM(BPF_REG_0, 0),
1345 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
31fd8581 1346 offsetof(struct __sk_buff, hash)),
62c7989b
DB		 1347 BPF_EXIT_INSN(),
1348 },
1349 .errstr = "invalid bpf_context access",
1350 .result = REJECT,
1351 },
1352 {
31fd8581 1353 "__sk_buff->tc_index, offset 3, byte store not permitted",
62c7989b
DB		 1354 .insns = {
1355 BPF_MOV64_IMM(BPF_REG_0, 0),
1356 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
31fd8581 1357 offsetof(struct __sk_buff, tc_index) + 3),
62c7989b
DB		 1358 BPF_EXIT_INSN(),
1359 },
1360 .errstr = "invalid bpf_context access",
1361 .result = REJECT,
1362 },
18f3d6be
YS		 1363 {
1364 "check skb->hash byte load permitted",
1365 .insns = {
1366 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 1367#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 1368 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1369 offsetof(struct __sk_buff, hash)),
1370#else
1371 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1372 offsetof(struct __sk_buff, hash) + 3),
1373#endif
1374 BPF_EXIT_INSN(),
1375 },
1376 .result = ACCEPT,
1377 },
1378 {
1379 "check skb->hash byte load not permitted 1",
1380 .insns = {
1381 BPF_MOV64_IMM(BPF_REG_0, 0),
1382 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1383 offsetof(struct __sk_buff, hash) + 1),
1384 BPF_EXIT_INSN(),
1385 },
1386 .errstr = "invalid bpf_context access",
1387 .result = REJECT,
1388 },
1389 {
1390 "check skb->hash byte load not permitted 2",
1391 .insns = {
1392 BPF_MOV64_IMM(BPF_REG_0, 0),
1393 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1394 offsetof(struct __sk_buff, hash) + 2),
1395 BPF_EXIT_INSN(),
1396 },
1397 .errstr = "invalid bpf_context access",
1398 .result = REJECT,
1399 },
1400 {
1401 "check skb->hash byte load not permitted 3",
1402 .insns = {
1403 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 1404#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 1405 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1406 offsetof(struct __sk_buff, hash) + 3),
1407#else
1408 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1409 offsetof(struct __sk_buff, hash)),
1410#endif
1411 BPF_EXIT_INSN(),
1412 },
1413 .errstr = "invalid bpf_context access",
1414 .result = REJECT,
1415 },
62c7989b
DB		 1416 {
1417 "check cb access: byte, wrong type",
1418 .insns = {
1419 BPF_MOV64_IMM(BPF_REG_0, 0),
1420 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1421 offsetof(struct __sk_buff, cb[0])),
1422 BPF_EXIT_INSN(),
1423 },
1424 .errstr = "invalid bpf_context access",
1425 .result = REJECT,
1426 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1427 },
1428 {
1429 "check cb access: half",
1430 .insns = {
1431 BPF_MOV64_IMM(BPF_REG_0, 0),
1432 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1433 offsetof(struct __sk_buff, cb[0])),
1434 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1435 offsetof(struct __sk_buff, cb[0]) + 2),
1436 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1437 offsetof(struct __sk_buff, cb[1])),
1438 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1439 offsetof(struct __sk_buff, cb[1]) + 2),
1440 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1441 offsetof(struct __sk_buff, cb[2])),
1442 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1443 offsetof(struct __sk_buff, cb[2]) + 2),
1444 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1445 offsetof(struct __sk_buff, cb[3])),
1446 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1447 offsetof(struct __sk_buff, cb[3]) + 2),
1448 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1449 offsetof(struct __sk_buff, cb[4])),
1450 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1451 offsetof(struct __sk_buff, cb[4]) + 2),
1452 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1453 offsetof(struct __sk_buff, cb[0])),
1454 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1455 offsetof(struct __sk_buff, cb[0]) + 2),
1456 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1457 offsetof(struct __sk_buff, cb[1])),
1458 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1459 offsetof(struct __sk_buff, cb[1]) + 2),
1460 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1461 offsetof(struct __sk_buff, cb[2])),
1462 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1463 offsetof(struct __sk_buff, cb[2]) + 2),
1464 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1465 offsetof(struct __sk_buff, cb[3])),
1466 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1467 offsetof(struct __sk_buff, cb[3]) + 2),
1468 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1469 offsetof(struct __sk_buff, cb[4])),
1470 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1471 offsetof(struct __sk_buff, cb[4]) + 2),
1472 BPF_EXIT_INSN(),
1473 },
1474 .result = ACCEPT,
1475 },
1476 {
1477 "check cb access: half, unaligned",
1478 .insns = {
1479 BPF_MOV64_IMM(BPF_REG_0, 0),
1480 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1481 offsetof(struct __sk_buff, cb[0]) + 1),
1482 BPF_EXIT_INSN(),
1483 },
f65b1849 1484 .errstr = "misaligned context access",
62c7989b 1485 .result = REJECT,
f65b1849 1486 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1487 },
1488 {
31fd8581 1489 "check __sk_buff->hash, offset 0, half store not permitted",
62c7989b
DB		 1490 .insns = {
1491 BPF_MOV64_IMM(BPF_REG_0, 0),
1492 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
31fd8581 1493 offsetof(struct __sk_buff, hash)),
62c7989b
DB		 1494 BPF_EXIT_INSN(),
1495 },
1496 .errstr = "invalid bpf_context access",
1497 .result = REJECT,
1498 },
1499 {
31fd8581 1500 "check __sk_buff->tc_index, offset 2, half store not permitted",
62c7989b
DB		 1501 .insns = {
1502 BPF_MOV64_IMM(BPF_REG_0, 0),
1503 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
31fd8581 1504 offsetof(struct __sk_buff, tc_index) + 2),
62c7989b
DB		 1505 BPF_EXIT_INSN(),
1506 },
1507 .errstr = "invalid bpf_context access",
1508 .result = REJECT,
1509 },
18f3d6be
YS		 1510 {
1511 "check skb->hash half load permitted",
1512 .insns = {
1513 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 1514#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 1515 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1516 offsetof(struct __sk_buff, hash)),
1517#else
1518 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1519 offsetof(struct __sk_buff, hash) + 2),
1520#endif
1521 BPF_EXIT_INSN(),
1522 },
1523 .result = ACCEPT,
1524 },
1525 {
1526 "check skb->hash half load not permitted",
1527 .insns = {
1528 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 1529#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 1530 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1531 offsetof(struct __sk_buff, hash) + 2),
1532#else
1533 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1534 offsetof(struct __sk_buff, hash)),
1535#endif
1536 BPF_EXIT_INSN(),
1537 },
1538 .errstr = "invalid bpf_context access",
1539 .result = REJECT,
1540 },
62c7989b
DB		 1541 {
1542 "check cb access: half, wrong type",
1543 .insns = {
1544 BPF_MOV64_IMM(BPF_REG_0, 0),
1545 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1546 offsetof(struct __sk_buff, cb[0])),
1547 BPF_EXIT_INSN(),
1548 },
1549 .errstr = "invalid bpf_context access",
1550 .result = REJECT,
1551 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1552 },
1553 {
1554 "check cb access: word",
1555 .insns = {
1556 BPF_MOV64_IMM(BPF_REG_0, 0),
1557 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1558 offsetof(struct __sk_buff, cb[0])),
1559 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1560 offsetof(struct __sk_buff, cb[1])),
1561 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1562 offsetof(struct __sk_buff, cb[2])),
1563 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1564 offsetof(struct __sk_buff, cb[3])),
1565 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1566 offsetof(struct __sk_buff, cb[4])),
1567 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1568 offsetof(struct __sk_buff, cb[0])),
1569 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1570 offsetof(struct __sk_buff, cb[1])),
1571 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1572 offsetof(struct __sk_buff, cb[2])),
1573 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1574 offsetof(struct __sk_buff, cb[3])),
1575 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1576 offsetof(struct __sk_buff, cb[4])),
1577 BPF_EXIT_INSN(),
1578 },
1579 .result = ACCEPT,
1580 },
1581 {
1582 "check cb access: word, unaligned 1",
1583 .insns = {
1584 BPF_MOV64_IMM(BPF_REG_0, 0),
1585 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1586 offsetof(struct __sk_buff, cb[0]) + 2),
1587 BPF_EXIT_INSN(),
1588 },
f65b1849 1589 .errstr = "misaligned context access",
62c7989b 1590 .result = REJECT,
f65b1849 1591 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1592 },
1593 {
1594 "check cb access: word, unaligned 2",
1595 .insns = {
1596 BPF_MOV64_IMM(BPF_REG_0, 0),
1597 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1598 offsetof(struct __sk_buff, cb[4]) + 1),
1599 BPF_EXIT_INSN(),
1600 },
f65b1849 1601 .errstr = "misaligned context access",
62c7989b 1602 .result = REJECT,
f65b1849 1603 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1604 },
1605 {
1606 "check cb access: word, unaligned 3",
1607 .insns = {
1608 BPF_MOV64_IMM(BPF_REG_0, 0),
1609 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1610 offsetof(struct __sk_buff, cb[4]) + 2),
1611 BPF_EXIT_INSN(),
1612 },
f65b1849 1613 .errstr = "misaligned context access",
62c7989b 1614 .result = REJECT,
f65b1849 1615 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1616 },
1617 {
1618 "check cb access: word, unaligned 4",
1619 .insns = {
1620 BPF_MOV64_IMM(BPF_REG_0, 0),
1621 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1622 offsetof(struct __sk_buff, cb[4]) + 3),
1623 BPF_EXIT_INSN(),
1624 },
f65b1849 1625 .errstr = "misaligned context access",
62c7989b 1626 .result = REJECT,
f65b1849 1627 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1628 },
1629 {
1630 "check cb access: double",
1631 .insns = {
1632 BPF_MOV64_IMM(BPF_REG_0, 0),
1633 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1634 offsetof(struct __sk_buff, cb[0])),
1635 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1636 offsetof(struct __sk_buff, cb[2])),
1637 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1638 offsetof(struct __sk_buff, cb[0])),
1639 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1640 offsetof(struct __sk_buff, cb[2])),
1641 BPF_EXIT_INSN(),
1642 },
1643 .result = ACCEPT,
1644 },
1645 {
1646 "check cb access: double, unaligned 1",
1647 .insns = {
1648 BPF_MOV64_IMM(BPF_REG_0, 0),
1649 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1650 offsetof(struct __sk_buff, cb[1])),
1651 BPF_EXIT_INSN(),
1652 },
f65b1849 1653 .errstr = "misaligned context access",
62c7989b 1654 .result = REJECT,
f65b1849 1655 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1656 },
1657 {
1658 "check cb access: double, unaligned 2",
1659 .insns = {
1660 BPF_MOV64_IMM(BPF_REG_0, 0),
1661 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1662 offsetof(struct __sk_buff, cb[3])),
1663 BPF_EXIT_INSN(),
1664 },
f65b1849 1665 .errstr = "misaligned context access",
62c7989b 1666 .result = REJECT,
f65b1849 1667 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
62c7989b
DB		 1668 },
1669 {
1670 "check cb access: double, oob 1",
1671 .insns = {
1672 BPF_MOV64_IMM(BPF_REG_0, 0),
1673 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1674 offsetof(struct __sk_buff, cb[4])),
1675 BPF_EXIT_INSN(),
1676 },
1677 .errstr = "invalid bpf_context access",
1678 .result = REJECT,
1679 },
1680 {
1681 "check cb access: double, oob 2",
62c7989b
DB		 1682 .insns = {
1683 BPF_MOV64_IMM(BPF_REG_0, 0),
1684 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1685 offsetof(struct __sk_buff, cb[4])),
1686 BPF_EXIT_INSN(),
1687 },
1688 .errstr = "invalid bpf_context access",
1689 .result = REJECT,
1690 },
1691 {
31fd8581 1692 "check __sk_buff->ifindex dw store not permitted",
62c7989b
DB		 1693 .insns = {
1694 BPF_MOV64_IMM(BPF_REG_0, 0),
31fd8581
YS		 1695 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1696 offsetof(struct __sk_buff, ifindex)),
62c7989b
DB		 1697 BPF_EXIT_INSN(),
1698 },
1699 .errstr = "invalid bpf_context access",
1700 .result = REJECT,
1701 },
1702 {
31fd8581 1703 "check __sk_buff->ifindex dw load not permitted",
62c7989b
DB		 1704 .insns = {
1705 BPF_MOV64_IMM(BPF_REG_0, 0),
1706 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
31fd8581 1707 offsetof(struct __sk_buff, ifindex)),
62c7989b
DB		 1708 BPF_EXIT_INSN(),
1709 },
1710 .errstr = "invalid bpf_context access",
1711 .result = REJECT,
1712 },
1713 {
1714 "check cb access: double, wrong type",
1715 .insns = {
1716 BPF_MOV64_IMM(BPF_REG_0, 0),
1717 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
d691f9e8
AS		 1718 offsetof(struct __sk_buff, cb[0])),
1719 BPF_EXIT_INSN(),
1720 },
1721 .errstr = "invalid bpf_context access",
1722 .result = REJECT,
62c7989b 1723 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
d691f9e8
AS		 1724 },
1725 {
1726 "check out of range skb->cb access",
1727 .insns = {
1728 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
bf508877 1729 offsetof(struct __sk_buff, cb[0]) + 256),
d691f9e8
AS		 1730 BPF_EXIT_INSN(),
1731 },
1732 .errstr = "invalid bpf_context access",
bf508877 1733 .errstr_unpriv = "",
d691f9e8
AS		 1734 .result = REJECT,
1735 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1736 },
1737 {
1738 "write skb fields from socket prog",
1739 .insns = {
1740 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1741 offsetof(struct __sk_buff, cb[4])),
1742 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1743 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1744 offsetof(struct __sk_buff, mark)),
1745 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1746 offsetof(struct __sk_buff, tc_index)),
1747 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1748 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1749 offsetof(struct __sk_buff, cb[0])),
1750 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1751 offsetof(struct __sk_buff, cb[2])),
1752 BPF_EXIT_INSN(),
1753 },
1754 .result = ACCEPT,
bf508877
AS		 1755 .errstr_unpriv = "R1 leaks addr",
1756 .result_unpriv = REJECT,
d691f9e8
AS		 1757 },
1758 {
1759 "write skb fields from tc_cls_act prog",
1760 .insns = {
1761 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1762 offsetof(struct __sk_buff, cb[0])),
1763 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1764 offsetof(struct __sk_buff, mark)),
1765 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1766 offsetof(struct __sk_buff, tc_index)),
1767 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1768 offsetof(struct __sk_buff, tc_index)),
1769 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1770 offsetof(struct __sk_buff, cb[3])),
1771 BPF_EXIT_INSN(),
1772 },
bf508877
AS		 1773 .errstr_unpriv = "",
1774 .result_unpriv = REJECT,
d691f9e8
AS		 1775 .result = ACCEPT,
1776 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1777 },
24b4d2ab
AG		 1778 {
1779 "PTR_TO_STACK store/load",
1780 .insns = {
1781 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1782 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1783 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1784 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1785 BPF_EXIT_INSN(),
1786 },
1787 .result = ACCEPT,
1788 },
1789 {
1790 "PTR_TO_STACK store/load - bad alignment on off",
1791 .insns = {
1792 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1793 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1794 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1795 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1796 BPF_EXIT_INSN(),
1797 },
1798 .result = REJECT,
f65b1849
EC		 1799 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
1800 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
24b4d2ab
AG		 1801 },
1802 {
1803 "PTR_TO_STACK store/load - bad alignment on reg",
1804 .insns = {
1805 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1806 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1807 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1808 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1809 BPF_EXIT_INSN(),
1810 },
1811 .result = REJECT,
f65b1849
EC		 1812 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
1813 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
24b4d2ab
AG		 1814 },
1815 {
1816 "PTR_TO_STACK store/load - out of bounds low",
1817 .insns = {
1818 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1819 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1820 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1821 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1822 BPF_EXIT_INSN(),
1823 },
1824 .result = REJECT,
1825 .errstr = "invalid stack off=-79992 size=8",
1826 },
1827 {
1828 "PTR_TO_STACK store/load - out of bounds high",
1829 .insns = {
1830 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1831 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1832 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1833 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1834 BPF_EXIT_INSN(),
1835 },
1836 .result = REJECT,
1837 .errstr = "invalid stack off=0 size=8",
1838 },
bf508877
AS		 1839 {
1840 "unpriv: return pointer",
1841 .insns = {
1842 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1843 BPF_EXIT_INSN(),
1844 },
1845 .result = ACCEPT,
1846 .result_unpriv = REJECT,
1847 .errstr_unpriv = "R0 leaks addr",
1848 },
1849 {
1850 "unpriv: add const to pointer",
1851 .insns = {
1852 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1853 BPF_MOV64_IMM(BPF_REG_0, 0),
1854 BPF_EXIT_INSN(),
1855 },
1856 .result = ACCEPT,
bf508877
AS		 1857 },
1858 {
1859 "unpriv: add pointer to pointer",
1860 .insns = {
1861 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1862 BPF_MOV64_IMM(BPF_REG_0, 0),
1863 BPF_EXIT_INSN(),
1864 },
1865 .result = ACCEPT,
1866 .result_unpriv = REJECT,
f65b1849 1867 .errstr_unpriv = "R1 pointer += pointer",
bf508877
AS		 1868 },
1869 {
1870 "unpriv: neg pointer",
1871 .insns = {
1872 BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1873 BPF_MOV64_IMM(BPF_REG_0, 0),
1874 BPF_EXIT_INSN(),
1875 },
1876 .result = ACCEPT,
1877 .result_unpriv = REJECT,
1878 .errstr_unpriv = "R1 pointer arithmetic",
1879 },
1880 {
1881 "unpriv: cmp pointer with const",
1882 .insns = {
1883 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1884 BPF_MOV64_IMM(BPF_REG_0, 0),
1885 BPF_EXIT_INSN(),
1886 },
1887 .result = ACCEPT,
1888 .result_unpriv = REJECT,
1889 .errstr_unpriv = "R1 pointer comparison",
1890 },
1891 {
1892 "unpriv: cmp pointer with pointer",
1893 .insns = {
1894 BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1895 BPF_MOV64_IMM(BPF_REG_0, 0),
1896 BPF_EXIT_INSN(),
1897 },
1898 .result = ACCEPT,
1899 .result_unpriv = REJECT,
1900 .errstr_unpriv = "R10 pointer comparison",
1901 },
1902 {
1903 "unpriv: check that printk is disallowed",
1904 .insns = {
1905 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1906 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1907 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1908 BPF_MOV64_IMM(BPF_REG_2, 8),
1909 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
5aa5bd14
DB		 1910 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1911 BPF_FUNC_trace_printk),
bf508877
AS		 1912 BPF_MOV64_IMM(BPF_REG_0, 0),
1913 BPF_EXIT_INSN(),
1914 },
0eb6984f 1915 .errstr_unpriv = "unknown func bpf_trace_printk#6",
bf508877
AS		 1916 .result_unpriv = REJECT,
1917 .result = ACCEPT,
1918 },
1919 {
1920 "unpriv: pass pointer to helper function",
1921 .insns = {
1922 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1923 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1924 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1925 BPF_LD_MAP_FD(BPF_REG_1, 0),
1926 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1927 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
5aa5bd14
DB		 1928 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1929 BPF_FUNC_map_update_elem),
bf508877
AS		 1930 BPF_MOV64_IMM(BPF_REG_0, 0),
1931 BPF_EXIT_INSN(),
1932 },
5aa5bd14 1933 .fixup_map1 = { 3 },
bf508877
AS		 1934 .errstr_unpriv = "R4 leaks addr",
1935 .result_unpriv = REJECT,
1936 .result = ACCEPT,
1937 },
1938 {
1939 "unpriv: indirectly pass pointer on stack to helper function",
1940 .insns = {
1941 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1942 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1943 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1944 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 1945 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1946 BPF_FUNC_map_lookup_elem),
bf508877
AS		 1947 BPF_MOV64_IMM(BPF_REG_0, 0),
1948 BPF_EXIT_INSN(),
1949 },
5aa5bd14 1950 .fixup_map1 = { 3 },
bf508877
AS		 1951 .errstr = "invalid indirect read from stack off -8+0 size 8",
1952 .result = REJECT,
1953 },
1954 {
1955 "unpriv: mangle pointer on stack 1",
1956 .insns = {
1957 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1958 BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1959 BPF_MOV64_IMM(BPF_REG_0, 0),
1960 BPF_EXIT_INSN(),
1961 },
1962 .errstr_unpriv = "attempt to corrupt spilled",
1963 .result_unpriv = REJECT,
1964 .result = ACCEPT,
1965 },
1966 {
1967 "unpriv: mangle pointer on stack 2",
1968 .insns = {
1969 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1970 BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
1971 BPF_MOV64_IMM(BPF_REG_0, 0),
1972 BPF_EXIT_INSN(),
1973 },
1974 .errstr_unpriv = "attempt to corrupt spilled",
1975 .result_unpriv = REJECT,
1976 .result = ACCEPT,
1977 },
1978 {
1979 "unpriv: read pointer from stack in small chunks",
1980 .insns = {
1981 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1982 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
1983 BPF_MOV64_IMM(BPF_REG_0, 0),
1984 BPF_EXIT_INSN(),
1985 },
1986 .errstr = "invalid size",
1987 .result = REJECT,
1988 },
1989 {
1990 "unpriv: write pointer into ctx",
1991 .insns = {
1992 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
1993 BPF_MOV64_IMM(BPF_REG_0, 0),
1994 BPF_EXIT_INSN(),
1995 },
1996 .errstr_unpriv = "R1 leaks addr",
1997 .result_unpriv = REJECT,
1998 .errstr = "invalid bpf_context access",
1999 .result = REJECT,
2000 },
1a776b9c
DB		 2001 {
2002 "unpriv: spill/fill of ctx",
2003 .insns = {
2004 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2005 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2006 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2007 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2008 BPF_MOV64_IMM(BPF_REG_0, 0),
2009 BPF_EXIT_INSN(),
2010 },
2011 .result = ACCEPT,
2012 },
2013 {
2014 "unpriv: spill/fill of ctx 2",
2015 .insns = {
2016 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2017 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2018 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2019 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 2020 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2021 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 2022 BPF_EXIT_INSN(),
2023 },
2024 .result = ACCEPT,
2025 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2026 },
2027 {
2028 "unpriv: spill/fill of ctx 3",
2029 .insns = {
2030 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2031 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2032 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2033 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2034 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 2035 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2036 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 2037 BPF_EXIT_INSN(),
2038 },
2039 .result = REJECT,
2040 .errstr = "R1 type=fp expected=ctx",
2041 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2042 },
2043 {
2044 "unpriv: spill/fill of ctx 4",
2045 .insns = {
2046 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2047 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2048 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2049 BPF_MOV64_IMM(BPF_REG_0, 1),
5aa5bd14
DB		 2050 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2051 BPF_REG_0, -8, 0),
1a776b9c 2052 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 2053 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2054 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 2055 BPF_EXIT_INSN(),
2056 },
2057 .result = REJECT,
2058 .errstr = "R1 type=inv expected=ctx",
2059 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2060 },
2061 {
2062 "unpriv: spill/fill of different pointers stx",
2063 .insns = {
2064 BPF_MOV64_IMM(BPF_REG_3, 42),
2065 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2066 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2067 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2068 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2069 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2070 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2071 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2072 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2073 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2074 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2075 offsetof(struct __sk_buff, mark)),
2076 BPF_MOV64_IMM(BPF_REG_0, 0),
2077 BPF_EXIT_INSN(),
2078 },
2079 .result = REJECT,
2080 .errstr = "same insn cannot be used with different pointers",
2081 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2082 },
2083 {
2084 "unpriv: spill/fill of different pointers ldx",
2085 .insns = {
2086 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2087 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2088 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2089 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2090 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2091 -(__s32)offsetof(struct bpf_perf_event_data,
2092 sample_period) - 8),
2093 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2094 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2095 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2096 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2097 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2098 offsetof(struct bpf_perf_event_data,
2099 sample_period)),
2100 BPF_MOV64_IMM(BPF_REG_0, 0),
2101 BPF_EXIT_INSN(),
2102 },
2103 .result = REJECT,
2104 .errstr = "same insn cannot be used with different pointers",
2105 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2106 },
bf508877
AS		 2107 {
2108 "unpriv: write pointer into map elem value",
2109 .insns = {
2110 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2111 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2112 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2113 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2114 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2115 BPF_FUNC_map_lookup_elem),
bf508877
AS		 2116 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2117 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2118 BPF_EXIT_INSN(),
2119 },
5aa5bd14 2120 .fixup_map1 = { 3 },
bf508877
AS		 2121 .errstr_unpriv = "R0 leaks addr",
2122 .result_unpriv = REJECT,
2123 .result = ACCEPT,
2124 },
2125 {
2126 "unpriv: partial copy of pointer",
2127 .insns = {
2128 BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2129 BPF_MOV64_IMM(BPF_REG_0, 0),
2130 BPF_EXIT_INSN(),
2131 },
2132 .errstr_unpriv = "R10 partial copy",
2133 .result_unpriv = REJECT,
2134 .result = ACCEPT,
2135 },
2136 {
2137 "unpriv: pass pointer to tail_call",
2138 .insns = {
2139 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2140 BPF_LD_MAP_FD(BPF_REG_2, 0),
5aa5bd14
DB		 2141 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2142 BPF_FUNC_tail_call),
bf508877
AS		 2143 BPF_MOV64_IMM(BPF_REG_0, 0),
2144 BPF_EXIT_INSN(),
2145 },
5aa5bd14 2146 .fixup_prog = { 1 },
bf508877
AS		 2147 .errstr_unpriv = "R3 leaks addr into helper",
2148 .result_unpriv = REJECT,
2149 .result = ACCEPT,
2150 },
2151 {
2152 "unpriv: cmp map pointer with zero",
2153 .insns = {
2154 BPF_MOV64_IMM(BPF_REG_1, 0),
2155 BPF_LD_MAP_FD(BPF_REG_1, 0),
2156 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2157 BPF_MOV64_IMM(BPF_REG_0, 0),
2158 BPF_EXIT_INSN(),
2159 },
5aa5bd14 2160 .fixup_map1 = { 1 },
bf508877
AS		 2161 .errstr_unpriv = "R1 pointer comparison",
2162 .result_unpriv = REJECT,
2163 .result = ACCEPT,
2164 },
2165 {
2166 "unpriv: write into frame pointer",
2167 .insns = {
2168 BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2169 BPF_MOV64_IMM(BPF_REG_0, 0),
2170 BPF_EXIT_INSN(),
2171 },
2172 .errstr = "frame pointer is read only",
2173 .result = REJECT,
2174 },
1a776b9c
DB		 2175 {
2176 "unpriv: spill/fill frame pointer",
2177 .insns = {
2178 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2179 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2180 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2181 BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2182 BPF_MOV64_IMM(BPF_REG_0, 0),
2183 BPF_EXIT_INSN(),
2184 },
2185 .errstr = "frame pointer is read only",
2186 .result = REJECT,
2187 },
bf508877
AS		 2188 {
2189 "unpriv: cmp of frame pointer",
2190 .insns = {
2191 BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2192 BPF_MOV64_IMM(BPF_REG_0, 0),
2193 BPF_EXIT_INSN(),
2194 },
2195 .errstr_unpriv = "R10 pointer comparison",
2196 .result_unpriv = REJECT,
2197 .result = ACCEPT,
2198 },
728a853a
DB		 2199 {
2200 "unpriv: adding of fp",
2201 .insns = {
2202 BPF_MOV64_IMM(BPF_REG_0, 0),
2203 BPF_MOV64_IMM(BPF_REG_1, 0),
2204 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2205 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2206 BPF_EXIT_INSN(),
2207 },
f65b1849 2208 .result = ACCEPT,
728a853a 2209 },
bf508877
AS		 2210 {
2211 "unpriv: cmp of stack pointer",
2212 .insns = {
2213 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2215 BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2216 BPF_MOV64_IMM(BPF_REG_0, 0),
2217 BPF_EXIT_INSN(),
2218 },
2219 .errstr_unpriv = "R2 pointer comparison",
2220 .result_unpriv = REJECT,
2221 .result = ACCEPT,
2222 },
2223 {
332270fd 2224 "stack pointer arithmetic",
bf508877 2225 .insns = {
332270fd
YS		 2226 BPF_MOV64_IMM(BPF_REG_1, 4),
2227 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2228 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2229 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2230 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2231 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2232 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2233 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2234 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2235 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2236 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
bf508877
AS		 2237 BPF_MOV64_IMM(BPF_REG_0, 0),
2238 BPF_EXIT_INSN(),
2239 },
bf508877
AS		 2240 .result = ACCEPT,
2241 },
3f2050e2
DB		 2242 {
2243 "raw_stack: no skb_load_bytes",
2244 .insns = {
2245 BPF_MOV64_IMM(BPF_REG_2, 4),
2246 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2247 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2248 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2249 BPF_MOV64_IMM(BPF_REG_4, 8),
2250 /* Call to skb_load_bytes() omitted. */
2251 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2252 BPF_EXIT_INSN(),
2253 },
2254 .result = REJECT,
2255 .errstr = "invalid read from stack off -8+0 size 8",
2256 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2257 },
7d95b0ab
DB		 2258 {
2259 "raw_stack: skb_load_bytes, negative len",
2260 .insns = {
2261 BPF_MOV64_IMM(BPF_REG_2, 4),
2262 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2263 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2264 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2265 BPF_MOV64_IMM(BPF_REG_4, -8),
5aa5bd14
DB		 2266 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2267 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 2268 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2269 BPF_EXIT_INSN(),
2270 },
2271 .result = REJECT,
f65b1849 2272 .errstr = "R4 min value is negative",
7d95b0ab
DB		 2273 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2274 },
2275 {
2276 "raw_stack: skb_load_bytes, negative len 2",
2277 .insns = {
2278 BPF_MOV64_IMM(BPF_REG_2, 4),
2279 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2280 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2281 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2282 BPF_MOV64_IMM(BPF_REG_4, ~0),
5aa5bd14
DB		 2283 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2284 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 2285 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2286 BPF_EXIT_INSN(),
2287 },
2288 .result = REJECT,
f65b1849 2289 .errstr = "R4 min value is negative",
7d95b0ab
DB		 2290 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2291 },
2292 {
2293 "raw_stack: skb_load_bytes, zero len",
2294 .insns = {
2295 BPF_MOV64_IMM(BPF_REG_2, 4),
2296 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2298 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2299 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 2300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2301 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 2302 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2303 BPF_EXIT_INSN(),
2304 },
2305 .result = REJECT,
2306 .errstr = "invalid stack type R3",
2307 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2308 },
3f2050e2
DB		 2309 {
2310 "raw_stack: skb_load_bytes, no init",
2311 .insns = {
2312 BPF_MOV64_IMM(BPF_REG_2, 4),
