tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  * Copyright (c) 2018 Covalent IO, Inc. http://covalent.io
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of version 2 of the GNU General Public
  10  * License as published by the Free Software Foundation.
  11  */
  12
  13 #include <endian.h>
  14 #include <asm/types.h>
  15 #include <linux/types.h>
  16 #include <stdint.h>
  17 #include <stdio.h>
  18 #include <stdlib.h>
  19 #include <unistd.h>
  20 #include <errno.h>
  21 #include <string.h>
  22 #include <stddef.h>
  23 #include <stdbool.h>
  24 #include <sched.h>
  25 #include <limits.h>
  26
  27 #include <sys/capability.h>
  28
  29 #include <linux/unistd.h>
  30 #include <linux/filter.h>
  31 #include <linux/bpf_perf_event.h>
  32 #include <linux/bpf.h>
  33 #include <linux/if_ether.h>
  34
  35 #include <bpf/bpf.h>
  36
  37 #ifdef HAVE_GENHDR
  38 # include "autoconf.h"
  39 #else
  40 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  41 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  42 # endif
  43 #endif
  44 #include "bpf_rlimit.h"
  45 #include "bpf_rand.h"
  46 #include "bpf_util.h"
  47 #include "../../../include/linux/filter.h"
  48
  49 #define MAX_INSNS       BPF_MAXINSNS
  50 #define MAX_FIXUPS      8
  51 #define MAX_NR_MAPS     13
  52 #define POINTER_VALUE   0xcafe4all
  53 #define TEST_DATA_LEN   64
  54
  55 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  56 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  57
  58 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  59 static bool unpriv_disabled = false;
  60
  61 struct bpf_test {
  62         const char *descr;
  63         struct bpf_insn insns[MAX_INSNS];
  64         int fixup_map_hash_8b[MAX_FIXUPS];
  65         int fixup_map_hash_48b[MAX_FIXUPS];
  66         int fixup_map_hash_16b[MAX_FIXUPS];
  67         int fixup_map_array_48b[MAX_FIXUPS];
  68         int fixup_map_sockmap[MAX_FIXUPS];
  69         int fixup_map_sockhash[MAX_FIXUPS];
  70         int fixup_map_xskmap[MAX_FIXUPS];
  71         int fixup_map_stacktrace[MAX_FIXUPS];
  72         int fixup_prog1[MAX_FIXUPS];
  73         int fixup_prog2[MAX_FIXUPS];
  74         int fixup_map_in_map[MAX_FIXUPS];
  75         int fixup_cgroup_storage[MAX_FIXUPS];
  76         int fixup_percpu_cgroup_storage[MAX_FIXUPS];
  77         const char *errstr;
  78         const char *errstr_unpriv;
  79         uint32_t retval;
  80         enum {
  81                 UNDEF,
  82                 ACCEPT,
  83                 REJECT
  84         } result, result_unpriv;
  85         enum bpf_prog_type prog_type;
  86         uint8_t flags;
  87         __u8 data[TEST_DATA_LEN];
  88         void (*fill_helper)(struct bpf_test *self);
  89 };
  90
  91 /* Note we want this to be 64 bit aligned so that the end of our array is
  92  * actually the end of the structure.
  93  */
  94 #define MAX_ENTRIES 11
  95
  96 struct test_val {
  97         unsigned int index;
  98         int foo[MAX_ENTRIES];
  99 };
 100
 101 struct other_val {
 102         long long foo;
 103         long long bar;
 104 };
 105
 106 static void bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
 107 {
 108         /* test: {skb->data[0], vlan_push} x 68 + {skb->data[0], vlan_pop} x 68 */
 109 #define PUSH_CNT 51
 110         unsigned int len = BPF_MAXINSNS;
 111         struct bpf_insn *insn = self->insns;
 112         int i = 0, j, k = 0;
 113
 114         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 115 loop:
 116         for (j = 0; j < PUSH_CNT; j++) {
 117                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 118                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 119                 i++;
 120                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 121                 insn[i++] = BPF_MOV64_IMM(BPF_REG_2, 1);
 122                 insn[i++] = BPF_MOV64_IMM(BPF_REG_3, 2);
 123                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 124                                          BPF_FUNC_skb_vlan_push),
 125                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 126                 i++;
 127         }
 128
 129         for (j = 0; j < PUSH_CNT; j++) {
 130                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 131                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 132                 i++;
 133                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 134                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 135                                          BPF_FUNC_skb_vlan_pop),
 136                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 137                 i++;
 138         }
 139         if (++k < 5)
 140                 goto loop;
 141
 142         for (; i < len - 1; i++)
 143                 insn[i] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 0xbef);
 144         insn[len - 1] = BPF_EXIT_INSN();
 145 }
 146
 147 static void bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 148 {
 149         struct bpf_insn *insn = self->insns;
 150         unsigned int len = BPF_MAXINSNS;
 151         int i = 0;
 152
 153         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 154         insn[i++] = BPF_LD_ABS(BPF_B, 0);
 155         insn[i] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 10, len - i - 2);
 156         i++;
 157         while (i < len - 1)
 158                 insn[i++] = BPF_LD_ABS(BPF_B, 1);
 159         insn[i] = BPF_EXIT_INSN();
 160 }
 161
 162 static void bpf_fill_rand_ld_dw(struct bpf_test *self)
 163 {
 164         struct bpf_insn *insn = self->insns;
 165         uint64_t res = 0;
 166         int i = 0;
 167
 168         insn[i++] = BPF_MOV32_IMM(BPF_REG_0, 0);
 169         while (i < self->retval) {
 170                 uint64_t val = bpf_semi_rand_get();
 171                 struct bpf_insn tmp[2] = { BPF_LD_IMM64(BPF_REG_1, val) };
 172
 173                 res ^= val;
 174                 insn[i++] = tmp[0];
 175                 insn[i++] = tmp[1];
 176                 insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 177         }
 178         insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_0);
 179         insn[i++] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32);
 180         insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 181         insn[i] = BPF_EXIT_INSN();
 182         res ^= (res >> 32);
 183         self->retval = (uint32_t)res;
 184 }
 185
 186 /* BPF_SK_LOOKUP contains 13 instructions, if you need to fix up maps */
 187 #define BPF_SK_LOOKUP                                                   \
 188         /* struct bpf_sock_tuple tuple = {} */                          \
 189         BPF_MOV64_IMM(BPF_REG_2, 0),                                    \
 190         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_2, -8),                  \
 191         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -16),                \
 192         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -24),                \
 193         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -32),                \
 194         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -40),                \
 195         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -48),                \
 196         /* sk = sk_lookup_tcp(ctx, &tuple, sizeof tuple, 0, 0) */       \
 197         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),                           \
 198         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),                         \
 199         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct bpf_sock_tuple)),        \
 200         BPF_MOV64_IMM(BPF_REG_4, 0),                                    \
 201         BPF_MOV64_IMM(BPF_REG_5, 0),                                    \
 202         BPF_EMIT_CALL(BPF_FUNC_sk_lookup_tcp)
 203
 204 static struct bpf_test tests[] = {
 205         {
 206                 "add+sub+mul",
 207                 .insns = {
 208                         BPF_MOV64_IMM(BPF_REG_1, 1),
 209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
 210                         BPF_MOV64_IMM(BPF_REG_2, 3),
 211                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
 212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 213                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 214                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 215                         BPF_EXIT_INSN(),
 216                 },
 217                 .result = ACCEPT,
 218                 .retval = -3,
 219         },
 220         {
 221                 "DIV32 by 0, zero check 1",
 222                 .insns = {
 223                         BPF_MOV32_IMM(BPF_REG_0, 42),
 224                         BPF_MOV32_IMM(BPF_REG_1, 0),
 225                         BPF_MOV32_IMM(BPF_REG_2, 1),
 226                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 227                         BPF_EXIT_INSN(),
 228                 },
 229                 .result = ACCEPT,
 230                 .retval = 42,
 231         },
 232         {
 233                 "DIV32 by 0, zero check 2",
 234                 .insns = {
 235                         BPF_MOV32_IMM(BPF_REG_0, 42),
 236                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 237                         BPF_MOV32_IMM(BPF_REG_2, 1),
 238                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 239                         BPF_EXIT_INSN(),
 240                 },
 241                 .result = ACCEPT,
 242                 .retval = 42,
 243         },
 244         {
 245                 "DIV64 by 0, zero check",
 246                 .insns = {
 247                         BPF_MOV32_IMM(BPF_REG_0, 42),
 248                         BPF_MOV32_IMM(BPF_REG_1, 0),
 249                         BPF_MOV32_IMM(BPF_REG_2, 1),
 250                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 251                         BPF_EXIT_INSN(),
 252                 },
 253                 .result = ACCEPT,
 254                 .retval = 42,
 255         },
 256         {
 257                 "MOD32 by 0, zero check 1",
 258                 .insns = {
 259                         BPF_MOV32_IMM(BPF_REG_0, 42),
 260                         BPF_MOV32_IMM(BPF_REG_1, 0),
 261                         BPF_MOV32_IMM(BPF_REG_2, 1),
 262                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 263                         BPF_EXIT_INSN(),
 264                 },
 265                 .result = ACCEPT,
 266                 .retval = 42,
 267         },
 268         {
 269                 "MOD32 by 0, zero check 2",
 270                 .insns = {
 271                         BPF_MOV32_IMM(BPF_REG_0, 42),
 272                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 273                         BPF_MOV32_IMM(BPF_REG_2, 1),
 274                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 275                         BPF_EXIT_INSN(),
 276                 },
 277                 .result = ACCEPT,
 278                 .retval = 42,
 279         },
 280         {
 281                 "MOD64 by 0, zero check",
 282                 .insns = {
 283                         BPF_MOV32_IMM(BPF_REG_0, 42),
 284                         BPF_MOV32_IMM(BPF_REG_1, 0),
 285                         BPF_MOV32_IMM(BPF_REG_2, 1),
 286                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 287                         BPF_EXIT_INSN(),
 288                 },
 289                 .result = ACCEPT,
 290                 .retval = 42,
 291         },
 292         {
 293                 "DIV32 by 0, zero check ok, cls",
 294                 .insns = {
 295                         BPF_MOV32_IMM(BPF_REG_0, 42),
 296                         BPF_MOV32_IMM(BPF_REG_1, 2),
 297                         BPF_MOV32_IMM(BPF_REG_2, 16),
 298                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 299                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 300                         BPF_EXIT_INSN(),
 301                 },
 302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 303                 .result = ACCEPT,
 304                 .retval = 8,
 305         },
 306         {
 307                 "DIV32 by 0, zero check 1, cls",
 308                 .insns = {
 309                         BPF_MOV32_IMM(BPF_REG_1, 0),
 310                         BPF_MOV32_IMM(BPF_REG_0, 1),
 311                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 312                         BPF_EXIT_INSN(),
 313                 },
 314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 315                 .result = ACCEPT,
 316                 .retval = 0,
 317         },
 318         {
 319                 "DIV32 by 0, zero check 2, cls",
 320                 .insns = {
 321                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 322                         BPF_MOV32_IMM(BPF_REG_0, 1),
 323                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 324                         BPF_EXIT_INSN(),
 325                 },
 326                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 327                 .result = ACCEPT,
 328                 .retval = 0,
 329         },
 330         {
 331                 "DIV64 by 0, zero check, cls",
 332                 .insns = {
 333                         BPF_MOV32_IMM(BPF_REG_1, 0),
 334                         BPF_MOV32_IMM(BPF_REG_0, 1),
 335                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 336                         BPF_EXIT_INSN(),
 337                 },
 338                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 339                 .result = ACCEPT,
 340                 .retval = 0,
 341         },
 342         {
 343                 "MOD32 by 0, zero check ok, cls",
 344                 .insns = {
 345                         BPF_MOV32_IMM(BPF_REG_0, 42),
 346                         BPF_MOV32_IMM(BPF_REG_1, 3),
 347                         BPF_MOV32_IMM(BPF_REG_2, 5),
 348                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 349                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 350                         BPF_EXIT_INSN(),
 351                 },
 352                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 353                 .result = ACCEPT,
 354                 .retval = 2,
 355         },
 356         {
 357                 "MOD32 by 0, zero check 1, cls",
 358                 .insns = {
 359                         BPF_MOV32_IMM(BPF_REG_1, 0),
 360                         BPF_MOV32_IMM(BPF_REG_0, 1),
 361                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 362                         BPF_EXIT_INSN(),
 363                 },
 364                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 365                 .result = ACCEPT,
 366                 .retval = 1,
 367         },
 368         {
 369                 "MOD32 by 0, zero check 2, cls",
 370                 .insns = {
 371                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 372                         BPF_MOV32_IMM(BPF_REG_0, 1),
 373                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 374                         BPF_EXIT_INSN(),
 375                 },
 376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 377                 .result = ACCEPT,
 378                 .retval = 1,
 379         },
 380         {
 381                 "MOD64 by 0, zero check 1, cls",
 382                 .insns = {
 383                         BPF_MOV32_IMM(BPF_REG_1, 0),
 384                         BPF_MOV32_IMM(BPF_REG_0, 2),
 385                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 386                         BPF_EXIT_INSN(),
 387                 },
 388                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 389                 .result = ACCEPT,
 390                 .retval = 2,
 391         },
 392         {
 393                 "MOD64 by 0, zero check 2, cls",
 394                 .insns = {
 395                         BPF_MOV32_IMM(BPF_REG_1, 0),
 396                         BPF_MOV32_IMM(BPF_REG_0, -1),
 397                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 398                         BPF_EXIT_INSN(),
 399                 },
 400                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 401                 .result = ACCEPT,
 402                 .retval = -1,
 403         },
 404         /* Just make sure that JITs used udiv/umod as otherwise we get
 405          * an exception from INT_MIN/-1 overflow similarly as with div
 406          * by zero.
 407          */
 408         {
 409                 "DIV32 overflow, check 1",
 410                 .insns = {
 411                         BPF_MOV32_IMM(BPF_REG_1, -1),
 412                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 413                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 414                         BPF_EXIT_INSN(),
 415                 },
 416                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 417                 .result = ACCEPT,
 418                 .retval = 0,
 419         },
 420         {
 421                 "DIV32 overflow, check 2",
 422                 .insns = {
 423                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 424                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 425                         BPF_EXIT_INSN(),
 426                 },
 427                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 428                 .result = ACCEPT,
 429                 .retval = 0,
 430         },
 431         {
 432                 "DIV64 overflow, check 1",
 433                 .insns = {
 434                         BPF_MOV64_IMM(BPF_REG_1, -1),
 435                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 436                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 437                         BPF_EXIT_INSN(),
 438                 },
 439                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 440                 .result = ACCEPT,
 441                 .retval = 0,
 442         },
 443         {
 444                 "DIV64 overflow, check 2",
 445                 .insns = {
 446                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 447                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 448                         BPF_EXIT_INSN(),
 449                 },
 450                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 451                 .result = ACCEPT,
 452                 .retval = 0,
 453         },
 454         {
 455                 "MOD32 overflow, check 1",
 456                 .insns = {
 457                         BPF_MOV32_IMM(BPF_REG_1, -1),
 458                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 459                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 460                         BPF_EXIT_INSN(),
 461                 },
 462                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 463                 .result = ACCEPT,
 464                 .retval = INT_MIN,
 465         },
 466         {
 467                 "MOD32 overflow, check 2",
 468                 .insns = {
 469                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 470                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 471                         BPF_EXIT_INSN(),
 472                 },
 473                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 474                 .result = ACCEPT,
 475                 .retval = INT_MIN,
 476         },
 477         {
 478                 "MOD64 overflow, check 1",
 479                 .insns = {
 480                         BPF_MOV64_IMM(BPF_REG_1, -1),
 481                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 482                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 483                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 484                         BPF_MOV32_IMM(BPF_REG_0, 0),
 485                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 486                         BPF_MOV32_IMM(BPF_REG_0, 1),
 487                         BPF_EXIT_INSN(),
 488                 },
 489                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 490                 .result = ACCEPT,
 491                 .retval = 1,
 492         },
 493         {
 494                 "MOD64 overflow, check 2",
 495                 .insns = {
 496                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 497                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 498                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 499                         BPF_MOV32_IMM(BPF_REG_0, 0),
 500                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 501                         BPF_MOV32_IMM(BPF_REG_0, 1),
 502                         BPF_EXIT_INSN(),
 503                 },
 504                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 505                 .result = ACCEPT,
 506                 .retval = 1,
 507         },
 508         {
 509                 "xor32 zero extend check",
 510                 .insns = {
 511                         BPF_MOV32_IMM(BPF_REG_2, -1),
 512                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 513                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 514                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 515                         BPF_MOV32_IMM(BPF_REG_0, 2),
 516                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 517                         BPF_MOV32_IMM(BPF_REG_0, 1),
 518                         BPF_EXIT_INSN(),
 519                 },
 520                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 521                 .result = ACCEPT,
 522                 .retval = 1,
 523         },
 524         {
 525                 "empty prog",
 526                 .insns = {
 527                 },
 528                 .errstr = "unknown opcode 00",
 529                 .result = REJECT,
 530         },
 531         {
 532                 "only exit insn",
 533                 .insns = {
 534                         BPF_EXIT_INSN(),
 535                 },
 536                 .errstr = "R0 !read_ok",
 537                 .result = REJECT,
 538         },
 539         {
 540                 "unreachable",
 541                 .insns = {
 542                         BPF_EXIT_INSN(),
 543                         BPF_EXIT_INSN(),
 544                 },
 545                 .errstr = "unreachable",
 546                 .result = REJECT,
 547         },
 548         {
 549                 "unreachable2",
 550                 .insns = {
 551                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 552                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 553                         BPF_EXIT_INSN(),
 554                 },
 555                 .errstr = "unreachable",
 556                 .result = REJECT,
 557         },
 558         {
 559                 "out of range jump",
 560                 .insns = {
 561                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 562                         BPF_EXIT_INSN(),
 563                 },
 564                 .errstr = "jump out of range",
 565                 .result = REJECT,
 566         },
 567         {
 568                 "out of range jump2",
 569                 .insns = {
 570                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 571                         BPF_EXIT_INSN(),
 572                 },
 573                 .errstr = "jump out of range",
 574                 .result = REJECT,
 575         },
 576         {
 577                 "test1 ld_imm64",
 578                 .insns = {
 579                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 580                         BPF_LD_IMM64(BPF_REG_0, 0),
 581                         BPF_LD_IMM64(BPF_REG_0, 0),
 582                         BPF_LD_IMM64(BPF_REG_0, 1),
 583                         BPF_LD_IMM64(BPF_REG_0, 1),
 584                         BPF_MOV64_IMM(BPF_REG_0, 2),
 585                         BPF_EXIT_INSN(),
 586                 },
 587                 .errstr = "invalid BPF_LD_IMM insn",
 588                 .errstr_unpriv = "R1 pointer comparison",
 589                 .result = REJECT,
 590         },
 591         {
 592                 "test2 ld_imm64",
 593                 .insns = {
 594                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 595                         BPF_LD_IMM64(BPF_REG_0, 0),
 596                         BPF_LD_IMM64(BPF_REG_0, 0),
 597                         BPF_LD_IMM64(BPF_REG_0, 1),
 598                         BPF_LD_IMM64(BPF_REG_0, 1),
 599                         BPF_EXIT_INSN(),
 600                 },
 601                 .errstr = "invalid BPF_LD_IMM insn",
 602                 .errstr_unpriv = "R1 pointer comparison",
 603                 .result = REJECT,
 604         },
 605         {
 606                 "test3 ld_imm64",
 607                 .insns = {
 608                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 609                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 610                         BPF_LD_IMM64(BPF_REG_0, 0),
 611                         BPF_LD_IMM64(BPF_REG_0, 0),
 612                         BPF_LD_IMM64(BPF_REG_0, 1),
 613                         BPF_LD_IMM64(BPF_REG_0, 1),
 614                         BPF_EXIT_INSN(),
 615                 },
 616                 .errstr = "invalid bpf_ld_imm64 insn",
 617                 .result = REJECT,
 618         },
 619         {
 620                 "test4 ld_imm64",
 621                 .insns = {
 622                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 623                         BPF_EXIT_INSN(),
 624                 },
 625                 .errstr = "invalid bpf_ld_imm64 insn",
 626                 .result = REJECT,
 627         },
 628         {
 629                 "test5 ld_imm64",
 630                 .insns = {
 631                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 632                 },
 633                 .errstr = "invalid bpf_ld_imm64 insn",
 634                 .result = REJECT,
 635         },
 636         {
 637                 "test6 ld_imm64",
 638                 .insns = {
 639                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 640                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 641                         BPF_EXIT_INSN(),
 642                 },
 643                 .result = ACCEPT,
 644         },
 645         {
 646                 "test7 ld_imm64",
 647                 .insns = {
 648                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 649                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 650                         BPF_EXIT_INSN(),
 651                 },
 652                 .result = ACCEPT,
 653                 .retval = 1,
 654         },
 655         {
 656                 "test8 ld_imm64",
 657                 .insns = {
 658                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 659                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 660                         BPF_EXIT_INSN(),
 661                 },
 662                 .errstr = "uses reserved fields",
 663                 .result = REJECT,
 664         },
 665         {
 666                 "test9 ld_imm64",
 667                 .insns = {
 668                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 669                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 670                         BPF_EXIT_INSN(),
 671                 },
 672                 .errstr = "invalid bpf_ld_imm64 insn",
 673                 .result = REJECT,
 674         },
 675         {
 676                 "test10 ld_imm64",
 677                 .insns = {
 678                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 679                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 680                         BPF_EXIT_INSN(),
 681                 },
 682                 .errstr = "invalid bpf_ld_imm64 insn",
 683                 .result = REJECT,
 684         },
 685         {
 686                 "test11 ld_imm64",
 687                 .insns = {
 688                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 689                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 690                         BPF_EXIT_INSN(),
 691                 },
 692                 .errstr = "invalid bpf_ld_imm64 insn",
 693                 .result = REJECT,
 694         },
 695         {
 696                 "test12 ld_imm64",
 697                 .insns = {
 698                         BPF_MOV64_IMM(BPF_REG_1, 0),
 699                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 700                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 701                         BPF_EXIT_INSN(),
 702                 },
 703                 .errstr = "not pointing to valid bpf_map",
 704                 .result = REJECT,
 705         },
 706         {
 707                 "test13 ld_imm64",
 708                 .insns = {
 709                         BPF_MOV64_IMM(BPF_REG_1, 0),
 710                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 711                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 712                         BPF_EXIT_INSN(),
 713                 },
 714                 .errstr = "invalid bpf_ld_imm64 insn",
 715                 .result = REJECT,
 716         },
 717         {
 718                 "arsh32 on imm",
 719                 .insns = {
 720                         BPF_MOV64_IMM(BPF_REG_0, 1),
 721                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 722                         BPF_EXIT_INSN(),
 723                 },
 724                 .result = REJECT,
 725                 .errstr = "unknown opcode c4",
 726         },
 727         {
 728                 "arsh32 on reg",
 729                 .insns = {
 730                         BPF_MOV64_IMM(BPF_REG_0, 1),
 731                         BPF_MOV64_IMM(BPF_REG_1, 5),
 732                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 733                         BPF_EXIT_INSN(),
 734                 },
 735                 .result = REJECT,
 736                 .errstr = "unknown opcode cc",
 737         },
 738         {
 739                 "arsh64 on imm",
 740                 .insns = {
 741                         BPF_MOV64_IMM(BPF_REG_0, 1),
 742                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 743                         BPF_EXIT_INSN(),
 744                 },
 745                 .result = ACCEPT,
 746         },
 747         {
 748                 "arsh64 on reg",
 749                 .insns = {
 750                         BPF_MOV64_IMM(BPF_REG_0, 1),
 751                         BPF_MOV64_IMM(BPF_REG_1, 5),
 752                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 753                         BPF_EXIT_INSN(),
 754                 },
 755                 .result = ACCEPT,
 756         },
 757         {
 758                 "no bpf_exit",
 759                 .insns = {
 760                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 761                 },
 762                 .errstr = "not an exit",
 763                 .result = REJECT,
 764         },
 765         {
 766                 "loop (back-edge)",
 767                 .insns = {
 768                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 769                         BPF_EXIT_INSN(),
 770                 },
 771                 .errstr = "back-edge",
 772                 .result = REJECT,
 773         },
 774         {
 775                 "loop2 (back-edge)",
 776                 .insns = {
 777                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 778                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 779                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 780                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 781                         BPF_EXIT_INSN(),
 782                 },
 783                 .errstr = "back-edge",
 784                 .result = REJECT,
 785         },
 786         {
 787                 "conditional loop",
 788                 .insns = {
 789                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 790                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 791                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 792                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 793                         BPF_EXIT_INSN(),
 794                 },
 795                 .errstr = "back-edge",
 796                 .result = REJECT,
 797         },
 798         {
 799                 "read uninitialized register",
 800                 .insns = {
 801                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 802                         BPF_EXIT_INSN(),
 803                 },
 804                 .errstr = "R2 !read_ok",
 805                 .result = REJECT,
 806         },
 807         {
 808                 "read invalid register",
 809                 .insns = {
 810                         BPF_MOV64_REG(BPF_REG_0, -1),
 811                         BPF_EXIT_INSN(),
 812                 },
 813                 .errstr = "R15 is invalid",
 814                 .result = REJECT,
 815         },
 816         {
 817                 "program doesn't init R0 before exit",
 818                 .insns = {
 819                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 820                         BPF_EXIT_INSN(),
 821                 },
 822                 .errstr = "R0 !read_ok",
 823                 .result = REJECT,
 824         },
 825         {
 826                 "program doesn't init R0 before exit in all branches",
 827                 .insns = {
 828                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 829                         BPF_MOV64_IMM(BPF_REG_0, 1),
 830                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 831                         BPF_EXIT_INSN(),
 832                 },
 833                 .errstr = "R0 !read_ok",
 834                 .errstr_unpriv = "R1 pointer comparison",
 835                 .result = REJECT,
 836         },
 837         {
 838                 "stack out of bounds",
 839                 .insns = {
 840                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 841                         BPF_EXIT_INSN(),
 842                 },
 843                 .errstr = "invalid stack",
 844                 .result = REJECT,
 845         },
 846         {
 847                 "invalid call insn1",
 848                 .insns = {
 849                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 850                         BPF_EXIT_INSN(),
 851                 },
 852                 .errstr = "unknown opcode 8d",
 853                 .result = REJECT,
 854         },
 855         {
 856                 "invalid call insn2",
 857                 .insns = {
 858                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 859                         BPF_EXIT_INSN(),
 860                 },
 861                 .errstr = "BPF_CALL uses reserved",
 862                 .result = REJECT,
 863         },
 864         {
 865                 "invalid function call",
 866                 .insns = {
 867                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 868                         BPF_EXIT_INSN(),
 869                 },
 870                 .errstr = "invalid func unknown#1234567",
 871                 .result = REJECT,
 872         },
 873         {
 874                 "uninitialized stack1",
 875                 .insns = {
 876                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 877                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 878                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 879                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 880                                      BPF_FUNC_map_lookup_elem),
 881                         BPF_EXIT_INSN(),
 882                 },
 883                 .fixup_map_hash_8b = { 2 },
 884                 .errstr = "invalid indirect read from stack",
 885                 .result = REJECT,
 886         },
 887         {
 888                 "uninitialized stack2",
 889                 .insns = {
 890                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 891                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 892                         BPF_EXIT_INSN(),
 893                 },
 894                 .errstr = "invalid read from stack",
 895                 .result = REJECT,
 896         },
 897         {
 898                 "invalid fp arithmetic",
 899                 /* If this gets ever changed, make sure JITs can deal with it. */
 900                 .insns = {
 901                         BPF_MOV64_IMM(BPF_REG_0, 0),
 902                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 903                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 904                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 905                         BPF_EXIT_INSN(),
 906                 },
 907                 .errstr = "R1 subtraction from stack pointer",
 908                 .result = REJECT,
 909         },
 910         {
 911                 "non-invalid fp arithmetic",
 912                 .insns = {
 913                         BPF_MOV64_IMM(BPF_REG_0, 0),
 914                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 915                         BPF_EXIT_INSN(),
 916                 },
 917                 .result = ACCEPT,
 918         },
 919         {
 920                 "invalid argument register",
 921                 .insns = {
 922                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 923                                      BPF_FUNC_get_cgroup_classid),
 924                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 925                                      BPF_FUNC_get_cgroup_classid),
 926                         BPF_EXIT_INSN(),
 927                 },
 928                 .errstr = "R1 !read_ok",
 929                 .result = REJECT,
 930                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 931         },
 932         {
 933                 "non-invalid argument register",
 934                 .insns = {
 935                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 936                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 937                                      BPF_FUNC_get_cgroup_classid),
 938                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 940                                      BPF_FUNC_get_cgroup_classid),
 941                         BPF_EXIT_INSN(),
 942                 },
 943                 .result = ACCEPT,
 944                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 945         },
 946         {
 947                 "check valid spill/fill",
 948                 .insns = {
 949                         /* spill R1(ctx) into stack */
 950                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 951                         /* fill it back into R2 */
 952                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 953                         /* should be able to access R0 = *(R2 + 8) */
 954                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 955                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 956                         BPF_EXIT_INSN(),
 957                 },
 958                 .errstr_unpriv = "R0 leaks addr",
 959                 .result = ACCEPT,
 960                 .result_unpriv = REJECT,
 961                 .retval = POINTER_VALUE,
 962         },
 963         {
 964                 "check valid spill/fill, skb mark",
 965                 .insns = {
 966                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 967                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 968                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 969                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 970                                     offsetof(struct __sk_buff, mark)),
 971                         BPF_EXIT_INSN(),
 972                 },
 973                 .result = ACCEPT,
 974                 .result_unpriv = ACCEPT,
 975         },
 976         {
 977                 "check corrupted spill/fill",
 978                 .insns = {
 979                         /* spill R1(ctx) into stack */
 980                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 981                         /* mess up with R1 pointer on stack */
 982                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 983                         /* fill back into R0 should fail */
 984                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 985                         BPF_EXIT_INSN(),
 986                 },
 987                 .errstr_unpriv = "attempt to corrupt spilled",
 988                 .errstr = "corrupted spill",
 989                 .result = REJECT,
 990         },
 991         {
 992                 "invalid src register in STX",
 993                 .insns = {
 994                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 995                         BPF_EXIT_INSN(),
 996                 },
 997                 .errstr = "R15 is invalid",
 998                 .result = REJECT,
 999         },
1000         {
1001                 "invalid dst register in STX",
1002                 .insns = {
1003                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
1004                         BPF_EXIT_INSN(),
1005                 },
1006                 .errstr = "R14 is invalid",
1007                 .result = REJECT,
1008         },
1009         {
1010                 "invalid dst register in ST",
1011                 .insns = {
1012                         BPF_ST_MEM(BPF_B, 14, -1, -1),
1013                         BPF_EXIT_INSN(),
1014                 },
1015                 .errstr = "R14 is invalid",
1016                 .result = REJECT,
1017         },
1018         {
1019                 "invalid src register in LDX",
1020                 .insns = {
1021                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
1022                         BPF_EXIT_INSN(),
1023                 },
1024                 .errstr = "R12 is invalid",
1025                 .result = REJECT,
1026         },
1027         {
1028                 "invalid dst register in LDX",
1029                 .insns = {
1030                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
1031                         BPF_EXIT_INSN(),
1032                 },
1033                 .errstr = "R11 is invalid",
1034                 .result = REJECT,
1035         },
1036         {
1037                 "junk insn",
1038                 .insns = {
1039                         BPF_RAW_INSN(0, 0, 0, 0, 0),
1040                         BPF_EXIT_INSN(),
1041                 },
1042                 .errstr = "unknown opcode 00",
1043                 .result = REJECT,
1044         },
1045         {
1046                 "junk insn2",
1047                 .insns = {
1048                         BPF_RAW_INSN(1, 0, 0, 0, 0),
1049                         BPF_EXIT_INSN(),
1050                 },
1051                 .errstr = "BPF_LDX uses reserved fields",
1052                 .result = REJECT,
1053         },
1054         {
1055                 "junk insn3",
1056                 .insns = {
1057                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
1058                         BPF_EXIT_INSN(),
1059                 },
1060                 .errstr = "unknown opcode ff",
1061                 .result = REJECT,
1062         },
1063         {
1064                 "junk insn4",
1065                 .insns = {
1066                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
1067                         BPF_EXIT_INSN(),
1068                 },
1069                 .errstr = "unknown opcode ff",
1070                 .result = REJECT,
1071         },
1072         {
1073                 "junk insn5",
1074                 .insns = {
1075                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
1076                         BPF_EXIT_INSN(),
1077                 },
1078                 .errstr = "BPF_ALU uses reserved fields",
1079                 .result = REJECT,
1080         },
1081         {
1082                 "misaligned read from stack",
1083                 .insns = {
1084                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1085                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
1086                         BPF_EXIT_INSN(),
1087                 },
1088                 .errstr = "misaligned stack access",
1089                 .result = REJECT,
1090         },
1091         {
1092                 "invalid map_fd for function call",
1093                 .insns = {
1094                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1095                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
1096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1097                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1098                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1099                                      BPF_FUNC_map_delete_elem),
1100                         BPF_EXIT_INSN(),
1101                 },
1102                 .errstr = "fd 0 is not pointing to valid bpf_map",
1103                 .result = REJECT,
1104         },
1105         {
1106                 "don't check return value before access",
1107                 .insns = {
1108                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1109                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1110                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1111                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1112                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1113                                      BPF_FUNC_map_lookup_elem),
1114                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1115                         BPF_EXIT_INSN(),
1116                 },
1117                 .fixup_map_hash_8b = { 3 },
1118                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1119                 .result = REJECT,
1120         },
1121         {
1122                 "access memory with incorrect alignment",
1123                 .insns = {
1124                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1125                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1126                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1127                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1128                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1129                                      BPF_FUNC_map_lookup_elem),
1130                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1131                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1132                         BPF_EXIT_INSN(),
1133                 },
1134                 .fixup_map_hash_8b = { 3 },
1135                 .errstr = "misaligned value access",
1136                 .result = REJECT,
1137                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1138         },
1139         {
1140                 "sometimes access memory with incorrect alignment",
1141                 .insns = {
1142                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1143                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1144                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1145                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1146                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1147                                      BPF_FUNC_map_lookup_elem),
1148                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1149                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1150                         BPF_EXIT_INSN(),
1151                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1152                         BPF_EXIT_INSN(),
1153                 },
1154                 .fixup_map_hash_8b = { 3 },
1155                 .errstr = "R0 invalid mem access",
1156                 .errstr_unpriv = "R0 leaks addr",
1157                 .result = REJECT,
1158                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1159         },
1160         {
1161                 "jump test 1",
1162                 .insns = {
1163                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1164                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1165                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1166                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1168                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1169                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1170                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1171                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1172                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1175                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1176                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1177                         BPF_MOV64_IMM(BPF_REG_0, 0),
1178                         BPF_EXIT_INSN(),
1179                 },
1180                 .errstr_unpriv = "R1 pointer comparison",
1181                 .result_unpriv = REJECT,
1182                 .result = ACCEPT,
1183         },
1184         {
1185                 "jump test 2",
1186                 .insns = {
1187                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1188                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1189                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1190                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1191                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1192                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1193                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1194                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1195                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1196                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1197                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1198                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1199                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1201                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1202                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1203                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1204                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1205                         BPF_MOV64_IMM(BPF_REG_0, 0),
1206                         BPF_EXIT_INSN(),
1207                 },
1208                 .errstr_unpriv = "R1 pointer comparison",
1209                 .result_unpriv = REJECT,
1210                 .result = ACCEPT,
1211         },
1212         {
1213                 "jump test 3",
1214                 .insns = {
1215                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1216                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1217                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1219                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1220                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1221                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1223                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1224                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1225                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1226                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1227                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1228                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1229                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1231                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1233                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1235                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1237                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1241                                      BPF_FUNC_map_delete_elem),