2313 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2314 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2315 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2316 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2317 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2318 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2319 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2320 BPF_EXIT_INSN(),
2321 },
2322 .result = ACCEPT,
2323 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2324 },
2325 {
2326 "raw_stack: skb_load_bytes, init",
2327 .insns = {
2328 BPF_MOV64_IMM(BPF_REG_2, 4),
2329 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2330 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2331 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2332 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2333 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2334 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2335 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2336 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2337 BPF_EXIT_INSN(),
2338 },
2339 .result = ACCEPT,
2340 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2341 },
2342 {
2343 "raw_stack: skb_load_bytes, spilled regs around bounds",
2344 .insns = {
2345 BPF_MOV64_IMM(BPF_REG_2, 4),
2346 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2347 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 2348 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2349 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 2350 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2351 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2352 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2353 BPF_FUNC_skb_load_bytes),
2354 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2355 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
3f2050e2
DB		 2356 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2357 offsetof(struct __sk_buff, mark)),
2358 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2359 offsetof(struct __sk_buff, priority)),
2360 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2361 BPF_EXIT_INSN(),
2362 },
2363 .result = ACCEPT,
2364 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2365 },
2366 {
2367 "raw_stack: skb_load_bytes, spilled regs corruption",
2368 .insns = {
2369 BPF_MOV64_IMM(BPF_REG_2, 4),
2370 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2371 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
5aa5bd14 2372 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3f2050e2
DB		 2373 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2374 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2375 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2376 BPF_FUNC_skb_load_bytes),
2377 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3f2050e2
DB		 2378 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2379 offsetof(struct __sk_buff, mark)),
2380 BPF_EXIT_INSN(),
2381 },
2382 .result = REJECT,
2383 .errstr = "R0 invalid mem access 'inv'",
2384 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2385 },
2386 {
2387 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2388 .insns = {
2389 BPF_MOV64_IMM(BPF_REG_2, 4),
2390 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2391 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 2392 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2393 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2394 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 2395 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2396 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2397 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2398 BPF_FUNC_skb_load_bytes),
2399 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2400 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2401 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
3f2050e2
DB		 2402 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2403 offsetof(struct __sk_buff, mark)),
2404 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2405 offsetof(struct __sk_buff, priority)),
2406 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2407 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2408 offsetof(struct __sk_buff, pkt_type)),
2409 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2410 BPF_EXIT_INSN(),
2411 },
2412 .result = REJECT,
2413 .errstr = "R3 invalid mem access 'inv'",
2414 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2415 },
2416 {
2417 "raw_stack: skb_load_bytes, spilled regs + data",
2418 .insns = {
2419 BPF_MOV64_IMM(BPF_REG_2, 4),
2420 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2421 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 2422 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2423 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2424 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 2425 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2426 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2427 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2428 BPF_FUNC_skb_load_bytes),
2429 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2430 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2431 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
3f2050e2
DB		 2432 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2433 offsetof(struct __sk_buff, mark)),
2434 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2435 offsetof(struct __sk_buff, priority)),
2436 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2437 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2438 BPF_EXIT_INSN(),
2439 },
2440 .result = ACCEPT,
2441 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2442 },
2443 {
2444 "raw_stack: skb_load_bytes, invalid access 1",
2445 .insns = {
2446 BPF_MOV64_IMM(BPF_REG_2, 4),
2447 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2448 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2449 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2450 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2451 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2452 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2453 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2454 BPF_EXIT_INSN(),
2455 },
2456 .result = REJECT,
2457 .errstr = "invalid stack type R3 off=-513 access_size=8",
2458 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2459 },
2460 {
2461 "raw_stack: skb_load_bytes, invalid access 2",
2462 .insns = {
2463 BPF_MOV64_IMM(BPF_REG_2, 4),
2464 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2465 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2466 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2467 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2468 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2469 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2470 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2471 BPF_EXIT_INSN(),
2472 },
2473 .result = REJECT,
2474 .errstr = "invalid stack type R3 off=-1 access_size=8",
2475 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2476 },
2477 {
2478 "raw_stack: skb_load_bytes, invalid access 3",
2479 .insns = {
2480 BPF_MOV64_IMM(BPF_REG_2, 4),
2481 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2482 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2483 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2484 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
5aa5bd14
DB		 2485 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2486 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2487 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2488 BPF_EXIT_INSN(),
2489 },
2490 .result = REJECT,
f65b1849 2491 .errstr = "R4 min value is negative",
3f2050e2
DB		 2492 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2493 },
2494 {
2495 "raw_stack: skb_load_bytes, invalid access 4",
2496 .insns = {
2497 BPF_MOV64_IMM(BPF_REG_2, 4),
2498 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2499 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2500 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2501 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
5aa5bd14
DB		 2502 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2503 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2504 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2505 BPF_EXIT_INSN(),
2506 },
2507 .result = REJECT,
f65b1849 2508 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3f2050e2
DB		 2509 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2510 },
2511 {
2512 "raw_stack: skb_load_bytes, invalid access 5",
2513 .insns = {
2514 BPF_MOV64_IMM(BPF_REG_2, 4),
2515 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2516 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2517 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2518 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
5aa5bd14
DB		 2519 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2520 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2521 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2522 BPF_EXIT_INSN(),
2523 },
2524 .result = REJECT,
f65b1849 2525 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3f2050e2
DB		 2526 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2527 },
2528 {
2529 "raw_stack: skb_load_bytes, invalid access 6",
2530 .insns = {
2531 BPF_MOV64_IMM(BPF_REG_2, 4),
2532 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2533 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2534 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2535 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 2536 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2537 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2538 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2539 BPF_EXIT_INSN(),
2540 },
2541 .result = REJECT,
2542 .errstr = "invalid stack type R3 off=-512 access_size=0",
2543 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2544 },
2545 {
2546 "raw_stack: skb_load_bytes, large access",
2547 .insns = {
2548 BPF_MOV64_IMM(BPF_REG_2, 4),
2549 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2550 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2551 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2552 BPF_MOV64_IMM(BPF_REG_4, 512),
5aa5bd14
DB		 2553 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2554 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2555 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2556 BPF_EXIT_INSN(),
2557 },
2558 .result = ACCEPT,
2559 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2560 },
883e44e4 2561 {
1633ac0a 2562 "direct packet access: test1",
883e44e4
AS		 2563 .insns = {
2564 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2565 offsetof(struct __sk_buff, data)),
2566 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2567 offsetof(struct __sk_buff, data_end)),
2568 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2569 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2570 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2571 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2572 BPF_MOV64_IMM(BPF_REG_0, 0),
2573 BPF_EXIT_INSN(),
2574 },
2575 .result = ACCEPT,
2576 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2577 },
2578 {
1633ac0a 2579 "direct packet access: test2",
883e44e4
AS		 2580 .insns = {
2581 BPF_MOV64_IMM(BPF_REG_0, 1),
2582 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2583 offsetof(struct __sk_buff, data_end)),
2584 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2585 offsetof(struct __sk_buff, data)),
2586 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2588 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2589 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2590 BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2591 BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2592 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2593 offsetof(struct __sk_buff, data)),
2594 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2595 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
1f9ab38f
EC		 2596 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
2597 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
883e44e4
AS		 2598 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2599 BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2600 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2601 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2602 offsetof(struct __sk_buff, data_end)),
2603 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2604 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2605 BPF_MOV64_IMM(BPF_REG_0, 0),
2606 BPF_EXIT_INSN(),
2607 },
2608 .result = ACCEPT,
2609 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2610 },
2611 {
1633ac0a 2612 "direct packet access: test3",
883e44e4
AS		 2613 .insns = {
2614 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2615 offsetof(struct __sk_buff, data)),
2616 BPF_MOV64_IMM(BPF_REG_0, 0),
2617 BPF_EXIT_INSN(),
2618 },
2619 .errstr = "invalid bpf_context access off=76",
2620 .result = REJECT,
2621 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2622 },
2623 {
7d95b0ab 2624 "direct packet access: test4 (write)",
883e44e4
AS		 2625 .insns = {
2626 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2627 offsetof(struct __sk_buff, data)),
2628 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2629 offsetof(struct __sk_buff, data_end)),
2630 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2631 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2632 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2633 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2634 BPF_MOV64_IMM(BPF_REG_0, 0),
2635 BPF_EXIT_INSN(),
2636 },
7d95b0ab 2637 .result = ACCEPT,
883e44e4
AS		 2638 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2639 },
2d2be8ca
DB		 2640 {
2641 "direct packet access: test5 (pkt_end >= reg, good access)",
2642 .insns = {
2643 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2644 offsetof(struct __sk_buff, data)),
2645 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2646 offsetof(struct __sk_buff, data_end)),
2647 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2648 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2649 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2650 BPF_MOV64_IMM(BPF_REG_0, 1),
2651 BPF_EXIT_INSN(),
2652 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2653 BPF_MOV64_IMM(BPF_REG_0, 0),
2654 BPF_EXIT_INSN(),
2655 },
2656 .result = ACCEPT,
2657 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2658 },
2659 {
2660 "direct packet access: test6 (pkt_end >= reg, bad access)",
2661 .insns = {
2662 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2663 offsetof(struct __sk_buff, data)),
2664 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2665 offsetof(struct __sk_buff, data_end)),
2666 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2667 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2668 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2669 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2670 BPF_MOV64_IMM(BPF_REG_0, 1),
2671 BPF_EXIT_INSN(),
2672 BPF_MOV64_IMM(BPF_REG_0, 0),
2673 BPF_EXIT_INSN(),
2674 },
2675 .errstr = "invalid access to packet",
2676 .result = REJECT,
2677 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2678 },
2679 {
2680 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2681 .insns = {
2682 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2683 offsetof(struct __sk_buff, data)),
2684 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2685 offsetof(struct __sk_buff, data_end)),
2686 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2687 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2688 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2689 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2690 BPF_MOV64_IMM(BPF_REG_0, 1),
2691 BPF_EXIT_INSN(),
2692 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2693 BPF_MOV64_IMM(BPF_REG_0, 0),
2694 BPF_EXIT_INSN(),
2695 },
2696 .errstr = "invalid access to packet",
2697 .result = REJECT,
2698 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2699 },
2700 {
2701 "direct packet access: test8 (double test, variant 1)",
2702 .insns = {
2703 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2704 offsetof(struct __sk_buff, data)),
2705 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2706 offsetof(struct __sk_buff, data_end)),
2707 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2708 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2709 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2710 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2711 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2712 BPF_MOV64_IMM(BPF_REG_0, 1),
2713 BPF_EXIT_INSN(),
2714 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2715 BPF_MOV64_IMM(BPF_REG_0, 0),
2716 BPF_EXIT_INSN(),
2717 },
2718 .result = ACCEPT,
2719 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2720 },
2721 {
2722 "direct packet access: test9 (double test, variant 2)",
2723 .insns = {
2724 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2725 offsetof(struct __sk_buff, data)),
2726 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2727 offsetof(struct __sk_buff, data_end)),
2728 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2729 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2730 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2731 BPF_MOV64_IMM(BPF_REG_0, 1),
2732 BPF_EXIT_INSN(),
2733 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2734 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2735 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2736 BPF_MOV64_IMM(BPF_REG_0, 0),
2737 BPF_EXIT_INSN(),
2738 },
2739 .result = ACCEPT,
2740 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2741 },
7d95b0ab
DB		 2742 {
2743 "direct packet access: test10 (write invalid)",
2744 .insns = {
2745 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2746 offsetof(struct __sk_buff, data)),
2747 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2748 offsetof(struct __sk_buff, data_end)),
2749 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2750 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2751 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2752 BPF_MOV64_IMM(BPF_REG_0, 0),
2753 BPF_EXIT_INSN(),
2754 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2755 BPF_MOV64_IMM(BPF_REG_0, 0),
2756 BPF_EXIT_INSN(),
2757 },
2758 .errstr = "invalid access to packet",
2759 .result = REJECT,
2760 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2761 },
3fadc801
DB		 2762 {
2763 "direct packet access: test11 (shift, good access)",
2764 .insns = {
2765 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2766 offsetof(struct __sk_buff, data)),
2767 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2768 offsetof(struct __sk_buff, data_end)),
2769 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2771 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2772 BPF_MOV64_IMM(BPF_REG_3, 144),
2773 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2774 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2775 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
2776 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2777 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2778 BPF_MOV64_IMM(BPF_REG_0, 1),
2779 BPF_EXIT_INSN(),
2780 BPF_MOV64_IMM(BPF_REG_0, 0),
2781 BPF_EXIT_INSN(),
2782 },
2783 .result = ACCEPT,
2784 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2785 },
2786 {
2787 "direct packet access: test12 (and, good access)",
2788 .insns = {
2789 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2790 offsetof(struct __sk_buff, data)),
2791 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2792 offsetof(struct __sk_buff, data_end)),
2793 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2794 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2795 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2796 BPF_MOV64_IMM(BPF_REG_3, 144),
2797 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2798 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2799 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2800 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2801 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2802 BPF_MOV64_IMM(BPF_REG_0, 1),
2803 BPF_EXIT_INSN(),
2804 BPF_MOV64_IMM(BPF_REG_0, 0),
2805 BPF_EXIT_INSN(),
2806 },
2807 .result = ACCEPT,
2808 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2809 },
2810 {
2811 "direct packet access: test13 (branches, good access)",
2812 .insns = {
2813 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2814 offsetof(struct __sk_buff, data)),
2815 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2816 offsetof(struct __sk_buff, data_end)),
2817 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2818 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2819 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
2820 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2821 offsetof(struct __sk_buff, mark)),
2822 BPF_MOV64_IMM(BPF_REG_4, 1),
2823 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
2824 BPF_MOV64_IMM(BPF_REG_3, 14),
2825 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
2826 BPF_MOV64_IMM(BPF_REG_3, 24),
2827 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2828 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2829 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2830 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2831 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2832 BPF_MOV64_IMM(BPF_REG_0, 1),
2833 BPF_EXIT_INSN(),
2834 BPF_MOV64_IMM(BPF_REG_0, 0),
2835 BPF_EXIT_INSN(),
2836 },
2837 .result = ACCEPT,
2838 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2839 },
63dfef75
WT		 2840 {
2841 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2842 .insns = {
2843 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2844 offsetof(struct __sk_buff, data)),
2845 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2846 offsetof(struct __sk_buff, data_end)),
2847 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2848 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2849 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
2850 BPF_MOV64_IMM(BPF_REG_5, 12),
2851 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
2852 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2853 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2854 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
2855 BPF_MOV64_IMM(BPF_REG_0, 1),
2856 BPF_EXIT_INSN(),
2857 BPF_MOV64_IMM(BPF_REG_0, 0),
2858 BPF_EXIT_INSN(),
2859 },
2860 .result = ACCEPT,
2861 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2862 },
02ea80b1
DB		 2863 {
2864 "direct packet access: test15 (spill with xadd)",
2865 .insns = {
2866 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2867 offsetof(struct __sk_buff, data)),
2868 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2869 offsetof(struct __sk_buff, data_end)),
2870 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2871 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2872 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2873 BPF_MOV64_IMM(BPF_REG_5, 4096),
2874 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
2875 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
2876 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
2877 BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
2878 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
2879 BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
2880 BPF_MOV64_IMM(BPF_REG_0, 0),
2881 BPF_EXIT_INSN(),
2882 },
2883 .errstr = "R2 invalid mem access 'inv'",
2884 .result = REJECT,
2885 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2886 },
728a853a
DB		 2887 {
2888 "direct packet access: test16 (arith on data_end)",
2889 .insns = {
2890 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2891 offsetof(struct __sk_buff, data)),
2892 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2893 offsetof(struct __sk_buff, data_end)),
2894 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2896 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
2897 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2898 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2899 BPF_MOV64_IMM(BPF_REG_0, 0),
2900 BPF_EXIT_INSN(),
2901 },
2902 .errstr = "invalid access to packet",
2903 .result = REJECT,
2904 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2905 },
614d0d77
DB		 2906 {
2907 "direct packet access: test17 (pruning, alignment)",
2908 .insns = {
2909 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2910 offsetof(struct __sk_buff, data)),
2911 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2912 offsetof(struct __sk_buff, data_end)),
2913 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2914 offsetof(struct __sk_buff, mark)),
2915 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2916 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
2917 BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
2918 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2919 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
2920 BPF_MOV64_IMM(BPF_REG_0, 0),
2921 BPF_EXIT_INSN(),
2922 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
2923 BPF_JMP_A(-6),
2924 },
f65b1849 2925 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
614d0d77
DB		 2926 .result = REJECT,
2927 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2928 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2929 },
6d191ed4
DB		 2930 {
2931 "direct packet access: test18 (imm += pkt_ptr, 1)",
2932 .insns = {
2933 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2934 offsetof(struct __sk_buff, data)),
2935 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2936 offsetof(struct __sk_buff, data_end)),
2937 BPF_MOV64_IMM(BPF_REG_0, 8),
2938 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2939 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2940 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2941 BPF_MOV64_IMM(BPF_REG_0, 0),
2942 BPF_EXIT_INSN(),
2943 },
2944 .result = ACCEPT,
2945 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2946 },
2947 {
2948 "direct packet access: test19 (imm += pkt_ptr, 2)",
2949 .insns = {
2950 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2951 offsetof(struct __sk_buff, data)),
2952 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2953 offsetof(struct __sk_buff, data_end)),
2954 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2955 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2956 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
2957 BPF_MOV64_IMM(BPF_REG_4, 4),
2958 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
2959 BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
2960 BPF_MOV64_IMM(BPF_REG_0, 0),
2961 BPF_EXIT_INSN(),
2962 },
2963 .result = ACCEPT,
2964 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2965 },
2966 {
2967 "direct packet access: test20 (x += pkt_ptr, 1)",
2968 .insns = {
2969 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2970 offsetof(struct __sk_buff, data)),
2971 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2972 offsetof(struct __sk_buff, data_end)),
2973 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
2974 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
2975 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
1f9ab38f 2976 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
6d191ed4
DB		 2977 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
2978 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
2979 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
1f9ab38f 2980 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
6d191ed4
DB		 2981 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
2982 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
2983 BPF_MOV64_IMM(BPF_REG_0, 0),
2984 BPF_EXIT_INSN(),
2985 },
2986 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2987 .result = ACCEPT,
2988 },
2989 {
2990 "direct packet access: test21 (x += pkt_ptr, 2)",
2991 .insns = {
2992 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2993 offsetof(struct __sk_buff, data)),
2994 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2995 offsetof(struct __sk_buff, data_end)),
2996 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2998 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
2999 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3000 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3001 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1f9ab38f 3002 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
6d191ed4
DB		 3003 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3004 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
1f9ab38f 3005 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
6d191ed4
DB		 3006 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3007 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3008 BPF_MOV64_IMM(BPF_REG_0, 0),
3009 BPF_EXIT_INSN(),
3010 },
3011 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3012 .result = ACCEPT,
3013 },
3014 {
3015 "direct packet access: test22 (x += pkt_ptr, 3)",
3016 .insns = {
3017 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3018 offsetof(struct __sk_buff, data)),
3019 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3020 offsetof(struct __sk_buff, data_end)),
3021 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3022 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3023 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3024 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3025 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3026 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3027 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3028 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3029 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3030 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1f9ab38f 3031 BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
6d191ed4
DB		 3032 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3033 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3034 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3035 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3036 BPF_MOV64_IMM(BPF_REG_2, 1),
3037 BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3038 BPF_MOV64_IMM(BPF_REG_0, 0),
3039 BPF_EXIT_INSN(),
3040 },
3041 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3042 .result = ACCEPT,
3043 },
3044 {
3045 "direct packet access: test23 (x += pkt_ptr, 4)",
3046 .insns = {
3047 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3048 offsetof(struct __sk_buff, data)),
3049 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3050 offsetof(struct __sk_buff, data_end)),
3051 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3052 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3053 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3054 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3055 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3056 BPF_MOV64_IMM(BPF_REG_0, 31),
3057 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3058 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3059 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3060 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3061 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3062 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3063 BPF_MOV64_IMM(BPF_REG_0, 0),
3064 BPF_EXIT_INSN(),
3065 },
3066 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3067 .result = REJECT,
f65b1849 3068 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
6d191ed4
DB		 3069 },
3070 {
3071 "direct packet access: test24 (x += pkt_ptr, 5)",
3072 .insns = {
3073 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3074 offsetof(struct __sk_buff, data)),
3075 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3076 offsetof(struct __sk_buff, data_end)),
3077 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3078 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3079 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3080 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3081 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3082 BPF_MOV64_IMM(BPF_REG_0, 64),
3083 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3084 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3085 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
1f9ab38f 3086 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
6d191ed4
DB		 3087 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3088 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3089 BPF_MOV64_IMM(BPF_REG_0, 0),
3090 BPF_EXIT_INSN(),
3091 },
3092 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3093 .result = ACCEPT,
3094 },
31e482bf
DB		 3095 {
3096 "direct packet access: test25 (marking on <, good access)",
3097 .insns = {
3098 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3099 offsetof(struct __sk_buff, data)),
3100 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3101 offsetof(struct __sk_buff, data_end)),
3102 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3104 BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3105 BPF_MOV64_IMM(BPF_REG_0, 0),
3106 BPF_EXIT_INSN(),
3107 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3108 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3109 },
3110 .result = ACCEPT,
3111 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3112 },
3113 {
3114 "direct packet access: test26 (marking on <, bad access)",
3115 .insns = {
3116 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3117 offsetof(struct __sk_buff, data)),
3118 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3119 offsetof(struct __sk_buff, data_end)),
3120 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3121 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3122 BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3123 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3124 BPF_MOV64_IMM(BPF_REG_0, 0),
3125 BPF_EXIT_INSN(),
3126 BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3127 },
3128 .result = REJECT,
3129 .errstr = "invalid access to packet",
3130 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3131 },
3132 {
3133 "direct packet access: test27 (marking on <=, good access)",
3134 .insns = {
3135 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3136 offsetof(struct __sk_buff, data)),
3137 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3138 offsetof(struct __sk_buff, data_end)),
3139 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3140 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3141 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3142 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3143 BPF_MOV64_IMM(BPF_REG_0, 1),
3144 BPF_EXIT_INSN(),
3145 },
3146 .result = ACCEPT,
3147 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3148 },
3149 {
3150 "direct packet access: test28 (marking on <=, bad access)",
3151 .insns = {
3152 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3153 offsetof(struct __sk_buff, data)),
3154 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3155 offsetof(struct __sk_buff, data_end)),
3156 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3157 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3158 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3159 BPF_MOV64_IMM(BPF_REG_0, 1),
3160 BPF_EXIT_INSN(),
3161 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3162 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3163 },
3164 .result = REJECT,
3165 .errstr = "invalid access to packet",
3166 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3167 },
1633ac0a
AY		 3168 {
3169 "helper access to packet: test1, valid packet_ptr range",
3170 .insns = {
3171 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3172 offsetof(struct xdp_md, data)),
3173 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3174 offsetof(struct xdp_md, data_end)),
3175 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3176 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3177 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3178 BPF_LD_MAP_FD(BPF_REG_1, 0),
3179 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3180 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 3181 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3182 BPF_FUNC_map_update_elem),
1633ac0a
AY		 3183 BPF_MOV64_IMM(BPF_REG_0, 0),
3184 BPF_EXIT_INSN(),
3185 },
5aa5bd14 3186 .fixup_map1 = { 5 },
1633ac0a
AY		 3187 .result_unpriv = ACCEPT,
3188 .result = ACCEPT,
3189 .prog_type = BPF_PROG_TYPE_XDP,
3190 },
3191 {
3192 "helper access to packet: test2, unchecked packet_ptr",
3193 .insns = {
3194 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3195 offsetof(struct xdp_md, data)),
3196 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3197 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3198 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 3199 BPF_MOV64_IMM(BPF_REG_0, 0),
3200 BPF_EXIT_INSN(),
3201 },
5aa5bd14 3202 .fixup_map1 = { 1 },
1633ac0a
AY		 3203 .result = REJECT,
3204 .errstr = "invalid access to packet",
3205 .prog_type = BPF_PROG_TYPE_XDP,
3206 },
3207 {
3208 "helper access to packet: test3, variable add",
3209 .insns = {
3210 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3211 offsetof(struct xdp_md, data)),
3212 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3213 offsetof(struct xdp_md, data_end)),
3214 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3215 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3216 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3217 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3218 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3219 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3220 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3221 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3222 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3223 BPF_LD_MAP_FD(BPF_REG_1, 0),
3224 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
5aa5bd14
DB		 3225 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3226 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 3227 BPF_MOV64_IMM(BPF_REG_0, 0),
3228 BPF_EXIT_INSN(),
3229 },
5aa5bd14 3230 .fixup_map1 = { 11 },
1633ac0a
AY		 3231 .result = ACCEPT,
3232 .prog_type = BPF_PROG_TYPE_XDP,
3233 },
3234 {
3235 "helper access to packet: test4, packet_ptr with bad range",
3236 .insns = {
3237 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3238 offsetof(struct xdp_md, data)),
3239 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3240 offsetof(struct xdp_md, data_end)),
3241 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3242 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3243 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3244 BPF_MOV64_IMM(BPF_REG_0, 0),
3245 BPF_EXIT_INSN(),
3246 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3247 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3248 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 3249 BPF_MOV64_IMM(BPF_REG_0, 0),
3250 BPF_EXIT_INSN(),
3251 },
5aa5bd14 3252 .fixup_map1 = { 7 },
1633ac0a
AY		 3253 .result = REJECT,
3254 .errstr = "invalid access to packet",
3255 .prog_type = BPF_PROG_TYPE_XDP,
3256 },
3257 {
3258 "helper access to packet: test5, packet_ptr with too short range",
3259 .insns = {
3260 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3261 offsetof(struct xdp_md, data)),
3262 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3263 offsetof(struct xdp_md, data_end)),
3264 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3265 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3266 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3267 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3268 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3269 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3270 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 3271 BPF_MOV64_IMM(BPF_REG_0, 0),
3272 BPF_EXIT_INSN(),
3273 },
5aa5bd14 3274 .fixup_map1 = { 6 },
1633ac0a
AY		 3275 .result = REJECT,
3276 .errstr = "invalid access to packet",
3277 .prog_type = BPF_PROG_TYPE_XDP,
3278 },
7d95b0ab
DB		 3279 {
3280 "helper access to packet: test6, cls valid packet_ptr range",
3281 .insns = {
3282 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3283 offsetof(struct __sk_buff, data)),
3284 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3285 offsetof(struct __sk_buff, data_end)),
3286 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3287 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3288 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3289 BPF_LD_MAP_FD(BPF_REG_1, 0),
3290 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3291 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 3292 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3293 BPF_FUNC_map_update_elem),
7d95b0ab
DB		 3294 BPF_MOV64_IMM(BPF_REG_0, 0),
3295 BPF_EXIT_INSN(),
3296 },
5aa5bd14 3297 .fixup_map1 = { 5 },
7d95b0ab
DB		 3298 .result = ACCEPT,
3299 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3300 },
3301 {
3302 "helper access to packet: test7, cls unchecked packet_ptr",
3303 .insns = {
3304 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3305 offsetof(struct __sk_buff, data)),
3306 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3307 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3308 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 3309 BPF_MOV64_IMM(BPF_REG_0, 0),
3310 BPF_EXIT_INSN(),
3311 },
5aa5bd14 3312 .fixup_map1 = { 1 },
7d95b0ab
DB		 3313 .result = REJECT,
3314 .errstr = "invalid access to packet",
3315 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3316 },
3317 {
3318 "helper access to packet: test8, cls variable add",
3319 .insns = {
3320 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3321 offsetof(struct __sk_buff, data)),
3322 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3323 offsetof(struct __sk_buff, data_end)),
3324 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3325 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3326 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3327 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3328 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3329 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3330 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3331 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3332 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3333 BPF_LD_MAP_FD(BPF_REG_1, 0),
3334 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
5aa5bd14
DB		 3335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3336 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 3337 BPF_MOV64_IMM(BPF_REG_0, 0),
3338 BPF_EXIT_INSN(),
3339 },
5aa5bd14 3340 .fixup_map1 = { 11 },
7d95b0ab
DB		 3341 .result = ACCEPT,
3342 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3343 },
3344 {
3345 "helper access to packet: test9, cls packet_ptr with bad range",
3346 .insns = {
3347 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3348 offsetof(struct __sk_buff, data)),
3349 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3350 offsetof(struct __sk_buff, data_end)),
3351 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3352 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3353 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3354 BPF_MOV64_IMM(BPF_REG_0, 0),
3355 BPF_EXIT_INSN(),
3356 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3358 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 3359 BPF_MOV64_IMM(BPF_REG_0, 0),
3360 BPF_EXIT_INSN(),
3361 },
5aa5bd14 3362 .fixup_map1 = { 7 },
7d95b0ab
DB		 3363 .result = REJECT,
3364 .errstr = "invalid access to packet",
3365 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3366 },
3367 {
3368 "helper access to packet: test10, cls packet_ptr with too short range",
3369 .insns = {
3370 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3371 offsetof(struct __sk_buff, data)),
3372 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3373 offsetof(struct __sk_buff, data_end)),
3374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3375 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3377 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3378 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3379 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3380 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 3381 BPF_MOV64_IMM(BPF_REG_0, 0),
3382 BPF_EXIT_INSN(),
3383 },
5aa5bd14 3384 .fixup_map1 = { 6 },
7d95b0ab
DB		 3385 .result = REJECT,
3386 .errstr = "invalid access to packet",
3387 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3388 },
3389 {
3390 "helper access to packet: test11, cls unsuitable helper 1",
3391 .insns = {
3392 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3393 offsetof(struct __sk_buff, data)),
3394 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3395 offsetof(struct __sk_buff, data_end)),
3396 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3397 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
3399 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
3400 BPF_MOV64_IMM(BPF_REG_2, 0),
3401 BPF_MOV64_IMM(BPF_REG_4, 42),
3402 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3403 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3404 BPF_FUNC_skb_store_bytes),
7d95b0ab
DB		 3405 BPF_MOV64_IMM(BPF_REG_0, 0),
3406 BPF_EXIT_INSN(),
3407 },
3408 .result = REJECT,
3409 .errstr = "helper access to the packet",
3410 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3411 },
3412 {
3413 "helper access to packet: test12, cls unsuitable helper 2",
3414 .insns = {
3415 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3416 offsetof(struct __sk_buff, data)),
3417 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3418 offsetof(struct __sk_buff, data_end)),
3419 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3420 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
3421 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
3422 BPF_MOV64_IMM(BPF_REG_2, 0),
3423 BPF_MOV64_IMM(BPF_REG_4, 4),
5aa5bd14
DB		 3424 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3425 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 3426 BPF_MOV64_IMM(BPF_REG_0, 0),
3427 BPF_EXIT_INSN(),
3428 },
3429 .result = REJECT,
3430 .errstr = "helper access to the packet",
3431 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3432 },
3433 {
3434 "helper access to packet: test13, cls helper ok",
3435 .insns = {
3436 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3437 offsetof(struct __sk_buff, data)),
3438 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3439 offsetof(struct __sk_buff, data_end)),
3440 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3441 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3442 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3443 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3444 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3445 BPF_MOV64_IMM(BPF_REG_2, 4),
3446 BPF_MOV64_IMM(BPF_REG_3, 0),
3447 BPF_MOV64_IMM(BPF_REG_4, 0),
3448 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3449 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3450 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3451 BPF_MOV64_IMM(BPF_REG_0, 0),
3452 BPF_EXIT_INSN(),
3453 },
3454 .result = ACCEPT,
3455 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3456 },
3457 {
f65b1849 3458 "helper access to packet: test14, cls helper ok sub",
7d95b0ab
DB		 3459 .insns = {
3460 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3461 offsetof(struct __sk_buff, data)),
3462 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3463 offsetof(struct __sk_buff, data_end)),
3464 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3465 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3466 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3467 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3468 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
3469 BPF_MOV64_IMM(BPF_REG_2, 4),
3470 BPF_MOV64_IMM(BPF_REG_3, 0),
3471 BPF_MOV64_IMM(BPF_REG_4, 0),
3472 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3473 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3474 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3475 BPF_MOV64_IMM(BPF_REG_0, 0),
3476 BPF_EXIT_INSN(),
3477 },
f65b1849
EC		 3478 .result = ACCEPT,
3479 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3480 },
3481 {
3482 "helper access to packet: test15, cls helper fail sub",
3483 .insns = {
3484 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3485 offsetof(struct __sk_buff, data)),
3486 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3487 offsetof(struct __sk_buff, data_end)),
3488 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3489 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3490 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3491 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3492 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
3493 BPF_MOV64_IMM(BPF_REG_2, 4),
3494 BPF_MOV64_IMM(BPF_REG_3, 0),
3495 BPF_MOV64_IMM(BPF_REG_4, 0),
3496 BPF_MOV64_IMM(BPF_REG_5, 0),
3497 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3498 BPF_FUNC_csum_diff),
3499 BPF_MOV64_IMM(BPF_REG_0, 0),
3500 BPF_EXIT_INSN(),
3501 },
7d95b0ab 3502 .result = REJECT,
f65b1849 3503 .errstr = "invalid access to packet",
7d95b0ab
DB		 3504 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3505 },
3506 {
f65b1849 3507 "helper access to packet: test16, cls helper fail range 1",
7d95b0ab
DB		 3508 .insns = {
3509 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3510 offsetof(struct __sk_buff, data)),
3511 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3512 offsetof(struct __sk_buff, data_end)),
3513 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3514 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3515 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3516 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3517 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3518 BPF_MOV64_IMM(BPF_REG_2, 8),
3519 BPF_MOV64_IMM(BPF_REG_3, 0),
3520 BPF_MOV64_IMM(BPF_REG_4, 0),
3521 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3522 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3523 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3524 BPF_MOV64_IMM(BPF_REG_0, 0),
3525 BPF_EXIT_INSN(),
3526 },
3527 .result = REJECT,
3528 .errstr = "invalid access to packet",
3529 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3530 },
3531 {
f65b1849 3532 "helper access to packet: test17, cls helper fail range 2",
7d95b0ab
DB		 3533 .insns = {
3534 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3535 offsetof(struct __sk_buff, data)),
3536 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3537 offsetof(struct __sk_buff, data_end)),
3538 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3539 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3540 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3541 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3542 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3543 BPF_MOV64_IMM(BPF_REG_2, -9),
3544 BPF_MOV64_IMM(BPF_REG_3, 0),
3545 BPF_MOV64_IMM(BPF_REG_4, 0),
3546 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3547 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3548 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3549 BPF_MOV64_IMM(BPF_REG_0, 0),
3550 BPF_EXIT_INSN(),
3551 },
3552 .result = REJECT,
f65b1849 3553 .errstr = "R2 min value is negative",
7d95b0ab
DB		 3554 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3555 },
3556 {
f65b1849 3557 "helper access to packet: test18, cls helper fail range 3",
7d95b0ab
DB		 3558 .insns = {
3559 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3560 offsetof(struct __sk_buff, data)),
3561 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3562 offsetof(struct __sk_buff, data_end)),
3563 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3564 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3565 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3566 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3567 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3568 BPF_MOV64_IMM(BPF_REG_2, ~0),
3569 BPF_MOV64_IMM(BPF_REG_3, 0),
3570 BPF_MOV64_IMM(BPF_REG_4, 0),
3571 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3572 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3573 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3574 BPF_MOV64_IMM(BPF_REG_0, 0),
3575 BPF_EXIT_INSN(),
3576 },
3577 .result = REJECT,
f65b1849 3578 .errstr = "R2 min value is negative",
7d95b0ab
DB		 3579 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3580 },
3581 {
b6ff6391 3582 "helper access to packet: test19, cls helper range zero",
7d95b0ab
DB		 3583 .insns = {
3584 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3585 offsetof(struct __sk_buff, data)),
3586 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3587 offsetof(struct __sk_buff, data_end)),
3588 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3589 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3590 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3591 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3592 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3593 BPF_MOV64_IMM(BPF_REG_2, 0),
3594 BPF_MOV64_IMM(BPF_REG_3, 0),
3595 BPF_MOV64_IMM(BPF_REG_4, 0),
3596 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3597 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3598 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3599 BPF_MOV64_IMM(BPF_REG_0, 0),
3600 BPF_EXIT_INSN(),
3601 },
b6ff6391 3602 .result = ACCEPT,
7d95b0ab
DB		 3603 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3604 },
3605 {
f65b1849 3606 "helper access to packet: test20, pkt end as input",
7d95b0ab
DB		 3607 .insns = {
3608 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3609 offsetof(struct __sk_buff, data)),
3610 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3611 offsetof(struct __sk_buff, data_end)),
3612 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3613 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3614 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3615 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3616 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
3617 BPF_MOV64_IMM(BPF_REG_2, 4),
3618 BPF_MOV64_IMM(BPF_REG_3, 0),
3619 BPF_MOV64_IMM(BPF_REG_4, 0),
3620 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3621 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3622 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3623 BPF_MOV64_IMM(BPF_REG_0, 0),
3624 BPF_EXIT_INSN(),
3625 },
3626 .result = REJECT,
3627 .errstr = "R1 type=pkt_end expected=fp",
3628 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3629 },
3630 {
f65b1849 3631 "helper access to packet: test21, wrong reg",
7d95b0ab
DB		 3632 .insns = {
3633 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3634 offsetof(struct __sk_buff, data)),
3635 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3636 offsetof(struct __sk_buff, data_end)),
3637 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3638 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3639 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3640 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3641 BPF_MOV64_IMM(BPF_REG_2, 4),
3642 BPF_MOV64_IMM(BPF_REG_3, 0),
3643 BPF_MOV64_IMM(BPF_REG_4, 0),
3644 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 3645 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3646 BPF_FUNC_csum_diff),
7d95b0ab
DB		 3647 BPF_MOV64_IMM(BPF_REG_0, 0),
3648 BPF_EXIT_INSN(),
3649 },
3650 .result = REJECT,
3651 .errstr = "invalid access to packet",
3652 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3653 },
48461135
JB		 3654 {
3655 "valid map access into an array with a constant",
3656 .insns = {
3657 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3658 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3659 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3660 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3661 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3662 BPF_FUNC_map_lookup_elem),
48461135 3663 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5aa5bd14
DB		 3664 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3665 offsetof(struct test_val, foo)),
48461135
JB		 3666 BPF_EXIT_INSN(),
3667 },
5aa5bd14 3668 .fixup_map2 = { 3 },
48461135
JB		 3669 .errstr_unpriv = "R0 leaks addr",
3670 .result_unpriv = REJECT,
3671 .result = ACCEPT,
3672 },
3673 {
3674 "valid map access into an array with a register",
3675 .insns = {
3676 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3677 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3678 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3679 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3680 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3681 BPF_FUNC_map_lookup_elem),
48461135
JB		 3682 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3683 BPF_MOV64_IMM(BPF_REG_1, 4),
3684 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3685 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3686 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3687 offsetof(struct test_val, foo)),
48461135
JB		 3688 BPF_EXIT_INSN(),
3689 },
5aa5bd14 3690 .fixup_map2 = { 3 },
f65b1849 3691 .errstr_unpriv = "R0 leaks addr",
48461135
JB		 3692 .result_unpriv = REJECT,
3693 .result = ACCEPT,
02ea80b1 3694 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3695 },
3696 {
3697 "valid map access into an array with a variable",
3698 .insns = {
3699 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3700 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3701 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3702 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3703 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3704 BPF_FUNC_map_lookup_elem),
48461135
JB		 3705 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3706 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3707 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
3708 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3709 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3710 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3711 offsetof(struct test_val, foo)),
48461135
JB		 3712 BPF_EXIT_INSN(),
3713 },
5aa5bd14 3714 .fixup_map2 = { 3 },
f65b1849 3715 .errstr_unpriv = "R0 leaks addr",
48461135
JB		 3716 .result_unpriv = REJECT,
3717 .result = ACCEPT,
02ea80b1 3718 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3719 },
3720 {
3721 "valid map access into an array with a signed variable",
3722 .insns = {
3723 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3724 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3725 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3726 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3727 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3728 BPF_FUNC_map_lookup_elem),
48461135
JB		 3729 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
3730 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3731 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
3732 BPF_MOV32_IMM(BPF_REG_1, 0),
3733 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3734 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3735 BPF_MOV32_IMM(BPF_REG_1, 0),
3736 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3737 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3738 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3739 offsetof(struct test_val, foo)),
48461135
JB		 3740 BPF_EXIT_INSN(),
3741 },
5aa5bd14 3742 .fixup_map2 = { 3 },
f65b1849 3743 .errstr_unpriv = "R0 leaks addr",
48461135
JB		 3744 .result_unpriv = REJECT,
3745 .result = ACCEPT,
02ea80b1 3746 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3747 },
3748 {
3749 "invalid map access into an array with a constant",
3750 .insns = {
3751 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3752 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3753 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3754 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3755 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3756 BPF_FUNC_map_lookup_elem),
48461135
JB		 3757 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3758 BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
3759 offsetof(struct test_val, foo)),
3760 BPF_EXIT_INSN(),
3761 },
5aa5bd14 3762 .fixup_map2 = { 3 },
48461135
JB		 3763 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
3764 .result = REJECT,
3765 },
3766 {
3767 "invalid map access into an array with a register",
3768 .insns = {
3769 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3770 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3771 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3772 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3773 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3774 BPF_FUNC_map_lookup_elem),
48461135
JB		 3775 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3776 BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
3777 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3778 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3779 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3780 offsetof(struct test_val, foo)),
48461135
JB		 3781 BPF_EXIT_INSN(),
3782 },
5aa5bd14 3783 .fixup_map2 = { 3 },
48461135
JB		 3784 .errstr = "R0 min value is outside of the array range",
3785 .result = REJECT,
02ea80b1 3786 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3787 },
3788 {
3789 "invalid map access into an array with a variable",
3790 .insns = {
3791 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3792 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3793 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3794 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3795 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3796 BPF_FUNC_map_lookup_elem),
48461135
JB		 3797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3798 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3799 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3800 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3801 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3802 offsetof(struct test_val, foo)),
48461135
JB		 3803 BPF_EXIT_INSN(),
3804 },
5aa5bd14 3805 .fixup_map2 = { 3 },
f65b1849 3806 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
48461135 3807 .result = REJECT,
02ea80b1 3808 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3809 },
3810 {
3811 "invalid map access into an array with no floor check",
3812 .insns = {
3813 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3814 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3815 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3816 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3817 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3818 BPF_FUNC_map_lookup_elem),
48461135 3819 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
f65b1849 3820 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
48461135
JB		 3821 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3822 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3823 BPF_MOV32_IMM(BPF_REG_1, 0),
3824 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3825 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3826 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3827 offsetof(struct test_val, foo)),
48461135
JB		 3828 BPF_EXIT_INSN(),
3829 },
5aa5bd14 3830 .fixup_map2 = { 3 },
f65b1849
EC		 3831 .errstr_unpriv = "R0 leaks addr",
3832 .errstr = "R0 unbounded memory access",
5aa5bd14 3833 .result_unpriv = REJECT,
48461135 3834 .result = REJECT,
02ea80b1 3835 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3836 },
3837 {
3838 "invalid map access into an array with a invalid max check",
3839 .insns = {
3840 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3841 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3842 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3843 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3844 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3845 BPF_FUNC_map_lookup_elem),
48461135
JB		 3846 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3847 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3848 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
3849 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3850 BPF_MOV32_IMM(BPF_REG_1, 0),
3851 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3852 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 3853 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3854 offsetof(struct test_val, foo)),
48461135
JB		 3855 BPF_EXIT_INSN(),
3856 },
5aa5bd14 3857 .fixup_map2 = { 3 },
f65b1849 3858 .errstr_unpriv = "R0 leaks addr",
48461135 3859 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
5aa5bd14 3860 .result_unpriv = REJECT,
48461135 3861 .result = REJECT,
02ea80b1 3862 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135
JB		 3863 },
3864 {
3865 "invalid map access into an array with a invalid max check",
3866 .insns = {
3867 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3868 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3869 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3870 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3871 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3872 BPF_FUNC_map_lookup_elem),
48461135
JB		 3873 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3874 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3875 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3876 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3877 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3878 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3879 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3880 BPF_FUNC_map_lookup_elem),
48461135
JB		 3881 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3882 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
5aa5bd14
DB		 3883 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3884 offsetof(struct test_val, foo)),
48461135
JB		 3885 BPF_EXIT_INSN(),
3886 },
5aa5bd14 3887 .fixup_map2 = { 3, 11 },
f65b1849
EC		 3888 .errstr_unpriv = "R0 pointer += pointer",
3889 .errstr = "R0 invalid mem access 'inv'",
5aa5bd14 3890 .result_unpriv = REJECT,
48461135 3891 .result = REJECT,
02ea80b1 3892 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
48461135 3893 },
57a09bf0
TG		 3894 {
3895 "multiple registers share map_lookup_elem result",
3896 .insns = {
3897 BPF_MOV64_IMM(BPF_REG_1, 10),
3898 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3899 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3900 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3901 BPF_LD_MAP_FD(BPF_REG_1, 0),
3902 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3903 BPF_FUNC_map_lookup_elem),
3904 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3905 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3906 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3907 BPF_EXIT_INSN(),
3908 },
3909 .fixup_map1 = { 4 },
3910 .result = ACCEPT,
3911 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3912 },
614d0d77
DB		 3913 {
3914 "alu ops on ptr_to_map_value_or_null, 1",
3915 .insns = {
3916 BPF_MOV64_IMM(BPF_REG_1, 10),
3917 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3918 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3919 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3920 BPF_LD_MAP_FD(BPF_REG_1, 0),