1242                         BPF_EXIT_INSN(),
1243                 },
1244                 .fixup_map_hash_8b = { 24 },
1245                 .errstr_unpriv = "R1 pointer comparison",
1246                 .result_unpriv = REJECT,
1247                 .result = ACCEPT,
1248                 .retval = -ENOENT,
1249         },
1250         {
1251                 "jump test 4",
1252                 .insns = {
1253                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1258                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1260                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1261                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1262                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1263                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1268                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1269                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1270                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1271                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1272                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1273                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1274                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1275                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1276                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1277                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1278                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1279                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1280                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1281                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1282                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1283                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1284                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1285                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1286                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1287                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1288                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1289                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1290                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1291                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1292                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1293                         BPF_MOV64_IMM(BPF_REG_0, 0),
1294                         BPF_EXIT_INSN(),
1295                 },
1296                 .errstr_unpriv = "R1 pointer comparison",
1297                 .result_unpriv = REJECT,
1298                 .result = ACCEPT,
1299         },
1300         {
1301                 "jump test 5",
1302                 .insns = {
1303                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1304                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1305                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1306                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1307                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1308                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1309                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1310                         BPF_MOV64_IMM(BPF_REG_0, 0),
1311                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1312                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1313                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1314                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1315                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1316                         BPF_MOV64_IMM(BPF_REG_0, 0),
1317                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1318                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1319                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1320                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1321                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1322                         BPF_MOV64_IMM(BPF_REG_0, 0),
1323                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1324                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1325                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1326                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1327                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1328                         BPF_MOV64_IMM(BPF_REG_0, 0),
1329                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1330                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1331                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1332                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1333                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1334                         BPF_MOV64_IMM(BPF_REG_0, 0),
1335                         BPF_EXIT_INSN(),
1336                 },
1337                 .errstr_unpriv = "R1 pointer comparison",
1338                 .result_unpriv = REJECT,
1339                 .result = ACCEPT,
1340         },
1341         {
1342                 "access skb fields ok",
1343                 .insns = {
1344                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1345                                     offsetof(struct __sk_buff, len)),
1346                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1347                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1348                                     offsetof(struct __sk_buff, mark)),
1349                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1350                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1351                                     offsetof(struct __sk_buff, pkt_type)),
1352                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1353                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1354                                     offsetof(struct __sk_buff, queue_mapping)),
1355                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1356                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1357                                     offsetof(struct __sk_buff, protocol)),
1358                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1359                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1360                                     offsetof(struct __sk_buff, vlan_present)),
1361                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1362                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1363                                     offsetof(struct __sk_buff, vlan_tci)),
1364                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1365                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1366                                     offsetof(struct __sk_buff, napi_id)),
1367                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1368                         BPF_EXIT_INSN(),
1369                 },
1370                 .result = ACCEPT,
1371         },
1372         {
1373                 "access skb fields bad1",
1374                 .insns = {
1375                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1376                         BPF_EXIT_INSN(),
1377                 },
1378                 .errstr = "invalid bpf_context access",
1379                 .result = REJECT,
1380         },
1381         {
1382                 "access skb fields bad2",
1383                 .insns = {
1384                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1385                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1386                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1388                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1389                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1390                                      BPF_FUNC_map_lookup_elem),
1391                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1392                         BPF_EXIT_INSN(),
1393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1394                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1395                                     offsetof(struct __sk_buff, pkt_type)),
1396                         BPF_EXIT_INSN(),
1397                 },
1398                 .fixup_map_hash_8b = { 4 },
1399                 .errstr = "different pointers",
1400                 .errstr_unpriv = "R1 pointer comparison",
1401                 .result = REJECT,
1402         },
1403         {
1404                 "access skb fields bad3",
1405                 .insns = {
1406                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1407                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1408                                     offsetof(struct __sk_buff, pkt_type)),
1409                         BPF_EXIT_INSN(),
1410                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1415                                      BPF_FUNC_map_lookup_elem),
1416                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1417                         BPF_EXIT_INSN(),
1418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1419                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1420                 },
1421                 .fixup_map_hash_8b = { 6 },
1422                 .errstr = "different pointers",
1423                 .errstr_unpriv = "R1 pointer comparison",
1424                 .result = REJECT,
1425         },
1426         {
1427                 "access skb fields bad4",
1428                 .insns = {
1429                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1430                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1431                                     offsetof(struct __sk_buff, len)),
1432                         BPF_MOV64_IMM(BPF_REG_0, 0),
1433                         BPF_EXIT_INSN(),
1434                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1435                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1436                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1437                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1438                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1439                                      BPF_FUNC_map_lookup_elem),
1440                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1441                         BPF_EXIT_INSN(),
1442                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1443                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1444                 },
1445                 .fixup_map_hash_8b = { 7 },
1446                 .errstr = "different pointers",
1447                 .errstr_unpriv = "R1 pointer comparison",
1448                 .result = REJECT,
1449         },
1450         {
1451                 "invalid access __sk_buff family",
1452                 .insns = {
1453                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1454                                     offsetof(struct __sk_buff, family)),
1455                         BPF_EXIT_INSN(),
1456                 },
1457                 .errstr = "invalid bpf_context access",
1458                 .result = REJECT,
1459         },
1460         {
1461                 "invalid access __sk_buff remote_ip4",
1462                 .insns = {
1463                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1464                                     offsetof(struct __sk_buff, remote_ip4)),
1465                         BPF_EXIT_INSN(),
1466                 },
1467                 .errstr = "invalid bpf_context access",
1468                 .result = REJECT,
1469         },
1470         {
1471                 "invalid access __sk_buff local_ip4",
1472                 .insns = {
1473                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1474                                     offsetof(struct __sk_buff, local_ip4)),
1475                         BPF_EXIT_INSN(),
1476                 },
1477                 .errstr = "invalid bpf_context access",
1478                 .result = REJECT,
1479         },
1480         {
1481                 "invalid access __sk_buff remote_ip6",
1482                 .insns = {
1483                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1484                                     offsetof(struct __sk_buff, remote_ip6)),
1485                         BPF_EXIT_INSN(),
1486                 },
1487                 .errstr = "invalid bpf_context access",
1488                 .result = REJECT,
1489         },
1490         {
1491                 "invalid access __sk_buff local_ip6",
1492                 .insns = {
1493                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1494                                     offsetof(struct __sk_buff, local_ip6)),
1495                         BPF_EXIT_INSN(),
1496                 },
1497                 .errstr = "invalid bpf_context access",
1498                 .result = REJECT,
1499         },
1500         {
1501                 "invalid access __sk_buff remote_port",
1502                 .insns = {
1503                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1504                                     offsetof(struct __sk_buff, remote_port)),
1505                         BPF_EXIT_INSN(),
1506                 },
1507                 .errstr = "invalid bpf_context access",
1508                 .result = REJECT,
1509         },
1510         {
1511                 "invalid access __sk_buff remote_port",
1512                 .insns = {
1513                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1514                                     offsetof(struct __sk_buff, local_port)),
1515                         BPF_EXIT_INSN(),
1516                 },
1517                 .errstr = "invalid bpf_context access",
1518                 .result = REJECT,
1519         },
1520         {
1521                 "valid access __sk_buff family",
1522                 .insns = {
1523                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1524                                     offsetof(struct __sk_buff, family)),
1525                         BPF_EXIT_INSN(),
1526                 },
1527                 .result = ACCEPT,
1528                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1529         },
1530         {
1531                 "valid access __sk_buff remote_ip4",
1532                 .insns = {
1533                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1534                                     offsetof(struct __sk_buff, remote_ip4)),
1535                         BPF_EXIT_INSN(),
1536                 },
1537                 .result = ACCEPT,
1538                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1539         },
1540         {
1541                 "valid access __sk_buff local_ip4",
1542                 .insns = {
1543                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1544                                     offsetof(struct __sk_buff, local_ip4)),
1545                         BPF_EXIT_INSN(),
1546                 },
1547                 .result = ACCEPT,
1548                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1549         },
1550         {
1551                 "valid access __sk_buff remote_ip6",
1552                 .insns = {
1553                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1554                                     offsetof(struct __sk_buff, remote_ip6[0])),
1555                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1556                                     offsetof(struct __sk_buff, remote_ip6[1])),
1557                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1558                                     offsetof(struct __sk_buff, remote_ip6[2])),
1559                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1560                                     offsetof(struct __sk_buff, remote_ip6[3])),
1561                         BPF_EXIT_INSN(),
1562                 },
1563                 .result = ACCEPT,
1564                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1565         },
1566         {
1567                 "valid access __sk_buff local_ip6",
1568                 .insns = {
1569                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1570                                     offsetof(struct __sk_buff, local_ip6[0])),
1571                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1572                                     offsetof(struct __sk_buff, local_ip6[1])),
1573                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1574                                     offsetof(struct __sk_buff, local_ip6[2])),
1575                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1576                                     offsetof(struct __sk_buff, local_ip6[3])),
1577                         BPF_EXIT_INSN(),
1578                 },
1579                 .result = ACCEPT,
1580                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1581         },
1582         {
1583                 "valid access __sk_buff remote_port",
1584                 .insns = {
1585                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1586                                     offsetof(struct __sk_buff, remote_port)),
1587                         BPF_EXIT_INSN(),
1588                 },
1589                 .result = ACCEPT,
1590                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1591         },
1592         {
1593                 "valid access __sk_buff remote_port",
1594                 .insns = {
1595                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1596                                     offsetof(struct __sk_buff, local_port)),
1597                         BPF_EXIT_INSN(),
1598                 },
1599                 .result = ACCEPT,
1600                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1601         },
1602         {
1603                 "invalid access of tc_classid for SK_SKB",
1604                 .insns = {
1605                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1606                                     offsetof(struct __sk_buff, tc_classid)),
1607                         BPF_EXIT_INSN(),
1608                 },
1609                 .result = REJECT,
1610                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1611                 .errstr = "invalid bpf_context access",
1612         },
1613         {
1614                 "invalid access of skb->mark for SK_SKB",
1615                 .insns = {
1616                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1617                                     offsetof(struct __sk_buff, mark)),
1618                         BPF_EXIT_INSN(),
1619                 },
1620                 .result =  REJECT,
1621                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1622                 .errstr = "invalid bpf_context access",
1623         },
1624         {
1625                 "check skb->mark is not writeable by SK_SKB",
1626                 .insns = {
1627                         BPF_MOV64_IMM(BPF_REG_0, 0),
1628                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1629                                     offsetof(struct __sk_buff, mark)),
1630                         BPF_EXIT_INSN(),
1631                 },
1632                 .result =  REJECT,
1633                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1634                 .errstr = "invalid bpf_context access",
1635         },
1636         {
1637                 "check skb->tc_index is writeable by SK_SKB",
1638                 .insns = {
1639                         BPF_MOV64_IMM(BPF_REG_0, 0),
1640                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1641                                     offsetof(struct __sk_buff, tc_index)),
1642                         BPF_EXIT_INSN(),
1643                 },
1644                 .result = ACCEPT,
1645                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1646         },
1647         {
1648                 "check skb->priority is writeable by SK_SKB",
1649                 .insns = {
1650                         BPF_MOV64_IMM(BPF_REG_0, 0),
1651                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1652                                     offsetof(struct __sk_buff, priority)),
1653                         BPF_EXIT_INSN(),
1654                 },
1655                 .result = ACCEPT,
1656                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1657         },
1658         {
1659                 "direct packet read for SK_SKB",
1660                 .insns = {
1661                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1662                                     offsetof(struct __sk_buff, data)),
1663                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1664                                     offsetof(struct __sk_buff, data_end)),
1665                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1666                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1667                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1668                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1669                         BPF_MOV64_IMM(BPF_REG_0, 0),
1670                         BPF_EXIT_INSN(),
1671                 },
1672                 .result = ACCEPT,
1673                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1674         },
1675         {
1676                 "direct packet write for SK_SKB",
1677                 .insns = {
1678                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1679                                     offsetof(struct __sk_buff, data)),
1680                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1681                                     offsetof(struct __sk_buff, data_end)),
1682                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1683                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1684                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1685                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1686                         BPF_MOV64_IMM(BPF_REG_0, 0),
1687                         BPF_EXIT_INSN(),
1688                 },
1689                 .result = ACCEPT,
1690                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1691         },
1692         {
1693                 "overlapping checks for direct packet access SK_SKB",
1694                 .insns = {
1695                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1696                                     offsetof(struct __sk_buff, data)),
1697                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1698                                     offsetof(struct __sk_buff, data_end)),
1699                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1701                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1702                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1703                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1704                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1705                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1706                         BPF_MOV64_IMM(BPF_REG_0, 0),
1707                         BPF_EXIT_INSN(),
1708                 },
1709                 .result = ACCEPT,
1710                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1711         },
1712         {
1713                 "valid access family in SK_MSG",
1714                 .insns = {
1715                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1716                                     offsetof(struct sk_msg_md, family)),
1717                         BPF_EXIT_INSN(),
1718                 },
1719                 .result = ACCEPT,
1720                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1721         },
1722         {
1723                 "valid access remote_ip4 in SK_MSG",
1724                 .insns = {
1725                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1726                                     offsetof(struct sk_msg_md, remote_ip4)),
1727                         BPF_EXIT_INSN(),
1728                 },
1729                 .result = ACCEPT,
1730                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1731         },
1732         {
1733                 "valid access local_ip4 in SK_MSG",
1734                 .insns = {
1735                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1736                                     offsetof(struct sk_msg_md, local_ip4)),
1737                         BPF_EXIT_INSN(),
1738                 },
1739                 .result = ACCEPT,
1740                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1741         },
1742         {
1743                 "valid access remote_port in SK_MSG",
1744                 .insns = {
1745                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1746                                     offsetof(struct sk_msg_md, remote_port)),
1747                         BPF_EXIT_INSN(),
1748                 },
1749                 .result = ACCEPT,
1750                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1751         },
1752         {
1753                 "valid access local_port in SK_MSG",
1754                 .insns = {
1755                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1756                                     offsetof(struct sk_msg_md, local_port)),
1757                         BPF_EXIT_INSN(),
1758                 },
1759                 .result = ACCEPT,
1760                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1761         },
1762         {
1763                 "valid access remote_ip6 in SK_MSG",
1764                 .insns = {
1765                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1766                                     offsetof(struct sk_msg_md, remote_ip6[0])),
1767                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1768                                     offsetof(struct sk_msg_md, remote_ip6[1])),
1769                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1770                                     offsetof(struct sk_msg_md, remote_ip6[2])),
1771                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1772                                     offsetof(struct sk_msg_md, remote_ip6[3])),
1773                         BPF_EXIT_INSN(),
1774                 },
1775                 .result = ACCEPT,
1776                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1777         },
1778         {
1779                 "valid access local_ip6 in SK_MSG",
1780                 .insns = {
1781                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1782                                     offsetof(struct sk_msg_md, local_ip6[0])),
1783                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1784                                     offsetof(struct sk_msg_md, local_ip6[1])),
1785                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1786                                     offsetof(struct sk_msg_md, local_ip6[2])),
1787                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1788                                     offsetof(struct sk_msg_md, local_ip6[3])),
1789                         BPF_EXIT_INSN(),
1790                 },
1791                 .result = ACCEPT,
1792                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1793         },
1794         {
1795                 "invalid 64B read of family in SK_MSG",
1796                 .insns = {
1797                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1798                                     offsetof(struct sk_msg_md, family)),
1799                         BPF_EXIT_INSN(),
1800                 },
1801                 .errstr = "invalid bpf_context access",
1802                 .result = REJECT,
1803                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1804         },
1805         {
1806                 "invalid read past end of SK_MSG",
1807                 .insns = {
1808                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1809                                     offsetof(struct sk_msg_md, local_port) + 4),
1810                         BPF_EXIT_INSN(),
1811                 },
1812                 .errstr = "R0 !read_ok",
1813                 .result = REJECT,
1814                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1815         },
1816         {
1817                 "invalid read offset in SK_MSG",
1818                 .insns = {
1819                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1820                                     offsetof(struct sk_msg_md, family) + 1),
1821                         BPF_EXIT_INSN(),
1822                 },
1823                 .errstr = "invalid bpf_context access",
1824                 .result = REJECT,
1825                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1826         },
1827         {
1828                 "direct packet read for SK_MSG",
1829                 .insns = {
1830                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1831                                     offsetof(struct sk_msg_md, data)),
1832                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1833                                     offsetof(struct sk_msg_md, data_end)),
1834                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1836                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1837                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1838                         BPF_MOV64_IMM(BPF_REG_0, 0),
1839                         BPF_EXIT_INSN(),
1840                 },
1841                 .result = ACCEPT,
1842                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1843         },
1844         {
1845                 "direct packet write for SK_MSG",
1846                 .insns = {
1847                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1848                                     offsetof(struct sk_msg_md, data)),
1849                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1850                                     offsetof(struct sk_msg_md, data_end)),
1851                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1853                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1854                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1855                         BPF_MOV64_IMM(BPF_REG_0, 0),
1856                         BPF_EXIT_INSN(),
1857                 },
1858                 .result = ACCEPT,
1859                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1860         },
1861         {
1862                 "overlapping checks for direct packet access SK_MSG",
1863                 .insns = {
1864                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1865                                     offsetof(struct sk_msg_md, data)),
1866                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1867                                     offsetof(struct sk_msg_md, data_end)),
1868                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1869                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1870                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1871                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1872                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1873                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1874                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1875                         BPF_MOV64_IMM(BPF_REG_0, 0),
1876                         BPF_EXIT_INSN(),
1877                 },
1878                 .result = ACCEPT,
1879                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1880         },
1881         {
1882                 "check skb->mark is not writeable by sockets",
1883                 .insns = {
1884                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1885                                     offsetof(struct __sk_buff, mark)),
1886                         BPF_EXIT_INSN(),
1887                 },
1888                 .errstr = "invalid bpf_context access",
1889                 .errstr_unpriv = "R1 leaks addr",
1890                 .result = REJECT,
1891         },
1892         {
1893                 "check skb->tc_index is not writeable by sockets",
1894                 .insns = {
1895                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1896                                     offsetof(struct __sk_buff, tc_index)),
1897                         BPF_EXIT_INSN(),
1898                 },
1899                 .errstr = "invalid bpf_context access",
1900                 .errstr_unpriv = "R1 leaks addr",
1901                 .result = REJECT,
1902         },
1903         {
1904                 "check cb access: byte",
1905                 .insns = {
1906                         BPF_MOV64_IMM(BPF_REG_0, 0),
1907                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1908                                     offsetof(struct __sk_buff, cb[0])),
1909                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1910                                     offsetof(struct __sk_buff, cb[0]) + 1),
1911                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1912                                     offsetof(struct __sk_buff, cb[0]) + 2),
1913                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1914                                     offsetof(struct __sk_buff, cb[0]) + 3),
1915                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1916                                     offsetof(struct __sk_buff, cb[1])),
1917                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1918                                     offsetof(struct __sk_buff, cb[1]) + 1),
1919                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1920                                     offsetof(struct __sk_buff, cb[1]) + 2),
1921                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1922                                     offsetof(struct __sk_buff, cb[1]) + 3),
1923                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1924                                     offsetof(struct __sk_buff, cb[2])),
1925                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1926                                     offsetof(struct __sk_buff, cb[2]) + 1),
1927                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1928                                     offsetof(struct __sk_buff, cb[2]) + 2),
1929                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1930                                     offsetof(struct __sk_buff, cb[2]) + 3),
1931                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1932                                     offsetof(struct __sk_buff, cb[3])),
1933                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1934                                     offsetof(struct __sk_buff, cb[3]) + 1),
1935                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1936                                     offsetof(struct __sk_buff, cb[3]) + 2),
1937                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1938                                     offsetof(struct __sk_buff, cb[3]) + 3),
1939                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1940                                     offsetof(struct __sk_buff, cb[4])),
1941                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1942                                     offsetof(struct __sk_buff, cb[4]) + 1),
1943                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1944                                     offsetof(struct __sk_buff, cb[4]) + 2),
1945                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1946                                     offsetof(struct __sk_buff, cb[4]) + 3),
1947                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1948                                     offsetof(struct __sk_buff, cb[0])),
1949                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1950                                     offsetof(struct __sk_buff, cb[0]) + 1),
1951                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1952                                     offsetof(struct __sk_buff, cb[0]) + 2),
1953                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1954                                     offsetof(struct __sk_buff, cb[0]) + 3),
1955                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1956                                     offsetof(struct __sk_buff, cb[1])),
1957                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1958                                     offsetof(struct __sk_buff, cb[1]) + 1),
1959                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1960                                     offsetof(struct __sk_buff, cb[1]) + 2),
1961                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1962                                     offsetof(struct __sk_buff, cb[1]) + 3),
1963                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1964                                     offsetof(struct __sk_buff, cb[2])),
1965                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1966                                     offsetof(struct __sk_buff, cb[2]) + 1),
1967                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1968                                     offsetof(struct __sk_buff, cb[2]) + 2),
1969                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1970                                     offsetof(struct __sk_buff, cb[2]) + 3),
1971                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1972                                     offsetof(struct __sk_buff, cb[3])),
1973                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1974                                     offsetof(struct __sk_buff, cb[3]) + 1),
1975                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1976                                     offsetof(struct __sk_buff, cb[3]) + 2),
1977                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1978                                     offsetof(struct __sk_buff, cb[3]) + 3),
1979                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1980                                     offsetof(struct __sk_buff, cb[4])),
1981                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1982                                     offsetof(struct __sk_buff, cb[4]) + 1),
1983                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1984                                     offsetof(struct __sk_buff, cb[4]) + 2),
1985                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1986                                     offsetof(struct __sk_buff, cb[4]) + 3),
1987                         BPF_EXIT_INSN(),
1988                 },
1989                 .result = ACCEPT,
1990         },
1991         {
1992                 "__sk_buff->hash, offset 0, byte store not permitted",
1993                 .insns = {
1994                         BPF_MOV64_IMM(BPF_REG_0, 0),
1995                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1996                                     offsetof(struct __sk_buff, hash)),
1997                         BPF_EXIT_INSN(),
1998                 },
1999                 .errstr = "invalid bpf_context access",
2000                 .result = REJECT,
2001         },
2002         {
2003                 "__sk_buff->tc_index, offset 3, byte store not permitted",
2004                 .insns = {
2005                         BPF_MOV64_IMM(BPF_REG_0, 0),
2006                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2007                                     offsetof(struct __sk_buff, tc_index) + 3),
2008                         BPF_EXIT_INSN(),
2009                 },
2010                 .errstr = "invalid bpf_context access",
2011                 .result = REJECT,
2012         },
2013         {
2014                 "check skb->hash byte load permitted",
2015                 .insns = {
2016                         BPF_MOV64_IMM(BPF_REG_0, 0),
2017 #if __BYTE_ORDER == __LITTLE_ENDIAN
2018                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2019                                     offsetof(struct __sk_buff, hash)),
2020 #else
2021                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2022                                     offsetof(struct __sk_buff, hash) + 3),
2023 #endif
2024                         BPF_EXIT_INSN(),
2025                 },
2026                 .result = ACCEPT,
2027         },
2028         {
2029                 "check skb->hash byte load not permitted 1",
2030                 .insns = {
2031                         BPF_MOV64_IMM(BPF_REG_0, 0),
2032                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2033                                     offsetof(struct __sk_buff, hash) + 1),
2034                         BPF_EXIT_INSN(),
2035                 },
2036                 .errstr = "invalid bpf_context access",
2037                 .result = REJECT,
2038         },
2039         {
2040                 "check skb->hash byte load not permitted 2",
2041                 .insns = {
2042                         BPF_MOV64_IMM(BPF_REG_0, 0),
2043                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2044                                     offsetof(struct __sk_buff, hash) + 2),
2045                         BPF_EXIT_INSN(),
2046                 },
2047                 .errstr = "invalid bpf_context access",
2048                 .result = REJECT,
2049         },
2050         {
2051                 "check skb->hash byte load not permitted 3",
2052                 .insns = {
2053                         BPF_MOV64_IMM(BPF_REG_0, 0),
2054 #if __BYTE_ORDER == __LITTLE_ENDIAN
2055                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2056                                     offsetof(struct __sk_buff, hash) + 3),
2057 #else
2058                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2059                                     offsetof(struct __sk_buff, hash)),
2060 #endif
2061                         BPF_EXIT_INSN(),
2062                 },
2063                 .errstr = "invalid bpf_context access",
2064                 .result = REJECT,
2065         },
2066         {
2067                 "check cb access: byte, wrong type",
2068                 .insns = {
2069                         BPF_MOV64_IMM(BPF_REG_0, 0),
2070                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2071                                     offsetof(struct __sk_buff, cb[0])),
2072                         BPF_EXIT_INSN(),
2073                 },
2074                 .errstr = "invalid bpf_context access",
2075                 .result = REJECT,
2076                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2077         },
2078         {
2079                 "check cb access: half",
2080                 .insns = {
2081                         BPF_MOV64_IMM(BPF_REG_0, 0),
2082                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2083                                     offsetof(struct __sk_buff, cb[0])),
2084                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2085                                     offsetof(struct __sk_buff, cb[0]) + 2),
2086                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2087                                     offsetof(struct __sk_buff, cb[1])),
2088                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2089                                     offsetof(struct __sk_buff, cb[1]) + 2),
2090                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2091                                     offsetof(struct __sk_buff, cb[2])),
2092                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2093                                     offsetof(struct __sk_buff, cb[2]) + 2),
2094                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2095                                     offsetof(struct __sk_buff, cb[3])),
2096                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2097                                     offsetof(struct __sk_buff, cb[3]) + 2),
2098                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2099                                     offsetof(struct __sk_buff, cb[4])),
2100                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2101                                     offsetof(struct __sk_buff, cb[4]) + 2),
2102                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2103                                     offsetof(struct __sk_buff, cb[0])),
2104                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2105                                     offsetof(struct __sk_buff, cb[0]) + 2),
2106                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2107                                     offsetof(struct __sk_buff, cb[1])),
2108                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2109                                     offsetof(struct __sk_buff, cb[1]) + 2),
2110                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2111                                     offsetof(struct __sk_buff, cb[2])),
2112                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2113                                     offsetof(struct __sk_buff, cb[2]) + 2),
2114                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2115                                     offsetof(struct __sk_buff, cb[3])),
2116                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2117                                     offsetof(struct __sk_buff, cb[3]) + 2),
2118                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2119                                     offsetof(struct __sk_buff, cb[4])),
2120                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2121                                     offsetof(struct __sk_buff, cb[4]) + 2),
2122                         BPF_EXIT_INSN(),
2123                 },
2124                 .result = ACCEPT,
2125         },
2126         {
2127                 "check cb access: half, unaligned",
2128                 .insns = {
2129                         BPF_MOV64_IMM(BPF_REG_0, 0),
2130                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2131                                     offsetof(struct __sk_buff, cb[0]) + 1),
2132                         BPF_EXIT_INSN(),
2133                 },
2134                 .errstr = "misaligned context access",
2135                 .result = REJECT,
2136                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2137         },
2138         {
2139                 "check __sk_buff->hash, offset 0, half store not permitted",
2140                 .insns = {
2141                         BPF_MOV64_IMM(BPF_REG_0, 0),
2142                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2143                                     offsetof(struct __sk_buff, hash)),
2144                         BPF_EXIT_INSN(),
2145                 },
2146                 .errstr = "invalid bpf_context access",
2147                 .result = REJECT,
2148         },
2149         {
2150                 "check __sk_buff->tc_index, offset 2, half store not permitted",
2151                 .insns = {
2152                         BPF_MOV64_IMM(BPF_REG_0, 0),
2153                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2154                                     offsetof(struct __sk_buff, tc_index) + 2),
2155                         BPF_EXIT_INSN(),
2156                 },
2157                 .errstr = "invalid bpf_context access",
2158                 .result = REJECT,
2159         },
2160         {
2161                 "check skb->hash half load permitted",
2162                 .insns = {
2163                         BPF_MOV64_IMM(BPF_REG_0, 0),
2164 #if __BYTE_ORDER == __LITTLE_ENDIAN
2165                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2166                                     offsetof(struct __sk_buff, hash)),
2167 #else
2168                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2169                                     offsetof(struct __sk_buff, hash) + 2),
2170 #endif
2171                         BPF_EXIT_INSN(),
2172                 },
2173                 .result = ACCEPT,
2174         },
2175         {
2176                 "check skb->hash half load not permitted",
2177                 .insns = {
2178                         BPF_MOV64_IMM(BPF_REG_0, 0),
2179 #if __BYTE_ORDER == __LITTLE_ENDIAN
2180                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2181                                     offsetof(struct __sk_buff, hash) + 2),
2182 #else
2183                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2184                                     offsetof(struct __sk_buff, hash)),
2185 #endif
2186                         BPF_EXIT_INSN(),
2187                 },
2188                 .errstr = "invalid bpf_context access",
2189                 .result = REJECT,
2190         },
2191         {
2192                 "check cb access: half, wrong type",
2193                 .insns = {
2194                         BPF_MOV64_IMM(BPF_REG_0, 0),
2195                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2196                                     offsetof(struct __sk_buff, cb[0])),
2197                         BPF_EXIT_INSN(),
2198                 },
2199                 .errstr = "invalid bpf_context access",
2200                 .result = REJECT,
2201                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2202         },
2203         {
2204                 "check cb access: word",
2205                 .insns = {
2206                         BPF_MOV64_IMM(BPF_REG_0, 0),
2207                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2208                                     offsetof(struct __sk_buff, cb[0])),
2209                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2210                                     offsetof(struct __sk_buff, cb[1])),
2211                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2212                                     offsetof(struct __sk_buff, cb[2])),
2213                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2214                                     offsetof(struct __sk_buff, cb[3])),
2215                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2216                                     offsetof(struct __sk_buff, cb[4])),
2217                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2218                                     offsetof(struct __sk_buff, cb[0])),
2219                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2220                                     offsetof(struct __sk_buff, cb[1])),
2221                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2222                                     offsetof(struct __sk_buff, cb[2])),
2223                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2224                                     offsetof(struct __sk_buff, cb[3])),
2225                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2226                                     offsetof(struct __sk_buff, cb[4])),
2227                         BPF_EXIT_INSN(),
2228                 },
2229                 .result = ACCEPT,
2230         },
2231         {