3921 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3922 BPF_FUNC_map_lookup_elem),
3923 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3924 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
3925 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
3926 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3927 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3928 BPF_EXIT_INSN(),
3929 },
3930 .fixup_map1 = { 4 },
3931 .errstr = "R4 invalid mem access",
3932 .result = REJECT,
3933 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3934 },
3935 {
3936 "alu ops on ptr_to_map_value_or_null, 2",
3937 .insns = {
3938 BPF_MOV64_IMM(BPF_REG_1, 10),
3939 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3940 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3941 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3942 BPF_LD_MAP_FD(BPF_REG_1, 0),
3943 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3944 BPF_FUNC_map_lookup_elem),
3945 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3946 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
3947 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3948 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3949 BPF_EXIT_INSN(),
3950 },
3951 .fixup_map1 = { 4 },
3952 .errstr = "R4 invalid mem access",
3953 .result = REJECT,
3954 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3955 },
3956 {
3957 "alu ops on ptr_to_map_value_or_null, 3",
3958 .insns = {
3959 BPF_MOV64_IMM(BPF_REG_1, 10),
3960 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3961 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3962 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3963 BPF_LD_MAP_FD(BPF_REG_1, 0),
3964 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3965 BPF_FUNC_map_lookup_elem),
3966 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3967 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
3968 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3969 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3970 BPF_EXIT_INSN(),
3971 },
3972 .fixup_map1 = { 4 },
3973 .errstr = "R4 invalid mem access",
3974 .result = REJECT,
3975 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3976 },
57a09bf0
TG		 3977 {
3978 "invalid memory access with multiple map_lookup_elem calls",
3979 .insns = {
3980 BPF_MOV64_IMM(BPF_REG_1, 10),
3981 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3982 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3983 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3984 BPF_LD_MAP_FD(BPF_REG_1, 0),
3985 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3986 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3987 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3988 BPF_FUNC_map_lookup_elem),
3989 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3990 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3991 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3992 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3993 BPF_FUNC_map_lookup_elem),
3994 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3995 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3996 BPF_EXIT_INSN(),
3997 },
3998 .fixup_map1 = { 4 },
3999 .result = REJECT,
4000 .errstr = "R4 !read_ok",
4001 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4002 },
4003 {
4004 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4005 .insns = {
4006 BPF_MOV64_IMM(BPF_REG_1, 10),
4007 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4008 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4009 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4010 BPF_LD_MAP_FD(BPF_REG_1, 0),
4011 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4012 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4014 BPF_FUNC_map_lookup_elem),
4015 BPF_MOV64_IMM(BPF_REG_2, 10),
4016 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4017 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4018 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4019 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4020 BPF_FUNC_map_lookup_elem),
4021 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4022 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4023 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4024 BPF_EXIT_INSN(),
4025 },
4026 .fixup_map1 = { 4 },
4027 .result = ACCEPT,
4028 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4029 },
e9548901
JB		 4030 {
4031 "invalid map access from else condition",
4032 .insns = {
4033 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4034 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4035 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4036 BPF_LD_MAP_FD(BPF_REG_1, 0),
4037 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4038 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4039 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4040 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4041 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4042 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4043 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4044 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4045 BPF_EXIT_INSN(),
4046 },
4047 .fixup_map2 = { 3 },
f65b1849 4048 .errstr = "R0 unbounded memory access",
e9548901 4049 .result = REJECT,
f65b1849 4050 .errstr_unpriv = "R0 leaks addr",
e9548901 4051 .result_unpriv = REJECT,
02ea80b1 4052 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
e9548901 4053 },
3c839744
GB		 4054 {
4055 "constant register |= constant should keep constant type",
4056 .insns = {
4057 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4058 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4059 BPF_MOV64_IMM(BPF_REG_2, 34),
4060 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4061 BPF_MOV64_IMM(BPF_REG_3, 0),
4062 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4063 BPF_EXIT_INSN(),
4064 },
4065 .result = ACCEPT,
4066 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4067 },
4068 {
4069 "constant register |= constant should not bypass stack boundary checks",
4070 .insns = {
4071 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4072 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4073 BPF_MOV64_IMM(BPF_REG_2, 34),
4074 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4075 BPF_MOV64_IMM(BPF_REG_3, 0),
4076 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4077 BPF_EXIT_INSN(),
4078 },
4079 .errstr = "invalid stack type R1 off=-48 access_size=58",
4080 .result = REJECT,
4081 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4082 },
4083 {
4084 "constant register |= constant register should keep constant type",
4085 .insns = {
4086 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4087 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4088 BPF_MOV64_IMM(BPF_REG_2, 34),
4089 BPF_MOV64_IMM(BPF_REG_4, 13),
4090 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4091 BPF_MOV64_IMM(BPF_REG_3, 0),
4092 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4093 BPF_EXIT_INSN(),
4094 },
4095 .result = ACCEPT,
4096 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4097 },
4098 {
4099 "constant register |= constant register should not bypass stack boundary checks",
4100 .insns = {
4101 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4102 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4103 BPF_MOV64_IMM(BPF_REG_2, 34),
4104 BPF_MOV64_IMM(BPF_REG_4, 24),
4105 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4106 BPF_MOV64_IMM(BPF_REG_3, 0),
4107 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4108 BPF_EXIT_INSN(),
4109 },
4110 .errstr = "invalid stack type R1 off=-48 access_size=58",
4111 .result = REJECT,
4112 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4113 },
3f731d89
TG		 4114 {
4115 "invalid direct packet write for LWT_IN",
4116 .insns = {
4117 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4118 offsetof(struct __sk_buff, data)),
4119 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4120 offsetof(struct __sk_buff, data_end)),
4121 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4122 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4123 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4124 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4125 BPF_MOV64_IMM(BPF_REG_0, 0),
4126 BPF_EXIT_INSN(),
4127 },
4128 .errstr = "cannot write into packet",
4129 .result = REJECT,
4130 .prog_type = BPF_PROG_TYPE_LWT_IN,
4131 },
4132 {
4133 "invalid direct packet write for LWT_OUT",
4134 .insns = {
4135 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4136 offsetof(struct __sk_buff, data)),
4137 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4138 offsetof(struct __sk_buff, data_end)),
4139 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4140 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4141 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4142 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4143 BPF_MOV64_IMM(BPF_REG_0, 0),
4144 BPF_EXIT_INSN(),
4145 },
4146 .errstr = "cannot write into packet",
4147 .result = REJECT,
4148 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4149 },
4150 {
4151 "direct packet write for LWT_XMIT",
4152 .insns = {
4153 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4154 offsetof(struct __sk_buff, data)),
4155 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4156 offsetof(struct __sk_buff, data_end)),
4157 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4158 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4159 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4160 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4161 BPF_MOV64_IMM(BPF_REG_0, 0),
4162 BPF_EXIT_INSN(),
4163 },
4164 .result = ACCEPT,
4165 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4166 },
4167 {
4168 "direct packet read for LWT_IN",
4169 .insns = {
4170 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4171 offsetof(struct __sk_buff, data)),
4172 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4173 offsetof(struct __sk_buff, data_end)),
4174 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4175 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4176 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4177 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4178 BPF_MOV64_IMM(BPF_REG_0, 0),
4179 BPF_EXIT_INSN(),
4180 },
4181 .result = ACCEPT,
4182 .prog_type = BPF_PROG_TYPE_LWT_IN,
4183 },
4184 {
4185 "direct packet read for LWT_OUT",
4186 .insns = {
4187 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4188 offsetof(struct __sk_buff, data)),
4189 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4190 offsetof(struct __sk_buff, data_end)),
4191 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4192 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4193 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4194 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4195 BPF_MOV64_IMM(BPF_REG_0, 0),
4196 BPF_EXIT_INSN(),
4197 },
4198 .result = ACCEPT,
4199 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4200 },
4201 {
4202 "direct packet read for LWT_XMIT",
4203 .insns = {
4204 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4205 offsetof(struct __sk_buff, data)),
4206 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4207 offsetof(struct __sk_buff, data_end)),
4208 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4209 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4210 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4211 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4212 BPF_MOV64_IMM(BPF_REG_0, 0),
4213 BPF_EXIT_INSN(),
4214 },
4215 .result = ACCEPT,
4216 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4217 },
b1977682
AS		 4218 {
4219 "overlapping checks for direct packet access",
4220 .insns = {
4221 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4222 offsetof(struct __sk_buff, data)),
4223 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4224 offsetof(struct __sk_buff, data_end)),
4225 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4226 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4227 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
4228 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4229 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
4230 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
4231 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
4232 BPF_MOV64_IMM(BPF_REG_0, 0),
4233 BPF_EXIT_INSN(),
3f731d89
TG		 4234 },
4235 .result = ACCEPT,
4236 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4237 },
4238 {
4239 "invalid access of tc_classid for LWT_IN",
4240 .insns = {
4241 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4242 offsetof(struct __sk_buff, tc_classid)),
4243 BPF_EXIT_INSN(),
4244 },
4245 .result = REJECT,
4246 .errstr = "invalid bpf_context access",
4247 },
4248 {
4249 "invalid access of tc_classid for LWT_OUT",
4250 .insns = {
4251 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4252 offsetof(struct __sk_buff, tc_classid)),
4253 BPF_EXIT_INSN(),
4254 },
4255 .result = REJECT,
4256 .errstr = "invalid bpf_context access",
4257 },
4258 {
4259 "invalid access of tc_classid for LWT_XMIT",
4260 .insns = {
4261 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4262 offsetof(struct __sk_buff, tc_classid)),
4263 BPF_EXIT_INSN(),
4264 },
4265 .result = REJECT,
4266 .errstr = "invalid bpf_context access",
4267 },
6bdf6abc
DB		 4268 {
4269 "leak pointer into ctx 1",
4270 .insns = {
4271 BPF_MOV64_IMM(BPF_REG_0, 0),
4272 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4273 offsetof(struct __sk_buff, cb[0])),
4274 BPF_LD_MAP_FD(BPF_REG_2, 0),
4275 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
4276 offsetof(struct __sk_buff, cb[0])),
4277 BPF_EXIT_INSN(),
4278 },
4279 .fixup_map1 = { 2 },
4280 .errstr_unpriv = "R2 leaks addr into mem",
4281 .result_unpriv = REJECT,
4282 .result = ACCEPT,
4283 },
4284 {
4285 "leak pointer into ctx 2",
4286 .insns = {
4287 BPF_MOV64_IMM(BPF_REG_0, 0),
4288 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4289 offsetof(struct __sk_buff, cb[0])),
4290 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
4291 offsetof(struct __sk_buff, cb[0])),
4292 BPF_EXIT_INSN(),
4293 },
4294 .errstr_unpriv = "R10 leaks addr into mem",
4295 .result_unpriv = REJECT,
4296 .result = ACCEPT,
4297 },
4298 {
4299 "leak pointer into ctx 3",
4300 .insns = {
4301 BPF_MOV64_IMM(BPF_REG_0, 0),
4302 BPF_LD_MAP_FD(BPF_REG_2, 0),
4303 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
4304 offsetof(struct __sk_buff, cb[0])),
4305 BPF_EXIT_INSN(),
4306 },
4307 .fixup_map1 = { 1 },
4308 .errstr_unpriv = "R2 leaks addr into ctx",
4309 .result_unpriv = REJECT,
4310 .result = ACCEPT,
4311 },
4312 {
4313 "leak pointer into map val",
4314 .insns = {
4315 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
4316 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4317 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4318 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4319 BPF_LD_MAP_FD(BPF_REG_1, 0),
4320 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4321 BPF_FUNC_map_lookup_elem),
4322 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4323 BPF_MOV64_IMM(BPF_REG_3, 0),
4324 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
4325 BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
4326 BPF_MOV64_IMM(BPF_REG_0, 0),
4327 BPF_EXIT_INSN(),
4328 },
4329 .fixup_map1 = { 4 },
4330 .errstr_unpriv = "R6 leaks addr into mem",
4331 .result_unpriv = REJECT,
4332 .result = ACCEPT,
4333 },
5722569b
GB		 4334 {
4335 "helper access to map: full range",
4336 .insns = {
4337 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4338 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4339 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4340 BPF_LD_MAP_FD(BPF_REG_1, 0),
4341 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4342 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4343 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4344 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4345 BPF_MOV64_IMM(BPF_REG_3, 0),
4346 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4347 BPF_EXIT_INSN(),
4348 },
4349 .fixup_map2 = { 3 },
4350 .result = ACCEPT,
4351 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4352 },
4353 {
4354 "helper access to map: partial range",
4355 .insns = {
4356 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4357 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4358 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4359 BPF_LD_MAP_FD(BPF_REG_1, 0),
4360 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4361 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4362 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4363 BPF_MOV64_IMM(BPF_REG_2, 8),
4364 BPF_MOV64_IMM(BPF_REG_3, 0),
4365 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4366 BPF_EXIT_INSN(),
4367 },
4368 .fixup_map2 = { 3 },
4369 .result = ACCEPT,
4370 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4371 },
4372 {
4373 "helper access to map: empty range",
4374 .insns = {
4375 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4377 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4378 BPF_LD_MAP_FD(BPF_REG_1, 0),
4379 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
f1a8b8e3
YS		 4380 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4381 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4382 BPF_MOV64_IMM(BPF_REG_2, 0),
4383 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5722569b
GB		 4384 BPF_EXIT_INSN(),
4385 },
4386 .fixup_map2 = { 3 },
4387 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
4388 .result = REJECT,
4389 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4390 },
4391 {
4392 "helper access to map: out-of-bound range",
4393 .insns = {
4394 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4395 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4396 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4397 BPF_LD_MAP_FD(BPF_REG_1, 0),
4398 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4399 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4400 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4401 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
4402 BPF_MOV64_IMM(BPF_REG_3, 0),
4403 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4404 BPF_EXIT_INSN(),
4405 },
4406 .fixup_map2 = { 3 },
4407 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
4408 .result = REJECT,
4409 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4410 },
4411 {
4412 "helper access to map: negative range",
4413 .insns = {
4414 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4415 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4416 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4417 BPF_LD_MAP_FD(BPF_REG_1, 0),
4418 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4419 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4420 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4421 BPF_MOV64_IMM(BPF_REG_2, -8),
4422 BPF_MOV64_IMM(BPF_REG_3, 0),
4423 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4424 BPF_EXIT_INSN(),
4425 },
4426 .fixup_map2 = { 3 },
f65b1849 4427 .errstr = "R2 min value is negative",
5722569b
GB		 4428 .result = REJECT,
4429 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4430 },
4431 {
4432 "helper access to adjusted map (via const imm): full range",
4433 .insns = {
4434 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4435 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4436 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4437 BPF_LD_MAP_FD(BPF_REG_1, 0),
4438 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4439 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4440 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4441 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4442 offsetof(struct test_val, foo)),
4443 BPF_MOV64_IMM(BPF_REG_2,
4444 sizeof(struct test_val) -
4445 offsetof(struct test_val, foo)),
4446 BPF_MOV64_IMM(BPF_REG_3, 0),
4447 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4448 BPF_EXIT_INSN(),
4449 },
4450 .fixup_map2 = { 3 },
4451 .result = ACCEPT,
4452 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4453 },
4454 {
4455 "helper access to adjusted map (via const imm): partial range",
4456 .insns = {
4457 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4458 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4459 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4460 BPF_LD_MAP_FD(BPF_REG_1, 0),
4461 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4462 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4463 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4464 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4465 offsetof(struct test_val, foo)),
4466 BPF_MOV64_IMM(BPF_REG_2, 8),
4467 BPF_MOV64_IMM(BPF_REG_3, 0),
4468 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4469 BPF_EXIT_INSN(),
4470 },
4471 .fixup_map2 = { 3 },
4472 .result = ACCEPT,
4473 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4474 },
4475 {
4476 "helper access to adjusted map (via const imm): empty range",
4477 .insns = {
4478 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4479 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4480 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4481 BPF_LD_MAP_FD(BPF_REG_1, 0),
4482 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
f1a8b8e3 4483 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5722569b
GB		 4484 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4485 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4486 offsetof(struct test_val, foo)),
f1a8b8e3
YS		 4487 BPF_MOV64_IMM(BPF_REG_2, 0),
4488 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5722569b
GB		 4489 BPF_EXIT_INSN(),
4490 },
4491 .fixup_map2 = { 3 },
f65b1849 4492 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5722569b
GB		 4493 .result = REJECT,
4494 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4495 },
4496 {
4497 "helper access to adjusted map (via const imm): out-of-bound range",
4498 .insns = {
4499 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4500 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4501 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4502 BPF_LD_MAP_FD(BPF_REG_1, 0),
4503 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4504 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4505 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4506 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4507 offsetof(struct test_val, foo)),
4508 BPF_MOV64_IMM(BPF_REG_2,
4509 sizeof(struct test_val) -
4510 offsetof(struct test_val, foo) + 8),
4511 BPF_MOV64_IMM(BPF_REG_3, 0),
4512 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4513 BPF_EXIT_INSN(),
4514 },
4515 .fixup_map2 = { 3 },
4516 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4517 .result = REJECT,
4518 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4519 },
4520 {
4521 "helper access to adjusted map (via const imm): negative range (> adjustment)",
4522 .insns = {
4523 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4524 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4525 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4526 BPF_LD_MAP_FD(BPF_REG_1, 0),
4527 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4528 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4529 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4530 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4531 offsetof(struct test_val, foo)),
4532 BPF_MOV64_IMM(BPF_REG_2, -8),
4533 BPF_MOV64_IMM(BPF_REG_3, 0),
4534 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4535 BPF_EXIT_INSN(),
4536 },
4537 .fixup_map2 = { 3 },
f65b1849 4538 .errstr = "R2 min value is negative",
5722569b
GB		 4539 .result = REJECT,
4540 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4541 },
4542 {
4543 "helper access to adjusted map (via const imm): negative range (< adjustment)",
4544 .insns = {
4545 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4546 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4547 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4548 BPF_LD_MAP_FD(BPF_REG_1, 0),
4549 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4550 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4551 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4552 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4553 offsetof(struct test_val, foo)),
4554 BPF_MOV64_IMM(BPF_REG_2, -1),
4555 BPF_MOV64_IMM(BPF_REG_3, 0),
4556 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4557 BPF_EXIT_INSN(),
4558 },
4559 .fixup_map2 = { 3 },
f65b1849 4560 .errstr = "R2 min value is negative",
5722569b
GB		 4561 .result = REJECT,
4562 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4563 },
4564 {
4565 "helper access to adjusted map (via const reg): full range",
4566 .insns = {
4567 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4568 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4569 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4570 BPF_LD_MAP_FD(BPF_REG_1, 0),
4571 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4572 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4573 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4574 BPF_MOV64_IMM(BPF_REG_3,
4575 offsetof(struct test_val, foo)),
4576 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4577 BPF_MOV64_IMM(BPF_REG_2,
4578 sizeof(struct test_val) -
4579 offsetof(struct test_val, foo)),
4580 BPF_MOV64_IMM(BPF_REG_3, 0),
4581 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4582 BPF_EXIT_INSN(),
4583 },
4584 .fixup_map2 = { 3 },
4585 .result = ACCEPT,
4586 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4587 },
4588 {
4589 "helper access to adjusted map (via const reg): partial range",
4590 .insns = {
4591 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4592 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4593 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4594 BPF_LD_MAP_FD(BPF_REG_1, 0),
4595 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4596 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4597 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4598 BPF_MOV64_IMM(BPF_REG_3,
4599 offsetof(struct test_val, foo)),
4600 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4601 BPF_MOV64_IMM(BPF_REG_2, 8),
4602 BPF_MOV64_IMM(BPF_REG_3, 0),
4603 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4604 BPF_EXIT_INSN(),
4605 },
4606 .fixup_map2 = { 3 },
4607 .result = ACCEPT,
4608 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4609 },
4610 {
4611 "helper access to adjusted map (via const reg): empty range",
4612 .insns = {
4613 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4614 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4615 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4616 BPF_LD_MAP_FD(BPF_REG_1, 0),
4617 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
f1a8b8e3 4618 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5722569b
GB		 4619 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4620 BPF_MOV64_IMM(BPF_REG_3, 0),
4621 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
f1a8b8e3
YS		 4622 BPF_MOV64_IMM(BPF_REG_2, 0),
4623 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5722569b
GB		 4624 BPF_EXIT_INSN(),
4625 },
4626 .fixup_map2 = { 3 },
f1a8b8e3 4627 .errstr = "R1 min value is outside of the array range",
5722569b
GB		 4628 .result = REJECT,
4629 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4630 },
4631 {
4632 "helper access to adjusted map (via const reg): out-of-bound range",
4633 .insns = {
4634 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4635 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4636 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4637 BPF_LD_MAP_FD(BPF_REG_1, 0),
4638 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4639 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4640 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4641 BPF_MOV64_IMM(BPF_REG_3,
4642 offsetof(struct test_val, foo)),
4643 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4644 BPF_MOV64_IMM(BPF_REG_2,
4645 sizeof(struct test_val) -
4646 offsetof(struct test_val, foo) + 8),
4647 BPF_MOV64_IMM(BPF_REG_3, 0),
4648 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4649 BPF_EXIT_INSN(),
4650 },
4651 .fixup_map2 = { 3 },
4652 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4653 .result = REJECT,
4654 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4655 },
4656 {
4657 "helper access to adjusted map (via const reg): negative range (> adjustment)",
4658 .insns = {
4659 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4660 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4661 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4662 BPF_LD_MAP_FD(BPF_REG_1, 0),
4663 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4664 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4665 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4666 BPF_MOV64_IMM(BPF_REG_3,
4667 offsetof(struct test_val, foo)),
4668 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4669 BPF_MOV64_IMM(BPF_REG_2, -8),
4670 BPF_MOV64_IMM(BPF_REG_3, 0),
4671 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4672 BPF_EXIT_INSN(),
4673 },
4674 .fixup_map2 = { 3 },
f65b1849 4675 .errstr = "R2 min value is negative",
5722569b
GB		 4676 .result = REJECT,
4677 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4678 },
4679 {
4680 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4681 .insns = {
4682 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4683 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4684 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4685 BPF_LD_MAP_FD(BPF_REG_1, 0),
4686 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4687 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4688 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4689 BPF_MOV64_IMM(BPF_REG_3,
4690 offsetof(struct test_val, foo)),
4691 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4692 BPF_MOV64_IMM(BPF_REG_2, -1),
4693 BPF_MOV64_IMM(BPF_REG_3, 0),
4694 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4695 BPF_EXIT_INSN(),
4696 },
4697 .fixup_map2 = { 3 },
f65b1849 4698 .errstr = "R2 min value is negative",
5722569b
GB		 4699 .result = REJECT,
4700 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4701 },
4702 {
4703 "helper access to adjusted map (via variable): full range",
4704 .insns = {
4705 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4706 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4707 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4708 BPF_LD_MAP_FD(BPF_REG_1, 0),
4709 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4710 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4711 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4712 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4713 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4714 offsetof(struct test_val, foo), 4),
4715 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4716 BPF_MOV64_IMM(BPF_REG_2,
4717 sizeof(struct test_val) -
4718 offsetof(struct test_val, foo)),
4719 BPF_MOV64_IMM(BPF_REG_3, 0),
4720 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4721 BPF_EXIT_INSN(),
4722 },
4723 .fixup_map2 = { 3 },
4724 .result = ACCEPT,
4725 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4726 },
4727 {
4728 "helper access to adjusted map (via variable): partial range",
4729 .insns = {
4730 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4731 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4732 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4733 BPF_LD_MAP_FD(BPF_REG_1, 0),
4734 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4735 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4736 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4737 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4738 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4739 offsetof(struct test_val, foo), 4),
4740 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4741 BPF_MOV64_IMM(BPF_REG_2, 8),
4742 BPF_MOV64_IMM(BPF_REG_3, 0),
4743 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4744 BPF_EXIT_INSN(),
4745 },
4746 .fixup_map2 = { 3 },
4747 .result = ACCEPT,
4748 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4749 },
4750 {
4751 "helper access to adjusted map (via variable): empty range",
4752 .insns = {
4753 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4755 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4756 BPF_LD_MAP_FD(BPF_REG_1, 0),
4757 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
f1a8b8e3 4758 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5722569b
GB		 4759 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4760 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4761 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
f1a8b8e3 4762 offsetof(struct test_val, foo), 3),
5722569b 4763 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
f1a8b8e3
YS		 4764 BPF_MOV64_IMM(BPF_REG_2, 0),
4765 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5722569b
GB		 4766 BPF_EXIT_INSN(),
4767 },
4768 .fixup_map2 = { 3 },
f1a8b8e3 4769 .errstr = "R1 min value is outside of the array range",
5722569b
GB		 4770 .result = REJECT,
4771 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4772 },
4773 {
4774 "helper access to adjusted map (via variable): no max check",
4775 .insns = {
4776 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4777 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4778 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4779 BPF_LD_MAP_FD(BPF_REG_1, 0),
4780 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4781 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4782 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4783 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4784 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
f65b1849 4785 BPF_MOV64_IMM(BPF_REG_2, 1),
5722569b
GB		 4786 BPF_MOV64_IMM(BPF_REG_3, 0),
4787 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4788 BPF_EXIT_INSN(),
4789 },
4790 .fixup_map2 = { 3 },
f65b1849 4791 .errstr = "R1 unbounded memory access",
5722569b
GB		 4792 .result = REJECT,
4793 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4794 },
4795 {
4796 "helper access to adjusted map (via variable): wrong max check",
4797 .insns = {
4798 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4800 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4801 BPF_LD_MAP_FD(BPF_REG_1, 0),
4802 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4803 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4804 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4805 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4806 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4807 offsetof(struct test_val, foo), 4),
4808 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4809 BPF_MOV64_IMM(BPF_REG_2,
4810 sizeof(struct test_val) -
4811 offsetof(struct test_val, foo) + 1),
4812 BPF_MOV64_IMM(BPF_REG_3, 0),
4813 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4814 BPF_EXIT_INSN(),
4815 },
4816 .fixup_map2 = { 3 },
4817 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
4818 .result = REJECT,
4819 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4820 },
31e482bf
DB		 4821 {
4822 "helper access to map: bounds check using <, good access",
4823 .insns = {
4824 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4825 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4826 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4827 BPF_LD_MAP_FD(BPF_REG_1, 0),
4828 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4829 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4830 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4831 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4832 BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
4833 BPF_MOV64_IMM(BPF_REG_0, 0),
4834 BPF_EXIT_INSN(),
4835 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4836 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4837 BPF_MOV64_IMM(BPF_REG_0, 0),
4838 BPF_EXIT_INSN(),
4839 },
4840 .fixup_map2 = { 3 },
4841 .result = ACCEPT,
4842 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4843 },
4844 {
4845 "helper access to map: bounds check using <, bad access",
4846 .insns = {
4847 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4848 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4849 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4850 BPF_LD_MAP_FD(BPF_REG_1, 0),
4851 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4852 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4853 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4854 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4855 BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
4856 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4857 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4858 BPF_MOV64_IMM(BPF_REG_0, 0),
4859 BPF_EXIT_INSN(),
4860 BPF_MOV64_IMM(BPF_REG_0, 0),
4861 BPF_EXIT_INSN(),
4862 },
4863 .fixup_map2 = { 3 },
4864 .result = REJECT,
4865 .errstr = "R1 unbounded memory access",
4866 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4867 },
4868 {
4869 "helper access to map: bounds check using <=, good access",
4870 .insns = {
4871 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4873 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4874 BPF_LD_MAP_FD(BPF_REG_1, 0),
4875 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4876 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4877 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4878 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4879 BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
4880 BPF_MOV64_IMM(BPF_REG_0, 0),
4881 BPF_EXIT_INSN(),
4882 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4883 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4884 BPF_MOV64_IMM(BPF_REG_0, 0),
4885 BPF_EXIT_INSN(),
4886 },
4887 .fixup_map2 = { 3 },
4888 .result = ACCEPT,
4889 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4890 },
4891 {
4892 "helper access to map: bounds check using <=, bad access",
4893 .insns = {
4894 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4896 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4897 BPF_LD_MAP_FD(BPF_REG_1, 0),
4898 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4899 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4900 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4901 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4902 BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
4903 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4904 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4905 BPF_MOV64_IMM(BPF_REG_0, 0),
4906 BPF_EXIT_INSN(),
4907 BPF_MOV64_IMM(BPF_REG_0, 0),
4908 BPF_EXIT_INSN(),
4909 },
4910 .fixup_map2 = { 3 },
4911 .result = REJECT,
4912 .errstr = "R1 unbounded memory access",
4913 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4914 },
4915 {
4916 "helper access to map: bounds check using s<, good access",
4917 .insns = {
4918 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4919 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4920 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4921 BPF_LD_MAP_FD(BPF_REG_1, 0),
4922 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4923 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4924 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4925 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4926 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
4927 BPF_MOV64_IMM(BPF_REG_0, 0),
4928 BPF_EXIT_INSN(),
4929 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
4930 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4931 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4932 BPF_MOV64_IMM(BPF_REG_0, 0),
4933 BPF_EXIT_INSN(),
4934 },
4935 .fixup_map2 = { 3 },
4936 .result = ACCEPT,
4937 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4938 },
4939 {
4940 "helper access to map: bounds check using s<, good access 2",
4941 .insns = {
4942 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4943 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4944 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4945 BPF_LD_MAP_FD(BPF_REG_1, 0),
4946 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4947 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4948 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4949 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4950 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
4951 BPF_MOV64_IMM(BPF_REG_0, 0),
4952 BPF_EXIT_INSN(),
4953 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
4954 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4955 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4956 BPF_MOV64_IMM(BPF_REG_0, 0),
4957 BPF_EXIT_INSN(),
4958 },
4959 .fixup_map2 = { 3 },
4960 .result = ACCEPT,
4961 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4962 },
4963 {
4964 "helper access to map: bounds check using s<, bad access",
4965 .insns = {
4966 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4967 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4968 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4969 BPF_LD_MAP_FD(BPF_REG_1, 0),
4970 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4971 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4972 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4973 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
4974 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
4975 BPF_MOV64_IMM(BPF_REG_0, 0),
4976 BPF_EXIT_INSN(),
4977 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
4978 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4979 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4980 BPF_MOV64_IMM(BPF_REG_0, 0),
4981 BPF_EXIT_INSN(),
4982 },
4983 .fixup_map2 = { 3 },
4984 .result = REJECT,
4985 .errstr = "R1 min value is negative",
4986 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4987 },
4988 {
4989 "helper access to map: bounds check using s<=, good access",
4990 .insns = {
4991 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4992 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4993 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4994 BPF_LD_MAP_FD(BPF_REG_1, 0),
4995 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4996 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4997 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4998 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4999 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5000 BPF_MOV64_IMM(BPF_REG_0, 0),
5001 BPF_EXIT_INSN(),
5002 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5003 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5004 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5005 BPF_MOV64_IMM(BPF_REG_0, 0),
5006 BPF_EXIT_INSN(),
5007 },
5008 .fixup_map2 = { 3 },
5009 .result = ACCEPT,
5010 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5011 },
5012 {
5013 "helper access to map: bounds check using s<=, good access 2",
5014 .insns = {
5015 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5016 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5017 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5018 BPF_LD_MAP_FD(BPF_REG_1, 0),
5019 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5020 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5021 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5022 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5023 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5024 BPF_MOV64_IMM(BPF_REG_0, 0),
5025 BPF_EXIT_INSN(),
5026 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5027 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5028 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5029 BPF_MOV64_IMM(BPF_REG_0, 0),
5030 BPF_EXIT_INSN(),
5031 },
5032 .fixup_map2 = { 3 },
5033 .result = ACCEPT,
5034 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5035 },
5036 {
5037 "helper access to map: bounds check using s<=, bad access",
5038 .insns = {
5039 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5040 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5041 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5042 BPF_LD_MAP_FD(BPF_REG_1, 0),
5043 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5044 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5045 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5046 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5047 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5048 BPF_MOV64_IMM(BPF_REG_0, 0),
5049 BPF_EXIT_INSN(),
5050 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5051 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5052 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5053 BPF_MOV64_IMM(BPF_REG_0, 0),
5054 BPF_EXIT_INSN(),
5055 },
5056 .fixup_map2 = { 3 },
5057 .result = REJECT,
5058 .errstr = "R1 min value is negative",
5059 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5060 },
f0318d01
GB		 5061 {
5062 "map element value is preserved across register spilling",
5063 .insns = {
5064 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5066 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5067 BPF_LD_MAP_FD(BPF_REG_1, 0),
5068 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5069 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5070 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5071 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5072 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5073 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5074 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5075 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5076 BPF_EXIT_INSN(),
5077 },
5078 .fixup_map2 = { 3 },
5079 .errstr_unpriv = "R0 leaks addr",
5080 .result = ACCEPT,
5081 .result_unpriv = REJECT,
5082 },
5083 {
02ea80b1
DB		 5084 "map element value or null is marked on register spilling",
5085 .insns = {
5086 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5087 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5088 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5089 BPF_LD_MAP_FD(BPF_REG_1, 0),
5090 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5091 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5092 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
5093 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5094 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5095 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5096 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5097 BPF_EXIT_INSN(),
5098 },
5099 .fixup_map2 = { 3 },
5100 .errstr_unpriv = "R0 leaks addr",
5101 .result = ACCEPT,
5102 .result_unpriv = REJECT,
5103 },
5104 {
5105 "map element value store of cleared call register",
5106 .insns = {
5107 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5108 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5109 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5110 BPF_LD_MAP_FD(BPF_REG_1, 0),
5111 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5112 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5113 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
5114 BPF_EXIT_INSN(),
5115 },
5116 .fixup_map2 = { 3 },
5117 .errstr_unpriv = "R1 !read_ok",
5118 .errstr = "R1 !read_ok",
5119 .result = REJECT,
5120 .result_unpriv = REJECT,
5121 },
5122 {
5123 "map element value with unaligned store",
5124 .insns = {
5125 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5126 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5127 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5128 BPF_LD_MAP_FD(BPF_REG_1, 0),
5129 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5130 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
5131 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5132 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5133 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
5134 BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
5135 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5136 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
5137 BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
5138 BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
5139 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
5140 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
5141 BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
5142 BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
5143 BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
5144 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
5145 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
5146 BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
5147 BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
5148 BPF_EXIT_INSN(),
5149 },
5150 .fixup_map2 = { 3 },
f65b1849 5151 .errstr_unpriv = "R0 leaks addr",
02ea80b1
DB		 5152 .result = ACCEPT,
5153 .result_unpriv = REJECT,
5154 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5155 },
5156 {
5157 "map element value with unaligned load",
5158 .insns = {
5159 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5161 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5162 BPF_LD_MAP_FD(BPF_REG_1, 0),
5163 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5164 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5165 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5166 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
5167 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5168 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5169 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
5170 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5171 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
5172 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
5173 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
5174 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5175 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
5176 BPF_EXIT_INSN(),
5177 },
5178 .fixup_map2 = { 3 },
f65b1849 5179 .errstr_unpriv = "R0 leaks addr",
02ea80b1
DB		 5180 .result = ACCEPT,
5181 .result_unpriv = REJECT,
5182 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5183 },
5184 {
5185 "map element value illegal alu op, 1",
5186 .insns = {
5187 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5188 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5189 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5190 BPF_LD_MAP_FD(BPF_REG_1, 0),
5191 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5192 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5193 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
5194 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5195 BPF_EXIT_INSN(),
5196 },
5197 .fixup_map2 = { 3 },
f65b1849 5198 .errstr_unpriv = "R0 bitwise operator &= on pointer",
02ea80b1
DB		 5199 .errstr = "invalid mem access 'inv'",
5200 .result = REJECT,
5201 .result_unpriv = REJECT,
5202 },
5203 {
5204 "map element value illegal alu op, 2",
5205 .insns = {
5206 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5207 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5208 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5209 BPF_LD_MAP_FD(BPF_REG_1, 0),
5210 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5211 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5212 BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
5213 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5214 BPF_EXIT_INSN(),
5215 },
5216 .fixup_map2 = { 3 },
f65b1849 5217 .errstr_unpriv = "R0 32-bit pointer arithmetic prohibited",
02ea80b1
DB		 5218 .errstr = "invalid mem access 'inv'",
5219 .result = REJECT,
5220 .result_unpriv = REJECT,
5221 },
5222 {
5223 "map element value illegal alu op, 3",
5224 .insns = {
5225 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5226 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5227 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5228 BPF_LD_MAP_FD(BPF_REG_1, 0),
5229 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5230 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5231 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
5232 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5233 BPF_EXIT_INSN(),
5234 },
5235 .fixup_map2 = { 3 },
f65b1849 5236 .errstr_unpriv = "R0 pointer arithmetic with /= operator",
02ea80b1
DB		 5237 .errstr = "invalid mem access 'inv'",
5238 .result = REJECT,
5239 .result_unpriv = REJECT,
5240 },
5241 {
5242 "map element value illegal alu op, 4",
5243 .insns = {
5244 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5245 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5246 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5247 BPF_LD_MAP_FD(BPF_REG_1, 0),
5248 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5249 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5250 BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
5251 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5252 BPF_EXIT_INSN(),
5253 },
5254 .fixup_map2 = { 3 },
5255 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5256 .errstr = "invalid mem access 'inv'",
5257 .result = REJECT,
5258 .result_unpriv = REJECT,
5259 },
5260 {
5261 "map element value illegal alu op, 5",
5262 .insns = {
5263 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5264 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5265 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5266 BPF_LD_MAP_FD(BPF_REG_1, 0),
5267 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5268 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5269 BPF_MOV64_IMM(BPF_REG_3, 4096),
5270 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5271 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5272 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5273 BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
5274 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
5275 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5276 BPF_EXIT_INSN(),
5277 },
5278 .fixup_map2 = { 3 },
02ea80b1
DB		 5279 .errstr = "R0 invalid mem access 'inv'",
5280 .result = REJECT,
02ea80b1
DB		 5281 },
5282 {
5283 "map element value is preserved across register spilling",
f0318d01
GB		 5284 .insns = {
5285 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5286 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5287 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5288 BPF_LD_MAP_FD(BPF_REG_1, 0),
5289 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5290 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5291 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
5292 offsetof(struct test_val, foo)),
5293 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5294 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5296 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5297 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5298 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5299 BPF_EXIT_INSN(),
5300 },
5301 .fixup_map2 = { 3 },
f65b1849 5302 .errstr_unpriv = "R0 leaks addr",
f0318d01
GB		 5303 .result = ACCEPT,
5304 .result_unpriv = REJECT,
02ea80b1 5305 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
f0318d01 5306 },
06c1c049
GB		 5307 {
5308 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
5309 .insns = {
5310 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5311 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5312 BPF_MOV64_IMM(BPF_REG_0, 0),
5313 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5314 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5315 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5316 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5317 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5318 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5319 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5320 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5321 BPF_MOV64_IMM(BPF_REG_2, 16),
5322 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5323 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5324 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5325 BPF_MOV64_IMM(BPF_REG_4, 0),
5326 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5327 BPF_MOV64_IMM(BPF_REG_3, 0),
5328 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5329 BPF_MOV64_IMM(BPF_REG_0, 0),
5330 BPF_EXIT_INSN(),
5331 },
5332 .result = ACCEPT,
5333 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5334 },
5335 {
5336 "helper access to variable memory: stack, bitwise AND, zero included",
5337 .insns = {
5338 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5339 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5340 BPF_MOV64_IMM(BPF_REG_2, 16),
5341 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5342 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5343 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5344 BPF_MOV64_IMM(BPF_REG_3, 0),
5345 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5346 BPF_EXIT_INSN(),
5347 },
b6ff6391 5348 .errstr = "invalid indirect read from stack off -64+0 size 64",
06c1c049
GB		 5349 .result = REJECT,
5350 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5351 },
5352 {
5353 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
5354 .insns = {
5355 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5356 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5357 BPF_MOV64_IMM(BPF_REG_2, 16),
5358 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5359 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5360 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
5361 BPF_MOV64_IMM(BPF_REG_4, 0),
5362 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5363 BPF_MOV64_IMM(BPF_REG_3, 0),
5364 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5365 BPF_MOV64_IMM(BPF_REG_0, 0),
5366 BPF_EXIT_INSN(),
5367 },
5368 .errstr = "invalid stack type R1 off=-64 access_size=65",
5369 .result = REJECT,
5370 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5371 },
5372 {
5373 "helper access to variable memory: stack, JMP, correct bounds",
5374 .insns = {
5375 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5377 BPF_MOV64_IMM(BPF_REG_0, 0),
5378 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5379 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5380 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5381 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5382 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5383 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5384 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5385 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5386 BPF_MOV64_IMM(BPF_REG_2, 16),
5387 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5388 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5389 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
5390 BPF_MOV64_IMM(BPF_REG_4, 0),
5391 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5392 BPF_MOV64_IMM(BPF_REG_3, 0),
5393 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5394 BPF_MOV64_IMM(BPF_REG_0, 0),
5395 BPF_EXIT_INSN(),
5396 },
5397 .result = ACCEPT,
5398 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5399 },
5400 {
5401 "helper access to variable memory: stack, JMP (signed), correct bounds",
5402 .insns = {
5403 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5404 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5405 BPF_MOV64_IMM(BPF_REG_0, 0),
5406 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5407 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5408 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5409 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5410 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5411 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5412 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5413 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5414 BPF_MOV64_IMM(BPF_REG_2, 16),
5415 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5416 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5417 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
5418 BPF_MOV64_IMM(BPF_REG_4, 0),
5419 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5420 BPF_MOV64_IMM(BPF_REG_3, 0),
5421 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5422 BPF_MOV64_IMM(BPF_REG_0, 0),
5423 BPF_EXIT_INSN(),
5424 },
5425 .result = ACCEPT,
5426 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5427 },
5428 {
5429 "helper access to variable memory: stack, JMP, bounds + offset",
5430 .insns = {
5431 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5432 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5433 BPF_MOV64_IMM(BPF_REG_2, 16),
5434 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5435 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5436 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
5437 BPF_MOV64_IMM(BPF_REG_4, 0),
5438 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
5439 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5440 BPF_MOV64_IMM(BPF_REG_3, 0),
5441 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5442 BPF_MOV64_IMM(BPF_REG_0, 0),
5443 BPF_EXIT_INSN(),
5444 },
5445 .errstr = "invalid stack type R1 off=-64 access_size=65",
5446 .result = REJECT,
5447 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5448 },
5449 {
5450 "helper access to variable memory: stack, JMP, wrong max",
5451 .insns = {
5452 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5453 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5454 BPF_MOV64_IMM(BPF_REG_2, 16),
5455 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5456 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5457 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
5458 BPF_MOV64_IMM(BPF_REG_4, 0),
5459 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5460 BPF_MOV64_IMM(BPF_REG_3, 0),
5461 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5462 BPF_MOV64_IMM(BPF_REG_0, 0),
5463 BPF_EXIT_INSN(),
5464 },
5465 .errstr = "invalid stack type R1 off=-64 access_size=65",
5466 .result = REJECT,
5467 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5468 },
5469 {
5470 "helper access to variable memory: stack, JMP, no max check",
5471 .insns = {
5472 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5473 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5474 BPF_MOV64_IMM(BPF_REG_2, 16),
5475 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5476 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5477 BPF_MOV64_IMM(BPF_REG_4, 0),
5478 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5479 BPF_MOV64_IMM(BPF_REG_3, 0),
5480 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5481 BPF_MOV64_IMM(BPF_REG_0, 0),
5482 BPF_EXIT_INSN(),
5483 },
f65b1849
EC		 5484 /* because max wasn't checked, signed min is negative */
5485 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
06c1c049
GB		 5486 .result = REJECT,
5487 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5488 },
5489 {
5490 "helper access to variable memory: stack, JMP, no min check",
5491 .insns = {
5492 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5493 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5494 BPF_MOV64_IMM(BPF_REG_2, 16),
5495 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5496 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5497 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
5498 BPF_MOV64_IMM(BPF_REG_3, 0),
5499 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5500 BPF_MOV64_IMM(BPF_REG_0, 0),
5501 BPF_EXIT_INSN(),
5502 },
b6ff6391 5503 .errstr = "invalid indirect read from stack off -64+0 size 64",
06c1c049
GB		 5504 .result = REJECT,
5505 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5506 },
5507 {
5508 "helper access to variable memory: stack, JMP (signed), no min check",
5509 .insns = {
5510 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5511 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5512 BPF_MOV64_IMM(BPF_REG_2, 16),
5513 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5514 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5515 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
5516 BPF_MOV64_IMM(BPF_REG_3, 0),
5517 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5518 BPF_MOV64_IMM(BPF_REG_0, 0),
5519 BPF_EXIT_INSN(),
5520 },
5521 .errstr = "R2 min value is negative",
5522 .result = REJECT,
5523 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5524 },
5525 {
5526 "helper access to variable memory: map, JMP, correct bounds",
5527 .insns = {
5528 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5529 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5530 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5531 BPF_LD_MAP_FD(BPF_REG_1, 0),
5532 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5533 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5534 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5535 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5536 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5537 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5538 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5539 sizeof(struct test_val), 4),
5540 BPF_MOV64_IMM(BPF_REG_4, 0),
a1502132 5541 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
06c1c049
GB		 5542 BPF_MOV64_IMM(BPF_REG_3, 0),
5543 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5544 BPF_MOV64_IMM(BPF_REG_0, 0),
5545 BPF_EXIT_INSN(),
5546 },
5547 .fixup_map2 = { 3 },
5548 .result = ACCEPT,
5549 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5550 },
5551 {
5552 "helper access to variable memory: map, JMP, wrong max",
5553 .insns = {
5554 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5555 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5556 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5557 BPF_LD_MAP_FD(BPF_REG_1, 0),
5558 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5559 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5560 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5561 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5562 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5563 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5564 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5565 sizeof(struct test_val) + 1, 4),
5566 BPF_MOV64_IMM(BPF_REG_4, 0),
a1502132 5567 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
06c1c049
GB		 5568 BPF_MOV64_IMM(BPF_REG_3, 0),
5569 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5570 BPF_MOV64_IMM(BPF_REG_0, 0),
5571 BPF_EXIT_INSN(),
5572 },
5573 .fixup_map2 = { 3 },
5574 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
5575 .result = REJECT,
5576 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5577 },
5578 {
5579 "helper access to variable memory: map adjusted, JMP, correct bounds",
5580 .insns = {
5581 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5582 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5583 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5584 BPF_LD_MAP_FD(BPF_REG_1, 0),
5585 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5586 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5587 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5588 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
5589 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5590 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5591 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5592 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5593 sizeof(struct test_val) - 20, 4),
5594 BPF_MOV64_IMM(BPF_REG_4, 0),