2232                 "check cb access: word, unaligned 1",
2233                 .insns = {
2234                         BPF_MOV64_IMM(BPF_REG_0, 0),
2235                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2236                                     offsetof(struct __sk_buff, cb[0]) + 2),
2237                         BPF_EXIT_INSN(),
2238                 },
2239                 .errstr = "misaligned context access",
2240                 .result = REJECT,
2241                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2242         },
2243         {
2244                 "check cb access: word, unaligned 2",
2245                 .insns = {
2246                         BPF_MOV64_IMM(BPF_REG_0, 0),
2247                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2248                                     offsetof(struct __sk_buff, cb[4]) + 1),
2249                         BPF_EXIT_INSN(),
2250                 },
2251                 .errstr = "misaligned context access",
2252                 .result = REJECT,
2253                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2254         },
2255         {
2256                 "check cb access: word, unaligned 3",
2257                 .insns = {
2258                         BPF_MOV64_IMM(BPF_REG_0, 0),
2259                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2260                                     offsetof(struct __sk_buff, cb[4]) + 2),
2261                         BPF_EXIT_INSN(),
2262                 },
2263                 .errstr = "misaligned context access",
2264                 .result = REJECT,
2265                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2266         },
2267         {
2268                 "check cb access: word, unaligned 4",
2269                 .insns = {
2270                         BPF_MOV64_IMM(BPF_REG_0, 0),
2271                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2272                                     offsetof(struct __sk_buff, cb[4]) + 3),
2273                         BPF_EXIT_INSN(),
2274                 },
2275                 .errstr = "misaligned context access",
2276                 .result = REJECT,
2277                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2278         },
2279         {
2280                 "check cb access: double",
2281                 .insns = {
2282                         BPF_MOV64_IMM(BPF_REG_0, 0),
2283                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2284                                     offsetof(struct __sk_buff, cb[0])),
2285                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2286                                     offsetof(struct __sk_buff, cb[2])),
2287                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2288                                     offsetof(struct __sk_buff, cb[0])),
2289                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2290                                     offsetof(struct __sk_buff, cb[2])),
2291                         BPF_EXIT_INSN(),
2292                 },
2293                 .result = ACCEPT,
2294         },
2295         {
2296                 "check cb access: double, unaligned 1",
2297                 .insns = {
2298                         BPF_MOV64_IMM(BPF_REG_0, 0),
2299                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2300                                     offsetof(struct __sk_buff, cb[1])),
2301                         BPF_EXIT_INSN(),
2302                 },
2303                 .errstr = "misaligned context access",
2304                 .result = REJECT,
2305                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2306         },
2307         {
2308                 "check cb access: double, unaligned 2",
2309                 .insns = {
2310                         BPF_MOV64_IMM(BPF_REG_0, 0),
2311                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2312                                     offsetof(struct __sk_buff, cb[3])),
2313                         BPF_EXIT_INSN(),
2314                 },
2315                 .errstr = "misaligned context access",
2316                 .result = REJECT,
2317                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2318         },
2319         {
2320                 "check cb access: double, oob 1",
2321                 .insns = {
2322                         BPF_MOV64_IMM(BPF_REG_0, 0),
2323                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2324                                     offsetof(struct __sk_buff, cb[4])),
2325                         BPF_EXIT_INSN(),
2326                 },
2327                 .errstr = "invalid bpf_context access",
2328                 .result = REJECT,
2329         },
2330         {
2331                 "check cb access: double, oob 2",
2332                 .insns = {
2333                         BPF_MOV64_IMM(BPF_REG_0, 0),
2334                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2335                                     offsetof(struct __sk_buff, cb[4])),
2336                         BPF_EXIT_INSN(),
2337                 },
2338                 .errstr = "invalid bpf_context access",
2339                 .result = REJECT,
2340         },
2341         {
2342                 "check __sk_buff->ifindex dw store not permitted",
2343                 .insns = {
2344                         BPF_MOV64_IMM(BPF_REG_0, 0),
2345                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2346                                     offsetof(struct __sk_buff, ifindex)),
2347                         BPF_EXIT_INSN(),
2348                 },
2349                 .errstr = "invalid bpf_context access",
2350                 .result = REJECT,
2351         },
2352         {
2353                 "check __sk_buff->ifindex dw load not permitted",
2354                 .insns = {
2355                         BPF_MOV64_IMM(BPF_REG_0, 0),
2356                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2357                                     offsetof(struct __sk_buff, ifindex)),
2358                         BPF_EXIT_INSN(),
2359                 },
2360                 .errstr = "invalid bpf_context access",
2361                 .result = REJECT,
2362         },
2363         {
2364                 "check cb access: double, wrong type",
2365                 .insns = {
2366                         BPF_MOV64_IMM(BPF_REG_0, 0),
2367                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2368                                     offsetof(struct __sk_buff, cb[0])),
2369                         BPF_EXIT_INSN(),
2370                 },
2371                 .errstr = "invalid bpf_context access",
2372                 .result = REJECT,
2373                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2374         },
2375         {
2376                 "check out of range skb->cb access",
2377                 .insns = {
2378                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2379                                     offsetof(struct __sk_buff, cb[0]) + 256),
2380                         BPF_EXIT_INSN(),
2381                 },
2382                 .errstr = "invalid bpf_context access",
2383                 .errstr_unpriv = "",
2384                 .result = REJECT,
2385                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2386         },
2387         {
2388                 "write skb fields from socket prog",
2389                 .insns = {
2390                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2391                                     offsetof(struct __sk_buff, cb[4])),
2392                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2393                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2394                                     offsetof(struct __sk_buff, mark)),
2395                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2396                                     offsetof(struct __sk_buff, tc_index)),
2397                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2398                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2399                                     offsetof(struct __sk_buff, cb[0])),
2400                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2401                                     offsetof(struct __sk_buff, cb[2])),
2402                         BPF_EXIT_INSN(),
2403                 },
2404                 .result = ACCEPT,
2405                 .errstr_unpriv = "R1 leaks addr",
2406                 .result_unpriv = REJECT,
2407         },
2408         {
2409                 "write skb fields from tc_cls_act prog",
2410                 .insns = {
2411                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2412                                     offsetof(struct __sk_buff, cb[0])),
2413                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2414                                     offsetof(struct __sk_buff, mark)),
2415                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2416                                     offsetof(struct __sk_buff, tc_index)),
2417                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2418                                     offsetof(struct __sk_buff, tc_index)),
2419                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2420                                     offsetof(struct __sk_buff, cb[3])),
2421                         BPF_EXIT_INSN(),
2422                 },
2423                 .errstr_unpriv = "",
2424                 .result_unpriv = REJECT,
2425                 .result = ACCEPT,
2426                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2427         },
2428         {
2429                 "PTR_TO_STACK store/load",
2430                 .insns = {
2431                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2433                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2434                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2435                         BPF_EXIT_INSN(),
2436                 },
2437                 .result = ACCEPT,
2438                 .retval = 0xfaceb00c,
2439         },
2440         {
2441                 "PTR_TO_STACK store/load - bad alignment on off",
2442                 .insns = {
2443                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2445                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2446                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2447                         BPF_EXIT_INSN(),
2448                 },
2449                 .result = REJECT,
2450                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2451         },
2452         {
2453                 "PTR_TO_STACK store/load - bad alignment on reg",
2454                 .insns = {
2455                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2457                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2458                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2459                         BPF_EXIT_INSN(),
2460                 },
2461                 .result = REJECT,
2462                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2463         },
2464         {
2465                 "PTR_TO_STACK store/load - out of bounds low",
2466                 .insns = {
2467                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2468                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2469                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2470                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2471                         BPF_EXIT_INSN(),
2472                 },
2473                 .result = REJECT,
2474                 .errstr = "invalid stack off=-79992 size=8",
2475         },
2476         {
2477                 "PTR_TO_STACK store/load - out of bounds high",
2478                 .insns = {
2479                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2480                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2481                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2482                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2483                         BPF_EXIT_INSN(),
2484                 },
2485                 .result = REJECT,
2486                 .errstr = "invalid stack off=0 size=8",
2487         },
2488         {
2489                 "unpriv: return pointer",
2490                 .insns = {
2491                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2492                         BPF_EXIT_INSN(),
2493                 },
2494                 .result = ACCEPT,
2495                 .result_unpriv = REJECT,
2496                 .errstr_unpriv = "R0 leaks addr",
2497                 .retval = POINTER_VALUE,
2498         },
2499         {
2500                 "unpriv: add const to pointer",
2501                 .insns = {
2502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2503                         BPF_MOV64_IMM(BPF_REG_0, 0),
2504                         BPF_EXIT_INSN(),
2505                 },
2506                 .result = ACCEPT,
2507         },
2508         {
2509                 "unpriv: add pointer to pointer",
2510                 .insns = {
2511                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2512                         BPF_MOV64_IMM(BPF_REG_0, 0),
2513                         BPF_EXIT_INSN(),
2514                 },
2515                 .result = REJECT,
2516                 .errstr = "R1 pointer += pointer",
2517         },
2518         {
2519                 "unpriv: neg pointer",
2520                 .insns = {
2521                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2522                         BPF_MOV64_IMM(BPF_REG_0, 0),
2523                         BPF_EXIT_INSN(),
2524                 },
2525                 .result = ACCEPT,
2526                 .result_unpriv = REJECT,
2527                 .errstr_unpriv = "R1 pointer arithmetic",
2528         },
2529         {
2530                 "unpriv: cmp pointer with const",
2531                 .insns = {
2532                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2533                         BPF_MOV64_IMM(BPF_REG_0, 0),
2534                         BPF_EXIT_INSN(),
2535                 },
2536                 .result = ACCEPT,
2537                 .result_unpriv = REJECT,
2538                 .errstr_unpriv = "R1 pointer comparison",
2539         },
2540         {
2541                 "unpriv: cmp pointer with pointer",
2542                 .insns = {
2543                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2544                         BPF_MOV64_IMM(BPF_REG_0, 0),
2545                         BPF_EXIT_INSN(),
2546                 },
2547                 .result = ACCEPT,
2548                 .result_unpriv = REJECT,
2549                 .errstr_unpriv = "R10 pointer comparison",
2550         },
2551         {
2552                 "unpriv: check that printk is disallowed",
2553                 .insns = {
2554                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2555                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2557                         BPF_MOV64_IMM(BPF_REG_2, 8),
2558                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2559                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2560                                      BPF_FUNC_trace_printk),
2561                         BPF_MOV64_IMM(BPF_REG_0, 0),
2562                         BPF_EXIT_INSN(),
2563                 },
2564                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2565                 .result_unpriv = REJECT,
2566                 .result = ACCEPT,
2567         },
2568         {
2569                 "unpriv: pass pointer to helper function",
2570                 .insns = {
2571                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2572                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2573                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2574                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2575                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2576                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2577                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2578                                      BPF_FUNC_map_update_elem),
2579                         BPF_MOV64_IMM(BPF_REG_0, 0),
2580                         BPF_EXIT_INSN(),
2581                 },
2582                 .fixup_map_hash_8b = { 3 },
2583                 .errstr_unpriv = "R4 leaks addr",
2584                 .result_unpriv = REJECT,
2585                 .result = ACCEPT,
2586         },
2587         {
2588                 "unpriv: indirectly pass pointer on stack to helper function",
2589                 .insns = {
2590                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2591                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2593                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2594                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2595                                      BPF_FUNC_map_lookup_elem),
2596                         BPF_MOV64_IMM(BPF_REG_0, 0),
2597                         BPF_EXIT_INSN(),
2598                 },
2599                 .fixup_map_hash_8b = { 3 },
2600                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2601                 .result = REJECT,
2602         },
2603         {
2604                 "unpriv: mangle pointer on stack 1",
2605                 .insns = {
2606                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2607                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2608                         BPF_MOV64_IMM(BPF_REG_0, 0),
2609                         BPF_EXIT_INSN(),
2610                 },
2611                 .errstr_unpriv = "attempt to corrupt spilled",
2612                 .result_unpriv = REJECT,
2613                 .result = ACCEPT,
2614         },
2615         {
2616                 "unpriv: mangle pointer on stack 2",
2617                 .insns = {
2618                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2619                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2620                         BPF_MOV64_IMM(BPF_REG_0, 0),
2621                         BPF_EXIT_INSN(),
2622                 },
2623                 .errstr_unpriv = "attempt to corrupt spilled",
2624                 .result_unpriv = REJECT,
2625                 .result = ACCEPT,
2626         },
2627         {
2628                 "unpriv: read pointer from stack in small chunks",
2629                 .insns = {
2630                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2631                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2632                         BPF_MOV64_IMM(BPF_REG_0, 0),
2633                         BPF_EXIT_INSN(),
2634                 },
2635                 .errstr = "invalid size",
2636                 .result = REJECT,
2637         },
2638         {
2639                 "unpriv: write pointer into ctx",
2640                 .insns = {
2641                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2642                         BPF_MOV64_IMM(BPF_REG_0, 0),
2643                         BPF_EXIT_INSN(),
2644                 },
2645                 .errstr_unpriv = "R1 leaks addr",
2646                 .result_unpriv = REJECT,
2647                 .errstr = "invalid bpf_context access",
2648                 .result = REJECT,
2649         },
2650         {
2651                 "unpriv: spill/fill of ctx",
2652                 .insns = {
2653                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2654                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2655                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2656                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2657                         BPF_MOV64_IMM(BPF_REG_0, 0),
2658                         BPF_EXIT_INSN(),
2659                 },
2660                 .result = ACCEPT,
2661         },
2662         {
2663                 "unpriv: spill/fill of ctx 2",
2664                 .insns = {
2665                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2666                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2667                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2668                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2670                                      BPF_FUNC_get_hash_recalc),
2671                         BPF_MOV64_IMM(BPF_REG_0, 0),
2672                         BPF_EXIT_INSN(),
2673                 },
2674                 .result = ACCEPT,
2675                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2676         },
2677         {
2678                 "unpriv: spill/fill of ctx 3",
2679                 .insns = {
2680                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2681                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2682                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2683                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2684                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2685                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2686                                      BPF_FUNC_get_hash_recalc),
2687                         BPF_EXIT_INSN(),
2688                 },
2689                 .result = REJECT,
2690                 .errstr = "R1 type=fp expected=ctx",
2691                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2692         },
2693         {
2694                 "unpriv: spill/fill of ctx 4",
2695                 .insns = {
2696                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2697                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2698                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2699                         BPF_MOV64_IMM(BPF_REG_0, 1),
2700                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2701                                      BPF_REG_0, -8, 0),
2702                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2703                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2704                                      BPF_FUNC_get_hash_recalc),
2705                         BPF_EXIT_INSN(),
2706                 },
2707                 .result = REJECT,
2708                 .errstr = "R1 type=inv expected=ctx",
2709                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2710         },
2711         {
2712                 "unpriv: spill/fill of different pointers stx",
2713                 .insns = {
2714                         BPF_MOV64_IMM(BPF_REG_3, 42),
2715                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2717                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2718                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2720                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2721                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2722                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2723                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2724                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2725                                     offsetof(struct __sk_buff, mark)),
2726                         BPF_MOV64_IMM(BPF_REG_0, 0),
2727                         BPF_EXIT_INSN(),
2728                 },
2729                 .result = REJECT,
2730                 .errstr = "same insn cannot be used with different pointers",
2731                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2732         },
2733         {
2734                 "unpriv: spill/fill of different pointers stx - ctx and sock",
2735                 .insns = {
2736                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2737                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2738                         BPF_SK_LOOKUP,
2739                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2740                         /* u64 foo; */
2741                         /* void *target = &foo; */
2742                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2743                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2744                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2745                         /* if (skb == NULL) *target = sock; */
2746                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2747                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2748                         /* else *target = skb; */
2749                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2750                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2751                         /* struct __sk_buff *skb = *target; */
2752                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2753                         /* skb->mark = 42; */
2754                         BPF_MOV64_IMM(BPF_REG_3, 42),
2755                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2756                                     offsetof(struct __sk_buff, mark)),
2757                         /* if (sk) bpf_sk_release(sk) */
2758                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2759                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2760                         BPF_MOV64_IMM(BPF_REG_0, 0),
2761                         BPF_EXIT_INSN(),
2762                 },
2763                 .result = REJECT,
2764                 .errstr = "type=ctx expected=sock",
2765                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2766         },
2767         {
2768                 "unpriv: spill/fill of different pointers stx - leak sock",
2769                 .insns = {
2770                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2771                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2772                         BPF_SK_LOOKUP,
2773                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2774                         /* u64 foo; */
2775                         /* void *target = &foo; */
2776                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2778                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2779                         /* if (skb == NULL) *target = sock; */
2780                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2781                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2782                         /* else *target = skb; */
2783                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2784                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2785                         /* struct __sk_buff *skb = *target; */
2786                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2787                         /* skb->mark = 42; */
2788                         BPF_MOV64_IMM(BPF_REG_3, 42),
2789                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2790                                     offsetof(struct __sk_buff, mark)),
2791                         BPF_EXIT_INSN(),
2792                 },
2793                 .result = REJECT,
2794                 //.errstr = "same insn cannot be used with different pointers",
2795                 .errstr = "Unreleased reference",
2796                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2797         },
2798         {
2799                 "unpriv: spill/fill of different pointers stx - sock and ctx (read)",
2800                 .insns = {
2801                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2802                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2803                         BPF_SK_LOOKUP,
2804                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2805                         /* u64 foo; */
2806                         /* void *target = &foo; */
2807                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2810                         /* if (skb) *target = skb */
2811                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2812                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2813                         /* else *target = sock */
2814                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2815                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2816                         /* struct bpf_sock *sk = *target; */
2817                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2818                         /* if (sk) u32 foo = sk->mark; bpf_sk_release(sk); */
2819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
2820                                 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2821                                             offsetof(struct bpf_sock, mark)),
2822                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2823                         BPF_MOV64_IMM(BPF_REG_0, 0),
2824                         BPF_EXIT_INSN(),
2825                 },
2826                 .result = REJECT,
2827                 .errstr = "same insn cannot be used with different pointers",
2828                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2829         },
2830         {
2831                 "unpriv: spill/fill of different pointers stx - sock and ctx (write)",
2832                 .insns = {
2833                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2834                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2835                         BPF_SK_LOOKUP,
2836                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2837                         /* u64 foo; */
2838                         /* void *target = &foo; */
2839                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2840                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2841                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2842                         /* if (skb) *target = skb */
2843                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2844                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2845                         /* else *target = sock */
2846                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2847                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2848                         /* struct bpf_sock *sk = *target; */
2849                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2850                         /* if (sk) sk->mark = 42; bpf_sk_release(sk); */
2851                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2852                                 BPF_MOV64_IMM(BPF_REG_3, 42),
2853                                 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2854                                             offsetof(struct bpf_sock, mark)),
2855                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2856                         BPF_MOV64_IMM(BPF_REG_0, 0),
2857                         BPF_EXIT_INSN(),
2858                 },
2859                 .result = REJECT,
2860                 //.errstr = "same insn cannot be used with different pointers",
2861                 .errstr = "cannot write into socket",
2862                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2863         },
2864         {
2865                 "unpriv: spill/fill of different pointers ldx",
2866                 .insns = {
2867                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2868                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2869                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2870                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2871                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2872                                       -(__s32)offsetof(struct bpf_perf_event_data,
2873                                                        sample_period) - 8),
2874                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2875                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2876                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2877                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2878                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2879                                     offsetof(struct bpf_perf_event_data,
2880                                              sample_period)),
2881                         BPF_MOV64_IMM(BPF_REG_0, 0),
2882                         BPF_EXIT_INSN(),
2883                 },
2884                 .result = REJECT,
2885                 .errstr = "same insn cannot be used with different pointers",
2886                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2887         },
2888         {
2889                 "unpriv: write pointer into map elem value",
2890                 .insns = {
2891                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2892                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2893                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2896                                      BPF_FUNC_map_lookup_elem),
2897                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2898                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2899                         BPF_EXIT_INSN(),
2900                 },
2901                 .fixup_map_hash_8b = { 3 },
2902                 .errstr_unpriv = "R0 leaks addr",
2903                 .result_unpriv = REJECT,
2904                 .result = ACCEPT,
2905         },
2906         {
2907                 "unpriv: partial copy of pointer",
2908                 .insns = {
2909                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2910                         BPF_MOV64_IMM(BPF_REG_0, 0),
2911                         BPF_EXIT_INSN(),
2912                 },
2913                 .errstr_unpriv = "R10 partial copy",
2914                 .result_unpriv = REJECT,
2915                 .result = ACCEPT,
2916         },
2917         {
2918                 "unpriv: pass pointer to tail_call",
2919                 .insns = {
2920                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2921                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2922                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2923                                      BPF_FUNC_tail_call),
2924                         BPF_MOV64_IMM(BPF_REG_0, 0),
2925                         BPF_EXIT_INSN(),
2926                 },
2927                 .fixup_prog1 = { 1 },
2928                 .errstr_unpriv = "R3 leaks addr into helper",
2929                 .result_unpriv = REJECT,
2930                 .result = ACCEPT,
2931         },
2932         {
2933                 "unpriv: cmp map pointer with zero",
2934                 .insns = {
2935                         BPF_MOV64_IMM(BPF_REG_1, 0),
2936                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2937                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2938                         BPF_MOV64_IMM(BPF_REG_0, 0),
2939                         BPF_EXIT_INSN(),
2940                 },
2941                 .fixup_map_hash_8b = { 1 },
2942                 .errstr_unpriv = "R1 pointer comparison",
2943                 .result_unpriv = REJECT,
2944                 .result = ACCEPT,
2945         },
2946         {
2947                 "unpriv: write into frame pointer",
2948                 .insns = {
2949                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2950                         BPF_MOV64_IMM(BPF_REG_0, 0),
2951                         BPF_EXIT_INSN(),
2952                 },
2953                 .errstr = "frame pointer is read only",
2954                 .result = REJECT,
2955         },
2956         {
2957                 "unpriv: spill/fill frame pointer",
2958                 .insns = {
2959                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2960                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2961                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2962                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2963                         BPF_MOV64_IMM(BPF_REG_0, 0),
2964                         BPF_EXIT_INSN(),
2965                 },
2966                 .errstr = "frame pointer is read only",
2967                 .result = REJECT,
2968         },
2969         {
2970                 "unpriv: cmp of frame pointer",
2971                 .insns = {
2972                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2973                         BPF_MOV64_IMM(BPF_REG_0, 0),
2974                         BPF_EXIT_INSN(),
2975                 },
2976                 .errstr_unpriv = "R10 pointer comparison",
2977                 .result_unpriv = REJECT,
2978                 .result = ACCEPT,
2979         },
2980         {
2981                 "unpriv: adding of fp",
2982                 .insns = {
2983                         BPF_MOV64_IMM(BPF_REG_0, 0),
2984                         BPF_MOV64_IMM(BPF_REG_1, 0),
2985                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2986                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2987                         BPF_EXIT_INSN(),
2988                 },
2989                 .result = ACCEPT,
2990         },
2991         {
2992                 "unpriv: cmp of stack pointer",
2993                 .insns = {
2994                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2996                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2997                         BPF_MOV64_IMM(BPF_REG_0, 0),
2998                         BPF_EXIT_INSN(),
2999                 },
3000                 .errstr_unpriv = "R2 pointer comparison",
3001                 .result_unpriv = REJECT,
3002                 .result = ACCEPT,
3003         },
3004         {
3005                 "runtime/jit: tail_call within bounds, prog once",
3006                 .insns = {
3007                         BPF_MOV64_IMM(BPF_REG_3, 0),
3008                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3009                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3010                                      BPF_FUNC_tail_call),
3011                         BPF_MOV64_IMM(BPF_REG_0, 1),
3012                         BPF_EXIT_INSN(),
3013                 },
3014                 .fixup_prog1 = { 1 },
3015                 .result = ACCEPT,
3016                 .retval = 42,
3017         },
3018         {
3019                 "runtime/jit: tail_call within bounds, prog loop",
3020                 .insns = {
3021                         BPF_MOV64_IMM(BPF_REG_3, 1),
3022                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3023                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3024                                      BPF_FUNC_tail_call),
3025                         BPF_MOV64_IMM(BPF_REG_0, 1),
3026                         BPF_EXIT_INSN(),
3027                 },
3028                 .fixup_prog1 = { 1 },
3029                 .result = ACCEPT,
3030                 .retval = 41,
3031         },
3032         {
3033                 "runtime/jit: tail_call within bounds, no prog",
3034                 .insns = {
3035                         BPF_MOV64_IMM(BPF_REG_3, 2),
3036                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3037                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3038                                      BPF_FUNC_tail_call),
3039                         BPF_MOV64_IMM(BPF_REG_0, 1),
3040                         BPF_EXIT_INSN(),
3041                 },
3042                 .fixup_prog1 = { 1 },
3043                 .result = ACCEPT,
3044                 .retval = 1,
3045         },
3046         {
3047                 "runtime/jit: tail_call out of bounds",
3048                 .insns = {
3049                         BPF_MOV64_IMM(BPF_REG_3, 256),
3050                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3051                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3052                                      BPF_FUNC_tail_call),
3053                         BPF_MOV64_IMM(BPF_REG_0, 2),
3054                         BPF_EXIT_INSN(),
3055                 },
3056                 .fixup_prog1 = { 1 },
3057                 .result = ACCEPT,
3058                 .retval = 2,
3059         },
3060         {
3061                 "runtime/jit: pass negative index to tail_call",
3062                 .insns = {
3063                         BPF_MOV64_IMM(BPF_REG_3, -1),
3064                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3065                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3066                                      BPF_FUNC_tail_call),
3067                         BPF_MOV64_IMM(BPF_REG_0, 2),
3068                         BPF_EXIT_INSN(),
3069                 },
3070                 .fixup_prog1 = { 1 },
3071                 .result = ACCEPT,
3072                 .retval = 2,
3073         },
3074         {
3075                 "runtime/jit: pass > 32bit index to tail_call",
3076                 .insns = {
3077                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
3078                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3079                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3080                                      BPF_FUNC_tail_call),
3081                         BPF_MOV64_IMM(BPF_REG_0, 2),
3082                         BPF_EXIT_INSN(),
3083                 },
3084                 .fixup_prog1 = { 2 },
3085                 .result = ACCEPT,
3086                 .retval = 42,
3087         },
3088         {
3089                 "stack pointer arithmetic",
3090                 .insns = {
3091                         BPF_MOV64_IMM(BPF_REG_1, 4),
3092                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
3093                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
3094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
3095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
3096                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3097                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
3098                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3099                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3100                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3101                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3102                         BPF_MOV64_IMM(BPF_REG_0, 0),
3103                         BPF_EXIT_INSN(),
3104                 },
3105                 .result = ACCEPT,
3106         },
3107         {
3108                 "raw_stack: no skb_load_bytes",
3109                 .insns = {
3110                         BPF_MOV64_IMM(BPF_REG_2, 4),
3111                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3112                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3113                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3114                         BPF_MOV64_IMM(BPF_REG_4, 8),
3115                         /* Call to skb_load_bytes() omitted. */
3116                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3117                         BPF_EXIT_INSN(),
3118                 },
3119                 .result = REJECT,
3120                 .errstr = "invalid read from stack off -8+0 size 8",
3121                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3122         },
3123         {
3124                 "raw_stack: skb_load_bytes, negative len",
3125                 .insns = {
3126                         BPF_MOV64_IMM(BPF_REG_2, 4),
3127                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3128                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3129                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3130                         BPF_MOV64_IMM(BPF_REG_4, -8),
3131                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3132                                      BPF_FUNC_skb_load_bytes),
3133                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3134                         BPF_EXIT_INSN(),
3135                 },
3136                 .result = REJECT,
3137                 .errstr = "R4 min value is negative",
3138                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3139         },
3140         {
3141                 "raw_stack: skb_load_bytes, negative len 2",
3142                 .insns = {
3143                         BPF_MOV64_IMM(BPF_REG_2, 4),
3144                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3145                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3146                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3147                         BPF_MOV64_IMM(BPF_REG_4, ~0),
3148                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3149                                      BPF_FUNC_skb_load_bytes),
3150                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3151                         BPF_EXIT_INSN(),
3152                 },
3153                 .result = REJECT,
3154                 .errstr = "R4 min value is negative",
3155                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3156         },
3157         {
3158                 "raw_stack: skb_load_bytes, zero len",
3159                 .insns = {
3160                         BPF_MOV64_IMM(BPF_REG_2, 4),
3161                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3162                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3163                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3164                         BPF_MOV64_IMM(BPF_REG_4, 0),
3165                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3166                                      BPF_FUNC_skb_load_bytes),
3167                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3168                         BPF_EXIT_INSN(),
3169                 },
3170                 .result = REJECT,
3171                 .errstr = "invalid stack type R3",
3172                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3173         },
3174         {
3175                 "raw_stack: skb_load_bytes, no init",
3176                 .insns = {
3177                         BPF_MOV64_IMM(BPF_REG_2, 4),
3178                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3180                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3181                         BPF_MOV64_IMM(BPF_REG_4, 8),
3182                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3183                                      BPF_FUNC_skb_load_bytes),
3184                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3185                         BPF_EXIT_INSN(),
3186                 },
3187                 .result = ACCEPT,
3188                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3189         },
3190         {
3191                 "raw_stack: skb_load_bytes, init",
3192                 .insns = {
3193                         BPF_MOV64_IMM(BPF_REG_2, 4),
3194                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3196                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
3197                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3198                         BPF_MOV64_IMM(BPF_REG_4, 8),
3199                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3200                                      BPF_FUNC_skb_load_bytes),
3201                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3202                         BPF_EXIT_INSN(),
3203                 },
3204                 .result = ACCEPT,
3205                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3206         },
3207         {
3208                 "raw_stack: skb_load_bytes, spilled regs around bounds",
3209                 .insns = {
3210                         BPF_MOV64_IMM(BPF_REG_2, 4),
3211                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3213                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3214                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3215                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3216                         BPF_MOV64_IMM(BPF_REG_4, 8),
3217                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3218                                      BPF_FUNC_skb_load_bytes),
3219                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3220                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3221                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3222                                     offsetof(struct __sk_buff, mark)),
3223                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3224                                     offsetof(struct __sk_buff, priority)),
3225                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3226                         BPF_EXIT_INSN(),
3227                 },
3228                 .result = ACCEPT,
3229                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3230         },
3231         {
3232                 "raw_stack: skb_load_bytes, spilled regs corruption",
3233                 .insns = {
3234                         BPF_MOV64_IMM(BPF_REG_2, 4),
3235                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3236                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3237                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3238                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3239                         BPF_MOV64_IMM(BPF_REG_4, 8),
3240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3241                                      BPF_FUNC_skb_load_bytes),
3242                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3243                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3244                                     offsetof(struct __sk_buff, mark)),
3245                         BPF_EXIT_INSN(),
3246                 },
3247                 .result = REJECT,
3248                 .errstr = "R0 invalid mem access 'inv'",
3249                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3250         },
3251         {
3252                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
3253                 .insns = {
3254                         BPF_MOV64_IMM(BPF_REG_2, 4),
3255                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3256                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3257                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3258                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3259                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3260                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3261                         BPF_MOV64_IMM(BPF_REG_4, 8),
3262                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3263                                      BPF_FUNC_skb_load_bytes),
3264                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3265                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3266                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3267                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3268                                     offsetof(struct __sk_buff, mark)),
3269                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3270                                     offsetof(struct __sk_buff, priority)),
3271                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3272                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
3273                                     offsetof(struct __sk_buff, pkt_type)),
3274                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3275                         BPF_EXIT_INSN(),
3276                 },
3277                 .result = REJECT,
3278                 .errstr = "R3 invalid mem access 'inv'",
3279                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3280         },
3281         {
3282                 "raw_stack: skb_load_bytes, spilled regs + data",
3283                 .insns = {
3284                         BPF_MOV64_IMM(BPF_REG_2, 4),
3285                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3287                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3288                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3289                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3290                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3291                         BPF_MOV64_IMM(BPF_REG_4, 8),
3292                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3293                                      BPF_FUNC_skb_load_bytes),
3294                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3295                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3296                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3297                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3298                                     offsetof(struct __sk_buff, mark)),
3299                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3300                                     offsetof(struct __sk_buff, priority)),
3301                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3302                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3303                         BPF_EXIT_INSN(),
3304                 },
3305                 .result = ACCEPT,
3306                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3307         },
3308         {
3309                 "raw_stack: skb_load_bytes, invalid access 1",
3310                 .insns = {
3311                         BPF_MOV64_IMM(BPF_REG_2, 4),
3312                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3313                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
3314                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3315                         BPF_MOV64_IMM(BPF_REG_4, 8),
3316                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3317                                      BPF_FUNC_skb_load_bytes),
3318                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3319                         BPF_EXIT_INSN(),
3320                 },
3321                 .result = REJECT,
3322                 .errstr = "invalid stack type R3 off=-513 access_size=8",
3323                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3324         },
3325         {
3326                 "raw_stack: skb_load_bytes, invalid access 2",
3327                 .insns = {
3328                         BPF_MOV64_IMM(BPF_REG_2, 4),
3329                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3331                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3332                         BPF_MOV64_IMM(BPF_REG_4, 8),
3333                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3334                                      BPF_FUNC_skb_load_bytes),
3335                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3336                         BPF_EXIT_INSN(),
3337                 },
3338                 .result = REJECT,
3339                 .errstr = "invalid stack type R3 off=-1 access_size=8",
3340                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3341         },
3342         {
3343                 "raw_stack: skb_load_bytes, invalid access 3",
3344                 .insns = {
3345                         BPF_MOV64_IMM(BPF_REG_2, 4),
3346                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
3348                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3349                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3350                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3351                                      BPF_FUNC_skb_load_bytes),
3352                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3353                         BPF_EXIT_INSN(),
3354                 },
3355                 .result = REJECT,
3356                 .errstr = "R4 min value is negative",
3357                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3358         },
3359         {
3360                 "raw_stack: skb_load_bytes, invalid access 4",
3361                 .insns = {
3362                         BPF_MOV64_IMM(BPF_REG_2, 4),
3363                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3365                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3366                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3367                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3368                                      BPF_FUNC_skb_load_bytes),
3369                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3370                         BPF_EXIT_INSN(),
3371                 },
3372                 .result = REJECT,
3373                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3374                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3375         },
3376         {
3377                 "raw_stack: skb_load_bytes, invalid access 5",
3378                 .insns = {
3379                         BPF_MOV64_IMM(BPF_REG_2, 4),
3380                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3382                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3383                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3384                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3385                                      BPF_FUNC_skb_load_bytes),
3386                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3387                         BPF_EXIT_INSN(),
3388                 },
3389                 .result = REJECT,
3390                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3391                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3392         },
3393         {
3394                 "raw_stack: skb_load_bytes, invalid access 6",
3395                 .insns = {
3396                         BPF_MOV64_IMM(BPF_REG_2, 4),
3397                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3398                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3399                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3400                         BPF_MOV64_IMM(BPF_REG_4, 0),
3401                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3402                                      BPF_FUNC_skb_load_bytes),
3403                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3404                         BPF_EXIT_INSN(),
3405                 },
3406                 .result = REJECT,
3407                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3408                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3409         },
3410         {
3411                 "raw_stack: skb_load_bytes, large access",
3412                 .insns = {
3413                         BPF_MOV64_IMM(BPF_REG_2, 4),
3414                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3416                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3417                         BPF_MOV64_IMM(BPF_REG_4, 512),
3418                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3419                                      BPF_FUNC_skb_load_bytes),
3420                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3421                         BPF_EXIT_INSN(),
3422                 },
3423                 .result = ACCEPT,
3424                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3425         },
3426         {
3427                 "context stores via ST",
3428                 .insns = {
3429                         BPF_MOV64_IMM(BPF_REG_0, 0),
3430                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3431                         BPF_EXIT_INSN(),
3432                 },
3433                 .errstr = "BPF_ST stores into R1 ctx is not allowed",
3434                 .result = REJECT,
3435                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3436         },
3437         {
3438                 "context stores via XADD",
3439                 .insns = {
3440                         BPF_MOV64_IMM(BPF_REG_0, 0),
3441                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3442                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3443                         BPF_EXIT_INSN(),
3444                 },
3445                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
3446                 .result = REJECT,
3447                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3448         },
3449         {
3450                 "direct packet access: test1",
3451                 .insns = {
3452                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3453                                     offsetof(struct __sk_buff, data)),
3454                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3455                                     offsetof(struct __sk_buff, data_end)),
3456                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3458                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3459                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3460                         BPF_MOV64_IMM(BPF_REG_0, 0),
3461                         BPF_EXIT_INSN(),
3462                 },
3463                 .result = ACCEPT,
3464                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3465         },
3466         {
3467                 "direct packet access: test2",
3468                 .insns = {
3469                         BPF_MOV64_IMM(BPF_REG_0, 1),
3470                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3471                                     offsetof(struct __sk_buff, data_end)),
3472                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3473                                     offsetof(struct __sk_buff, data)),
3474                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3475                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3476                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3477                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3478                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3479                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3480                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3481                                     offsetof(struct __sk_buff, data)),
3482                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3483                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3484                                     offsetof(struct __sk_buff, len)),
3485                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3486                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3487                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3488                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3489                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3490                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3491                                     offsetof(struct __sk_buff, data_end)),
3492                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3493                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3494                         BPF_MOV64_IMM(BPF_REG_0, 0),
3495                         BPF_EXIT_INSN(),
3496                 },
3497                 .result = ACCEPT,
3498                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3499         },
3500         {
3501                 "direct packet access: test3",
3502                 .insns = {
3503                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3504                                     offsetof(struct __sk_buff, data)),
3505                         BPF_MOV64_IMM(BPF_REG_0, 0),
3506                         BPF_EXIT_INSN(),
3507                 },
3508                 .errstr = "invalid bpf_context access off=76",
3509                 .result = REJECT,
3510                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3511         },
3512         {
3513                 "direct packet access: test4 (write)",
3514                 .insns = {
3515                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3516                                     offsetof(struct __sk_buff, data)),
3517                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3518                                     offsetof(struct __sk_buff, data_end)),
3519                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3521                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3522                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3523                         BPF_MOV64_IMM(BPF_REG_0, 0),
3524                         BPF_EXIT_INSN(),
3525                 },
3526                 .result = ACCEPT,
3527                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3528         },
3529         {
3530                 "direct packet access: test5 (pkt_end >= reg, good access)",
3531                 .insns = {
3532                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3533                                     offsetof(struct __sk_buff, data)),
3534                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3535                                     offsetof(struct __sk_buff, data_end)),
3536                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3537                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3538                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3539                         BPF_MOV64_IMM(BPF_REG_0, 1),
3540                         BPF_EXIT_INSN(),
3541                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3542                         BPF_MOV64_IMM(BPF_REG_0, 0),
3543                         BPF_EXIT_INSN(),
3544                 },
3545                 .result = ACCEPT,
3546                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3547         },
3548         {
3549                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3550                 .insns = {
3551                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3552                                     offsetof(struct __sk_buff, data)),
3553                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3554                                     offsetof(struct __sk_buff, data_end)),
3555                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3557                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3558                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3559                         BPF_MOV64_IMM(BPF_REG_0, 1),
3560                         BPF_EXIT_INSN(),
3561                         BPF_MOV64_IMM(BPF_REG_0, 0),
3562                         BPF_EXIT_INSN(),
3563                 },
3564                 .errstr = "invalid access to packet",
3565                 .result = REJECT,
3566                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3567         },
3568         {
3569                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3570                 .insns = {
3571                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3572                                     offsetof(struct __sk_buff, data)),
3573                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3574                                     offsetof(struct __sk_buff, data_end)),
3575                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3577                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3578                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3579                         BPF_MOV64_IMM(BPF_REG_0, 1),
3580                         BPF_EXIT_INSN(),
3581                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3582                         BPF_MOV64_IMM(BPF_REG_0, 0),
3583                         BPF_EXIT_INSN(),
3584                 },
3585                 .errstr = "invalid access to packet",
3586                 .result = REJECT,
3587                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3588         },
3589         {
3590                 "direct packet access: test8 (double test, variant 1)",
3591                 .insns = {
3592                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3593                                     offsetof(struct __sk_buff, data)),
3594                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3595                                     offsetof(struct __sk_buff, data_end)),
3596                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3598                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3599                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3600                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3601                         BPF_MOV64_IMM(BPF_REG_0, 1),
3602                         BPF_EXIT_INSN(),
3603                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3604                         BPF_MOV64_IMM(BPF_REG_0, 0),
3605                         BPF_EXIT_INSN(),
3606                 },
3607                 .result = ACCEPT,
3608                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3609         },
3610         {
3611                 "direct packet access: test9 (double test, variant 2)",
3612                 .insns = {
3613                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3614                                     offsetof(struct __sk_buff, data)),
3615                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3616                                     offsetof(struct __sk_buff, data_end)),
3617                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3618                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3619                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3620                         BPF_MOV64_IMM(BPF_REG_0, 1),
3621                         BPF_EXIT_INSN(),
3622                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3623                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3624                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3625                         BPF_MOV64_IMM(BPF_REG_0, 0),
3626                         BPF_EXIT_INSN(),
3627                 },
3628                 .result = ACCEPT,
3629                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3630         },
3631         {
3632                 "direct packet access: test10 (write invalid)",
3633                 .insns = {
3634                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3635                                     offsetof(struct __sk_buff, data)),
3636                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3637                                     offsetof(struct __sk_buff, data_end)),
3638                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3639                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3640                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3641                         BPF_MOV64_IMM(BPF_REG_0, 0),
3642                         BPF_EXIT_INSN(),
3643                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3644                         BPF_MOV64_IMM(BPF_REG_0, 0),
3645                         BPF_EXIT_INSN(),
3646                 },
3647                 .errstr = "invalid access to packet",
3648                 .result = REJECT,
3649                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3650         },
3651         {
3652                 "direct packet access: test11 (shift, good access)",
3653                 .insns = {
3654                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3655                                     offsetof(struct __sk_buff, data)),
3656                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3657                                     offsetof(struct __sk_buff, data_end)),
3658                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3660                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3661                         BPF_MOV64_IMM(BPF_REG_3, 144),
3662                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3664                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3665                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3666                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3667                         BPF_MOV64_IMM(BPF_REG_0, 1),
3668                         BPF_EXIT_INSN(),
3669                         BPF_MOV64_IMM(BPF_REG_0, 0),
3670                         BPF_EXIT_INSN(),
3671                 },
3672                 .result = ACCEPT,
3673                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3674                 .retval = 1,
3675         },
3676         {
3677                 "direct packet access: test12 (and, good access)",
3678                 .insns = {
3679                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3680                                     offsetof(struct __sk_buff, data)),
3681                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3682                                     offsetof(struct __sk_buff, data_end)),
3683                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3684                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3685                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3686                         BPF_MOV64_IMM(BPF_REG_3, 144),
3687                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3689                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3690                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3691                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3692                         BPF_MOV64_IMM(BPF_REG_0, 1),
3693                         BPF_EXIT_INSN(),
3694                         BPF_MOV64_IMM(BPF_REG_0, 0),
3695                         BPF_EXIT_INSN(),
3696                 },
3697                 .result = ACCEPT,
3698                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3699                 .retval = 1,
3700         },
3701         {
3702                 "direct packet access: test13 (branches, good access)",
3703                 .insns = {
3704                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3705                                     offsetof(struct __sk_buff, data)),
3706                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3707                                     offsetof(struct __sk_buff, data_end)),
3708                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3709                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3710                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3711                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3712                                     offsetof(struct __sk_buff, mark)),
3713                         BPF_MOV64_IMM(BPF_REG_4, 1),
3714                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3715                         BPF_MOV64_IMM(BPF_REG_3, 14),
3716                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3717                         BPF_MOV64_IMM(BPF_REG_3, 24),
3718                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3720                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3721                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3722                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3723                         BPF_MOV64_IMM(BPF_REG_0, 1),
3724                         BPF_EXIT_INSN(),
3725                         BPF_MOV64_IMM(BPF_REG_0, 0),
3726                         BPF_EXIT_INSN(),
3727                 },
3728                 .result = ACCEPT,
3729                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3730                 .retval = 1,
3731         },
3732         {
3733                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3734                 .insns = {
3735                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3736                                     offsetof(struct __sk_buff, data)),
3737                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3738                                     offsetof(struct __sk_buff, data_end)),
3739                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3740                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3741                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3742                         BPF_MOV64_IMM(BPF_REG_5, 12),
3743                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3744                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3745                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3746                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3747                         BPF_MOV64_IMM(BPF_REG_0, 1),
3748                         BPF_EXIT_INSN(),
3749                         BPF_MOV64_IMM(BPF_REG_0, 0),
3750                         BPF_EXIT_INSN(),
3751                 },
3752                 .result = ACCEPT,
3753                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3754                 .retval = 1,
3755         },
3756         {
3757                 "direct packet access: test15 (spill with xadd)",
3758                 .insns = {
3759                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3760                                     offsetof(struct __sk_buff, data)),
3761                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3762                                     offsetof(struct __sk_buff, data_end)),
3763                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3765                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3766                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3767                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3768                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3769                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3770                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3771                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3772                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3773                         BPF_MOV64_IMM(BPF_REG_0, 0),
3774                         BPF_EXIT_INSN(),
3775                 },
3776                 .errstr = "R2 invalid mem access 'inv'",
3777                 .result = REJECT,
3778                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3779         },
3780         {
3781                 "direct packet access: test16 (arith on data_end)",
3782                 .insns = {
3783                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3784                                     offsetof(struct __sk_buff, data)),
3785                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3786                                     offsetof(struct __sk_buff, data_end)),
3787                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3788                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3789                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3790                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3791                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3792                         BPF_MOV64_IMM(BPF_REG_0, 0),
3793                         BPF_EXIT_INSN(),
3794                 },
3795                 .errstr = "R3 pointer arithmetic on pkt_end",
3796                 .result = REJECT,
3797                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3798         },
3799         {
3800                 "direct packet access: test17 (pruning, alignment)",
3801                 .insns = {
3802                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3803                                     offsetof(struct __sk_buff, data)),
3804                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3805                                     offsetof(struct __sk_buff, data_end)),
3806                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3807                                     offsetof(struct __sk_buff, mark)),
3808                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3810                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3811                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3812                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3813                         BPF_MOV64_IMM(BPF_REG_0, 0),
3814                         BPF_EXIT_INSN(),
3815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3816                         BPF_JMP_A(-6),
3817                 },
3818                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3819                 .result = REJECT,
3820                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3821                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3822         },
3823         {
3824                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3825                 .insns = {
3826                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3827                                     offsetof(struct __sk_buff, data)),
3828                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3829                                     offsetof(struct __sk_buff, data_end)),
3830                         BPF_MOV64_IMM(BPF_REG_0, 8),
3831                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3832                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3833                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3834                         BPF_MOV64_IMM(BPF_REG_0, 0),
3835                         BPF_EXIT_INSN(),
3836                 },
3837                 .result = ACCEPT,
3838                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3839         },
3840         {
3841                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3842                 .insns = {
3843                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3844                                     offsetof(struct __sk_buff, data)),
3845                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3846                                     offsetof(struct __sk_buff, data_end)),
3847                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3849                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3850                         BPF_MOV64_IMM(BPF_REG_4, 4),
3851                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3852                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3853                         BPF_MOV64_IMM(BPF_REG_0, 0),
3854                         BPF_EXIT_INSN(),
3855                 },
3856                 .result = ACCEPT,
3857                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3858         },
3859         {
3860                 "direct packet access: test20 (x += pkt_ptr, 1)",
3861                 .insns = {
3862                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3863                                     offsetof(struct __sk_buff, data)),
3864                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3865                                     offsetof(struct __sk_buff, data_end)),
3866                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3867                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3868                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3869                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3870                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3871                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3872                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3873                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3874                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3875                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3876                         BPF_MOV64_IMM(BPF_REG_0, 0),
3877                         BPF_EXIT_INSN(),
3878                 },
3879                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3880                 .result = ACCEPT,
3881         },
3882         {
3883                 "direct packet access: test21 (x += pkt_ptr, 2)",
3884                 .insns = {
3885                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3886                                     offsetof(struct __sk_buff, data)),
3887                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3888                                     offsetof(struct __sk_buff, data_end)),
3889                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3891                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3892                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3893                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3894                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3895                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3896                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3897                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3898                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3899                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3900                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3901                         BPF_MOV64_IMM(BPF_REG_0, 0),
3902                         BPF_EXIT_INSN(),
3903                 },
3904                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3905                 .result = ACCEPT,
3906         },
3907         {
3908                 "direct packet access: test22 (x += pkt_ptr, 3)",
3909                 .insns = {
3910                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3911                                     offsetof(struct __sk_buff, data)),
3912                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3913                                     offsetof(struct __sk_buff, data_end)),
3914                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3915                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3916                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3917                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3918                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3919                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3920                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3921                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3922                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3923                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3924                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3925                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3926                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3927                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3928                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3929                         BPF_MOV64_IMM(BPF_REG_2, 1),
3930                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3931                         BPF_MOV64_IMM(BPF_REG_0, 0),
3932                         BPF_EXIT_INSN(),
3933                 },
3934                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3935                 .result = ACCEPT,
3936         },
3937         {
3938                 "direct packet access: test23 (x += pkt_ptr, 4)",
3939                 .insns = {
3940                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3941                                     offsetof(struct __sk_buff, data)),
3942                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3943                                     offsetof(struct __sk_buff, data_end)),
3944                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3945                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3946                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3947                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3948                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3949                         BPF_MOV64_IMM(BPF_REG_0, 31),
3950                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3951                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3952                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3954                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3955                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3956                         BPF_MOV64_IMM(BPF_REG_0, 0),
3957                         BPF_EXIT_INSN(),
3958                 },
3959                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3960                 .result = REJECT,
3961                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3962         },
3963         {
3964                 "direct packet access: test24 (x += pkt_ptr, 5)",
3965                 .insns = {
3966                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3967                                     offsetof(struct __sk_buff, data)),
3968                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3969                                     offsetof(struct __sk_buff, data_end)),
3970                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3971                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3972                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3973                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3974                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3975                         BPF_MOV64_IMM(BPF_REG_0, 64),
3976                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3977                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3978                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3979                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3980                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3981                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3982                         BPF_MOV64_IMM(BPF_REG_0, 0),
3983                         BPF_EXIT_INSN(),
3984                 },
3985                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3986                 .result = ACCEPT,
3987         },
3988         {
3989                 "direct packet access: test25 (marking on <, good access)",
3990                 .insns = {
3991                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3992                                     offsetof(struct __sk_buff, data)),
3993                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3994                                     offsetof(struct __sk_buff, data_end)),
3995                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3997                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3998                         BPF_MOV64_IMM(BPF_REG_0, 0),
3999                         BPF_EXIT_INSN(),
4000                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4001                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
4002                 },
4003                 .result = ACCEPT,
4004                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4005         },
4006         {
4007                 "direct packet access: test26 (marking on <, bad access)",
4008                 .insns = {
4009                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4010                                     offsetof(struct __sk_buff, data)),
4011                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4012                                     offsetof(struct __sk_buff, data_end)),
4013                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4015                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
4016                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4017                         BPF_MOV64_IMM(BPF_REG_0, 0),
4018                         BPF_EXIT_INSN(),
4019                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
4020                 },
4021                 .result = REJECT,
4022                 .errstr = "invalid access to packet",
4023                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4024         },
4025         {
4026                 "direct packet access: test27 (marking on <=, good access)",
4027                 .insns = {
4028                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4029                                     offsetof(struct __sk_buff, data)),
4030                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4031                                     offsetof(struct __sk_buff, data_end)),
4032                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4033                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4034                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
4035                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4036                         BPF_MOV64_IMM(BPF_REG_0, 1),
4037                         BPF_EXIT_INSN(),
4038                 },
4039                 .result = ACCEPT,
4040                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4041                 .retval = 1,
4042         },
4043         {
4044                 "direct packet access: test28 (marking on <=, bad access)",
4045                 .insns = {
4046                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4047                                     offsetof(struct __sk_buff, data)),
4048                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4049                                     offsetof(struct __sk_buff, data_end)),
4050                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4051                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4052                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
4053                         BPF_MOV64_IMM(BPF_REG_0, 1),
4054                         BPF_EXIT_INSN(),
4055                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4056                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
4057                 },
4058                 .result = REJECT,
4059                 .errstr = "invalid access to packet",
4060                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4061         },
4062         {
4063                 "helper access to packet: test1, valid packet_ptr range",
4064                 .insns = {
4065                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4066                                     offsetof(struct xdp_md, data)),
4067                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4068                                     offsetof(struct xdp_md, data_end)),
4069                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4071                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4072                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4073                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4074                         BPF_MOV64_IMM(BPF_REG_4, 0),
4075                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4076                                      BPF_FUNC_map_update_elem),
4077                         BPF_MOV64_IMM(BPF_REG_0, 0),
4078                         BPF_EXIT_INSN(),
4079                 },
4080                 .fixup_map_hash_8b = { 5 },
4081                 .result_unpriv = ACCEPT,
4082                 .result = ACCEPT,
4083                 .prog_type = BPF_PROG_TYPE_XDP,
4084         },
4085         {
4086                 "helper access to packet: test2, unchecked packet_ptr",
4087                 .insns = {
4088                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4089                                     offsetof(struct xdp_md, data)),
4090                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4091                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4092                                      BPF_FUNC_map_lookup_elem),
4093                         BPF_MOV64_IMM(BPF_REG_0, 0),
4094                         BPF_EXIT_INSN(),
4095                 },
4096                 .fixup_map_hash_8b = { 1 },
4097                 .result = REJECT,
4098                 .errstr = "invalid access to packet",
4099                 .prog_type = BPF_PROG_TYPE_XDP,
4100         },
4101         {
4102                 "helper access to packet: test3, variable add",
4103                 .insns = {
4104                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4105                                         offsetof(struct xdp_md, data)),
4106                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4107                                         offsetof(struct xdp_md, data_end)),
4108                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4109                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4110                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4111                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4112                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4113                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4114                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4115                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4116                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4117                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4118                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4119                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4120                                      BPF_FUNC_map_lookup_elem),
4121                         BPF_MOV64_IMM(BPF_REG_0, 0),
4122                         BPF_EXIT_INSN(),
4123                 },
4124                 .fixup_map_hash_8b = { 11 },
4125                 .result = ACCEPT,
4126                 .prog_type = BPF_PROG_TYPE_XDP,
4127         },
4128         {
4129                 "helper access to packet: test4, packet_ptr with bad range",
4130                 .insns = {
4131                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4132                                     offsetof(struct xdp_md, data)),
4133                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4134                                     offsetof(struct xdp_md, data_end)),
4135                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4136                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4137                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4138                         BPF_MOV64_IMM(BPF_REG_0, 0),
4139                         BPF_EXIT_INSN(),
4140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4142                                      BPF_FUNC_map_lookup_elem),
4143                         BPF_MOV64_IMM(BPF_REG_0, 0),
4144                         BPF_EXIT_INSN(),
4145                 },
4146                 .fixup_map_hash_8b = { 7 },
4147                 .result = REJECT,
4148                 .errstr = "invalid access to packet",
4149                 .prog_type = BPF_PROG_TYPE_XDP,
4150         },
4151         {
4152                 "helper access to packet: test5, packet_ptr with too short range",
4153                 .insns = {
4154                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4155                                     offsetof(struct xdp_md, data)),
4156                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4157                                     offsetof(struct xdp_md, data_end)),
4158                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4159                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4160                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4161                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4162                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4163                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4164                                      BPF_FUNC_map_lookup_elem),
4165                         BPF_MOV64_IMM(BPF_REG_0, 0),
4166                         BPF_EXIT_INSN(),
4167                 },
4168                 .fixup_map_hash_8b = { 6 },
4169                 .result = REJECT,
4170                 .errstr = "invalid access to packet",
4171                 .prog_type = BPF_PROG_TYPE_XDP,
4172         },
4173         {
4174                 "helper access to packet: test6, cls valid packet_ptr range",
4175                 .insns = {
4176                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4177                                     offsetof(struct __sk_buff, data)),
4178                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4179                                     offsetof(struct __sk_buff, data_end)),
4180                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4181                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4182                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4183                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4184                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4185                         BPF_MOV64_IMM(BPF_REG_4, 0),
4186                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4187                                      BPF_FUNC_map_update_elem),
4188                         BPF_MOV64_IMM(BPF_REG_0, 0),
4189                         BPF_EXIT_INSN(),
4190                 },
4191                 .fixup_map_hash_8b = { 5 },
4192                 .result = ACCEPT,
4193                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4194         },
4195         {
4196                 "helper access to packet: test7, cls unchecked packet_ptr",
4197                 .insns = {
4198                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4199                                     offsetof(struct __sk_buff, data)),
4200                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4201                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4202                                      BPF_FUNC_map_lookup_elem),
4203                         BPF_MOV64_IMM(BPF_REG_0, 0),
4204                         BPF_EXIT_INSN(),
4205                 },
4206                 .fixup_map_hash_8b = { 1 },
4207                 .result = REJECT,
4208                 .errstr = "invalid access to packet",
4209                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4210         },
4211         {
4212                 "helper access to packet: test8, cls variable add",
4213                 .insns = {
4214                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4215                                         offsetof(struct __sk_buff, data)),
4216                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4217                                         offsetof(struct __sk_buff, data_end)),
4218                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4219                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4220                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4221                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4222                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4223                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4224                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4225                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4226                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4227                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4228                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4229                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4230                                      BPF_FUNC_map_lookup_elem),