a1502132 5595 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
06c1c049
GB		 5596 BPF_MOV64_IMM(BPF_REG_3, 0),
5597 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5598 BPF_MOV64_IMM(BPF_REG_0, 0),
5599 BPF_EXIT_INSN(),
5600 },
5601 .fixup_map2 = { 3 },
5602 .result = ACCEPT,
5603 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5604 },
5605 {
5606 "helper access to variable memory: map adjusted, JMP, wrong max",
5607 .insns = {
5608 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5609 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5610 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5611 BPF_LD_MAP_FD(BPF_REG_1, 0),
5612 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5613 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5614 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5615 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
5616 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5617 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5618 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5619 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5620 sizeof(struct test_val) - 19, 4),
5621 BPF_MOV64_IMM(BPF_REG_4, 0),
a1502132 5622 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
06c1c049
GB		 5623 BPF_MOV64_IMM(BPF_REG_3, 0),
5624 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5625 BPF_MOV64_IMM(BPF_REG_0, 0),
5626 BPF_EXIT_INSN(),
5627 },
5628 .fixup_map2 = { 3 },
5629 .errstr = "R1 min value is outside of the array range",
5630 .result = REJECT,
5631 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5632 },
f65b1849
EC		 5633 {
5634 "helper access to variable memory: size = 0 allowed on NULL",
5635 .insns = {
5636 BPF_MOV64_IMM(BPF_REG_1, 0),
5637 BPF_MOV64_IMM(BPF_REG_2, 0),
5638 BPF_MOV64_IMM(BPF_REG_3, 0),
5639 BPF_MOV64_IMM(BPF_REG_4, 0),
5640 BPF_MOV64_IMM(BPF_REG_5, 0),
5641 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5642 BPF_EXIT_INSN(),
5643 },
5644 .result = ACCEPT,
5645 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5646 },
06c1c049
GB		 5647 {
5648 "helper access to variable memory: size > 0 not allowed on NULL",
5649 .insns = {
5650 BPF_MOV64_IMM(BPF_REG_1, 0),
5651 BPF_MOV64_IMM(BPF_REG_2, 0),
3fadc801
DB		 5652 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5653 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
06c1c049
GB		 5654 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5655 BPF_MOV64_IMM(BPF_REG_3, 0),
5656 BPF_MOV64_IMM(BPF_REG_4, 0),
5657 BPF_MOV64_IMM(BPF_REG_5, 0),
5658 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5659 BPF_EXIT_INSN(),
5660 },
f65b1849 5661 .errstr = "R1 type=inv expected=fp",
06c1c049
GB		 5662 .result = REJECT,
5663 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5664 },
5665 {
b6ff6391 5666 "helper access to variable memory: size = 0 allowed on != NULL stack pointer",
06c1c049
GB		 5667 .insns = {
5668 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5669 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
5670 BPF_MOV64_IMM(BPF_REG_2, 0),
5671 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
5672 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
5673 BPF_MOV64_IMM(BPF_REG_3, 0),
5674 BPF_MOV64_IMM(BPF_REG_4, 0),
5675 BPF_MOV64_IMM(BPF_REG_5, 0),
5676 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5677 BPF_EXIT_INSN(),
5678 },
b6ff6391
YS		 5679 .result = ACCEPT,
5680 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5681 },
5682 {
5683 "helper access to variable memory: size = 0 allowed on != NULL map pointer",
5684 .insns = {
5685 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5686 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5687 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5688 BPF_LD_MAP_FD(BPF_REG_1, 0),
5689 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5690 BPF_FUNC_map_lookup_elem),
5691 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5692 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5693 BPF_MOV64_IMM(BPF_REG_2, 0),
5694 BPF_MOV64_IMM(BPF_REG_3, 0),
5695 BPF_MOV64_IMM(BPF_REG_4, 0),
5696 BPF_MOV64_IMM(BPF_REG_5, 0),
5697 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5698 BPF_EXIT_INSN(),
5699 },
5700 .fixup_map1 = { 3 },
5701 .result = ACCEPT,
5702 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5703 },
5704 {
5705 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer",
5706 .insns = {
5707 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5708 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5709 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5710 BPF_LD_MAP_FD(BPF_REG_1, 0),
5711 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5712 BPF_FUNC_map_lookup_elem),
5713 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
5714 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5715 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
5716 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5717 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
5718 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
5719 BPF_MOV64_IMM(BPF_REG_3, 0),
5720 BPF_MOV64_IMM(BPF_REG_4, 0),
5721 BPF_MOV64_IMM(BPF_REG_5, 0),
5722 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5723 BPF_EXIT_INSN(),
5724 },
5725 .fixup_map1 = { 3 },
5726 .result = ACCEPT,
5727 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5728 },
5729 {
5730 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer",
5731 .insns = {
5732 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5733 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5734 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5735 BPF_LD_MAP_FD(BPF_REG_1, 0),
5736 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5737 BPF_FUNC_map_lookup_elem),
5738 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5739 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5740 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5741 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
5742 BPF_MOV64_IMM(BPF_REG_3, 0),
5743 BPF_MOV64_IMM(BPF_REG_4, 0),
5744 BPF_MOV64_IMM(BPF_REG_5, 0),
5745 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5746 BPF_EXIT_INSN(),
5747 },
5748 .fixup_map1 = { 3 },
5749 .result = ACCEPT,
5750 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5751 },
5752 {
5753 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer",
5754 .insns = {
5755 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
5756 offsetof(struct __sk_buff, data)),
5757 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5758 offsetof(struct __sk_buff, data_end)),
5759 BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
5760 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5761 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
5762 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5763 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
5764 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
5765 BPF_MOV64_IMM(BPF_REG_3, 0),
5766 BPF_MOV64_IMM(BPF_REG_4, 0),
5767 BPF_MOV64_IMM(BPF_REG_5, 0),
5768 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5769 BPF_EXIT_INSN(),
5770 },
5771 .result = ACCEPT,
06c1c049
GB		 5772 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5773 },
5774 {
5775 "helper access to variable memory: 8 bytes leak",
5776 .insns = {
5777 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5778 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5779 BPF_MOV64_IMM(BPF_REG_0, 0),
5780 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5781 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5782 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5783 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5784 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5785 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5786 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5787 BPF_MOV64_IMM(BPF_REG_2, 0),
3fadc801
DB		 5788 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5789 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
06c1c049
GB		 5790 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
5791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5792 BPF_MOV64_IMM(BPF_REG_3, 0),
5793 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5794 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5795 BPF_EXIT_INSN(),
5796 },
5797 .errstr = "invalid indirect read from stack off -64+32 size 64",
5798 .result = REJECT,
5799 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5800 },
5801 {
5802 "helper access to variable memory: 8 bytes no leak (init memory)",
5803 .insns = {
5804 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5805 BPF_MOV64_IMM(BPF_REG_0, 0),
5806 BPF_MOV64_IMM(BPF_REG_0, 0),
5807 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5808 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5809 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5810 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5811 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5812 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5813 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5814 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5815 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5816 BPF_MOV64_IMM(BPF_REG_2, 0),
5817 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
5818 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
5819 BPF_MOV64_IMM(BPF_REG_3, 0),
5820 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5821 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5822 BPF_EXIT_INSN(),
5823 },
5824 .result = ACCEPT,
5825 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5826 },
29200c19
JB		 5827 {
5828 "invalid and of negative number",
5829 .insns = {
5830 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5831 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5832 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5833 BPF_LD_MAP_FD(BPF_REG_1, 0),
5834 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5835 BPF_FUNC_map_lookup_elem),
5836 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
f65b1849 5837 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
29200c19
JB		 5838 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
5839 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
5840 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5841 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
5842 offsetof(struct test_val, foo)),
5843 BPF_EXIT_INSN(),
5844 },
5845 .fixup_map2 = { 3 },
f65b1849 5846 .errstr = "R0 max value is outside of the array range",
29200c19 5847 .result = REJECT,
02ea80b1 5848 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
29200c19
JB		 5849 },
5850 {
5851 "invalid range check",
5852 .insns = {
5853 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5854 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5855 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5856 BPF_LD_MAP_FD(BPF_REG_1, 0),
5857 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5858 BPF_FUNC_map_lookup_elem),
5859 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
5860 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5861 BPF_MOV64_IMM(BPF_REG_9, 1),
5862 BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
5863 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
5864 BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
5865 BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
5866 BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
5867 BPF_MOV32_IMM(BPF_REG_3, 1),
5868 BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
5869 BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
5870 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
5871 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
5872 BPF_MOV64_REG(BPF_REG_0, 0),
5873 BPF_EXIT_INSN(),
5874 },
5875 .fixup_map2 = { 3 },
f65b1849 5876 .errstr = "R0 max value is outside of the array range",
29200c19 5877 .result = REJECT,
02ea80b1 5878 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
fb30d4b7
MKL		 5879 },
5880 {
5881 "map in map access",
5882 .insns = {
5883 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5884 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5885 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5886 BPF_LD_MAP_FD(BPF_REG_1, 0),
5887 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5888 BPF_FUNC_map_lookup_elem),
5889 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5890 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5891 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5892 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5893 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5894 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5895 BPF_FUNC_map_lookup_elem),
5896 BPF_MOV64_REG(BPF_REG_0, 0),
5897 BPF_EXIT_INSN(),
5898 },
5899 .fixup_map_in_map = { 3 },
5900 .result = ACCEPT,
5901 },
5902 {
5903 "invalid inner map pointer",
5904 .insns = {
5905 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5906 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5907 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5908 BPF_LD_MAP_FD(BPF_REG_1, 0),
5909 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5910 BPF_FUNC_map_lookup_elem),
5911 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5912 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5913 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5914 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5915 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5916 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
5917 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5918 BPF_FUNC_map_lookup_elem),
5919 BPF_MOV64_REG(BPF_REG_0, 0),
5920 BPF_EXIT_INSN(),
5921 },
5922 .fixup_map_in_map = { 3 },
5923 .errstr = "R1 type=inv expected=map_ptr",
f65b1849 5924 .errstr_unpriv = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
fb30d4b7
MKL		 5925 .result = REJECT,
5926 },
5927 {
5928 "forgot null checking on the inner map pointer",
5929 .insns = {
5930 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5931 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5932 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5933 BPF_LD_MAP_FD(BPF_REG_1, 0),
5934 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5935 BPF_FUNC_map_lookup_elem),
5936 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5937 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5938 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5939 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5940 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5941 BPF_FUNC_map_lookup_elem),
5942 BPF_MOV64_REG(BPF_REG_0, 0),
5943 BPF_EXIT_INSN(),
5944 },
5945 .fixup_map_in_map = { 3 },
5946 .errstr = "R1 type=map_value_or_null expected=map_ptr",
5947 .result = REJECT,
614d0d77
DB		 5948 },
5949 {
5950 "ld_abs: check calling conv, r1",
5951 .insns = {
5952 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5953 BPF_MOV64_IMM(BPF_REG_1, 0),
5954 BPF_LD_ABS(BPF_W, -0x200000),
5955 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5956 BPF_EXIT_INSN(),
5957 },
5958 .errstr = "R1 !read_ok",
5959 .result = REJECT,
5960 },
5961 {
5962 "ld_abs: check calling conv, r2",
5963 .insns = {
5964 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5965 BPF_MOV64_IMM(BPF_REG_2, 0),
5966 BPF_LD_ABS(BPF_W, -0x200000),
5967 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5968 BPF_EXIT_INSN(),
5969 },
5970 .errstr = "R2 !read_ok",
5971 .result = REJECT,
5972 },
5973 {
5974 "ld_abs: check calling conv, r3",
5975 .insns = {
5976 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5977 BPF_MOV64_IMM(BPF_REG_3, 0),
5978 BPF_LD_ABS(BPF_W, -0x200000),
5979 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5980 BPF_EXIT_INSN(),
5981 },
5982 .errstr = "R3 !read_ok",
5983 .result = REJECT,
5984 },
5985 {
5986 "ld_abs: check calling conv, r4",
5987 .insns = {
5988 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5989 BPF_MOV64_IMM(BPF_REG_4, 0),
5990 BPF_LD_ABS(BPF_W, -0x200000),
5991 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5992 BPF_EXIT_INSN(),
5993 },
5994 .errstr = "R4 !read_ok",
5995 .result = REJECT,
5996 },
5997 {
5998 "ld_abs: check calling conv, r5",
5999 .insns = {
6000 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6001 BPF_MOV64_IMM(BPF_REG_5, 0),
6002 BPF_LD_ABS(BPF_W, -0x200000),
6003 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6004 BPF_EXIT_INSN(),
6005 },
6006 .errstr = "R5 !read_ok",
6007 .result = REJECT,
6008 },
6009 {
6010 "ld_abs: check calling conv, r7",
6011 .insns = {
6012 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6013 BPF_MOV64_IMM(BPF_REG_7, 0),
6014 BPF_LD_ABS(BPF_W, -0x200000),
6015 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6016 BPF_EXIT_INSN(),
6017 },
6018 .result = ACCEPT,
6019 },
6020 {
6021 "ld_ind: check calling conv, r1",
6022 .insns = {
6023 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6024 BPF_MOV64_IMM(BPF_REG_1, 1),
6025 BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
6026 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6027 BPF_EXIT_INSN(),
6028 },
6029 .errstr = "R1 !read_ok",
6030 .result = REJECT,
6031 },
6032 {
6033 "ld_ind: check calling conv, r2",
6034 .insns = {
6035 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6036 BPF_MOV64_IMM(BPF_REG_2, 1),
6037 BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
6038 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6039 BPF_EXIT_INSN(),
6040 },
6041 .errstr = "R2 !read_ok",
6042 .result = REJECT,
6043 },
6044 {
6045 "ld_ind: check calling conv, r3",
6046 .insns = {
6047 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6048 BPF_MOV64_IMM(BPF_REG_3, 1),
6049 BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
6050 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6051 BPF_EXIT_INSN(),
6052 },
6053 .errstr = "R3 !read_ok",
6054 .result = REJECT,
6055 },
6056 {
6057 "ld_ind: check calling conv, r4",
6058 .insns = {
6059 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6060 BPF_MOV64_IMM(BPF_REG_4, 1),
6061 BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
6062 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6063 BPF_EXIT_INSN(),
6064 },
6065 .errstr = "R4 !read_ok",
6066 .result = REJECT,
6067 },
6068 {
6069 "ld_ind: check calling conv, r5",
6070 .insns = {
6071 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6072 BPF_MOV64_IMM(BPF_REG_5, 1),
6073 BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
6074 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6075 BPF_EXIT_INSN(),
6076 },
6077 .errstr = "R5 !read_ok",
6078 .result = REJECT,
6079 },
6080 {
6081 "ld_ind: check calling conv, r7",
6082 .insns = {
6083 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6084 BPF_MOV64_IMM(BPF_REG_7, 1),
6085 BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
6086 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6087 BPF_EXIT_INSN(),
6088 },
6089 .result = ACCEPT,
6090 },
18f3d6be
YS		 6091 {
6092 "check bpf_perf_event_data->sample_period byte load permitted",
6093 .insns = {
6094 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 6095#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 6096 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6097 offsetof(struct bpf_perf_event_data, sample_period)),
6098#else
6099 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6100 offsetof(struct bpf_perf_event_data, sample_period) + 7),
6101#endif
6102 BPF_EXIT_INSN(),
6103 },
6104 .result = ACCEPT,
6105 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6106 },
6107 {
6108 "check bpf_perf_event_data->sample_period half load permitted",
6109 .insns = {
6110 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 6111#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 6112 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6113 offsetof(struct bpf_perf_event_data, sample_period)),
6114#else
6115 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6116 offsetof(struct bpf_perf_event_data, sample_period) + 6),
6117#endif
6118 BPF_EXIT_INSN(),
6119 },
6120 .result = ACCEPT,
6121 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6122 },
6123 {
6124 "check bpf_perf_event_data->sample_period word load permitted",
6125 .insns = {
6126 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 6127#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 6128 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6129 offsetof(struct bpf_perf_event_data, sample_period)),
6130#else
6131 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6132 offsetof(struct bpf_perf_event_data, sample_period) + 4),
6133#endif
6134 BPF_EXIT_INSN(),
6135 },
6136 .result = ACCEPT,
6137 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6138 },
6139 {
6140 "check bpf_perf_event_data->sample_period dword load permitted",
6141 .insns = {
6142 BPF_MOV64_IMM(BPF_REG_0, 0),
6143 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
6144 offsetof(struct bpf_perf_event_data, sample_period)),
6145 BPF_EXIT_INSN(),
6146 },
6147 .result = ACCEPT,
6148 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6149 },
6150 {
6151 "check skb->data half load not permitted",
6152 .insns = {
6153 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 6154#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 6155 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6156 offsetof(struct __sk_buff, data)),
6157#else
6158 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6159 offsetof(struct __sk_buff, data) + 2),
6160#endif
6161 BPF_EXIT_INSN(),
6162 },
6163 .result = REJECT,
6164 .errstr = "invalid bpf_context access",
6165 },
6166 {
6167 "check skb->tc_classid half load not permitted for lwt prog",
6168 .insns = {
6169 BPF_MOV64_IMM(BPF_REG_0, 0),
2c460621 6170#if __BYTE_ORDER == __LITTLE_ENDIAN
18f3d6be
YS		 6171 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6172 offsetof(struct __sk_buff, tc_classid)),
6173#else
6174 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6175 offsetof(struct __sk_buff, tc_classid) + 2),
6176#endif
6177 BPF_EXIT_INSN(),
6178 },
6179 .result = REJECT,
6180 .errstr = "invalid bpf_context access",
6181 .prog_type = BPF_PROG_TYPE_LWT_IN,
6182 },
b712296a
EC		 6183 {
6184 "bounds checks mixing signed and unsigned, positive bounds",
6185 .insns = {
6186 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6187 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6188 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6189 BPF_LD_MAP_FD(BPF_REG_1, 0),
6190 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6191 BPF_FUNC_map_lookup_elem),
6192 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6193 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6194 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6195 BPF_MOV64_IMM(BPF_REG_2, 2),
6196 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
6197 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
6198 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6199 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6200 BPF_MOV64_IMM(BPF_REG_0, 0),
6201 BPF_EXIT_INSN(),
6202 },
6203 .fixup_map1 = { 3 },
b712296a
EC		 6204 .errstr = "R0 min value is negative",
6205 .result = REJECT,
b712296a
EC		 6206 },
6207 {
6208 "bounds checks mixing signed and unsigned",
6209 .insns = {
6210 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6211 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6212 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6213 BPF_LD_MAP_FD(BPF_REG_1, 0),
6214 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6215 BPF_FUNC_map_lookup_elem),
6216 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6217 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6218 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6219 BPF_MOV64_IMM(BPF_REG_2, -1),
6220 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6221 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6222 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6223 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6224 BPF_MOV64_IMM(BPF_REG_0, 0),
6225 BPF_EXIT_INSN(),
6226 },
6227 .fixup_map1 = { 3 },
b712296a
EC		 6228 .errstr = "R0 min value is negative",
6229 .result = REJECT,
b712296a 6230 },
86412502
DB		 6231 {
6232 "bounds checks mixing signed and unsigned, variant 2",
6233 .insns = {
6234 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6235 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6236 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6237 BPF_LD_MAP_FD(BPF_REG_1, 0),
6238 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6239 BPF_FUNC_map_lookup_elem),
6240 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6241 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6242 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6243 BPF_MOV64_IMM(BPF_REG_2, -1),
6244 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6245 BPF_MOV64_IMM(BPF_REG_8, 0),
6246 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
6247 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6248 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6249 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6250 BPF_MOV64_IMM(BPF_REG_0, 0),
6251 BPF_EXIT_INSN(),
6252 },
6253 .fixup_map1 = { 3 },
86412502
DB		 6254 .errstr = "R8 invalid mem access 'inv'",
6255 .result = REJECT,
86412502
DB		 6256 },
6257 {
6258 "bounds checks mixing signed and unsigned, variant 3",
6259 .insns = {
6260 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6261 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6262 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6263 BPF_LD_MAP_FD(BPF_REG_1, 0),
6264 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6265 BPF_FUNC_map_lookup_elem),
6266 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6267 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6268 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6269 BPF_MOV64_IMM(BPF_REG_2, -1),
6270 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
6271 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
6272 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6273 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6274 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6275 BPF_MOV64_IMM(BPF_REG_0, 0),
6276 BPF_EXIT_INSN(),
6277 },
6278 .fixup_map1 = { 3 },
86412502
DB		 6279 .errstr = "R8 invalid mem access 'inv'",
6280 .result = REJECT,
86412502
DB		 6281 },
6282 {
6283 "bounds checks mixing signed and unsigned, variant 4",
6284 .insns = {
6285 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6286 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6287 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6288 BPF_LD_MAP_FD(BPF_REG_1, 0),
6289 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6290 BPF_FUNC_map_lookup_elem),
6291 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6292 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6293 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6294 BPF_MOV64_IMM(BPF_REG_2, 1),
6295 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
6296 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6297 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6298 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6299 BPF_MOV64_IMM(BPF_REG_0, 0),
6300 BPF_EXIT_INSN(),
6301 },
6302 .fixup_map1 = { 3 },
f65b1849 6303 .result = ACCEPT,
86412502
DB		 6304 },
6305 {
6306 "bounds checks mixing signed and unsigned, variant 5",
6307 .insns = {
6308 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6309 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6310 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6311 BPF_LD_MAP_FD(BPF_REG_1, 0),
6312 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6313 BPF_FUNC_map_lookup_elem),
6314 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6315 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6316 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6317 BPF_MOV64_IMM(BPF_REG_2, -1),
6318 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6319 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
6320 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
6321 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6322 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6323 BPF_MOV64_IMM(BPF_REG_0, 0),
6324 BPF_EXIT_INSN(),
6325 },
6326 .fixup_map1 = { 3 },
f65b1849 6327 .errstr = "R0 min value is negative",
86412502 6328 .result = REJECT,
86412502
DB		 6329 },
6330 {
6331 "bounds checks mixing signed and unsigned, variant 6",
6332 .insns = {
6333 BPF_MOV64_IMM(BPF_REG_2, 0),
6334 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
6335 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
6336 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6337 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
6338 BPF_MOV64_IMM(BPF_REG_6, -1),
6339 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
6340 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
6341 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
6342 BPF_MOV64_IMM(BPF_REG_5, 0),
6343 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
6344 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6345 BPF_FUNC_skb_load_bytes),
6346 BPF_MOV64_IMM(BPF_REG_0, 0),
6347 BPF_EXIT_INSN(),
6348 },
86412502
DB		 6349 .errstr = "R4 min value is negative, either use unsigned",
6350 .result = REJECT,
86412502
DB		 6351 },
6352 {
6353 "bounds checks mixing signed and unsigned, variant 7",
6354 .insns = {
6355 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6356 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6357 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6358 BPF_LD_MAP_FD(BPF_REG_1, 0),
6359 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6360 BPF_FUNC_map_lookup_elem),
6361 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6362 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6363 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6364 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
6365 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6366 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6367 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6368 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6369 BPF_MOV64_IMM(BPF_REG_0, 0),
6370 BPF_EXIT_INSN(),
6371 },
6372 .fixup_map1 = { 3 },
f65b1849 6373 .result = ACCEPT,
86412502
DB		 6374 },
6375 {
6376 "bounds checks mixing signed and unsigned, variant 8",
86412502
DB		 6377 .insns = {
6378 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6379 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6380 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6381 BPF_LD_MAP_FD(BPF_REG_1, 0),
6382 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6383 BPF_FUNC_map_lookup_elem),
6384 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6385 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6386 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6387 BPF_MOV64_IMM(BPF_REG_2, -1),
6388 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6389 BPF_MOV64_IMM(BPF_REG_0, 0),
6390 BPF_EXIT_INSN(),
6391 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6392 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6393 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6394 BPF_MOV64_IMM(BPF_REG_0, 0),
6395 BPF_EXIT_INSN(),
6396 },
6397 .fixup_map1 = { 3 },
86412502
DB		 6398 .errstr = "R0 min value is negative",
6399 .result = REJECT,
86412502
DB		 6400 },
6401 {
f65b1849 6402 "bounds checks mixing signed and unsigned, variant 9",
86412502
DB		 6403 .insns = {
6404 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6405 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6406 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6407 BPF_LD_MAP_FD(BPF_REG_1, 0),
6408 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6409 BPF_FUNC_map_lookup_elem),
6410 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6411 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6412 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6413 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
6414 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6415 BPF_MOV64_IMM(BPF_REG_0, 0),
6416 BPF_EXIT_INSN(),
6417 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6418 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6419 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6420 BPF_MOV64_IMM(BPF_REG_0, 0),
6421 BPF_EXIT_INSN(),
6422 },
6423 .fixup_map1 = { 3 },
f65b1849 6424 .result = ACCEPT,
86412502
DB		 6425 },
6426 {
f65b1849 6427 "bounds checks mixing signed and unsigned, variant 10",
86412502
DB		 6428 .insns = {
6429 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6430 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6431 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6432 BPF_LD_MAP_FD(BPF_REG_1, 0),
6433 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6434 BPF_FUNC_map_lookup_elem),
6435 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6436 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6437 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6438 BPF_MOV64_IMM(BPF_REG_2, 0),
6439 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6440 BPF_MOV64_IMM(BPF_REG_0, 0),
6441 BPF_EXIT_INSN(),
6442 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6443 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6444 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6445 BPF_MOV64_IMM(BPF_REG_0, 0),
6446 BPF_EXIT_INSN(),
6447 },
6448 .fixup_map1 = { 3 },
86412502
DB		 6449 .errstr = "R0 min value is negative",
6450 .result = REJECT,
86412502
DB		 6451 },
6452 {
f65b1849 6453 "bounds checks mixing signed and unsigned, variant 11",
86412502
DB		 6454 .insns = {
6455 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6456 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6457 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6458 BPF_LD_MAP_FD(BPF_REG_1, 0),
6459 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6460 BPF_FUNC_map_lookup_elem),
6461 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6462 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6463 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6464 BPF_MOV64_IMM(BPF_REG_2, -1),
6465 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6466 /* Dead branch. */
6467 BPF_MOV64_IMM(BPF_REG_0, 0),
6468 BPF_EXIT_INSN(),
6469 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6470 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6471 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6472 BPF_MOV64_IMM(BPF_REG_0, 0),
6473 BPF_EXIT_INSN(),
6474 },
6475 .fixup_map1 = { 3 },
86412502
DB		 6476 .errstr = "R0 min value is negative",
6477 .result = REJECT,
86412502
DB		 6478 },
6479 {
f65b1849 6480 "bounds checks mixing signed and unsigned, variant 12",
86412502
DB		 6481 .insns = {
6482 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6483 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6484 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6485 BPF_LD_MAP_FD(BPF_REG_1, 0),
6486 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6487 BPF_FUNC_map_lookup_elem),
6488 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6489 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6490 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6491 BPF_MOV64_IMM(BPF_REG_2, -6),
6492 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6493 BPF_MOV64_IMM(BPF_REG_0, 0),
6494 BPF_EXIT_INSN(),
6495 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6496 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6497 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6498 BPF_MOV64_IMM(BPF_REG_0, 0),
6499 BPF_EXIT_INSN(),
6500 },
6501 .fixup_map1 = { 3 },
86412502
DB		 6502 .errstr = "R0 min value is negative",
6503 .result = REJECT,
86412502
DB		 6504 },
6505 {
f65b1849 6506 "bounds checks mixing signed and unsigned, variant 13",
86412502
DB		 6507 .insns = {
6508 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6509 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6510 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6511 BPF_LD_MAP_FD(BPF_REG_1, 0),
6512 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6513 BPF_FUNC_map_lookup_elem),
6514 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6515 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6516 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6517 BPF_MOV64_IMM(BPF_REG_2, 2),
6518 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6519 BPF_MOV64_IMM(BPF_REG_7, 1),
6520 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
6521 BPF_MOV64_IMM(BPF_REG_0, 0),
6522 BPF_EXIT_INSN(),
6523 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
6524 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
6525 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
6526 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6527 BPF_MOV64_IMM(BPF_REG_0, 0),
6528 BPF_EXIT_INSN(),
6529 },
6530 .fixup_map1 = { 3 },
86412502
DB		 6531 .errstr = "R0 min value is negative",
6532 .result = REJECT,
86412502
DB		 6533 },
6534 {
f65b1849 6535 "bounds checks mixing signed and unsigned, variant 14",
86412502
DB		 6536 .insns = {
6537 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
6538 offsetof(struct __sk_buff, mark)),
6539 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6540 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6541 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6542 BPF_LD_MAP_FD(BPF_REG_1, 0),
6543 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6544 BPF_FUNC_map_lookup_elem),
6545 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6546 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6547 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6548 BPF_MOV64_IMM(BPF_REG_2, -1),
6549 BPF_MOV64_IMM(BPF_REG_8, 2),
6550 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
6551 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
6552 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6553 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6554 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6555 BPF_MOV64_IMM(BPF_REG_0, 0),
6556 BPF_EXIT_INSN(),
6557 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
6558 BPF_JMP_IMM(BPF_JA, 0, 0, -7),
6559 },
6560 .fixup_map1 = { 4 },
86412502
DB		 6561 .errstr = "R0 min value is negative",
6562 .result = REJECT,
86412502
DB		 6563 },
6564 {
f65b1849 6565 "bounds checks mixing signed and unsigned, variant 15",
86412502
DB		 6566 .insns = {
6567 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6568 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6569 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6570 BPF_LD_MAP_FD(BPF_REG_1, 0),
6571 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6572 BPF_FUNC_map_lookup_elem),
6573 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6574 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6575 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6576 BPF_MOV64_IMM(BPF_REG_2, -6),
6577 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6578 BPF_MOV64_IMM(BPF_REG_0, 0),
6579 BPF_EXIT_INSN(),
6580 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6581 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
6582 BPF_MOV64_IMM(BPF_REG_0, 0),
6583 BPF_EXIT_INSN(),
6584 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6585 BPF_MOV64_IMM(BPF_REG_0, 0),
6586 BPF_EXIT_INSN(),
6587 },
6588 .fixup_map1 = { 3 },
f65b1849 6589 .errstr_unpriv = "R0 pointer comparison prohibited",
86412502
DB		 6590 .errstr = "R0 min value is negative",
6591 .result = REJECT,
6592 .result_unpriv = REJECT,
6593 },
545722cb 6594 {
f65b1849 6595 "subtraction bounds (map value) variant 1",
545722cb
EC		 6596 .insns = {
6597 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6598 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6599 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6600 BPF_LD_MAP_FD(BPF_REG_1, 0),
6601 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6602 BPF_FUNC_map_lookup_elem),
6603 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6604 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6605 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
6606 BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
6607 BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
6608 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
6609 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
6610 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6611 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6612 BPF_EXIT_INSN(),
6613 BPF_MOV64_IMM(BPF_REG_0, 0),
6614 BPF_EXIT_INSN(),
6615 },
6616 .fixup_map1 = { 3 },
f65b1849
EC		 6617 .errstr = "R0 max value is outside of the array range",
6618 .result = REJECT,
6619 },
6620 {
6621 "subtraction bounds (map value) variant 2",
6622 .insns = {
6623 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6624 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6625 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6626 BPF_LD_MAP_FD(BPF_REG_1, 0),
6627 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6628 BPF_FUNC_map_lookup_elem),
6629 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6630 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6631 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
6632 BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
6633 BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
6634 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
6635 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6636 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6637 BPF_EXIT_INSN(),
6638 BPF_MOV64_IMM(BPF_REG_0, 0),
6639 BPF_EXIT_INSN(),
6640 },
6641 .fixup_map1 = { 3 },
545722cb
EC		 6642 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
6643 .result = REJECT,
545722cb 6644 },
69c4e8ad
EC		 6645 {
6646 "variable-offset ctx access",
6647 .insns = {
6648 /* Get an unknown value */
6649 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
6650 /* Make it small and 4-byte aligned */
6651 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
6652 /* add it to skb. We now have either &skb->len or
6653 * &skb->pkt_type, but we don't know which
6654 */
6655 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
6656 /* dereference it */
6657 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
6658 BPF_EXIT_INSN(),
6659 },
6660 .errstr = "variable ctx access var_off=(0x0; 0x4)",
6661 .result = REJECT,
6662 .prog_type = BPF_PROG_TYPE_LWT_IN,
6663 },
6664 {
6665 "variable-offset stack access",
6666 .insns = {
6667 /* Fill the top 8 bytes of the stack */
6668 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6669 /* Get an unknown value */
6670 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
6671 /* Make it small and 4-byte aligned */
6672 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
6673 BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
6674 /* add it to fp. We now have either fp-4 or fp-8, but
6675 * we don't know which
6676 */
6677 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
6678 /* dereference it */
6679 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
6680 BPF_EXIT_INSN(),
6681 },
6682 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
6683 .result = REJECT,
6684 .prog_type = BPF_PROG_TYPE_LWT_IN,
6685 },
d893dc26
EC		 6686 {
6687 "liveness pruning and write screening",
6688 .insns = {
6689 /* Get an unknown value */
6690 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
6691 /* branch conditions teach us nothing about R2 */
6692 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
6693 BPF_MOV64_IMM(BPF_REG_0, 0),
6694 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
6695 BPF_MOV64_IMM(BPF_REG_0, 0),
6696 BPF_EXIT_INSN(),
6697 },
6698 .errstr = "R0 !read_ok",
6699 .result = REJECT,
6700 .prog_type = BPF_PROG_TYPE_LWT_IN,
6701 },
df20cb7e
AS		 6702 {
6703 "varlen_map_value_access pruning",
6704 .insns = {
6705 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6706 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6707 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6708 BPF_LD_MAP_FD(BPF_REG_1, 0),
6709 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6710 BPF_FUNC_map_lookup_elem),
6711 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6712 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6713 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
6714 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
6715 BPF_MOV32_IMM(BPF_REG_1, 0),
6716 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
6717 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6718 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
6719 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
6720 offsetof(struct test_val, foo)),
6721 BPF_EXIT_INSN(),
6722 },
6723 .fixup_map2 = { 3 },
6724 .errstr_unpriv = "R0 leaks addr",
6725 .errstr = "R0 unbounded memory access",
6726 .result_unpriv = REJECT,
6727 .result = REJECT,
6728 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6729 },
e67b8a68
EC		 6730 {
6731 "invalid 64-bit BPF_END",
6732 .insns = {
6733 BPF_MOV32_IMM(BPF_REG_0, 0),
6734 {
6735 .code = BPF_ALU64 | BPF_END | BPF_TO_LE,
6736 .dst_reg = BPF_REG_0,
6737 .src_reg = 0,
6738 .off = 0,
6739 .imm = 32,
6740 },
6741 BPF_EXIT_INSN(),
6742 },
6743 .errstr = "BPF_END uses reserved fields",
6744 .result = REJECT,
6745 },
22c88526
DB		 6746 {
6747 "meta access, test1",
6748 .insns = {
6749 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6750 offsetof(struct xdp_md, data_meta)),
6751 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6752 offsetof(struct xdp_md, data)),
6753 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6755 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
6756 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6757 BPF_MOV64_IMM(BPF_REG_0, 0),
6758 BPF_EXIT_INSN(),
6759 },
6760 .result = ACCEPT,
6761 .prog_type = BPF_PROG_TYPE_XDP,
6762 },
6763 {
6764 "meta access, test2",
6765 .insns = {
6766 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6767 offsetof(struct xdp_md, data_meta)),
6768 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6769 offsetof(struct xdp_md, data)),
6770 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6771 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
6772 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
6773 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
6774 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
6775 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6776 BPF_MOV64_IMM(BPF_REG_0, 0),
6777 BPF_EXIT_INSN(),
6778 },
6779 .result = REJECT,
6780 .errstr = "invalid access to packet, off=-8",
6781 .prog_type = BPF_PROG_TYPE_XDP,
6782 },
6783 {
6784 "meta access, test3",
6785 .insns = {
6786 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6787 offsetof(struct xdp_md, data_meta)),
6788 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6789 offsetof(struct xdp_md, data_end)),
6790 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6792 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
6793 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6794 BPF_MOV64_IMM(BPF_REG_0, 0),
6795 BPF_EXIT_INSN(),
6796 },
6797 .result = REJECT,
6798 .errstr = "invalid access to packet",
6799 .prog_type = BPF_PROG_TYPE_XDP,
6800 },
6801 {
6802 "meta access, test4",
6803 .insns = {
6804 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6805 offsetof(struct xdp_md, data_meta)),
6806 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6807 offsetof(struct xdp_md, data_end)),
6808 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
6809 offsetof(struct xdp_md, data)),
6810 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6811 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6812 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
6813 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6814 BPF_MOV64_IMM(BPF_REG_0, 0),
6815 BPF_EXIT_INSN(),
6816 },
6817 .result = REJECT,
6818 .errstr = "invalid access to packet",
6819 .prog_type = BPF_PROG_TYPE_XDP,
6820 },
6821 {
6822 "meta access, test5",
6823 .insns = {
6824 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6825 offsetof(struct xdp_md, data_meta)),
6826 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
6827 offsetof(struct xdp_md, data)),
6828 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6829 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6830 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
6831 BPF_MOV64_IMM(BPF_REG_2, -8),
6832 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6833 BPF_FUNC_xdp_adjust_meta),
6834 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
6835 BPF_MOV64_IMM(BPF_REG_0, 0),
6836 BPF_EXIT_INSN(),
6837 },
6838 .result = REJECT,
6839 .errstr = "R3 !read_ok",
6840 .prog_type = BPF_PROG_TYPE_XDP,
6841 },
6842 {
6843 "meta access, test6",
6844 .insns = {
6845 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6846 offsetof(struct xdp_md, data_meta)),
6847 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6848 offsetof(struct xdp_md, data)),
6849 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6850 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6851 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
6852 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
6853 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
6854 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6855 BPF_MOV64_IMM(BPF_REG_0, 0),
6856 BPF_EXIT_INSN(),
6857 },
6858 .result = REJECT,
6859 .errstr = "invalid access to packet",
6860 .prog_type = BPF_PROG_TYPE_XDP,
6861 },
6862 {
6863 "meta access, test7",
6864 .insns = {
6865 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6866 offsetof(struct xdp_md, data_meta)),
6867 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6868 offsetof(struct xdp_md, data)),
6869 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6870 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6871 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
6872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
6873 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
6874 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6875 BPF_MOV64_IMM(BPF_REG_0, 0),
6876 BPF_EXIT_INSN(),
6877 },
6878 .result = ACCEPT,
6879 .prog_type = BPF_PROG_TYPE_XDP,
6880 },
6881 {
6882 "meta access, test8",
6883 .insns = {
6884 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6885 offsetof(struct xdp_md, data_meta)),
6886 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6887 offsetof(struct xdp_md, data)),
6888 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
6889 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
6890 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
6891 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6892 BPF_MOV64_IMM(BPF_REG_0, 0),
6893 BPF_EXIT_INSN(),
6894 },
6895 .result = ACCEPT,
6896 .prog_type = BPF_PROG_TYPE_XDP,
6897 },
6898 {
6899 "meta access, test9",
6900 .insns = {
6901 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6902 offsetof(struct xdp_md, data_meta)),
6903 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6904 offsetof(struct xdp_md, data)),
6905 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
6906 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
6907 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
6908 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
6909 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6910 BPF_MOV64_IMM(BPF_REG_0, 0),
6911 BPF_EXIT_INSN(),
6912 },
6913 .result = REJECT,
6914 .errstr = "invalid access to packet",
6915 .prog_type = BPF_PROG_TYPE_XDP,
6916 },
6917 {
6918 "meta access, test10",
6919 .insns = {
6920 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6921 offsetof(struct xdp_md, data_meta)),
6922 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6923 offsetof(struct xdp_md, data)),
6924 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
6925 offsetof(struct xdp_md, data_end)),
6926 BPF_MOV64_IMM(BPF_REG_5, 42),
6927 BPF_MOV64_IMM(BPF_REG_6, 24),
6928 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
6929 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
6930 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
6931 BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
6932 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
6933 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
6934 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
6935 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
6936 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
6937 BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
6938 BPF_MOV64_IMM(BPF_REG_0, 0),
6939 BPF_EXIT_INSN(),
6940 },
6941 .result = REJECT,
6942 .errstr = "invalid access to packet",
6943 .prog_type = BPF_PROG_TYPE_XDP,
6944 },
6945 {
6946 "meta access, test11",
6947 .insns = {
6948 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6949 offsetof(struct xdp_md, data_meta)),
6950 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6951 offsetof(struct xdp_md, data)),
6952 BPF_MOV64_IMM(BPF_REG_5, 42),
6953 BPF_MOV64_IMM(BPF_REG_6, 24),
6954 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
6955 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
6956 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
6957 BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
6958 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
6959 BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
6960 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
6961 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
6962 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
6963 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
6964 BPF_MOV64_IMM(BPF_REG_0, 0),
6965 BPF_EXIT_INSN(),
6966 },
6967 .result = ACCEPT,
6968 .prog_type = BPF_PROG_TYPE_XDP,
6969 },
6970 {
6971 "meta access, test12",
6972 .insns = {
6973 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
6974 offsetof(struct xdp_md, data_meta)),
6975 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6976 offsetof(struct xdp_md, data)),
6977 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
6978 offsetof(struct xdp_md, data_end)),
6979 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
6980 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
6981 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
6982 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
6983 BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
6984 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
6985 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
6986 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
6987 BPF_MOV64_IMM(BPF_REG_0, 0),
6988 BPF_EXIT_INSN(),
6989 },
6990 .result = ACCEPT,
6991 .prog_type = BPF_PROG_TYPE_XDP,
6992 },
28e33f9d
JK		 6993 {
6994 "arithmetic ops make PTR_TO_CTX unusable",
6995 .insns = {
6996 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
6997 offsetof(struct __sk_buff, data) -
6998 offsetof(struct __sk_buff, mark)),
6999 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7000 offsetof(struct __sk_buff, mark)),
7001 BPF_EXIT_INSN(),
7002 },
7003 .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
7004 .result = REJECT,
7005 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7006 },
b37242c7
DB		 7007 {
7008 "XDP pkt read, pkt_end mangling, bad access 1",
7009 .insns = {
7010 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7011 offsetof(struct xdp_md, data)),
7012 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7013 offsetof(struct xdp_md, data_end)),
7014 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7015 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7016 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
7017 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7018 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7019 BPF_MOV64_IMM(BPF_REG_0, 0),
7020 BPF_EXIT_INSN(),
7021 },
7022 .errstr = "R1 offset is outside of the packet",
7023 .result = REJECT,
7024 .prog_type = BPF_PROG_TYPE_XDP,
7025 },
7026 {
7027 "XDP pkt read, pkt_end mangling, bad access 2",
7028 .insns = {
7029 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7030 offsetof(struct xdp_md, data)),
7031 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7032 offsetof(struct xdp_md, data_end)),
7033 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7034 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7035 BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
7036 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7037 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7038 BPF_MOV64_IMM(BPF_REG_0, 0),
7039 BPF_EXIT_INSN(),
7040 },
7041 .errstr = "R1 offset is outside of the packet",
7042 .result = REJECT,
7043 .prog_type = BPF_PROG_TYPE_XDP,
7044 },
7045 {
7046 "XDP pkt read, pkt_data' > pkt_end, good access",
7047 .insns = {
7048 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7049 offsetof(struct xdp_md, data)),
7050 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7051 offsetof(struct xdp_md, data_end)),
7052 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7053 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7054 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7055 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7056 BPF_MOV64_IMM(BPF_REG_0, 0),
7057 BPF_EXIT_INSN(),
7058 },
7059 .result = ACCEPT,
7060 .prog_type = BPF_PROG_TYPE_XDP,
7061 },
7062 {
7063 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
7064 .insns = {
7065 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7066 offsetof(struct xdp_md, data)),
7067 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7068 offsetof(struct xdp_md, data_end)),
7069 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7070 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7071 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7072 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7073 BPF_MOV64_IMM(BPF_REG_0, 0),
7074 BPF_EXIT_INSN(),
7075 },
7076 .errstr = "R1 offset is outside of the packet",
7077 .result = REJECT,
7078 .prog_type = BPF_PROG_TYPE_XDP,
7079 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7080 },
7081 {
7082 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
7083 .insns = {
7084 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7085 offsetof(struct xdp_md, data)),
7086 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7087 offsetof(struct xdp_md, data_end)),
7088 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7089 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7090 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
7091 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7092 BPF_MOV64_IMM(BPF_REG_0, 0),
7093 BPF_EXIT_INSN(),
7094 },
7095 .errstr = "R1 offset is outside of the packet",
7096 .result = REJECT,
7097 .prog_type = BPF_PROG_TYPE_XDP,
7098 },
7099 {
7100 "XDP pkt read, pkt_end > pkt_data', good access",
7101 .insns = {
7102 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7103 offsetof(struct xdp_md, data)),
7104 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7105 offsetof(struct xdp_md, data_end)),
7106 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7107 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7108 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7109 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7110 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7111 BPF_MOV64_IMM(BPF_REG_0, 0),
7112 BPF_EXIT_INSN(),
7113 },
7114 .result = ACCEPT,
7115 .prog_type = BPF_PROG_TYPE_XDP,
7116 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7117 },
7118 {
7119 "XDP pkt read, pkt_end > pkt_data', bad access 1",
7120 .insns = {
7121 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7122 offsetof(struct xdp_md, data)),
7123 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7124 offsetof(struct xdp_md, data_end)),
7125 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7126 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7127 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7128 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7129 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7130 BPF_MOV64_IMM(BPF_REG_0, 0),
7131 BPF_EXIT_INSN(),
7132 },
7133 .errstr = "R1 offset is outside of the packet",
7134 .result = REJECT,
7135 .prog_type = BPF_PROG_TYPE_XDP,
7136 },
7137 {
7138 "XDP pkt read, pkt_end > pkt_data', bad access 2",
7139 .insns = {
7140 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7141 offsetof(struct xdp_md, data)),
7142 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7143 offsetof(struct xdp_md, data_end)),
7144 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7145 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7146 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7147 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7148 BPF_MOV64_IMM(BPF_REG_0, 0),
7149 BPF_EXIT_INSN(),
7150 },
7151 .errstr = "R1 offset is outside of the packet",
7152 .result = REJECT,
7153 .prog_type = BPF_PROG_TYPE_XDP,
7154 },
7155 {
7156 "XDP pkt read, pkt_data' < pkt_end, good access",
7157 .insns = {
7158 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7159 offsetof(struct xdp_md, data)),
7160 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7161 offsetof(struct xdp_md, data_end)),
7162 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7163 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7164 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7165 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7166 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7167 BPF_MOV64_IMM(BPF_REG_0, 0),
7168 BPF_EXIT_INSN(),
7169 },
7170 .result = ACCEPT,
7171 .prog_type = BPF_PROG_TYPE_XDP,
7172 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7173 },
7174 {
7175 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
7176 .insns = {
7177 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7178 offsetof(struct xdp_md, data)),
7179 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7180 offsetof(struct xdp_md, data_end)),
7181 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7182 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7183 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7184 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7185 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7186 BPF_MOV64_IMM(BPF_REG_0, 0),
7187 BPF_EXIT_INSN(),
7188 },
7189 .errstr = "R1 offset is outside of the packet",
7190 .result = REJECT,
7191 .prog_type = BPF_PROG_TYPE_XDP,
7192 },
7193 {
7194 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
7195 .insns = {
7196 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7197 offsetof(struct xdp_md, data)),
7198 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7199 offsetof(struct xdp_md, data_end)),
7200 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7201 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7202 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7203 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7204 BPF_MOV64_IMM(BPF_REG_0, 0),
7205 BPF_EXIT_INSN(),
7206 },
7207 .errstr = "R1 offset is outside of the packet",
7208 .result = REJECT,
7209 .prog_type = BPF_PROG_TYPE_XDP,
7210 },
7211 {
7212 "XDP pkt read, pkt_end < pkt_data', good access",
7213 .insns = {
7214 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7215 offsetof(struct xdp_md, data)),
7216 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7217 offsetof(struct xdp_md, data_end)),
7218 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7219 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7220 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7221 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7222 BPF_MOV64_IMM(BPF_REG_0, 0),
7223 BPF_EXIT_INSN(),
7224 },
7225 .result = ACCEPT,
7226 .prog_type = BPF_PROG_TYPE_XDP,
7227 },
7228 {
7229 "XDP pkt read, pkt_end < pkt_data', bad access 1",
7230 .insns = {
7231 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7232 offsetof(struct xdp_md, data)),
7233 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7234 offsetof(struct xdp_md, data_end)),
7235 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7236 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7237 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7238 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7239 BPF_MOV64_IMM(BPF_REG_0, 0),
7240 BPF_EXIT_INSN(),
7241 },
7242 .errstr = "R1 offset is outside of the packet",
7243 .result = REJECT,
7244 .prog_type = BPF_PROG_TYPE_XDP,
7245 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7246 },
7247 {
7248 "XDP pkt read, pkt_end < pkt_data', bad access 2",
7249 .insns = {
7250 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7251 offsetof(struct xdp_md, data)),
7252 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7253 offsetof(struct xdp_md, data_end)),
7254 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7255 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7256 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
7257 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7258 BPF_MOV64_IMM(BPF_REG_0, 0),
7259 BPF_EXIT_INSN(),
7260 },
7261 .errstr = "R1 offset is outside of the packet",
7262 .result = REJECT,
7263 .prog_type = BPF_PROG_TYPE_XDP,
7264 },
7265 {
7266 "XDP pkt read, pkt_data' >= pkt_end, good access",
7267 .insns = {
7268 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7269 offsetof(struct xdp_md, data)),
7270 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7271 offsetof(struct xdp_md, data_end)),
7272 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7273 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7274 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7275 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7276 BPF_MOV64_IMM(BPF_REG_0, 0),
7277 BPF_EXIT_INSN(),
7278 },
7279 .result = ACCEPT,
7280 .prog_type = BPF_PROG_TYPE_XDP,
7281 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7282 },
7283 {
7284 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
7285 .insns = {
7286 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7287 offsetof(struct xdp_md, data)),
7288 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7289 offsetof(struct xdp_md, data_end)),
7290 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7291 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7292 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7293 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7294 BPF_MOV64_IMM(BPF_REG_0, 0),
7295 BPF_EXIT_INSN(),
7296 },
7297 .errstr = "R1 offset is outside of the packet",
7298 .result = REJECT,
7299 .prog_type = BPF_PROG_TYPE_XDP,
7300 },
7301 {
7302 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
7303 .insns = {
7304 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7305 offsetof(struct xdp_md, data)),
7306 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7307 offsetof(struct xdp_md, data_end)),
7308 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7309 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7310 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
7311 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7312 BPF_MOV64_IMM(BPF_REG_0, 0),
7313 BPF_EXIT_INSN(),
7314 },
7315 .errstr = "R1 offset is outside of the packet",
7316 .result = REJECT,
7317 .prog_type = BPF_PROG_TYPE_XDP,
7318 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7319 },
7320 {
7321 "XDP pkt read, pkt_end >= pkt_data', good access",
7322 .insns = {
7323 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7324 offsetof(struct xdp_md, data)),
7325 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7326 offsetof(struct xdp_md, data_end)),