4231                         BPF_MOV64_IMM(BPF_REG_0, 0),
4232                         BPF_EXIT_INSN(),
4233                 },
4234                 .fixup_map_hash_8b = { 11 },
4235                 .result = ACCEPT,
4236                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4237         },
4238         {
4239                 "helper access to packet: test9, cls packet_ptr with bad range",
4240                 .insns = {
4241                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4242                                     offsetof(struct __sk_buff, data)),
4243                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4244                                     offsetof(struct __sk_buff, data_end)),
4245                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4247                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4248                         BPF_MOV64_IMM(BPF_REG_0, 0),
4249                         BPF_EXIT_INSN(),
4250                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4251                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4252                                      BPF_FUNC_map_lookup_elem),
4253                         BPF_MOV64_IMM(BPF_REG_0, 0),
4254                         BPF_EXIT_INSN(),
4255                 },
4256                 .fixup_map_hash_8b = { 7 },
4257                 .result = REJECT,
4258                 .errstr = "invalid access to packet",
4259                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4260         },
4261         {
4262                 "helper access to packet: test10, cls packet_ptr with too short range",
4263                 .insns = {
4264                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4265                                     offsetof(struct __sk_buff, data)),
4266                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4267                                     offsetof(struct __sk_buff, data_end)),
4268                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4269                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4271                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4272                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4273                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4274                                      BPF_FUNC_map_lookup_elem),
4275                         BPF_MOV64_IMM(BPF_REG_0, 0),
4276                         BPF_EXIT_INSN(),
4277                 },
4278                 .fixup_map_hash_8b = { 6 },
4279                 .result = REJECT,
4280                 .errstr = "invalid access to packet",
4281                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4282         },
4283         {
4284                 "helper access to packet: test11, cls unsuitable helper 1",
4285                 .insns = {
4286                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4287                                     offsetof(struct __sk_buff, data)),
4288                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4289                                     offsetof(struct __sk_buff, data_end)),
4290                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4291                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4292                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
4293                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
4294                         BPF_MOV64_IMM(BPF_REG_2, 0),
4295                         BPF_MOV64_IMM(BPF_REG_4, 42),
4296                         BPF_MOV64_IMM(BPF_REG_5, 0),
4297                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4298                                      BPF_FUNC_skb_store_bytes),
4299                         BPF_MOV64_IMM(BPF_REG_0, 0),
4300                         BPF_EXIT_INSN(),
4301                 },
4302                 .result = REJECT,
4303                 .errstr = "helper access to the packet",
4304                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4305         },
4306         {
4307                 "helper access to packet: test12, cls unsuitable helper 2",
4308                 .insns = {
4309                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4310                                     offsetof(struct __sk_buff, data)),
4311                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4312                                     offsetof(struct __sk_buff, data_end)),
4313                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4314                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
4315                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
4316                         BPF_MOV64_IMM(BPF_REG_2, 0),
4317                         BPF_MOV64_IMM(BPF_REG_4, 4),
4318                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4319                                      BPF_FUNC_skb_load_bytes),
4320                         BPF_MOV64_IMM(BPF_REG_0, 0),
4321                         BPF_EXIT_INSN(),
4322                 },
4323                 .result = REJECT,
4324                 .errstr = "helper access to the packet",
4325                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4326         },
4327         {
4328                 "helper access to packet: test13, cls helper ok",
4329                 .insns = {
4330                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4331                                     offsetof(struct __sk_buff, data)),
4332                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4333                                     offsetof(struct __sk_buff, data_end)),
4334                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4335                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4337                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4338                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4339                         BPF_MOV64_IMM(BPF_REG_2, 4),
4340                         BPF_MOV64_IMM(BPF_REG_3, 0),
4341                         BPF_MOV64_IMM(BPF_REG_4, 0),
4342                         BPF_MOV64_IMM(BPF_REG_5, 0),
4343                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4344                                      BPF_FUNC_csum_diff),
4345                         BPF_MOV64_IMM(BPF_REG_0, 0),
4346                         BPF_EXIT_INSN(),
4347                 },
4348                 .result = ACCEPT,
4349                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4350         },
4351         {
4352                 "helper access to packet: test14, cls helper ok sub",
4353                 .insns = {
4354                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4355                                     offsetof(struct __sk_buff, data)),
4356                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4357                                     offsetof(struct __sk_buff, data_end)),
4358                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4359                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4361                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4362                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4363                         BPF_MOV64_IMM(BPF_REG_2, 4),
4364                         BPF_MOV64_IMM(BPF_REG_3, 0),
4365                         BPF_MOV64_IMM(BPF_REG_4, 0),
4366                         BPF_MOV64_IMM(BPF_REG_5, 0),
4367                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4368                                      BPF_FUNC_csum_diff),
4369                         BPF_MOV64_IMM(BPF_REG_0, 0),
4370                         BPF_EXIT_INSN(),
4371                 },
4372                 .result = ACCEPT,
4373                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4374         },
4375         {
4376                 "helper access to packet: test15, cls helper fail sub",
4377                 .insns = {
4378                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4379                                     offsetof(struct __sk_buff, data)),
4380                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4381                                     offsetof(struct __sk_buff, data_end)),
4382                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4383                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4384                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4385                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4386                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4387                         BPF_MOV64_IMM(BPF_REG_2, 4),
4388                         BPF_MOV64_IMM(BPF_REG_3, 0),
4389                         BPF_MOV64_IMM(BPF_REG_4, 0),
4390                         BPF_MOV64_IMM(BPF_REG_5, 0),
4391                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4392                                      BPF_FUNC_csum_diff),
4393                         BPF_MOV64_IMM(BPF_REG_0, 0),
4394                         BPF_EXIT_INSN(),
4395                 },
4396                 .result = REJECT,
4397                 .errstr = "invalid access to packet",
4398                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4399         },
4400         {
4401                 "helper access to packet: test16, cls helper fail range 1",
4402                 .insns = {
4403                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4404                                     offsetof(struct __sk_buff, data)),
4405                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4406                                     offsetof(struct __sk_buff, data_end)),
4407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4408                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4409                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4410                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4411                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4412                         BPF_MOV64_IMM(BPF_REG_2, 8),
4413                         BPF_MOV64_IMM(BPF_REG_3, 0),
4414                         BPF_MOV64_IMM(BPF_REG_4, 0),
4415                         BPF_MOV64_IMM(BPF_REG_5, 0),
4416                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4417                                      BPF_FUNC_csum_diff),
4418                         BPF_MOV64_IMM(BPF_REG_0, 0),
4419                         BPF_EXIT_INSN(),
4420                 },
4421                 .result = REJECT,
4422                 .errstr = "invalid access to packet",
4423                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4424         },
4425         {
4426                 "helper access to packet: test17, cls helper fail range 2",
4427                 .insns = {
4428                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4429                                     offsetof(struct __sk_buff, data)),
4430                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4431                                     offsetof(struct __sk_buff, data_end)),
4432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4435                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4436                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4437                         BPF_MOV64_IMM(BPF_REG_2, -9),
4438                         BPF_MOV64_IMM(BPF_REG_3, 0),
4439                         BPF_MOV64_IMM(BPF_REG_4, 0),
4440                         BPF_MOV64_IMM(BPF_REG_5, 0),
4441                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4442                                      BPF_FUNC_csum_diff),
4443                         BPF_MOV64_IMM(BPF_REG_0, 0),
4444                         BPF_EXIT_INSN(),
4445                 },
4446                 .result = REJECT,
4447                 .errstr = "R2 min value is negative",
4448                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4449         },
4450         {
4451                 "helper access to packet: test18, cls helper fail range 3",
4452                 .insns = {
4453                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4454                                     offsetof(struct __sk_buff, data)),
4455                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4456                                     offsetof(struct __sk_buff, data_end)),
4457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4460                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4461                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4462                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4463                         BPF_MOV64_IMM(BPF_REG_3, 0),
4464                         BPF_MOV64_IMM(BPF_REG_4, 0),
4465                         BPF_MOV64_IMM(BPF_REG_5, 0),
4466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4467                                      BPF_FUNC_csum_diff),
4468                         BPF_MOV64_IMM(BPF_REG_0, 0),
4469                         BPF_EXIT_INSN(),
4470                 },
4471                 .result = REJECT,
4472                 .errstr = "R2 min value is negative",
4473                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4474         },
4475         {
4476                 "helper access to packet: test19, cls helper range zero",
4477                 .insns = {
4478                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4479                                     offsetof(struct __sk_buff, data)),
4480                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4481                                     offsetof(struct __sk_buff, data_end)),
4482                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4483                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4485                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4486                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4487                         BPF_MOV64_IMM(BPF_REG_2, 0),
4488                         BPF_MOV64_IMM(BPF_REG_3, 0),
4489                         BPF_MOV64_IMM(BPF_REG_4, 0),
4490                         BPF_MOV64_IMM(BPF_REG_5, 0),
4491                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4492                                      BPF_FUNC_csum_diff),
4493                         BPF_MOV64_IMM(BPF_REG_0, 0),
4494                         BPF_EXIT_INSN(),
4495                 },
4496                 .result = ACCEPT,
4497                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4498         },
4499         {
4500                 "helper access to packet: test20, pkt end as input",
4501                 .insns = {
4502                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4503                                     offsetof(struct __sk_buff, data)),
4504                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4505                                     offsetof(struct __sk_buff, data_end)),
4506                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4507                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4508                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4509                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4510                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4511                         BPF_MOV64_IMM(BPF_REG_2, 4),
4512                         BPF_MOV64_IMM(BPF_REG_3, 0),
4513                         BPF_MOV64_IMM(BPF_REG_4, 0),
4514                         BPF_MOV64_IMM(BPF_REG_5, 0),
4515                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4516                                      BPF_FUNC_csum_diff),
4517                         BPF_MOV64_IMM(BPF_REG_0, 0),
4518                         BPF_EXIT_INSN(),
4519                 },
4520                 .result = REJECT,
4521                 .errstr = "R1 type=pkt_end expected=fp",
4522                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4523         },
4524         {
4525                 "helper access to packet: test21, wrong reg",
4526                 .insns = {
4527                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4528                                     offsetof(struct __sk_buff, data)),
4529                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4530                                     offsetof(struct __sk_buff, data_end)),
4531                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4533                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4534                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4535                         BPF_MOV64_IMM(BPF_REG_2, 4),
4536                         BPF_MOV64_IMM(BPF_REG_3, 0),
4537                         BPF_MOV64_IMM(BPF_REG_4, 0),
4538                         BPF_MOV64_IMM(BPF_REG_5, 0),
4539                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4540                                      BPF_FUNC_csum_diff),
4541                         BPF_MOV64_IMM(BPF_REG_0, 0),
4542                         BPF_EXIT_INSN(),
4543                 },
4544                 .result = REJECT,
4545                 .errstr = "invalid access to packet",
4546                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4547         },
4548         {
4549                 "prevent map lookup in sockmap",
4550                 .insns = {
4551                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4552                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4554                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4555                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4556                                      BPF_FUNC_map_lookup_elem),
4557                         BPF_EXIT_INSN(),
4558                 },
4559                 .fixup_map_sockmap = { 3 },
4560                 .result = REJECT,
4561                 .errstr = "cannot pass map_type 15 into func bpf_map_lookup_elem",
4562                 .prog_type = BPF_PROG_TYPE_SOCK_OPS,
4563         },
4564         {
4565                 "prevent map lookup in sockhash",
4566                 .insns = {
4567                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4568                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4569                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4570                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4571                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4572                                      BPF_FUNC_map_lookup_elem),
4573                         BPF_EXIT_INSN(),
4574                 },
4575                 .fixup_map_sockhash = { 3 },
4576                 .result = REJECT,
4577                 .errstr = "cannot pass map_type 18 into func bpf_map_lookup_elem",
4578                 .prog_type = BPF_PROG_TYPE_SOCK_OPS,
4579         },
4580         {
4581                 "prevent map lookup in xskmap",
4582                 .insns = {
4583                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4584                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4586                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4587                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4588                                      BPF_FUNC_map_lookup_elem),
4589                         BPF_EXIT_INSN(),
4590                 },
4591                 .fixup_map_xskmap = { 3 },
4592                 .result = REJECT,
4593                 .errstr = "cannot pass map_type 17 into func bpf_map_lookup_elem",
4594                 .prog_type = BPF_PROG_TYPE_XDP,
4595         },
4596         {
4597                 "prevent map lookup in stack trace",
4598                 .insns = {
4599                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4600                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4601                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4602                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4603                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4604                                      BPF_FUNC_map_lookup_elem),
4605                         BPF_EXIT_INSN(),
4606                 },
4607                 .fixup_map_stacktrace = { 3 },
4608                 .result = REJECT,
4609                 .errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem",
4610                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
4611         },
4612         {
4613                 "prevent map lookup in prog array",
4614                 .insns = {
4615                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4616                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4617                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4618                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4619                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4620                                      BPF_FUNC_map_lookup_elem),
4621                         BPF_EXIT_INSN(),
4622                 },
4623                 .fixup_prog2 = { 3 },
4624                 .result = REJECT,
4625                 .errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem",
4626         },
4627         {
4628                 "valid map access into an array with a constant",
4629                 .insns = {
4630                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4631                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4632                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4633                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4634                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4635                                      BPF_FUNC_map_lookup_elem),
4636                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4637                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4638                                    offsetof(struct test_val, foo)),
4639                         BPF_EXIT_INSN(),
4640                 },
4641                 .fixup_map_hash_48b = { 3 },
4642                 .errstr_unpriv = "R0 leaks addr",
4643                 .result_unpriv = REJECT,
4644                 .result = ACCEPT,
4645         },
4646         {
4647                 "valid map access into an array with a register",
4648                 .insns = {
4649                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4650                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4652                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4653                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4654                                      BPF_FUNC_map_lookup_elem),
4655                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4656                         BPF_MOV64_IMM(BPF_REG_1, 4),
4657                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4658                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4659                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4660                                    offsetof(struct test_val, foo)),
4661                         BPF_EXIT_INSN(),
4662                 },
4663                 .fixup_map_hash_48b = { 3 },
4664                 .errstr_unpriv = "R0 leaks addr",
4665                 .result_unpriv = REJECT,
4666                 .result = ACCEPT,
4667                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4668         },
4669         {
4670                 "valid map access into an array with a variable",
4671                 .insns = {
4672                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4673                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4674                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4675                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4676                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4677                                      BPF_FUNC_map_lookup_elem),
4678                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4679                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4680                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4681                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4682                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4683                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4684                                    offsetof(struct test_val, foo)),
4685                         BPF_EXIT_INSN(),
4686                 },
4687                 .fixup_map_hash_48b = { 3 },
4688                 .errstr_unpriv = "R0 leaks addr",
4689                 .result_unpriv = REJECT,
4690                 .result = ACCEPT,
4691                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4692         },
4693         {
4694                 "valid map access into an array with a signed variable",
4695                 .insns = {
4696                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4697                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4698                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4699                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4700                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4701                                      BPF_FUNC_map_lookup_elem),
4702                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4703                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4704                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4705                         BPF_MOV32_IMM(BPF_REG_1, 0),
4706                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4707                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4708                         BPF_MOV32_IMM(BPF_REG_1, 0),
4709                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4710                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4711                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4712                                    offsetof(struct test_val, foo)),
4713                         BPF_EXIT_INSN(),
4714                 },
4715                 .fixup_map_hash_48b = { 3 },
4716                 .errstr_unpriv = "R0 leaks addr",
4717                 .result_unpriv = REJECT,
4718                 .result = ACCEPT,
4719                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4720         },
4721         {
4722                 "invalid map access into an array with a constant",
4723                 .insns = {
4724                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4725                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4726                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4727                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4728                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4729                                      BPF_FUNC_map_lookup_elem),
4730                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4731                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4732                                    offsetof(struct test_val, foo)),
4733                         BPF_EXIT_INSN(),
4734                 },
4735                 .fixup_map_hash_48b = { 3 },
4736                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4737                 .result = REJECT,
4738         },
4739         {
4740                 "invalid map access into an array with a register",
4741                 .insns = {
4742                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4743                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4744                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4745                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4746                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4747                                      BPF_FUNC_map_lookup_elem),
4748                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4749                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4750                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4751                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4752                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4753                                    offsetof(struct test_val, foo)),
4754                         BPF_EXIT_INSN(),
4755                 },
4756                 .fixup_map_hash_48b = { 3 },
4757                 .errstr = "R0 min value is outside of the array range",
4758                 .result = REJECT,
4759                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4760         },
4761         {
4762                 "invalid map access into an array with a variable",
4763                 .insns = {
4764                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4765                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4766                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4767                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4768                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4769                                      BPF_FUNC_map_lookup_elem),
4770                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4771                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4772                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4773                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4774                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4775                                    offsetof(struct test_val, foo)),
4776                         BPF_EXIT_INSN(),
4777                 },
4778                 .fixup_map_hash_48b = { 3 },
4779                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4780                 .result = REJECT,
4781                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4782         },
4783         {
4784                 "invalid map access into an array with no floor check",
4785                 .insns = {
4786                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4787                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4788                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4789                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4790                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4791                                      BPF_FUNC_map_lookup_elem),
4792                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4793                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4794                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4795                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4796                         BPF_MOV32_IMM(BPF_REG_1, 0),
4797                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4798                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4799                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4800                                    offsetof(struct test_val, foo)),
4801                         BPF_EXIT_INSN(),
4802                 },
4803                 .fixup_map_hash_48b = { 3 },
4804                 .errstr_unpriv = "R0 leaks addr",
4805                 .errstr = "R0 unbounded memory access",
4806                 .result_unpriv = REJECT,
4807                 .result = REJECT,
4808                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4809         },
4810         {
4811                 "invalid map access into an array with a invalid max check",
4812                 .insns = {
4813                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4814                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4816                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4817                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4818                                      BPF_FUNC_map_lookup_elem),
4819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4820                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4821                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4822                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4823                         BPF_MOV32_IMM(BPF_REG_1, 0),
4824                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4825                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4826                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4827                                    offsetof(struct test_val, foo)),
4828                         BPF_EXIT_INSN(),
4829                 },
4830                 .fixup_map_hash_48b = { 3 },
4831                 .errstr_unpriv = "R0 leaks addr",
4832                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4833                 .result_unpriv = REJECT,
4834                 .result = REJECT,
4835                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4836         },
4837         {
4838                 "invalid map access into an array with a invalid max check",
4839                 .insns = {
4840                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4841                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4843                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4844                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4845                                      BPF_FUNC_map_lookup_elem),
4846                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4847                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4848                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4849                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4850                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4851                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4852                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4853                                      BPF_FUNC_map_lookup_elem),
4854                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4855                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4856                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4857                                     offsetof(struct test_val, foo)),
4858                         BPF_EXIT_INSN(),
4859                 },
4860                 .fixup_map_hash_48b = { 3, 11 },
4861                 .errstr = "R0 pointer += pointer",
4862                 .result = REJECT,
4863                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4864         },
4865         {
4866                 "direct packet read test#1 for CGROUP_SKB",
4867                 .insns = {
4868                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4869                                     offsetof(struct __sk_buff, data)),
4870                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4871                                     offsetof(struct __sk_buff, data_end)),
4872                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4873                                     offsetof(struct __sk_buff, len)),
4874                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4875                                     offsetof(struct __sk_buff, pkt_type)),
4876                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4877                                     offsetof(struct __sk_buff, mark)),
4878                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4879                                     offsetof(struct __sk_buff, mark)),
4880                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4881                                     offsetof(struct __sk_buff, queue_mapping)),
4882                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4883                                     offsetof(struct __sk_buff, protocol)),
4884                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4885                                     offsetof(struct __sk_buff, vlan_present)),
4886                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4887                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4888                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4889                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4890                         BPF_MOV64_IMM(BPF_REG_0, 0),
4891                         BPF_EXIT_INSN(),
4892                 },
4893                 .result = ACCEPT,
4894                 .result_unpriv = REJECT,
4895                 .errstr_unpriv = "invalid bpf_context access off=76 size=4",
4896                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4897         },
4898         {
4899                 "direct packet read test#2 for CGROUP_SKB",
4900                 .insns = {
4901                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4902                                     offsetof(struct __sk_buff, vlan_tci)),
4903                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4904                                     offsetof(struct __sk_buff, vlan_proto)),
4905                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4906                                     offsetof(struct __sk_buff, priority)),
4907                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4908                                     offsetof(struct __sk_buff, priority)),
4909                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4910                                     offsetof(struct __sk_buff,
4911                                              ingress_ifindex)),
4912                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4913                                     offsetof(struct __sk_buff, tc_index)),
4914                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4915                                     offsetof(struct __sk_buff, hash)),
4916                         BPF_MOV64_IMM(BPF_REG_0, 0),
4917                         BPF_EXIT_INSN(),
4918                 },
4919                 .result = ACCEPT,
4920                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4921         },
4922         {
4923                 "direct packet read test#3 for CGROUP_SKB",
4924                 .insns = {
4925                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4926                                     offsetof(struct __sk_buff, cb[0])),
4927                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4928                                     offsetof(struct __sk_buff, cb[1])),
4929                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4930                                     offsetof(struct __sk_buff, cb[2])),
4931                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4932                                     offsetof(struct __sk_buff, cb[3])),
4933                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4934                                     offsetof(struct __sk_buff, cb[4])),
4935                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4936                                     offsetof(struct __sk_buff, napi_id)),
4937                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_4,
4938                                     offsetof(struct __sk_buff, cb[0])),
4939                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_5,
4940                                     offsetof(struct __sk_buff, cb[1])),
4941                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4942                                     offsetof(struct __sk_buff, cb[2])),
4943                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_7,
4944                                     offsetof(struct __sk_buff, cb[3])),
4945                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_8,
4946                                     offsetof(struct __sk_buff, cb[4])),
4947                         BPF_MOV64_IMM(BPF_REG_0, 0),
4948                         BPF_EXIT_INSN(),
4949                 },
4950                 .result = ACCEPT,
4951                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4952         },
4953         {
4954                 "direct packet read test#4 for CGROUP_SKB",
4955                 .insns = {
4956                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4957                                     offsetof(struct __sk_buff, family)),
4958                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4959                                     offsetof(struct __sk_buff, remote_ip4)),
4960                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4961                                     offsetof(struct __sk_buff, local_ip4)),
4962                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4963                                     offsetof(struct __sk_buff, remote_ip6[0])),
4964                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4965                                     offsetof(struct __sk_buff, remote_ip6[1])),
4966                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4967                                     offsetof(struct __sk_buff, remote_ip6[2])),
4968                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4969                                     offsetof(struct __sk_buff, remote_ip6[3])),
4970                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4971                                     offsetof(struct __sk_buff, local_ip6[0])),
4972                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4973                                     offsetof(struct __sk_buff, local_ip6[1])),
4974                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4975                                     offsetof(struct __sk_buff, local_ip6[2])),
4976                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4977                                     offsetof(struct __sk_buff, local_ip6[3])),
4978                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4979                                     offsetof(struct __sk_buff, remote_port)),
4980                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4981                                     offsetof(struct __sk_buff, local_port)),
4982                         BPF_MOV64_IMM(BPF_REG_0, 0),
4983                         BPF_EXIT_INSN(),
4984                 },
4985                 .result = ACCEPT,
4986                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4987         },
4988         {
4989                 "invalid access of tc_classid for CGROUP_SKB",
4990                 .insns = {
4991                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4992                                     offsetof(struct __sk_buff, tc_classid)),
4993                         BPF_MOV64_IMM(BPF_REG_0, 0),
4994                         BPF_EXIT_INSN(),
4995                 },
4996                 .result = REJECT,
4997                 .errstr = "invalid bpf_context access",
4998                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4999         },
5000         {
5001                 "invalid access of data_meta for CGROUP_SKB",
5002                 .insns = {
5003                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5004                                     offsetof(struct __sk_buff, data_meta)),
5005                         BPF_MOV64_IMM(BPF_REG_0, 0),
5006                         BPF_EXIT_INSN(),
5007                 },
5008                 .result = REJECT,
5009                 .errstr = "invalid bpf_context access",
5010                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5011         },
5012         {
5013                 "invalid access of flow_keys for CGROUP_SKB",
5014                 .insns = {
5015                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5016                                     offsetof(struct __sk_buff, flow_keys)),
5017                         BPF_MOV64_IMM(BPF_REG_0, 0),
5018                         BPF_EXIT_INSN(),
5019                 },
5020                 .result = REJECT,
5021                 .errstr = "invalid bpf_context access",
5022                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5023         },
5024         {
5025                 "invalid write access to napi_id for CGROUP_SKB",
5026                 .insns = {
5027                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
5028                                     offsetof(struct __sk_buff, napi_id)),
5029                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_9,
5030                                     offsetof(struct __sk_buff, napi_id)),
5031                         BPF_MOV64_IMM(BPF_REG_0, 0),
5032                         BPF_EXIT_INSN(),
5033                 },
5034                 .result = REJECT,
5035                 .errstr = "invalid bpf_context access",
5036                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5037         },
5038         {
5039                 "valid cgroup storage access",
5040                 .insns = {
5041                         BPF_MOV64_IMM(BPF_REG_2, 0),
5042                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5043                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5044                                      BPF_FUNC_get_local_storage),
5045                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5046                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5047                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5048                         BPF_EXIT_INSN(),
5049                 },
5050                 .fixup_cgroup_storage = { 1 },
5051                 .result = ACCEPT,
5052                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5053         },
5054         {
5055                 "invalid cgroup storage access 1",
5056                 .insns = {
5057                         BPF_MOV64_IMM(BPF_REG_2, 0),
5058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5060                                      BPF_FUNC_get_local_storage),
5061                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5062                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5063                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5064                         BPF_EXIT_INSN(),
5065                 },
5066                 .fixup_map_hash_8b = { 1 },
5067                 .result = REJECT,
5068                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
5069                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5070         },
5071         {
5072                 "invalid cgroup storage access 2",
5073                 .insns = {
5074                         BPF_MOV64_IMM(BPF_REG_2, 0),
5075                         BPF_LD_MAP_FD(BPF_REG_1, 1),
5076                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5077                                      BPF_FUNC_get_local_storage),
5078                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5079                         BPF_EXIT_INSN(),
5080                 },
5081                 .result = REJECT,
5082                 .errstr = "fd 1 is not pointing to valid bpf_map",
5083                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5084         },
5085         {
5086                 "invalid cgroup storage access 3",
5087                 .insns = {
5088                         BPF_MOV64_IMM(BPF_REG_2, 0),
5089                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5090                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5091                                      BPF_FUNC_get_local_storage),
5092                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
5093                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5094                         BPF_MOV64_IMM(BPF_REG_0, 0),
5095                         BPF_EXIT_INSN(),
5096                 },
5097                 .fixup_cgroup_storage = { 1 },
5098                 .result = REJECT,
5099                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
5100                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5101         },
5102         {
5103                 "invalid cgroup storage access 4",
5104                 .insns = {
5105                         BPF_MOV64_IMM(BPF_REG_2, 0),
5106                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5107                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5108                                      BPF_FUNC_get_local_storage),
5109                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
5110                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5112                         BPF_EXIT_INSN(),
5113                 },
5114                 .fixup_cgroup_storage = { 1 },
5115                 .result = REJECT,
5116                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
5117                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5118         },
5119         {
5120                 "invalid cgroup storage access 5",
5121                 .insns = {
5122                         BPF_MOV64_IMM(BPF_REG_2, 7),
5123                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5124                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5125                                      BPF_FUNC_get_local_storage),
5126                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5127                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5128                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5129                         BPF_EXIT_INSN(),
5130                 },
5131                 .fixup_cgroup_storage = { 1 },
5132                 .result = REJECT,
5133                 .errstr = "get_local_storage() doesn't support non-zero flags",
5134                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5135         },
5136         {
5137                 "invalid cgroup storage access 6",
5138                 .insns = {
5139                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
5140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5142                                      BPF_FUNC_get_local_storage),
5143                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5144                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5145                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5146                         BPF_EXIT_INSN(),
5147                 },
5148                 .fixup_cgroup_storage = { 1 },
5149                 .result = REJECT,
5150                 .errstr = "get_local_storage() doesn't support non-zero flags",
5151                 .errstr_unpriv = "R2 leaks addr into helper function",
5152                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5153         },
5154         {
5155                 "valid per-cpu cgroup storage access",
5156                 .insns = {
5157                         BPF_MOV64_IMM(BPF_REG_2, 0),
5158                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5159                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5160                                      BPF_FUNC_get_local_storage),
5161                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5162                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5163                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5164                         BPF_EXIT_INSN(),
5165                 },
5166                 .fixup_percpu_cgroup_storage = { 1 },
5167                 .result = ACCEPT,
5168                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5169         },
5170         {
5171                 "invalid per-cpu cgroup storage access 1",
5172                 .insns = {
5173                         BPF_MOV64_IMM(BPF_REG_2, 0),
5174                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5175                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5176                                      BPF_FUNC_get_local_storage),
5177                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5178                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5179                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5180                         BPF_EXIT_INSN(),
5181                 },
5182                 .fixup_map_hash_8b = { 1 },
5183                 .result = REJECT,
5184                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
5185                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5186         },
5187         {
5188                 "invalid per-cpu cgroup storage access 2",
5189                 .insns = {
5190                         BPF_MOV64_IMM(BPF_REG_2, 0),
5191                         BPF_LD_MAP_FD(BPF_REG_1, 1),
5192                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5193                                      BPF_FUNC_get_local_storage),
5194                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5195                         BPF_EXIT_INSN(),
5196                 },
5197                 .result = REJECT,
5198                 .errstr = "fd 1 is not pointing to valid bpf_map",
5199                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5200         },
5201         {
5202                 "invalid per-cpu cgroup storage access 3",
5203                 .insns = {
5204                         BPF_MOV64_IMM(BPF_REG_2, 0),
5205                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5206                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5207                                      BPF_FUNC_get_local_storage),
5208                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
5209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5210                         BPF_MOV64_IMM(BPF_REG_0, 0),
5211                         BPF_EXIT_INSN(),
5212                 },
5213                 .fixup_percpu_cgroup_storage = { 1 },
5214                 .result = REJECT,
5215                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
5216                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5217         },
5218         {
5219                 "invalid per-cpu cgroup storage access 4",
5220                 .insns = {
5221                         BPF_MOV64_IMM(BPF_REG_2, 0),
5222                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5223                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5224                                      BPF_FUNC_get_local_storage),
5225                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
5226                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5227                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5228                         BPF_EXIT_INSN(),
5229                 },
5230                 .fixup_cgroup_storage = { 1 },
5231                 .result = REJECT,
5232                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
5233                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5234         },
5235         {
5236                 "invalid per-cpu cgroup storage access 5",
5237                 .insns = {
5238                         BPF_MOV64_IMM(BPF_REG_2, 7),
5239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5241                                      BPF_FUNC_get_local_storage),
5242                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5243                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5244                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5245                         BPF_EXIT_INSN(),
5246                 },
5247                 .fixup_percpu_cgroup_storage = { 1 },
5248                 .result = REJECT,
5249                 .errstr = "get_local_storage() doesn't support non-zero flags",
5250                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5251         },
5252         {
5253                 "invalid per-cpu cgroup storage access 6",
5254                 .insns = {
5255                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
5256                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5257                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5258                                      BPF_FUNC_get_local_storage),
5259                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5260                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5261                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5262                         BPF_EXIT_INSN(),
5263                 },
5264                 .fixup_percpu_cgroup_storage = { 1 },
5265                 .result = REJECT,
5266                 .errstr = "get_local_storage() doesn't support non-zero flags",
5267                 .errstr_unpriv = "R2 leaks addr into helper function",
5268                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5269         },
5270         {
5271                 "multiple registers share map_lookup_elem result",
5272                 .insns = {
5273                         BPF_MOV64_IMM(BPF_REG_1, 10),
5274                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5275                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5277                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5279                                      BPF_FUNC_map_lookup_elem),
5280                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5281                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5282                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5283                         BPF_EXIT_INSN(),
5284                 },
5285                 .fixup_map_hash_8b = { 4 },
5286                 .result = ACCEPT,
5287                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5288         },
5289         {
5290                 "alu ops on ptr_to_map_value_or_null, 1",
5291                 .insns = {
5292                         BPF_MOV64_IMM(BPF_REG_1, 10),
5293                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5294                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5295                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5296                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5297                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5298                                      BPF_FUNC_map_lookup_elem),
5299                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
5301                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
5302                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5303                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5304                         BPF_EXIT_INSN(),
5305                 },
5306                 .fixup_map_hash_8b = { 4 },
5307                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5308                 .result = REJECT,
5309                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5310         },
5311         {
5312                 "alu ops on ptr_to_map_value_or_null, 2",
5313                 .insns = {
5314                         BPF_MOV64_IMM(BPF_REG_1, 10),
5315                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5316                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5318                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5319                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5320                                      BPF_FUNC_map_lookup_elem),
5321                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5322                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
5323                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5324                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5325                         BPF_EXIT_INSN(),
5326                 },
5327                 .fixup_map_hash_8b = { 4 },
5328                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5329                 .result = REJECT,
5330                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5331         },
5332         {
5333                 "alu ops on ptr_to_map_value_or_null, 3",
5334                 .insns = {
5335                         BPF_MOV64_IMM(BPF_REG_1, 10),
5336                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5337                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5338                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5339                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5340                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5341                                      BPF_FUNC_map_lookup_elem),
5342                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5343                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
5344                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5345                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5346                         BPF_EXIT_INSN(),
5347                 },
5348                 .fixup_map_hash_8b = { 4 },
5349                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5350                 .result = REJECT,
5351                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5352         },
5353         {
5354                 "invalid memory access with multiple map_lookup_elem calls",
5355                 .insns = {
5356                         BPF_MOV64_IMM(BPF_REG_1, 10),
5357                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5358                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5359                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5360                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5361                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
5362                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
5363                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5364                                      BPF_FUNC_map_lookup_elem),
5365                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5366                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
5367                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
5368                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5369                                      BPF_FUNC_map_lookup_elem),
5370                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5371                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5372                         BPF_EXIT_INSN(),
5373                 },
5374                 .fixup_map_hash_8b = { 4 },
5375                 .result = REJECT,
5376                 .errstr = "R4 !read_ok",
5377                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5378         },
5379         {
5380                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
5381                 .insns = {
5382                         BPF_MOV64_IMM(BPF_REG_1, 10),
5383                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5386                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5387                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
5388                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
5389                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5390                                      BPF_FUNC_map_lookup_elem),
5391                         BPF_MOV64_IMM(BPF_REG_2, 10),
5392                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
5393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
5394                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
5395                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5396                                      BPF_FUNC_map_lookup_elem),
5397                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5398                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5399                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5400                         BPF_EXIT_INSN(),
5401                 },
5402                 .fixup_map_hash_8b = { 4 },
5403                 .result = ACCEPT,
5404                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5405         },
5406         {
5407                 "invalid map access from else condition",
5408                 .insns = {
5409                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5410                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5412                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5413                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
5414                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5415                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5416                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
5417                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5418                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
5419                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5420                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
5421                         BPF_EXIT_INSN(),
5422                 },
5423                 .fixup_map_hash_48b = { 3 },
5424                 .errstr = "R0 unbounded memory access",
5425                 .result = REJECT,
5426                 .errstr_unpriv = "R0 leaks addr",
5427                 .result_unpriv = REJECT,
5428                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5429         },
5430         {
5431                 "constant register |= constant should keep constant type",
5432                 .insns = {
5433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5435                         BPF_MOV64_IMM(BPF_REG_2, 34),
5436                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
5437                         BPF_MOV64_IMM(BPF_REG_3, 0),
5438                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5439                         BPF_EXIT_INSN(),
5440                 },
5441                 .result = ACCEPT,
5442                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5443         },
5444         {
5445                 "constant register |= constant should not bypass stack boundary checks",
5446                 .insns = {
5447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5449                         BPF_MOV64_IMM(BPF_REG_2, 34),
5450                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
5451                         BPF_MOV64_IMM(BPF_REG_3, 0),
5452                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5453                         BPF_EXIT_INSN(),
5454                 },
5455                 .errstr = "invalid stack type R1 off=-48 access_size=58",
5456                 .result = REJECT,
5457                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5458         },
5459         {
5460                 "constant register |= constant register should keep constant type",
5461                 .insns = {
5462                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5463                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5464                         BPF_MOV64_IMM(BPF_REG_2, 34),
5465                         BPF_MOV64_IMM(BPF_REG_4, 13),
5466                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5467                         BPF_MOV64_IMM(BPF_REG_3, 0),
5468                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5469                         BPF_EXIT_INSN(),
5470                 },
5471                 .result = ACCEPT,
5472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5473         },
5474         {
5475                 "constant register |= constant register should not bypass stack boundary checks",
5476                 .insns = {
5477                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5479                         BPF_MOV64_IMM(BPF_REG_2, 34),
5480                         BPF_MOV64_IMM(BPF_REG_4, 24),
5481                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5482                         BPF_MOV64_IMM(BPF_REG_3, 0),
5483                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5484                         BPF_EXIT_INSN(),
5485                 },
5486                 .errstr = "invalid stack type R1 off=-48 access_size=58",
5487                 .result = REJECT,
5488                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5489         },
5490         {
5491                 "invalid direct packet write for LWT_IN",
5492                 .insns = {
5493                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5494                                     offsetof(struct __sk_buff, data)),
5495                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5496                                     offsetof(struct __sk_buff, data_end)),
5497                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5498                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5499                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5500                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5501                         BPF_MOV64_IMM(BPF_REG_0, 0),
5502                         BPF_EXIT_INSN(),
5503                 },
5504                 .errstr = "cannot write into packet",
5505                 .result = REJECT,
5506                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5507         },
5508         {
5509                 "invalid direct packet write for LWT_OUT",
5510                 .insns = {
5511                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5512                                     offsetof(struct __sk_buff, data)),
5513                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5514                                     offsetof(struct __sk_buff, data_end)),
5515                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5516                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5517                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5518                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5519                         BPF_MOV64_IMM(BPF_REG_0, 0),
5520                         BPF_EXIT_INSN(),
5521                 },
5522                 .errstr = "cannot write into packet",
5523                 .result = REJECT,
5524                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5525         },
5526         {
5527                 "direct packet write for LWT_XMIT",
5528                 .insns = {
5529                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5530                                     offsetof(struct __sk_buff, data)),
5531                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5532                                     offsetof(struct __sk_buff, data_end)),
5533                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5535                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5536                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5537                         BPF_MOV64_IMM(BPF_REG_0, 0),
5538                         BPF_EXIT_INSN(),
5539                 },
5540                 .result = ACCEPT,
5541                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5542         },
5543         {
5544                 "direct packet read for LWT_IN",
5545                 .insns = {
5546                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5547                                     offsetof(struct __sk_buff, data)),
5548                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5549                                     offsetof(struct __sk_buff, data_end)),
5550                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5551                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5552                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5553                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5554                         BPF_MOV64_IMM(BPF_REG_0, 0),
5555                         BPF_EXIT_INSN(),
5556                 },
5557                 .result = ACCEPT,
5558                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5559         },
5560         {
5561                 "direct packet read for LWT_OUT",
5562                 .insns = {
5563                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5564                                     offsetof(struct __sk_buff, data)),
5565                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5566                                     offsetof(struct __sk_buff, data_end)),
5567                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5569                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5570                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5571                         BPF_MOV64_IMM(BPF_REG_0, 0),
5572                         BPF_EXIT_INSN(),
5573                 },
5574                 .result = ACCEPT,
5575                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5576         },
5577         {
5578                 "direct packet read for LWT_XMIT",
5579                 .insns = {
5580                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5581                                     offsetof(struct __sk_buff, data)),
5582                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5583                                     offsetof(struct __sk_buff, data_end)),
5584                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5586                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5587                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5588                         BPF_MOV64_IMM(BPF_REG_0, 0),
5589                         BPF_EXIT_INSN(),
5590                 },
5591                 .result = ACCEPT,
5592                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5593         },
5594         {
5595                 "overlapping checks for direct packet access",
5596                 .insns = {
5597                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5598                                     offsetof(struct __sk_buff, data)),
5599                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5600                                     offsetof(struct __sk_buff, data_end)),
5601                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5603                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
5604                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
5605                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
5606                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
5607                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
5608                         BPF_MOV64_IMM(BPF_REG_0, 0),
5609                         BPF_EXIT_INSN(),
5610                 },
5611                 .result = ACCEPT,
5612                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5613         },
5614         {
5615                 "make headroom for LWT_XMIT",
5616                 .insns = {
5617                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5618                         BPF_MOV64_IMM(BPF_REG_2, 34),
5619                         BPF_MOV64_IMM(BPF_REG_3, 0),
5620                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5621                         /* split for s390 to succeed */
5622                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5623                         BPF_MOV64_IMM(BPF_REG_2, 42),
5624                         BPF_MOV64_IMM(BPF_REG_3, 0),
5625                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5626                         BPF_MOV64_IMM(BPF_REG_0, 0),
5627                         BPF_EXIT_INSN(),
5628                 },
5629                 .result = ACCEPT,
5630                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5631         },
5632         {
5633                 "invalid access of tc_classid for LWT_IN",
5634                 .insns = {
5635                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5636                                     offsetof(struct __sk_buff, tc_classid)),
5637                         BPF_EXIT_INSN(),
5638                 },
5639                 .result = REJECT,
5640                 .errstr = "invalid bpf_context access",
5641         },
5642         {
5643                 "invalid access of tc_classid for LWT_OUT",
5644                 .insns = {
5645                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5646                                     offsetof(struct __sk_buff, tc_classid)),
5647                         BPF_EXIT_INSN(),
5648                 },
5649                 .result = REJECT,
5650                 .errstr = "invalid bpf_context access",
5651         },
5652         {
5653                 "invalid access of tc_classid for LWT_XMIT",
5654                 .insns = {
5655                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5656                                     offsetof(struct __sk_buff, tc_classid)),
5657                         BPF_EXIT_INSN(),
5658                 },
5659                 .result = REJECT,
5660                 .errstr = "invalid bpf_context access",
5661         },
5662         {
5663                 "leak pointer into ctx 1",
5664                 .insns = {
5665                         BPF_MOV64_IMM(BPF_REG_0, 0),
5666                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5667                                     offsetof(struct __sk_buff, cb[0])),
5668                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5669                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
5670                                       offsetof(struct __sk_buff, cb[0])),
5671                         BPF_EXIT_INSN(),
5672                 },
5673                 .fixup_map_hash_8b = { 2 },
5674                 .errstr_unpriv = "R2 leaks addr into mem",
5675                 .result_unpriv = REJECT,
5676                 .result = REJECT,
5677                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
5678         },
5679         {
5680                 "leak pointer into ctx 2",
5681                 .insns = {
5682                         BPF_MOV64_IMM(BPF_REG_0, 0),
5683                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5684                                     offsetof(struct __sk_buff, cb[0])),
5685                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
5686                                       offsetof(struct __sk_buff, cb[0])),
5687                         BPF_EXIT_INSN(),
5688                 },
5689                 .errstr_unpriv = "R10 leaks addr into mem",
5690                 .result_unpriv = REJECT,
5691                 .result = REJECT,
5692                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
5693         },
5694         {
5695                 "leak pointer into ctx 3",
5696                 .insns = {
5697                         BPF_MOV64_IMM(BPF_REG_0, 0),
5698                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5699                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
5700                                       offsetof(struct __sk_buff, cb[0])),
5701                         BPF_EXIT_INSN(),
5702                 },
5703                 .fixup_map_hash_8b = { 1 },
5704                 .errstr_unpriv = "R2 leaks addr into ctx",
5705                 .result_unpriv = REJECT,
5706                 .result = ACCEPT,
5707         },
5708         {
5709                 "leak pointer into map val",
5710                 .insns = {
5711                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5712                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5713                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5714                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5715                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5716                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5717                                      BPF_FUNC_map_lookup_elem),
5718                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5719                         BPF_MOV64_IMM(BPF_REG_3, 0),
5720                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
5721                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
5722                         BPF_MOV64_IMM(BPF_REG_0, 0),
5723                         BPF_EXIT_INSN(),
5724                 },
5725                 .fixup_map_hash_8b = { 4 },
5726                 .errstr_unpriv = "R6 leaks addr into mem",
5727                 .result_unpriv = REJECT,
5728                 .result = ACCEPT,
5729         },
5730         {
5731                 "helper access to map: full range",
5732                 .insns = {
5733                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5734                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5735                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5736                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5737                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5738                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5739                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5740                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5741                         BPF_MOV64_IMM(BPF_REG_3, 0),
5742                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5743                         BPF_EXIT_INSN(),
5744                 },
5745                 .fixup_map_hash_48b = { 3 },
5746                 .result = ACCEPT,
5747                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5748         },
5749         {
5750                 "helper access to map: partial range",
5751                 .insns = {
5752                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5753                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5754                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5755                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5756                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5757                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5758                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5759                         BPF_MOV64_IMM(BPF_REG_2, 8),
5760                         BPF_MOV64_IMM(BPF_REG_3, 0),
5761                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5762                         BPF_EXIT_INSN(),
5763                 },
5764                 .fixup_map_hash_48b = { 3 },
5765                 .result = ACCEPT,
5766                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5767         },
5768         {
5769                 "helper access to map: empty range",
5770                 .insns = {
5771                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5772                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5773                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5774                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5775                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5776                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5777                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5778                         BPF_MOV64_IMM(BPF_REG_2, 0),
5779                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5780                         BPF_EXIT_INSN(),
5781                 },
5782                 .fixup_map_hash_48b = { 3 },
5783                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
5784                 .result = REJECT,
5785                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5786         },
5787         {
5788                 "helper access to map: out-of-bound range",
5789                 .insns = {
5790                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5792                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5793                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5794                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5796                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5797                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
5798                         BPF_MOV64_IMM(BPF_REG_3, 0),
5799                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5800                         BPF_EXIT_INSN(),
5801                 },
5802                 .fixup_map_hash_48b = { 3 },
5803                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
5804                 .result = REJECT,
5805                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5806         },
5807         {
5808                 "helper access to map: negative range",
5809                 .insns = {
5810                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5812                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5813                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5814                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5815                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5816                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5817                         BPF_MOV64_IMM(BPF_REG_2, -8),
5818                         BPF_MOV64_IMM(BPF_REG_3, 0),
5819                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5820                         BPF_EXIT_INSN(),
5821                 },
5822                 .fixup_map_hash_48b = { 3 },
5823                 .errstr = "R2 min value is negative",
5824                 .result = REJECT,
5825                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5826         },
5827         {
5828                 "helper access to adjusted map (via const imm): full range",
5829                 .insns = {
5830                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5832                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5833                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5834                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5835                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5836                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5838                                 offsetof(struct test_val, foo)),
5839                         BPF_MOV64_IMM(BPF_REG_2,
5840                                 sizeof(struct test_val) -
5841                                 offsetof(struct test_val, foo)),
5842                         BPF_MOV64_IMM(BPF_REG_3, 0),
5843                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5844                         BPF_EXIT_INSN(),
5845                 },
5846                 .fixup_map_hash_48b = { 3 },
5847                 .result = ACCEPT,
5848                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5849         },
5850         {
5851                 "helper access to adjusted map (via const imm): partial range",
5852                 .insns = {
5853                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5855                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5856                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5857                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5858                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5859                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5860                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5861                                 offsetof(struct test_val, foo)),
5862                         BPF_MOV64_IMM(BPF_REG_2, 8),
5863                         BPF_MOV64_IMM(BPF_REG_3, 0),
5864                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5865                         BPF_EXIT_INSN(),
5866                 },
5867                 .fixup_map_hash_48b = { 3 },
5868                 .result = ACCEPT,
5869                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5870         },
5871         {
5872                 "helper access to adjusted map (via const imm): empty range",
5873                 .insns = {
5874                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5876                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5877                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5878                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5879                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5880                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5881                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5882                                 offsetof(struct test_val, foo)),
5883                         BPF_MOV64_IMM(BPF_REG_2, 0),
5884                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5885                         BPF_EXIT_INSN(),
5886                 },
5887                 .fixup_map_hash_48b = { 3 },
5888                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5889                 .result = REJECT,
5890                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5891         },
5892         {
5893                 "helper access to adjusted map (via const imm): out-of-bound range",
5894                 .insns = {
5895                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5896                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5897                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5898                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5899                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5900                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5903                                 offsetof(struct test_val, foo)),
5904                         BPF_MOV64_IMM(BPF_REG_2,
5905                                 sizeof(struct test_val) -
5906                                 offsetof(struct test_val, foo) + 8),
5907                         BPF_MOV64_IMM(BPF_REG_3, 0),
5908                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5909                         BPF_EXIT_INSN(),
5910                 },
5911                 .fixup_map_hash_48b = { 3 },
5912                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5913                 .result = REJECT,
5914                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5915         },
5916         {
5917                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5918                 .insns = {
5919                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5920                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5921                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5922                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5923                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5924                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5925                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5926                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5927                                 offsetof(struct test_val, foo)),
5928                         BPF_MOV64_IMM(BPF_REG_2, -8),
5929                         BPF_MOV64_IMM(BPF_REG_3, 0),
5930                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5931                         BPF_EXIT_INSN(),
5932                 },
5933                 .fixup_map_hash_48b = { 3 },
5934                 .errstr = "R2 min value is negative",
5935                 .result = REJECT,
5936                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5937         },
5938         {
5939                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5940                 .insns = {
5941                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5942                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5943                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5944                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5945                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5946                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5947                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5948                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5949                                 offsetof(struct test_val, foo)),
5950                         BPF_MOV64_IMM(BPF_REG_2, -1),
5951                         BPF_MOV64_IMM(BPF_REG_3, 0),
5952                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5953                         BPF_EXIT_INSN(),
5954                 },
5955                 .fixup_map_hash_48b = { 3 },
5956                 .errstr = "R2 min value is negative",
5957                 .result = REJECT,
5958                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5959         },
5960         {
5961                 "helper access to adjusted map (via const reg): full range",
5962                 .insns = {
5963                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5964                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5965                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5966                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5967                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5968                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5969                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5970                         BPF_MOV64_IMM(BPF_REG_3,
5971                                 offsetof(struct test_val, foo)),
5972                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5973                         BPF_MOV64_IMM(BPF_REG_2,
5974                                 sizeof(struct test_val) -
5975                                 offsetof(struct test_val, foo)),
5976                         BPF_MOV64_IMM(BPF_REG_3, 0),
5977                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5978                         BPF_EXIT_INSN(),
5979                 },
5980                 .fixup_map_hash_48b = { 3 },
5981                 .result = ACCEPT,
5982                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5983         },
5984         {
5985                 "helper access to adjusted map (via const reg): partial range",
5986                 .insns = {
5987                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5989                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5990                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5991                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5992                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5993                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5994                         BPF_MOV64_IMM(BPF_REG_3,
5995                                 offsetof(struct test_val, foo)),
5996                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5997                         BPF_MOV64_IMM(BPF_REG_2, 8),
5998                         BPF_MOV64_IMM(BPF_REG_3, 0),
5999                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6000                         BPF_EXIT_INSN(),
6001                 },
6002                 .fixup_map_hash_48b = { 3 },
6003                 .result = ACCEPT,
6004                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6005         },
6006         {
6007                 "helper access to adjusted map (via const reg): empty range",
6008                 .insns = {
6009                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6010                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6011                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6012                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6013                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6014                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6015                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6016                         BPF_MOV64_IMM(BPF_REG_3, 0),
6017                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6018                         BPF_MOV64_IMM(BPF_REG_2, 0),
6019                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
6020                         BPF_EXIT_INSN(),
6021                 },
6022                 .fixup_map_hash_48b = { 3 },
6023                 .errstr = "R1 min value is outside of the array range",
6024                 .result = REJECT,
6025                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6026         },
6027         {
6028                 "helper access to adjusted map (via const reg): out-of-bound range",
6029                 .insns = {
6030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6032                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6033                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6034                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6036                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6037                         BPF_MOV64_IMM(BPF_REG_3,
6038                                 offsetof(struct test_val, foo)),
6039                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6040                         BPF_MOV64_IMM(BPF_REG_2,
6041                                 sizeof(struct test_val) -
6042                                 offsetof(struct test_val, foo) + 8),
6043                         BPF_MOV64_IMM(BPF_REG_3, 0),
6044                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6045                         BPF_EXIT_INSN(),
6046                 },
6047                 .fixup_map_hash_48b = { 3 },
6048                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
6049                 .result = REJECT,
6050                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6051         },
6052         {
6053                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
6054                 .insns = {
6055                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6057                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6059                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6060                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6061                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6062                         BPF_MOV64_IMM(BPF_REG_3,
6063                                 offsetof(struct test_val, foo)),
6064                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6065                         BPF_MOV64_IMM(BPF_REG_2, -8),
6066                         BPF_MOV64_IMM(BPF_REG_3, 0),
6067                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6068                         BPF_EXIT_INSN(),
6069                 },
6070                 .fixup_map_hash_48b = { 3 },
6071                 .errstr = "R2 min value is negative",
6072                 .result = REJECT,
6073                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6074         },
6075         {
6076                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
6077                 .insns = {
6078                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6080                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6081                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6082                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6083                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6084                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6085                         BPF_MOV64_IMM(BPF_REG_3,
6086                                 offsetof(struct test_val, foo)),
6087                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6088                         BPF_MOV64_IMM(BPF_REG_2, -1),
6089                         BPF_MOV64_IMM(BPF_REG_3, 0),
6090                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6091                         BPF_EXIT_INSN(),
6092                 },
6093                 .fixup_map_hash_48b = { 3 },
6094                 .errstr = "R2 min value is negative",
6095                 .result = REJECT,
6096                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6097         },
6098         {
6099                 "helper access to adjusted map (via variable): full range",
6100                 .insns = {
6101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6103                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6104                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6105                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6106                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6107                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6109                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6110                                 offsetof(struct test_val, foo), 4),
6111                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6112                         BPF_MOV64_IMM(BPF_REG_2,
6113                                 sizeof(struct test_val) -
6114                                 offsetof(struct test_val, foo)),
6115                         BPF_MOV64_IMM(BPF_REG_3, 0),
6116                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6117                         BPF_EXIT_INSN(),
6118                 },
6119                 .fixup_map_hash_48b = { 3 },
6120                 .result = ACCEPT,
6121                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6122         },
6123         {
6124                 "helper access to adjusted map (via variable): partial range",
6125                 .insns = {
6126                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6127                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6128                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6129                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6130                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6131                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6132                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6133                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6134                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6135                                 offsetof(struct test_val, foo), 4),
6136                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6137                         BPF_MOV64_IMM(BPF_REG_2, 8),
6138                         BPF_MOV64_IMM(BPF_REG_3, 0),
6139                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6140                         BPF_EXIT_INSN(),
6141                 },
6142                 .fixup_map_hash_48b = { 3 },
6143                 .result = ACCEPT,
6144                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6145         },
6146         {
6147                 "helper access to adjusted map (via variable): empty range",
6148                 .insns = {
6149                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6150                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6151                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6152                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6153                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6154                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6155                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6156                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6157                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6158                                 offsetof(struct test_val, foo), 3),
6159                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6160                         BPF_MOV64_IMM(BPF_REG_2, 0),