7327 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7328 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7329 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7330 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7331 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7332 BPF_MOV64_IMM(BPF_REG_0, 0),
7333 BPF_EXIT_INSN(),
7334 },
7335 .result = ACCEPT,
7336 .prog_type = BPF_PROG_TYPE_XDP,
7337 },
7338 {
7339 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
7340 .insns = {
7341 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7342 offsetof(struct xdp_md, data)),
7343 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7344 offsetof(struct xdp_md, data_end)),
7345 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7346 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7347 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7348 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7349 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7350 BPF_MOV64_IMM(BPF_REG_0, 0),
7351 BPF_EXIT_INSN(),
7352 },
7353 .errstr = "R1 offset is outside of the packet",
7354 .result = REJECT,
7355 .prog_type = BPF_PROG_TYPE_XDP,
7356 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7357 },
7358 {
7359 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
7360 .insns = {
7361 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7362 offsetof(struct xdp_md, data)),
7363 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7364 offsetof(struct xdp_md, data_end)),
7365 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7366 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7367 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7368 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7369 BPF_MOV64_IMM(BPF_REG_0, 0),
7370 BPF_EXIT_INSN(),
7371 },
7372 .errstr = "R1 offset is outside of the packet",
7373 .result = REJECT,
7374 .prog_type = BPF_PROG_TYPE_XDP,
7375 },
7376 {
7377 "XDP pkt read, pkt_data' <= pkt_end, good access",
7378 .insns = {
7379 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7380 offsetof(struct xdp_md, data)),
7381 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7382 offsetof(struct xdp_md, data_end)),
7383 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7384 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7385 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7386 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7387 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7388 BPF_MOV64_IMM(BPF_REG_0, 0),
7389 BPF_EXIT_INSN(),
7390 },
7391 .result = ACCEPT,
7392 .prog_type = BPF_PROG_TYPE_XDP,
7393 },
7394 {
7395 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
7396 .insns = {
7397 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7398 offsetof(struct xdp_md, data)),
7399 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7400 offsetof(struct xdp_md, data_end)),
7401 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7402 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7403 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7404 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7405 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7406 BPF_MOV64_IMM(BPF_REG_0, 0),
7407 BPF_EXIT_INSN(),
7408 },
7409 .errstr = "R1 offset is outside of the packet",
7410 .result = REJECT,
7411 .prog_type = BPF_PROG_TYPE_XDP,
7412 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7413 },
7414 {
7415 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
7416 .insns = {
7417 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7418 offsetof(struct xdp_md, data)),
7419 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7420 offsetof(struct xdp_md, data_end)),
7421 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7422 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7423 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7424 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7425 BPF_MOV64_IMM(BPF_REG_0, 0),
7426 BPF_EXIT_INSN(),
7427 },
7428 .errstr = "R1 offset is outside of the packet",
7429 .result = REJECT,
7430 .prog_type = BPF_PROG_TYPE_XDP,
7431 },
7432 {
7433 "XDP pkt read, pkt_end <= pkt_data', good access",
7434 .insns = {
7435 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7436 offsetof(struct xdp_md, data)),
7437 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7438 offsetof(struct xdp_md, data_end)),
7439 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7440 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7441 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7442 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7443 BPF_MOV64_IMM(BPF_REG_0, 0),
7444 BPF_EXIT_INSN(),
7445 },
7446 .result = ACCEPT,
7447 .prog_type = BPF_PROG_TYPE_XDP,
7448 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7449 },
7450 {
7451 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
7452 .insns = {
7453 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7454 offsetof(struct xdp_md, data)),
7455 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7456 offsetof(struct xdp_md, data_end)),
7457 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7458 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7459 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7460 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7461 BPF_MOV64_IMM(BPF_REG_0, 0),
7462 BPF_EXIT_INSN(),
7463 },
7464 .errstr = "R1 offset is outside of the packet",
7465 .result = REJECT,
7466 .prog_type = BPF_PROG_TYPE_XDP,
7467 },
7468 {
7469 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
7470 .insns = {
7471 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7472 offsetof(struct xdp_md, data)),
7473 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7474 offsetof(struct xdp_md, data_end)),
7475 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7476 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7477 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
7478 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7479 BPF_MOV64_IMM(BPF_REG_0, 0),
7480 BPF_EXIT_INSN(),
7481 },
7482 .errstr = "R1 offset is outside of the packet",
7483 .result = REJECT,
7484 .prog_type = BPF_PROG_TYPE_XDP,
7485 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7486 },
634eab11
DB		 7487 {
7488 "XDP pkt read, pkt_meta' > pkt_data, good access",
7489 .insns = {
7490 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7491 offsetof(struct xdp_md, data_meta)),
7492 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7493 offsetof(struct xdp_md, data)),
7494 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7495 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7496 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7497 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7498 BPF_MOV64_IMM(BPF_REG_0, 0),
7499 BPF_EXIT_INSN(),
7500 },
7501 .result = ACCEPT,
7502 .prog_type = BPF_PROG_TYPE_XDP,
7503 },
7504 {
7505 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
7506 .insns = {
7507 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7508 offsetof(struct xdp_md, data_meta)),
7509 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7510 offsetof(struct xdp_md, data)),
7511 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7512 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7513 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7514 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7515 BPF_MOV64_IMM(BPF_REG_0, 0),
7516 BPF_EXIT_INSN(),
7517 },
7518 .errstr = "R1 offset is outside of the packet",
7519 .result = REJECT,
7520 .prog_type = BPF_PROG_TYPE_XDP,
7521 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7522 },
7523 {
7524 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
7525 .insns = {
7526 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7527 offsetof(struct xdp_md, data_meta)),
7528 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7529 offsetof(struct xdp_md, data)),
7530 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7531 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7532 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
7533 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7534 BPF_MOV64_IMM(BPF_REG_0, 0),
7535 BPF_EXIT_INSN(),
7536 },
7537 .errstr = "R1 offset is outside of the packet",
7538 .result = REJECT,
7539 .prog_type = BPF_PROG_TYPE_XDP,
7540 },
7541 {
7542 "XDP pkt read, pkt_data > pkt_meta', good access",
7543 .insns = {
7544 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7545 offsetof(struct xdp_md, data_meta)),
7546 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7547 offsetof(struct xdp_md, data)),
7548 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7549 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7550 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7551 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7552 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7553 BPF_MOV64_IMM(BPF_REG_0, 0),
7554 BPF_EXIT_INSN(),
7555 },
7556 .result = ACCEPT,
7557 .prog_type = BPF_PROG_TYPE_XDP,
7558 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7559 },
7560 {
7561 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
7562 .insns = {
7563 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7564 offsetof(struct xdp_md, data_meta)),
7565 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7566 offsetof(struct xdp_md, data)),
7567 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7568 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7569 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7570 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7571 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7572 BPF_MOV64_IMM(BPF_REG_0, 0),
7573 BPF_EXIT_INSN(),
7574 },
7575 .errstr = "R1 offset is outside of the packet",
7576 .result = REJECT,
7577 .prog_type = BPF_PROG_TYPE_XDP,
7578 },
7579 {
7580 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
7581 .insns = {
7582 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7583 offsetof(struct xdp_md, data_meta)),
7584 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7585 offsetof(struct xdp_md, data)),
7586 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7588 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7589 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7590 BPF_MOV64_IMM(BPF_REG_0, 0),
7591 BPF_EXIT_INSN(),
7592 },
7593 .errstr = "R1 offset is outside of the packet",
7594 .result = REJECT,
7595 .prog_type = BPF_PROG_TYPE_XDP,
7596 },
7597 {
7598 "XDP pkt read, pkt_meta' < pkt_data, good access",
7599 .insns = {
7600 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7601 offsetof(struct xdp_md, data_meta)),
7602 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7603 offsetof(struct xdp_md, data)),
7604 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7605 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7606 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7607 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7608 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7609 BPF_MOV64_IMM(BPF_REG_0, 0),
7610 BPF_EXIT_INSN(),
7611 },
7612 .result = ACCEPT,
7613 .prog_type = BPF_PROG_TYPE_XDP,
7614 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7615 },
7616 {
7617 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
7618 .insns = {
7619 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7620 offsetof(struct xdp_md, data_meta)),
7621 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7622 offsetof(struct xdp_md, data)),
7623 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7624 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7625 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7626 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7627 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7628 BPF_MOV64_IMM(BPF_REG_0, 0),
7629 BPF_EXIT_INSN(),
7630 },
7631 .errstr = "R1 offset is outside of the packet",
7632 .result = REJECT,
7633 .prog_type = BPF_PROG_TYPE_XDP,
7634 },
7635 {
7636 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
7637 .insns = {
7638 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7639 offsetof(struct xdp_md, data_meta)),
7640 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7641 offsetof(struct xdp_md, data)),
7642 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7643 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7644 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7645 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7646 BPF_MOV64_IMM(BPF_REG_0, 0),
7647 BPF_EXIT_INSN(),
7648 },
7649 .errstr = "R1 offset is outside of the packet",
7650 .result = REJECT,
7651 .prog_type = BPF_PROG_TYPE_XDP,
7652 },
7653 {
7654 "XDP pkt read, pkt_data < pkt_meta', good access",
7655 .insns = {
7656 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7657 offsetof(struct xdp_md, data_meta)),
7658 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7659 offsetof(struct xdp_md, data)),
7660 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7661 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7662 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7663 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7664 BPF_MOV64_IMM(BPF_REG_0, 0),
7665 BPF_EXIT_INSN(),
7666 },
7667 .result = ACCEPT,
7668 .prog_type = BPF_PROG_TYPE_XDP,
7669 },
7670 {
7671 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
7672 .insns = {
7673 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7674 offsetof(struct xdp_md, data_meta)),
7675 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7676 offsetof(struct xdp_md, data)),
7677 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7678 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7679 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7680 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7681 BPF_MOV64_IMM(BPF_REG_0, 0),
7682 BPF_EXIT_INSN(),
7683 },
7684 .errstr = "R1 offset is outside of the packet",
7685 .result = REJECT,
7686 .prog_type = BPF_PROG_TYPE_XDP,
7687 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7688 },
7689 {
7690 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
7691 .insns = {
7692 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7693 offsetof(struct xdp_md, data_meta)),
7694 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7695 offsetof(struct xdp_md, data)),
7696 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7697 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7698 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
7699 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7700 BPF_MOV64_IMM(BPF_REG_0, 0),
7701 BPF_EXIT_INSN(),
7702 },
7703 .errstr = "R1 offset is outside of the packet",
7704 .result = REJECT,
7705 .prog_type = BPF_PROG_TYPE_XDP,
7706 },
7707 {
7708 "XDP pkt read, pkt_meta' >= pkt_data, good access",
7709 .insns = {
7710 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7711 offsetof(struct xdp_md, data_meta)),
7712 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7713 offsetof(struct xdp_md, data)),
7714 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7715 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7716 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7717 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7718 BPF_MOV64_IMM(BPF_REG_0, 0),
7719 BPF_EXIT_INSN(),
7720 },
7721 .result = ACCEPT,
7722 .prog_type = BPF_PROG_TYPE_XDP,
7723 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7724 },
7725 {
7726 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
7727 .insns = {
7728 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7729 offsetof(struct xdp_md, data_meta)),
7730 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7731 offsetof(struct xdp_md, data)),
7732 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7733 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7734 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7735 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7736 BPF_MOV64_IMM(BPF_REG_0, 0),
7737 BPF_EXIT_INSN(),
7738 },
7739 .errstr = "R1 offset is outside of the packet",
7740 .result = REJECT,
7741 .prog_type = BPF_PROG_TYPE_XDP,
7742 },
7743 {
7744 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
7745 .insns = {
7746 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7747 offsetof(struct xdp_md, data_meta)),
7748 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7749 offsetof(struct xdp_md, data)),
7750 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7751 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7752 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
7753 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7754 BPF_MOV64_IMM(BPF_REG_0, 0),
7755 BPF_EXIT_INSN(),
7756 },
7757 .errstr = "R1 offset is outside of the packet",
7758 .result = REJECT,
7759 .prog_type = BPF_PROG_TYPE_XDP,
7760 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7761 },
7762 {
7763 "XDP pkt read, pkt_data >= pkt_meta', good access",
7764 .insns = {
7765 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7766 offsetof(struct xdp_md, data_meta)),
7767 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7768 offsetof(struct xdp_md, data)),
7769 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7771 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7772 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7773 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7774 BPF_MOV64_IMM(BPF_REG_0, 0),
7775 BPF_EXIT_INSN(),
7776 },
7777 .result = ACCEPT,
7778 .prog_type = BPF_PROG_TYPE_XDP,
7779 },
7780 {
7781 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
7782 .insns = {
7783 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7784 offsetof(struct xdp_md, data_meta)),
7785 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7786 offsetof(struct xdp_md, data)),
7787 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7788 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7789 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7790 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7791 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7792 BPF_MOV64_IMM(BPF_REG_0, 0),
7793 BPF_EXIT_INSN(),
7794 },
7795 .errstr = "R1 offset is outside of the packet",
7796 .result = REJECT,
7797 .prog_type = BPF_PROG_TYPE_XDP,
7798 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7799 },
7800 {
7801 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
7802 .insns = {
7803 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7804 offsetof(struct xdp_md, data_meta)),
7805 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7806 offsetof(struct xdp_md, data)),
7807 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7808 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7809 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7810 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7811 BPF_MOV64_IMM(BPF_REG_0, 0),
7812 BPF_EXIT_INSN(),
7813 },
7814 .errstr = "R1 offset is outside of the packet",
7815 .result = REJECT,
7816 .prog_type = BPF_PROG_TYPE_XDP,
7817 },
7818 {
7819 "XDP pkt read, pkt_meta' <= pkt_data, good access",
7820 .insns = {
7821 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7822 offsetof(struct xdp_md, data_meta)),
7823 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7824 offsetof(struct xdp_md, data)),
7825 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7826 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7827 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7828 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7829 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7830 BPF_MOV64_IMM(BPF_REG_0, 0),
7831 BPF_EXIT_INSN(),
7832 },
7833 .result = ACCEPT,
7834 .prog_type = BPF_PROG_TYPE_XDP,
7835 },
7836 {
7837 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
7838 .insns = {
7839 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7840 offsetof(struct xdp_md, data_meta)),
7841 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7842 offsetof(struct xdp_md, data)),
7843 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7844 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7845 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7846 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7847 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7848 BPF_MOV64_IMM(BPF_REG_0, 0),
7849 BPF_EXIT_INSN(),
7850 },
7851 .errstr = "R1 offset is outside of the packet",
7852 .result = REJECT,
7853 .prog_type = BPF_PROG_TYPE_XDP,
7854 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7855 },
7856 {
7857 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
7858 .insns = {
7859 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7860 offsetof(struct xdp_md, data_meta)),
7861 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7862 offsetof(struct xdp_md, data)),
7863 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7864 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7865 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7866 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7867 BPF_MOV64_IMM(BPF_REG_0, 0),
7868 BPF_EXIT_INSN(),
7869 },
7870 .errstr = "R1 offset is outside of the packet",
7871 .result = REJECT,
7872 .prog_type = BPF_PROG_TYPE_XDP,
7873 },
7874 {
7875 "XDP pkt read, pkt_data <= pkt_meta', good access",
7876 .insns = {
7877 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7878 offsetof(struct xdp_md, data_meta)),
7879 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7880 offsetof(struct xdp_md, data)),
7881 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7882 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7883 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7884 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7885 BPF_MOV64_IMM(BPF_REG_0, 0),
7886 BPF_EXIT_INSN(),
7887 },
7888 .result = ACCEPT,
7889 .prog_type = BPF_PROG_TYPE_XDP,
7890 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7891 },
7892 {
7893 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
7894 .insns = {
7895 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7896 offsetof(struct xdp_md, data_meta)),
7897 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7898 offsetof(struct xdp_md, data)),
7899 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7900 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7901 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7902 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7903 BPF_MOV64_IMM(BPF_REG_0, 0),
7904 BPF_EXIT_INSN(),
7905 },
7906 .errstr = "R1 offset is outside of the packet",
7907 .result = REJECT,
7908 .prog_type = BPF_PROG_TYPE_XDP,
7909 },
7910 {
7911 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
7912 .insns = {
7913 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7914 offsetof(struct xdp_md, data_meta)),
7915 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7916 offsetof(struct xdp_md, data)),
7917 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7918 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7919 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
7920 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7921 BPF_MOV64_IMM(BPF_REG_0, 0),
7922 BPF_EXIT_INSN(),
7923 },
7924 .errstr = "R1 offset is outside of the packet",
7925 .result = REJECT,
7926 .prog_type = BPF_PROG_TYPE_XDP,
7927 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7928 },
b06723da
DB		 7929 {
7930 "bpf_exit with invalid return code. test1",
7931 .insns = {
7932 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7933 BPF_EXIT_INSN(),
7934 },
7935 .errstr = "R0 has value (0x0; 0xffffffff)",
7936 .result = REJECT,
7937 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7938 },
7939 {
7940 "bpf_exit with invalid return code. test2",
7941 .insns = {
7942 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7943 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
7944 BPF_EXIT_INSN(),
7945 },
7946 .result = ACCEPT,
7947 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7948 },
7949 {
7950 "bpf_exit with invalid return code. test3",
7951 .insns = {
7952 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7953 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
7954 BPF_EXIT_INSN(),
7955 },
7956 .errstr = "R0 has value (0x0; 0x3)",
7957 .result = REJECT,
7958 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7959 },
7960 {
7961 "bpf_exit with invalid return code. test4",
7962 .insns = {
7963 BPF_MOV64_IMM(BPF_REG_0, 1),
7964 BPF_EXIT_INSN(),
7965 },
7966 .result = ACCEPT,
7967 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7968 },
7969 {
7970 "bpf_exit with invalid return code. test5",
7971 .insns = {
7972 BPF_MOV64_IMM(BPF_REG_0, 2),
7973 BPF_EXIT_INSN(),
7974 },
7975 .errstr = "R0 has value (0x2; 0x0)",
7976 .result = REJECT,
7977 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7978 },
7979 {
7980 "bpf_exit with invalid return code. test6",
7981 .insns = {
7982 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7983 BPF_EXIT_INSN(),
7984 },
7985 .errstr = "R0 is not a known value (ctx)",
7986 .result = REJECT,
7987 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
7988 },
7989 {
7990 "bpf_exit with invalid return code. test7",
7991 .insns = {
7992 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7993 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
7994 BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
7995 BPF_EXIT_INSN(),
7996 },
7997 .errstr = "R0 has unknown scalar value",
7998 .result = REJECT,
7999 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
8000 },
3c731eba
AS		 8001};
8002
5aa5bd14 8003static int probe_filter_length(const struct bpf_insn *fp)
3c731eba 8004{
5aa5bd14 8005 int len;
3c731eba
AS		 8006
8007 for (len = MAX_INSNS - 1; len > 0; --len)
8008 if (fp[len].code != 0 || fp[len].imm != 0)
8009 break;
3c731eba
AS		 8010 return len + 1;
8011}
8012
5aa5bd14 8013static int create_map(uint32_t size_value, uint32_t max_elem)
3c731eba 8014{
5aa5bd14 8015 int fd;
3c731eba 8016
f4874d01 8017 fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
5aa5bd14
DB		 8018 size_value, max_elem, BPF_F_NO_PREALLOC);
8019 if (fd < 0)
8020 printf("Failed to create hash map '%s'!\n", strerror(errno));
bf508877 8021
5aa5bd14 8022 return fd;
bf508877
AS		 8023}
8024
8025static int create_prog_array(void)
8026{
5aa5bd14 8027 int fd;
bf508877 8028
f4874d01 8029 fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
5aa5bd14
DB		 8030 sizeof(int), 4, 0);
8031 if (fd < 0)
8032 printf("Failed to create prog array '%s'!\n", strerror(errno));
3c731eba 8033
5aa5bd14 8034 return fd;
3c731eba
AS		 8035}
8036
fb30d4b7
MKL		 8037static int create_map_in_map(void)
8038{
8039 int inner_map_fd, outer_map_fd;
8040
8041 inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
8042 sizeof(int), 1, 0);
8043 if (inner_map_fd < 0) {
8044 printf("Failed to create array '%s'!\n", strerror(errno));
8045 return inner_map_fd;
8046 }
8047
88cda1c9 8048 outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
fb30d4b7
MKL		 8049 sizeof(int), inner_map_fd, 1, 0);
8050 if (outer_map_fd < 0)
8051 printf("Failed to create array of maps '%s'!\n",
8052 strerror(errno));
8053
8054 close(inner_map_fd);
8055
8056 return outer_map_fd;
8057}
8058
5aa5bd14
DB		 8059static char bpf_vlog[32768];
8060
8061static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
fb30d4b7 8062 int *map_fds)
3c731eba 8063{
5aa5bd14
DB		 8064 int *fixup_map1 = test->fixup_map1;
8065 int *fixup_map2 = test->fixup_map2;
8066 int *fixup_prog = test->fixup_prog;
fb30d4b7 8067 int *fixup_map_in_map = test->fixup_map_in_map;
3c731eba 8068
5aa5bd14
DB		 8069 /* Allocating HTs with 1 elem is fine here, since we only test
8070 * for verifier and not do a runtime lookup, so the only thing
8071 * that really matters is value size in this case.
8072 */
8073 if (*fixup_map1) {
fb30d4b7 8074 map_fds[0] = create_map(sizeof(long long), 1);
5aa5bd14 8075 do {
fb30d4b7 8076 prog[*fixup_map1].imm = map_fds[0];
5aa5bd14
DB		 8077 fixup_map1++;
8078 } while (*fixup_map1);
8079 }
3c731eba 8080
5aa5bd14 8081 if (*fixup_map2) {
fb30d4b7 8082 map_fds[1] = create_map(sizeof(struct test_val), 1);
5aa5bd14 8083 do {
fb30d4b7 8084 prog[*fixup_map2].imm = map_fds[1];
5aa5bd14
DB		 8085 fixup_map2++;
8086 } while (*fixup_map2);
8087 }
3c731eba 8088
5aa5bd14 8089 if (*fixup_prog) {
fb30d4b7 8090 map_fds[2] = create_prog_array();
5aa5bd14 8091 do {
fb30d4b7 8092 prog[*fixup_prog].imm = map_fds[2];
5aa5bd14
DB		 8093 fixup_prog++;
8094 } while (*fixup_prog);
8095 }
fb30d4b7
MKL		 8096
8097 if (*fixup_map_in_map) {
8098 map_fds[3] = create_map_in_map();
8099 do {
8100 prog[*fixup_map_in_map].imm = map_fds[3];
8101 fixup_map_in_map++;
8102 } while (*fixup_map_in_map);
8103 }
5aa5bd14 8104}
bf508877 8105
5aa5bd14
DB		 8106static void do_test_single(struct bpf_test *test, bool unpriv,
8107 int *passes, int *errors)
8108{
02ea80b1 8109 int fd_prog, expected_ret, reject_from_alignment;
5aa5bd14
DB		 8110 struct bpf_insn *prog = test->insns;
8111 int prog_len = probe_filter_length(prog);
8112 int prog_type = test->prog_type;
fb30d4b7 8113 int map_fds[MAX_NR_MAPS];
5aa5bd14 8114 const char *expected_err;
fb30d4b7
MKL		 8115 int i;
8116
8117 for (i = 0; i < MAX_NR_MAPS; i++)
8118 map_fds[i] = -1;
48461135 8119
fb30d4b7 8120 do_test_fixup(test, prog, map_fds);
3c731eba 8121
614d0d77
DB		 8122 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
8123 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
d6554904 8124 "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
3c731eba 8125
5aa5bd14
DB		 8126 expected_ret = unpriv && test->result_unpriv != UNDEF ?
8127 test->result_unpriv : test->result;
8128 expected_err = unpriv && test->errstr_unpriv ?
8129 test->errstr_unpriv : test->errstr;
02ea80b1
DB		 8130
8131 reject_from_alignment = fd_prog < 0 &&
8132 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
8133 strstr(bpf_vlog, "Unknown alignment.");
8134#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
8135 if (reject_from_alignment) {
8136 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
8137 strerror(errno));
8138 goto fail_log;
8139 }
8140#endif
5aa5bd14 8141 if (expected_ret == ACCEPT) {
02ea80b1 8142 if (fd_prog < 0 && !reject_from_alignment) {
5aa5bd14
DB		 8143 printf("FAIL\nFailed to load prog '%s'!\n",
8144 strerror(errno));
8145 goto fail_log;
8146 }
8147 } else {
8148 if (fd_prog >= 0) {
8149 printf("FAIL\nUnexpected success to load!\n");
8150 goto fail_log;
8151 }
02ea80b1 8152 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
5aa5bd14
DB		 8153 printf("FAIL\nUnexpected error message!\n");
8154 goto fail_log;
8155 }
8156 }
bf508877 8157
5aa5bd14 8158 (*passes)++;
02ea80b1
DB		 8159 printf("OK%s\n", reject_from_alignment ?
8160 " (NOTE: reject due to unknown alignment)" : "");
5aa5bd14
DB		 8161close_fds:
8162 close(fd_prog);
fb30d4b7
MKL		 8163 for (i = 0; i < MAX_NR_MAPS; i++)
8164 close(map_fds[i]);
5aa5bd14
DB		 8165 sched_yield();
8166 return;
8167fail_log:
8168 (*errors)++;
8169 printf("%s", bpf_vlog);
8170 goto close_fds;
8171}
bf508877 8172
d02d8986
MS		 8173static bool is_admin(void)
8174{
8175 cap_t caps;
8176 cap_flag_value_t sysadmin = CAP_CLEAR;
8177 const cap_value_t cap_val = CAP_SYS_ADMIN;
8178
1da8ac7c 8179#ifdef CAP_IS_SUPPORTED
d02d8986
MS		 8180 if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
8181 perror("cap_get_flag");
8182 return false;
8183 }
1da8ac7c 8184#endif
d02d8986
MS		 8185 caps = cap_get_proc();
8186 if (!caps) {
8187 perror("cap_get_proc");
8188 return false;
8189 }
8190 if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
8191 perror("cap_get_flag");
8192 if (cap_free(caps))
8193 perror("cap_free");
8194 return (sysadmin == CAP_SET);
8195}
8196
8197static int set_admin(bool admin)
8198{
8199 cap_t caps;
8200 const cap_value_t cap_val = CAP_SYS_ADMIN;
8201 int ret = -1;
8202
8203 caps = cap_get_proc();
8204 if (!caps) {
8205 perror("cap_get_proc");
8206 return -1;
8207 }
8208 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
8209 admin ? CAP_SET : CAP_CLEAR)) {
8210 perror("cap_set_flag");
8211 goto out;
8212 }
8213 if (cap_set_proc(caps)) {
8214 perror("cap_set_proc");
8215 goto out;
8216 }
8217 ret = 0;
8218out:
8219 if (cap_free(caps))
8220 perror("cap_free");
8221 return ret;
8222}
8223
5aa5bd14
DB		 8224static int do_test(bool unpriv, unsigned int from, unsigned int to)
8225{
8226 int i, passes = 0, errors = 0;
3c731eba 8227
5aa5bd14
DB		 8228 for (i = from; i < to; i++) {
8229 struct bpf_test *test = &tests[i];
3c731eba 8230
5aa5bd14
DB		 8231 /* Program types that are not supported by non-root we
8232 * skip right away.
8233 */
d02d8986
MS		 8234 if (!test->prog_type) {
8235 if (!unpriv)
8236 set_admin(false);
8237 printf("#%d/u %s ", i, test->descr);
8238 do_test_single(test, true, &passes, &errors);
8239 if (!unpriv)
8240 set_admin(true);
8241 }
5aa5bd14 8242
d02d8986
MS		 8243 if (!unpriv) {
8244 printf("#%d/p %s ", i, test->descr);
8245 do_test_single(test, false, &passes, &errors);
8246 }
3c731eba
AS		 8247 }
8248
5aa5bd14 8249 printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
efe5f9c0 8250 return errors ? EXIT_FAILURE : EXIT_SUCCESS;
3c731eba
AS		 8251}
8252
5aa5bd14 8253int main(int argc, char **argv)
3c731eba 8254{
5aa5bd14
DB		 8255 struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
8256 struct rlimit rlim = { 1 << 20, 1 << 20 };
8257 unsigned int from = 0, to = ARRAY_SIZE(tests);
d02d8986 8258 bool unpriv = !is_admin();
5aa5bd14
DB		 8259
8260 if (argc == 3) {
8261 unsigned int l = atoi(argv[argc - 2]);
8262 unsigned int u = atoi(argv[argc - 1]);
8263
8264 if (l < to && u < to) {
8265 from = l;
8266 to = u + 1;
8267 }
8268 } else if (argc == 2) {
8269 unsigned int t = atoi(argv[argc - 1]);
8270
8271 if (t < to) {
8272 from = t;
8273 to = t + 1;
8274 }
8275 }
bf508877 8276
5aa5bd14
DB		 8277 setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
8278 return do_test(unpriv, from, to);
3c731eba 8279}
Linux 6.x block layer and io_uring tree(s)