6161                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
6162                         BPF_EXIT_INSN(),
6163                 },
6164                 .fixup_map_hash_48b = { 3 },
6165                 .errstr = "R1 min value is outside of the array range",
6166                 .result = REJECT,
6167                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6168         },
6169         {
6170                 "helper access to adjusted map (via variable): no max check",
6171                 .insns = {
6172                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6173                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6175                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6176                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6177                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6178                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6179                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6180                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6181                         BPF_MOV64_IMM(BPF_REG_2, 1),
6182                         BPF_MOV64_IMM(BPF_REG_3, 0),
6183                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6184                         BPF_EXIT_INSN(),
6185                 },
6186                 .fixup_map_hash_48b = { 3 },
6187                 .errstr = "R1 unbounded memory access",
6188                 .result = REJECT,
6189                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6190         },
6191         {
6192                 "helper access to adjusted map (via variable): wrong max check",
6193                 .insns = {
6194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6196                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6197                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6198                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6200                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6201                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6202                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6203                                 offsetof(struct test_val, foo), 4),
6204                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6205                         BPF_MOV64_IMM(BPF_REG_2,
6206                                 sizeof(struct test_val) -
6207                                 offsetof(struct test_val, foo) + 1),
6208                         BPF_MOV64_IMM(BPF_REG_3, 0),
6209                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6210                         BPF_EXIT_INSN(),
6211                 },
6212                 .fixup_map_hash_48b = { 3 },
6213                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
6214                 .result = REJECT,
6215                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6216         },
6217         {
6218                 "helper access to map: bounds check using <, good access",
6219                 .insns = {
6220                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6221                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6222                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6223                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6224                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6225                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6226                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6227                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6228                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
6229                         BPF_MOV64_IMM(BPF_REG_0, 0),
6230                         BPF_EXIT_INSN(),
6231                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6232                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6233                         BPF_MOV64_IMM(BPF_REG_0, 0),
6234                         BPF_EXIT_INSN(),
6235                 },
6236                 .fixup_map_hash_48b = { 3 },
6237                 .result = ACCEPT,
6238                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6239         },
6240         {
6241                 "helper access to map: bounds check using <, bad access",
6242                 .insns = {
6243                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6245                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6246                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6247                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6249                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6250                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6251                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
6252                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6253                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6254                         BPF_MOV64_IMM(BPF_REG_0, 0),
6255                         BPF_EXIT_INSN(),
6256                         BPF_MOV64_IMM(BPF_REG_0, 0),
6257                         BPF_EXIT_INSN(),
6258                 },
6259                 .fixup_map_hash_48b = { 3 },
6260                 .result = REJECT,
6261                 .errstr = "R1 unbounded memory access",
6262                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6263         },
6264         {
6265                 "helper access to map: bounds check using <=, good access",
6266                 .insns = {
6267                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6268                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6269                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6270                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6271                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6272                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6273                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6274                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6275                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
6276                         BPF_MOV64_IMM(BPF_REG_0, 0),
6277                         BPF_EXIT_INSN(),
6278                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6279                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6280                         BPF_MOV64_IMM(BPF_REG_0, 0),
6281                         BPF_EXIT_INSN(),
6282                 },
6283                 .fixup_map_hash_48b = { 3 },
6284                 .result = ACCEPT,
6285                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6286         },
6287         {
6288                 "helper access to map: bounds check using <=, bad access",
6289                 .insns = {
6290                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6291                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6292                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6293                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6294                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6295                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6296                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6297                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6298                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
6299                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6300                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6301                         BPF_MOV64_IMM(BPF_REG_0, 0),
6302                         BPF_EXIT_INSN(),
6303                         BPF_MOV64_IMM(BPF_REG_0, 0),
6304                         BPF_EXIT_INSN(),
6305                 },
6306                 .fixup_map_hash_48b = { 3 },
6307                 .result = REJECT,
6308                 .errstr = "R1 unbounded memory access",
6309                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6310         },
6311         {
6312                 "helper access to map: bounds check using s<, good access",
6313                 .insns = {
6314                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6315                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6316                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6317                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6318                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6319                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6320                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6321                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6322                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6323                         BPF_MOV64_IMM(BPF_REG_0, 0),
6324                         BPF_EXIT_INSN(),
6325                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
6326                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6327                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6328                         BPF_MOV64_IMM(BPF_REG_0, 0),
6329                         BPF_EXIT_INSN(),
6330                 },
6331                 .fixup_map_hash_48b = { 3 },
6332                 .result = ACCEPT,
6333                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6334         },
6335         {
6336                 "helper access to map: bounds check using s<, good access 2",
6337                 .insns = {
6338                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6339                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6340                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6341                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6342                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6343                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6344                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6345                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6346                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6347                         BPF_MOV64_IMM(BPF_REG_0, 0),
6348                         BPF_EXIT_INSN(),
6349                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
6350                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6351                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6352                         BPF_MOV64_IMM(BPF_REG_0, 0),
6353                         BPF_EXIT_INSN(),
6354                 },
6355                 .fixup_map_hash_48b = { 3 },
6356                 .result = ACCEPT,
6357                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6358         },
6359         {
6360                 "helper access to map: bounds check using s<, bad access",
6361                 .insns = {
6362                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6364                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6366                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6367                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6368                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6369                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
6370                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6371                         BPF_MOV64_IMM(BPF_REG_0, 0),
6372                         BPF_EXIT_INSN(),
6373                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
6374                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6375                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6376                         BPF_MOV64_IMM(BPF_REG_0, 0),
6377                         BPF_EXIT_INSN(),
6378                 },
6379                 .fixup_map_hash_48b = { 3 },
6380                 .result = REJECT,
6381                 .errstr = "R1 min value is negative",
6382                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6383         },
6384         {
6385                 "helper access to map: bounds check using s<=, good access",
6386                 .insns = {
6387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6389                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6390                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6391                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6392                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6394                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6395                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6396                         BPF_MOV64_IMM(BPF_REG_0, 0),
6397                         BPF_EXIT_INSN(),
6398                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
6399                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6400                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6401                         BPF_MOV64_IMM(BPF_REG_0, 0),
6402                         BPF_EXIT_INSN(),
6403                 },
6404                 .fixup_map_hash_48b = { 3 },
6405                 .result = ACCEPT,
6406                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6407         },
6408         {
6409                 "helper access to map: bounds check using s<=, good access 2",
6410                 .insns = {
6411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6413                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6414                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6415                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6416                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6417                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6418                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6419                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6420                         BPF_MOV64_IMM(BPF_REG_0, 0),
6421                         BPF_EXIT_INSN(),
6422                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
6423                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6424                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6425                         BPF_MOV64_IMM(BPF_REG_0, 0),
6426                         BPF_EXIT_INSN(),
6427                 },
6428                 .fixup_map_hash_48b = { 3 },
6429                 .result = ACCEPT,
6430                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6431         },
6432         {
6433                 "helper access to map: bounds check using s<=, bad access",
6434                 .insns = {
6435                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6436                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6437                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6438                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6439                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6440                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6441                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6442                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
6443                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6444                         BPF_MOV64_IMM(BPF_REG_0, 0),
6445                         BPF_EXIT_INSN(),
6446                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
6447                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6448                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6449                         BPF_MOV64_IMM(BPF_REG_0, 0),
6450                         BPF_EXIT_INSN(),
6451                 },
6452                 .fixup_map_hash_48b = { 3 },
6453                 .result = REJECT,
6454                 .errstr = "R1 min value is negative",
6455                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6456         },
6457         {
6458                 "map access: known scalar += value_ptr",
6459                 .insns = {
6460                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6461                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6462                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6463                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6464                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6465                                      BPF_FUNC_map_lookup_elem),
6466                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6467                         BPF_MOV64_IMM(BPF_REG_1, 4),
6468                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
6469                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6470                         BPF_MOV64_IMM(BPF_REG_0, 1),
6471                         BPF_EXIT_INSN(),
6472                 },
6473                 .fixup_map_array_48b = { 3 },
6474                 .result = ACCEPT,
6475                 .retval = 1,
6476         },
6477         {
6478                 "map access: value_ptr += known scalar",
6479                 .insns = {
6480                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6481                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6482                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6483                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6484                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6485                                      BPF_FUNC_map_lookup_elem),
6486                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6487                         BPF_MOV64_IMM(BPF_REG_1, 4),
6488                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6489                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6490                         BPF_MOV64_IMM(BPF_REG_0, 1),
6491                         BPF_EXIT_INSN(),
6492                 },
6493                 .fixup_map_array_48b = { 3 },
6494                 .result = ACCEPT,
6495                 .retval = 1,
6496         },
6497         {
6498                 "map access: unknown scalar += value_ptr",
6499                 .insns = {
6500                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6501                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6503                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6504                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6505                                      BPF_FUNC_map_lookup_elem),
6506                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6507                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6508                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6509                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
6510                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6511                         BPF_MOV64_IMM(BPF_REG_0, 1),
6512                         BPF_EXIT_INSN(),
6513                 },
6514                 .fixup_map_array_48b = { 3 },
6515                 .result = ACCEPT,
6516                 .retval = 1,
6517         },
6518         {
6519                 "map access: value_ptr += unknown scalar",
6520                 .insns = {
6521                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6522                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6524                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6526                                      BPF_FUNC_map_lookup_elem),
6527                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6528                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6529                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6530                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6531                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6532                         BPF_MOV64_IMM(BPF_REG_0, 1),
6533                         BPF_EXIT_INSN(),
6534                 },
6535                 .fixup_map_array_48b = { 3 },
6536                 .result = ACCEPT,
6537                 .retval = 1,
6538         },
6539         {
6540                 "map access: value_ptr += value_ptr",
6541                 .insns = {
6542                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6543                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6544                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6545                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6547                                      BPF_FUNC_map_lookup_elem),
6548                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6549                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),
6550                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6551                         BPF_MOV64_IMM(BPF_REG_0, 1),
6552                         BPF_EXIT_INSN(),
6553                 },
6554                 .fixup_map_array_48b = { 3 },
6555                 .result = REJECT,
6556                 .errstr = "R0 pointer += pointer prohibited",
6557         },
6558         {
6559                 "map access: known scalar -= value_ptr",
6560                 .insns = {
6561                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6562                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6563                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6564                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6565                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6566                                      BPF_FUNC_map_lookup_elem),
6567                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6568                         BPF_MOV64_IMM(BPF_REG_1, 4),
6569                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
6570                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6571                         BPF_MOV64_IMM(BPF_REG_0, 1),
6572                         BPF_EXIT_INSN(),
6573                 },
6574                 .fixup_map_array_48b = { 3 },
6575                 .result = REJECT,
6576                 .errstr = "R1 tried to subtract pointer from scalar",
6577         },
6578         {
6579                 "map access: value_ptr -= known scalar",
6580                 .insns = {
6581                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6582                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6583                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6584                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6585                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6586                                      BPF_FUNC_map_lookup_elem),
6587                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
6588                         BPF_MOV64_IMM(BPF_REG_1, 4),
6589                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6590                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6591                         BPF_MOV64_IMM(BPF_REG_0, 1),
6592                         BPF_EXIT_INSN(),
6593                 },
6594                 .fixup_map_array_48b = { 3 },
6595                 .result = REJECT,
6596                 .errstr = "R0 min value is outside of the array range",
6597         },
6598         {
6599                 "map access: value_ptr -= known scalar, 2",
6600                 .insns = {
6601                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6602                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6604                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6605                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6606                                      BPF_FUNC_map_lookup_elem),
6607                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6608                         BPF_MOV64_IMM(BPF_REG_1, 6),
6609                         BPF_MOV64_IMM(BPF_REG_2, 4),
6610                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6611                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
6612                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6613                         BPF_MOV64_IMM(BPF_REG_0, 1),
6614                         BPF_EXIT_INSN(),
6615                 },
6616                 .fixup_map_array_48b = { 3 },
6617                 .result = ACCEPT,
6618                 .retval = 1,
6619         },
6620         {
6621                 "map access: unknown scalar -= value_ptr",
6622                 .insns = {
6623                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6624                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6626                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6627                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6628                                      BPF_FUNC_map_lookup_elem),
6629                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6630                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6631                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6632                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
6633                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
6634                         BPF_MOV64_IMM(BPF_REG_0, 1),
6635                         BPF_EXIT_INSN(),
6636                 },
6637                 .fixup_map_array_48b = { 3 },
6638                 .result = REJECT,
6639                 .errstr = "R1 tried to subtract pointer from scalar",
6640         },
6641         {
6642                 "map access: value_ptr -= unknown scalar",
6643                 .insns = {
6644                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6645                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6646                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6647                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6648                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6649                                      BPF_FUNC_map_lookup_elem),
6650                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6651                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6652                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6653                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6654                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6655                         BPF_MOV64_IMM(BPF_REG_0, 1),
6656                         BPF_EXIT_INSN(),
6657                 },
6658                 .fixup_map_array_48b = { 3 },
6659                 .result = REJECT,
6660                 .errstr = "R0 min value is negative",
6661         },
6662         {
6663                 "map access: value_ptr -= unknown scalar, 2",
6664                 .insns = {
6665                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6666                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6667                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6668                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6670                                      BPF_FUNC_map_lookup_elem),
6671                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6672                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6673                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
6674                         BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),
6675                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6676                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6677                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
6678                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6679                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6680                         BPF_MOV64_IMM(BPF_REG_0, 1),
6681                         BPF_EXIT_INSN(),
6682                 },
6683                 .fixup_map_array_48b = { 3 },
6684                 .result = ACCEPT,
6685                 .retval = 1,
6686         },
6687         {
6688                 "map access: value_ptr -= value_ptr",
6689                 .insns = {
6690                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6691                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6693                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6694                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6695                                      BPF_FUNC_map_lookup_elem),
6696                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6697                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),
6698                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6699                         BPF_MOV64_IMM(BPF_REG_0, 1),
6700                         BPF_EXIT_INSN(),
6701                 },
6702                 .fixup_map_array_48b = { 3 },
6703                 .result = REJECT,
6704                 .errstr = "R0 invalid mem access 'inv'",
6705                 .errstr_unpriv = "R0 pointer -= pointer prohibited",
6706         },
6707         {
6708                 "map lookup helper access to map",
6709                 .insns = {
6710                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6711                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6712                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6713                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6714                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6715                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6716                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6717                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6718                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6719                         BPF_EXIT_INSN(),
6720                 },
6721                 .fixup_map_hash_16b = { 3, 8 },
6722                 .result = ACCEPT,
6723                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6724         },
6725         {
6726                 "map update helper access to map",
6727                 .insns = {
6728                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6730                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6731                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6732                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6733                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6734                         BPF_MOV64_IMM(BPF_REG_4, 0),
6735                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6736                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6737                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6738                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6739                         BPF_EXIT_INSN(),
6740                 },
6741                 .fixup_map_hash_16b = { 3, 10 },
6742                 .result = ACCEPT,
6743                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6744         },
6745         {
6746                 "map update helper access to map: wrong size",
6747                 .insns = {
6748                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6749                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6750                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6751                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6752                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6753                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6754                         BPF_MOV64_IMM(BPF_REG_4, 0),
6755                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6756                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6757                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6758                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6759                         BPF_EXIT_INSN(),
6760                 },
6761                 .fixup_map_hash_8b = { 3 },
6762                 .fixup_map_hash_16b = { 10 },
6763                 .result = REJECT,
6764                 .errstr = "invalid access to map value, value_size=8 off=0 size=16",
6765                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6766         },
6767         {
6768                 "map helper access to adjusted map (via const imm)",
6769                 .insns = {
6770                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6771                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6772                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6773                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6774                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6775                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6776                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6778                                       offsetof(struct other_val, bar)),
6779                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6780                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6781                         BPF_EXIT_INSN(),
6782                 },
6783                 .fixup_map_hash_16b = { 3, 9 },
6784                 .result = ACCEPT,
6785                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6786         },
6787         {
6788                 "map helper access to adjusted map (via const imm): out-of-bound 1",
6789                 .insns = {
6790                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6792                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6793                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6794                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6796                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6797                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6798                                       sizeof(struct other_val) - 4),
6799                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6800                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6801                         BPF_EXIT_INSN(),
6802                 },
6803                 .fixup_map_hash_16b = { 3, 9 },
6804                 .result = REJECT,
6805                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6806                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6807         },
6808         {
6809                 "map helper access to adjusted map (via const imm): out-of-bound 2",
6810                 .insns = {
6811                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6812                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6813                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6814                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6815                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6816                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6817                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6818                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6819                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6820                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6821                         BPF_EXIT_INSN(),
6822                 },
6823                 .fixup_map_hash_16b = { 3, 9 },
6824                 .result = REJECT,
6825                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6826                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6827         },
6828         {
6829                 "map helper access to adjusted map (via const reg)",
6830                 .insns = {
6831                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6832                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6833                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6834                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6835                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6836                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6837                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6838                         BPF_MOV64_IMM(BPF_REG_3,
6839                                       offsetof(struct other_val, bar)),
6840                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6841                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6842                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6843                         BPF_EXIT_INSN(),
6844                 },
6845                 .fixup_map_hash_16b = { 3, 10 },
6846                 .result = ACCEPT,
6847                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6848         },
6849         {
6850                 "map helper access to adjusted map (via const reg): out-of-bound 1",
6851                 .insns = {
6852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6854                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6855                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6856                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6857                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6858                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6859                         BPF_MOV64_IMM(BPF_REG_3,
6860                                       sizeof(struct other_val) - 4),
6861                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6862                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6863                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6864                         BPF_EXIT_INSN(),
6865                 },
6866                 .fixup_map_hash_16b = { 3, 10 },
6867                 .result = REJECT,
6868                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6869                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6870         },
6871         {
6872                 "map helper access to adjusted map (via const reg): out-of-bound 2",
6873                 .insns = {
6874                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6876                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6877                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6878                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6879                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6880                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6881                         BPF_MOV64_IMM(BPF_REG_3, -4),
6882                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6883                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6884                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6885                         BPF_EXIT_INSN(),
6886                 },
6887                 .fixup_map_hash_16b = { 3, 10 },
6888                 .result = REJECT,
6889                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6890                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6891         },
6892         {
6893                 "map helper access to adjusted map (via variable)",
6894                 .insns = {
6895                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6896                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6897                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6898                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6899                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6900                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6901                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6902                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6903                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6904                                     offsetof(struct other_val, bar), 4),
6905                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6906                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6907                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6908                         BPF_EXIT_INSN(),
6909                 },
6910                 .fixup_map_hash_16b = { 3, 11 },
6911                 .result = ACCEPT,
6912                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6913         },
6914         {
6915                 "map helper access to adjusted map (via variable): no max check",
6916                 .insns = {
6917                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6919                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6920                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6921                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6922                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6923                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6924                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6925                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6926                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6927                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6928                         BPF_EXIT_INSN(),
6929                 },
6930                 .fixup_map_hash_16b = { 3, 10 },
6931                 .result = REJECT,
6932                 .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
6933                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6934         },
6935         {
6936                 "map helper access to adjusted map (via variable): wrong max check",
6937                 .insns = {
6938                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6939                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6940                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6941                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6942                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6943                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6944                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6945                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6946                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6947                                     offsetof(struct other_val, bar) + 1, 4),
6948                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6949                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6950                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6951                         BPF_EXIT_INSN(),
6952                 },
6953                 .fixup_map_hash_16b = { 3, 11 },
6954                 .result = REJECT,
6955                 .errstr = "invalid access to map value, value_size=16 off=9 size=8",
6956                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6957         },
6958         {
6959                 "map element value is preserved across register spilling",
6960                 .insns = {
6961                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6962                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6963                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6964                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6965                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6966                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6967                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6968                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6969                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6970                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6971                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6972                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6973                         BPF_EXIT_INSN(),
6974                 },
6975                 .fixup_map_hash_48b = { 3 },
6976                 .errstr_unpriv = "R0 leaks addr",
6977                 .result = ACCEPT,
6978                 .result_unpriv = REJECT,
6979         },
6980         {
6981                 "map element value or null is marked on register spilling",
6982                 .insns = {
6983                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6985                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6986                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6987                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6988                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6989                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
6990                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6991                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6992                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6993                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6994                         BPF_EXIT_INSN(),
6995                 },
6996                 .fixup_map_hash_48b = { 3 },
6997                 .errstr_unpriv = "R0 leaks addr",
6998                 .result = ACCEPT,
6999                 .result_unpriv = REJECT,
7000         },
7001         {
7002                 "map element value store of cleared call register",
7003                 .insns = {
7004                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7005                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7006                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7007                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7008                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7009                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
7010                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
7011                         BPF_EXIT_INSN(),
7012                 },
7013                 .fixup_map_hash_48b = { 3 },
7014                 .errstr_unpriv = "R1 !read_ok",
7015                 .errstr = "R1 !read_ok",
7016                 .result = REJECT,
7017                 .result_unpriv = REJECT,
7018         },
7019         {
7020                 "map element value with unaligned store",
7021                 .insns = {
7022                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7024                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7025                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7026                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7027                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
7028                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
7029                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
7030                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
7031                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
7032                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
7033                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
7034                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
7035                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
7036                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
7037                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
7038                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
7039                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
7040                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
7041                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
7042                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
7043                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
7044                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
7045                         BPF_EXIT_INSN(),
7046                 },
7047                 .fixup_map_hash_48b = { 3 },
7048                 .errstr_unpriv = "R0 leaks addr",
7049                 .result = ACCEPT,
7050                 .result_unpriv = REJECT,
7051                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7052         },
7053         {
7054                 "map element value with unaligned load",
7055                 .insns = {
7056                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7058                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7059                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7060                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7061                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
7062                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7063                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
7064                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
7065                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
7066                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
7067                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
7068                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
7069                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
7070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
7071                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
7072                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
7073                         BPF_EXIT_INSN(),
7074                 },
7075                 .fixup_map_hash_48b = { 3 },
7076                 .errstr_unpriv = "R0 leaks addr",
7077                 .result = ACCEPT,
7078                 .result_unpriv = REJECT,
7079                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7080         },
7081         {
7082                 "map element value illegal alu op, 1",
7083                 .insns = {
7084                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7085                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7086                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7087                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7088                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7089                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7090                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
7091                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
7092                         BPF_EXIT_INSN(),
7093                 },
7094                 .fixup_map_hash_48b = { 3 },
7095                 .errstr = "R0 bitwise operator &= on pointer",
7096                 .result = REJECT,
7097         },
7098         {
7099                 "map element value illegal alu op, 2",
7100                 .insns = {
7101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7103                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7104                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7105                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7106                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7107                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
7108                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
7109                         BPF_EXIT_INSN(),
7110                 },
7111                 .fixup_map_hash_48b = { 3 },
7112                 .errstr = "R0 32-bit pointer arithmetic prohibited",
7113                 .result = REJECT,
7114         },
7115         {
7116                 "map element value illegal alu op, 3",
7117                 .insns = {
7118                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7119                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7120                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7121                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7122                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7123                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7124                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
7125                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
7126                         BPF_EXIT_INSN(),
7127                 },
7128                 .fixup_map_hash_48b = { 3 },
7129                 .errstr = "R0 pointer arithmetic with /= operator",
7130                 .result = REJECT,
7131         },
7132         {
7133                 "map element value illegal alu op, 4",
7134                 .insns = {
7135                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7136                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7137                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7138                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7139                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7140                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7141                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
7142                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
7143                         BPF_EXIT_INSN(),
7144                 },
7145                 .fixup_map_hash_48b = { 3 },
7146                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
7147                 .errstr = "invalid mem access 'inv'",
7148                 .result = REJECT,
7149                 .result_unpriv = REJECT,
7150         },
7151         {
7152                 "map element value illegal alu op, 5",
7153                 .insns = {
7154                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7155                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7156                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7157                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7158                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7159                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7160                         BPF_MOV64_IMM(BPF_REG_3, 4096),
7161                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7162                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7163                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7164                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
7165                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
7166                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
7167                         BPF_EXIT_INSN(),
7168                 },
7169                 .fixup_map_hash_48b = { 3 },
7170                 .errstr = "R0 invalid mem access 'inv'",
7171                 .result = REJECT,
7172         },
7173         {
7174                 "map element value is preserved across register spilling",
7175                 .insns = {
7176                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7177                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7178                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7179                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7180                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7181                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7182                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
7183                                 offsetof(struct test_val, foo)),
7184                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
7185                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7186                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
7187                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
7188                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
7189                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
7190                         BPF_EXIT_INSN(),
7191                 },
7192                 .fixup_map_hash_48b = { 3 },
7193                 .errstr_unpriv = "R0 leaks addr",
7194                 .result = ACCEPT,
7195                 .result_unpriv = REJECT,
7196                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7197         },
7198         {
7199                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
7200                 .insns = {
7201                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7202                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7203                         BPF_MOV64_IMM(BPF_REG_0, 0),
7204                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7205                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7206                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7207                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7208                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7209                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7210                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7211                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7212                         BPF_MOV64_IMM(BPF_REG_2, 16),
7213                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7214                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7215                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
7216                         BPF_MOV64_IMM(BPF_REG_4, 0),
7217                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7218                         BPF_MOV64_IMM(BPF_REG_3, 0),
7219                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7220                         BPF_MOV64_IMM(BPF_REG_0, 0),
7221                         BPF_EXIT_INSN(),
7222                 },
7223                 .result = ACCEPT,
7224                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7225         },
7226         {
7227                 "helper access to variable memory: stack, bitwise AND, zero included",
7228                 .insns = {
7229                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7231                         BPF_MOV64_IMM(BPF_REG_2, 16),
7232                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7233                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7234                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
7235                         BPF_MOV64_IMM(BPF_REG_3, 0),
7236                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7237                         BPF_EXIT_INSN(),
7238                 },
7239                 .errstr = "invalid indirect read from stack off -64+0 size 64",
7240                 .result = REJECT,
7241                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7242         },
7243         {
7244                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
7245                 .insns = {
7246                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7247                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7248                         BPF_MOV64_IMM(BPF_REG_2, 16),
7249                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7250                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7251                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
7252                         BPF_MOV64_IMM(BPF_REG_4, 0),
7253                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7254                         BPF_MOV64_IMM(BPF_REG_3, 0),
7255                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7256                         BPF_MOV64_IMM(BPF_REG_0, 0),
7257                         BPF_EXIT_INSN(),
7258                 },
7259                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7260                 .result = REJECT,
7261                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7262         },
7263         {
7264                 "helper access to variable memory: stack, JMP, correct bounds",
7265                 .insns = {
7266                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7267                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7268                         BPF_MOV64_IMM(BPF_REG_0, 0),
7269                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7270                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7271                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7272                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7273                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7274                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7275                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7276                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7277                         BPF_MOV64_IMM(BPF_REG_2, 16),
7278                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7279                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7280                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
7281                         BPF_MOV64_IMM(BPF_REG_4, 0),
7282                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7283                         BPF_MOV64_IMM(BPF_REG_3, 0),
7284                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7285                         BPF_MOV64_IMM(BPF_REG_0, 0),
7286                         BPF_EXIT_INSN(),
7287                 },
7288                 .result = ACCEPT,
7289                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7290         },
7291         {
7292                 "helper access to variable memory: stack, JMP (signed), correct bounds",
7293                 .insns = {
7294                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7295                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7296                         BPF_MOV64_IMM(BPF_REG_0, 0),
7297                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7298                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7299                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7300                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7301                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7302                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7303                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7304                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7305                         BPF_MOV64_IMM(BPF_REG_2, 16),
7306                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7307                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7308                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
7309                         BPF_MOV64_IMM(BPF_REG_4, 0),
7310                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7311                         BPF_MOV64_IMM(BPF_REG_3, 0),
7312                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7313                         BPF_MOV64_IMM(BPF_REG_0, 0),
7314                         BPF_EXIT_INSN(),
7315                 },
7316                 .result = ACCEPT,
7317                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7318         },
7319         {
7320                 "helper access to variable memory: stack, JMP, bounds + offset",
7321                 .insns = {
7322                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7324                         BPF_MOV64_IMM(BPF_REG_2, 16),
7325                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7326                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7327                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
7328                         BPF_MOV64_IMM(BPF_REG_4, 0),
7329                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
7330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7331                         BPF_MOV64_IMM(BPF_REG_3, 0),
7332                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7333                         BPF_MOV64_IMM(BPF_REG_0, 0),
7334                         BPF_EXIT_INSN(),
7335                 },
7336                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7337                 .result = REJECT,
7338                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7339         },
7340         {
7341                 "helper access to variable memory: stack, JMP, wrong max",
7342                 .insns = {
7343                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7344                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7345                         BPF_MOV64_IMM(BPF_REG_2, 16),
7346                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7347                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7348                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
7349                         BPF_MOV64_IMM(BPF_REG_4, 0),
7350                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7351                         BPF_MOV64_IMM(BPF_REG_3, 0),
7352                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7353                         BPF_MOV64_IMM(BPF_REG_0, 0),
7354                         BPF_EXIT_INSN(),
7355                 },
7356                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7357                 .result = REJECT,
7358                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7359         },
7360         {
7361                 "helper access to variable memory: stack, JMP, no max check",
7362                 .insns = {
7363                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7365                         BPF_MOV64_IMM(BPF_REG_2, 16),
7366                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7367                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7368                         BPF_MOV64_IMM(BPF_REG_4, 0),
7369                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7370                         BPF_MOV64_IMM(BPF_REG_3, 0),
7371                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7372                         BPF_MOV64_IMM(BPF_REG_0, 0),
7373                         BPF_EXIT_INSN(),
7374                 },
7375                 /* because max wasn't checked, signed min is negative */
7376                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
7377                 .result = REJECT,
7378                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7379         },
7380         {
7381                 "helper access to variable memory: stack, JMP, no min check",
7382                 .insns = {
7383                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7384                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7385                         BPF_MOV64_IMM(BPF_REG_2, 16),
7386                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7387                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7388                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
7389                         BPF_MOV64_IMM(BPF_REG_3, 0),
7390                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7391                         BPF_MOV64_IMM(BPF_REG_0, 0),
7392                         BPF_EXIT_INSN(),
7393                 },
7394                 .errstr = "invalid indirect read from stack off -64+0 size 64",
7395                 .result = REJECT,
7396                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7397         },
7398         {
7399                 "helper access to variable memory: stack, JMP (signed), no min check",
7400                 .insns = {
7401                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7402                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7403                         BPF_MOV64_IMM(BPF_REG_2, 16),
7404                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7405                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7406                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
7407                         BPF_MOV64_IMM(BPF_REG_3, 0),
7408                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7409                         BPF_MOV64_IMM(BPF_REG_0, 0),
7410                         BPF_EXIT_INSN(),
7411                 },
7412                 .errstr = "R2 min value is negative",
7413                 .result = REJECT,
7414                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7415         },
7416         {
7417                 "helper access to variable memory: map, JMP, correct bounds",
7418                 .insns = {
7419                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7420                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7421                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7422                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7423                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7424                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7425                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7426                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7427                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7428                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7429                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7430                                 sizeof(struct test_val), 4),
7431                         BPF_MOV64_IMM(BPF_REG_4, 0),
7432                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7433                         BPF_MOV64_IMM(BPF_REG_3, 0),
7434                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7435                         BPF_MOV64_IMM(BPF_REG_0, 0),
7436                         BPF_EXIT_INSN(),
7437                 },
7438                 .fixup_map_hash_48b = { 3 },
7439                 .result = ACCEPT,
7440                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7441         },
7442         {
7443                 "helper access to variable memory: map, JMP, wrong max",
7444                 .insns = {
7445                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7446                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7447                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7448                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7449                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7450                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7451                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7452                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7453                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7454                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7455                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7456                                 sizeof(struct test_val) + 1, 4),
7457                         BPF_MOV64_IMM(BPF_REG_4, 0),
7458                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7459                         BPF_MOV64_IMM(BPF_REG_3, 0),
7460                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7461                         BPF_MOV64_IMM(BPF_REG_0, 0),
7462                         BPF_EXIT_INSN(),
7463                 },
7464                 .fixup_map_hash_48b = { 3 },
7465                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
7466                 .result = REJECT,
7467                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7468         },
7469         {
7470                 "helper access to variable memory: map adjusted, JMP, correct bounds",
7471                 .insns = {
7472                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7473                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7474                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7475                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7476                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7477                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
7478                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
7480                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7481                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7482                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7483                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7484                                 sizeof(struct test_val) - 20, 4),
7485                         BPF_MOV64_IMM(BPF_REG_4, 0),
7486                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7487                         BPF_MOV64_IMM(BPF_REG_3, 0),
7488                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7489                         BPF_MOV64_IMM(BPF_REG_0, 0),
7490                         BPF_EXIT_INSN(),
7491                 },
7492                 .fixup_map_hash_48b = { 3 },
7493                 .result = ACCEPT,
7494                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7495         },
7496         {
7497                 "helper access to variable memory: map adjusted, JMP, wrong max",
7498                 .insns = {
7499                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7501                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7502                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7503                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7504                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
7505                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7506                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
7507                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7508                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7509                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7510                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7511                                 sizeof(struct test_val) - 19, 4),
7512                         BPF_MOV64_IMM(BPF_REG_4, 0),
7513                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7514                         BPF_MOV64_IMM(BPF_REG_3, 0),
7515                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7516                         BPF_MOV64_IMM(BPF_REG_0, 0),
7517                         BPF_EXIT_INSN(),
7518                 },
7519                 .fixup_map_hash_48b = { 3 },
7520                 .errstr = "R1 min value is outside of the array range",
7521                 .result = REJECT,
7522                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7523         },
7524         {
7525                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
7526                 .insns = {
7527                         BPF_MOV64_IMM(BPF_REG_1, 0),
7528                         BPF_MOV64_IMM(BPF_REG_2, 0),
7529                         BPF_MOV64_IMM(BPF_REG_3, 0),
7530                         BPF_MOV64_IMM(BPF_REG_4, 0),
7531                         BPF_MOV64_IMM(BPF_REG_5, 0),
7532                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7533                         BPF_EXIT_INSN(),
7534                 },
7535                 .result = ACCEPT,
7536                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7537         },
7538         {
7539                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
7540                 .insns = {
7541                         BPF_MOV64_IMM(BPF_REG_1, 0),
7542                         BPF_MOV64_IMM(BPF_REG_2, 1),
7543                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7544                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7545                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
7546                         BPF_MOV64_IMM(BPF_REG_3, 0),
7547                         BPF_MOV64_IMM(BPF_REG_4, 0),
7548                         BPF_MOV64_IMM(BPF_REG_5, 0),
7549                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7550                         BPF_EXIT_INSN(),
7551                 },
7552                 .errstr = "R1 type=inv expected=fp",
7553                 .result = REJECT,
7554                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7555         },
7556         {
7557                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
7558                 .insns = {
7559                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7560                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7561                         BPF_MOV64_IMM(BPF_REG_2, 0),
7562                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
7563                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
7564                         BPF_MOV64_IMM(BPF_REG_3, 0),
7565                         BPF_MOV64_IMM(BPF_REG_4, 0),
7566                         BPF_MOV64_IMM(BPF_REG_5, 0),
7567                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7568                         BPF_EXIT_INSN(),
7569                 },
7570                 .result = ACCEPT,
7571                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7572         },
7573         {
7574                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
7575                 .insns = {
7576                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7577                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7578                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7579                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7580                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7581                                      BPF_FUNC_map_lookup_elem),
7582                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7583                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7584                         BPF_MOV64_IMM(BPF_REG_2, 0),
7585                         BPF_MOV64_IMM(BPF_REG_3, 0),
7586                         BPF_MOV64_IMM(BPF_REG_4, 0),
7587                         BPF_MOV64_IMM(BPF_REG_5, 0),
7588                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7589                         BPF_EXIT_INSN(),
7590                 },
7591                 .fixup_map_hash_8b = { 3 },
7592                 .result = ACCEPT,
7593                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7594         },
7595         {
7596                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
7597                 .insns = {
7598                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7599                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7600                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7601                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7602                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7603                                      BPF_FUNC_map_lookup_elem),
7604                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7605                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7606                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
7607                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7608                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7609                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
7610                         BPF_MOV64_IMM(BPF_REG_3, 0),
7611                         BPF_MOV64_IMM(BPF_REG_4, 0),
7612                         BPF_MOV64_IMM(BPF_REG_5, 0),
7613                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7614                         BPF_EXIT_INSN(),
7615                 },
7616                 .fixup_map_hash_8b = { 3 },
7617                 .result = ACCEPT,
7618                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7619         },
7620         {
7621                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
7622                 .insns = {
7623                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7624                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7626                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7627                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7628                                      BPF_FUNC_map_lookup_elem),
7629                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7630                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7631                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7632                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7633                         BPF_MOV64_IMM(BPF_REG_3, 0),
7634                         BPF_MOV64_IMM(BPF_REG_4, 0),
7635                         BPF_MOV64_IMM(BPF_REG_5, 0),
7636                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7637                         BPF_EXIT_INSN(),
7638                 },
7639                 .fixup_map_hash_8b = { 3 },
7640                 .result = ACCEPT,
7641                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7642         },
7643         {
7644                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
7645                 .insns = {
7646                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7647                                     offsetof(struct __sk_buff, data)),
7648                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7649                                     offsetof(struct __sk_buff, data_end)),
7650                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
7651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7652                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
7653                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
7654                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
7655                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7656                         BPF_MOV64_IMM(BPF_REG_3, 0),
7657                         BPF_MOV64_IMM(BPF_REG_4, 0),
7658                         BPF_MOV64_IMM(BPF_REG_5, 0),
7659                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7660                         BPF_EXIT_INSN(),
7661                 },
7662                 .result = ACCEPT,
7663                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7664                 .retval = 0 /* csum_diff of 64-byte packet */,
7665         },
7666         {
7667                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
7668                 .insns = {
7669                         BPF_MOV64_IMM(BPF_REG_1, 0),
7670                         BPF_MOV64_IMM(BPF_REG_2, 0),
7671                         BPF_MOV64_IMM(BPF_REG_3, 0),
7672                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7673                         BPF_EXIT_INSN(),
7674                 },
7675                 .errstr = "R1 type=inv expected=fp",
7676                 .result = REJECT,
7677                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7678         },
7679         {
7680                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
7681                 .insns = {
7682                         BPF_MOV64_IMM(BPF_REG_1, 0),
7683                         BPF_MOV64_IMM(BPF_REG_2, 1),
7684                         BPF_MOV64_IMM(BPF_REG_3, 0),
7685                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7686                         BPF_EXIT_INSN(),
7687                 },
7688                 .errstr = "R1 type=inv expected=fp",
7689                 .result = REJECT,
7690                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7691         },
7692         {
7693                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7694                 .insns = {
7695                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7696                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7697                         BPF_MOV64_IMM(BPF_REG_2, 0),
7698                         BPF_MOV64_IMM(BPF_REG_3, 0),
7699                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7700                         BPF_EXIT_INSN(),
7701                 },
7702                 .result = ACCEPT,
7703                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7704         },
7705         {
7706                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7707                 .insns = {
7708                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7709                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7710                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7711                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7712                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7713                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7714                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7715                         BPF_MOV64_IMM(BPF_REG_2, 0),
7716                         BPF_MOV64_IMM(BPF_REG_3, 0),
7717                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7718                         BPF_EXIT_INSN(),
7719                 },
7720                 .fixup_map_hash_8b = { 3 },
7721                 .result = ACCEPT,
7722                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7723         },
7724         {
7725                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7726                 .insns = {
7727                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7728                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7730                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7731                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7732                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7733                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7734                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7735                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7736                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7737                         BPF_MOV64_IMM(BPF_REG_3, 0),
7738                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7739                         BPF_EXIT_INSN(),
7740                 },
7741                 .fixup_map_hash_8b = { 3 },
7742                 .result = ACCEPT,
7743                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7744         },
7745         {
7746                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7747                 .insns = {
7748                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7749                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7750                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7751                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7752                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7753                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7754                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7755                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7756                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
7757                         BPF_MOV64_IMM(BPF_REG_3, 0),
7758                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7759                         BPF_EXIT_INSN(),
7760                 },
7761                 .fixup_map_hash_8b = { 3 },
7762                 .result = ACCEPT,
7763                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7764         },
7765         {
7766                 "helper access to variable memory: 8 bytes leak",
7767                 .insns = {
7768                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7769                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7770                         BPF_MOV64_IMM(BPF_REG_0, 0),
7771                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7772                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7773                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7774                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7775                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7776                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7777                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7778                         BPF_MOV64_IMM(BPF_REG_2, 1),
7779                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7780                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7781                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
7782                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7783                         BPF_MOV64_IMM(BPF_REG_3, 0),
7784                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7785                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7786                         BPF_EXIT_INSN(),
7787                 },
7788                 .errstr = "invalid indirect read from stack off -64+32 size 64",
7789                 .result = REJECT,
7790                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7791         },
7792         {
7793                 "helper access to variable memory: 8 bytes no leak (init memory)",
7794                 .insns = {
7795                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7796                         BPF_MOV64_IMM(BPF_REG_0, 0),
7797                         BPF_MOV64_IMM(BPF_REG_0, 0),
7798                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7799                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7800                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7801                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7802                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7803                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7804                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7805                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7806                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7807                         BPF_MOV64_IMM(BPF_REG_2, 0),
7808                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
7809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
7810                         BPF_MOV64_IMM(BPF_REG_3, 0),
7811                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7812                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7813                         BPF_EXIT_INSN(),
7814                 },
7815                 .result = ACCEPT,
7816                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7817         },
7818         {
7819                 "invalid and of negative number",
7820                 .insns = {
7821                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7822                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7823                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7824                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7825                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7826                                      BPF_FUNC_map_lookup_elem),
7827                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7828                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7829                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
7830                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
7831                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7832                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7833                                    offsetof(struct test_val, foo)),
7834                         BPF_EXIT_INSN(),
7835                 },
7836                 .fixup_map_hash_48b = { 3 },
7837                 .errstr = "R0 max value is outside of the array range",
7838                 .result = REJECT,
7839                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7840         },
7841         {
7842                 "invalid range check",
7843                 .insns = {
7844                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7845                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7846                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7847                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7848                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7849                                      BPF_FUNC_map_lookup_elem),
7850                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
7851                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7852                         BPF_MOV64_IMM(BPF_REG_9, 1),
7853                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
7854                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
7855                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
7856                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
7857                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
7858                         BPF_MOV32_IMM(BPF_REG_3, 1),
7859                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
7860                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
7861                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
7862                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
7863                         BPF_MOV64_REG(BPF_REG_0, 0),
7864                         BPF_EXIT_INSN(),
7865                 },
7866                 .fixup_map_hash_48b = { 3 },
7867                 .errstr = "R0 max value is outside of the array range",
7868                 .result = REJECT,
7869                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7870         },
7871         {
7872                 "map in map access",
7873                 .insns = {
7874                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7875                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7876                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7877                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7878                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7879                                      BPF_FUNC_map_lookup_elem),
7880                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7881                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7882                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7883                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7884                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7885                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7886                                      BPF_FUNC_map_lookup_elem),
7887                         BPF_MOV64_IMM(BPF_REG_0, 0),
7888                         BPF_EXIT_INSN(),
7889                 },
7890                 .fixup_map_in_map = { 3 },
7891                 .result = ACCEPT,
7892         },
7893         {
7894                 "invalid inner map pointer",
7895                 .insns = {
7896                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7897                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7898                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7899                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7900                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7901                                      BPF_FUNC_map_lookup_elem),
7902                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7903                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7904                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7905                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7906                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7907                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7908                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7909                                      BPF_FUNC_map_lookup_elem),
7910                         BPF_MOV64_IMM(BPF_REG_0, 0),
7911                         BPF_EXIT_INSN(),
7912                 },
7913                 .fixup_map_in_map = { 3 },
7914                 .errstr = "R1 pointer arithmetic on map_ptr prohibited",
7915                 .result = REJECT,
7916         },
7917         {
7918                 "forgot null checking on the inner map pointer",
7919                 .insns = {
7920                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7921                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7922                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7923                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7924                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7925                                      BPF_FUNC_map_lookup_elem),
7926                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7927                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7928                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7929                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7930                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7931                                      BPF_FUNC_map_lookup_elem),
7932                         BPF_MOV64_IMM(BPF_REG_0, 0),
7933                         BPF_EXIT_INSN(),
7934                 },
7935                 .fixup_map_in_map = { 3 },
7936                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
7937                 .result = REJECT,
7938         },
7939         {
7940                 "ld_abs: check calling conv, r1",
7941                 .insns = {
7942                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7943                         BPF_MOV64_IMM(BPF_REG_1, 0),
7944                         BPF_LD_ABS(BPF_W, -0x200000),
7945                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7946                         BPF_EXIT_INSN(),
7947                 },
7948                 .errstr = "R1 !read_ok",
7949                 .result = REJECT,
7950         },
7951         {
7952                 "ld_abs: check calling conv, r2",
7953                 .insns = {
7954                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7955                         BPF_MOV64_IMM(BPF_REG_2, 0),
7956                         BPF_LD_ABS(BPF_W, -0x200000),
7957                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7958                         BPF_EXIT_INSN(),
7959                 },
7960                 .errstr = "R2 !read_ok",
7961                 .result = REJECT,
7962         },
7963         {
7964                 "ld_abs: check calling conv, r3",
7965                 .insns = {
7966                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7967                         BPF_MOV64_IMM(BPF_REG_3, 0),
7968                         BPF_LD_ABS(BPF_W, -0x200000),
7969                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7970                         BPF_EXIT_INSN(),
7971                 },
7972                 .errstr = "R3 !read_ok",
7973                 .result = REJECT,
7974         },
7975         {
7976                 "ld_abs: check calling conv, r4",
7977                 .insns = {
7978                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7979                         BPF_MOV64_IMM(BPF_REG_4, 0),
7980                         BPF_LD_ABS(BPF_W, -0x200000),
7981                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7982                         BPF_EXIT_INSN(),
7983                 },
7984                 .errstr = "R4 !read_ok",
7985                 .result = REJECT,
7986         },
7987         {
7988                 "ld_abs: check calling conv, r5",
7989                 .insns = {
7990                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7991                         BPF_MOV64_IMM(BPF_REG_5, 0),
7992                         BPF_LD_ABS(BPF_W, -0x200000),
7993                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7994                         BPF_EXIT_INSN(),
7995                 },
7996                 .errstr = "R5 !read_ok",
7997                 .result = REJECT,
7998         },
7999         {
8000                 "ld_abs: check calling conv, r7",
8001                 .insns = {
8002                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8003                         BPF_MOV64_IMM(BPF_REG_7, 0),
8004                         BPF_LD_ABS(BPF_W, -0x200000),
8005                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
8006                         BPF_EXIT_INSN(),
8007                 },
8008                 .result = ACCEPT,
8009         },
8010         {
8011                 "ld_abs: tests on r6 and skb data reload helper",
8012                 .insns = {
8013                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8014                         BPF_LD_ABS(BPF_B, 0),
8015                         BPF_LD_ABS(BPF_H, 0),
8016                         BPF_LD_ABS(BPF_W, 0),
8017                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
8018                         BPF_MOV64_IMM(BPF_REG_6, 0),
8019                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
8020                         BPF_MOV64_IMM(BPF_REG_2, 1),
8021                         BPF_MOV64_IMM(BPF_REG_3, 2),
8022                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8023                                      BPF_FUNC_skb_vlan_push),
8024                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
8025                         BPF_LD_ABS(BPF_B, 0),
8026                         BPF_LD_ABS(BPF_H, 0),
8027                         BPF_LD_ABS(BPF_W, 0),
8028                         BPF_MOV64_IMM(BPF_REG_0, 42),
8029                         BPF_EXIT_INSN(),
8030                 },
8031                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8032                 .result = ACCEPT,
8033                 .retval = 42 /* ultimate return value */,
8034         },
8035         {
8036                 "ld_ind: check calling conv, r1",
8037                 .insns = {
8038                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8039                         BPF_MOV64_IMM(BPF_REG_1, 1),
8040                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
8041                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
8042                         BPF_EXIT_INSN(),
8043                 },
8044                 .errstr = "R1 !read_ok",
8045                 .result = REJECT,
8046         },
8047         {
8048                 "ld_ind: check calling conv, r2",
8049                 .insns = {
8050                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8051                         BPF_MOV64_IMM(BPF_REG_2, 1),
8052                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
8053                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8054                         BPF_EXIT_INSN(),
8055                 },
8056                 .errstr = "R2 !read_ok",
8057                 .result = REJECT,
8058         },
8059         {
8060                 "ld_ind: check calling conv, r3",
8061                 .insns = {
8062                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8063                         BPF_MOV64_IMM(BPF_REG_3, 1),
8064                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
8065                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8066                         BPF_EXIT_INSN(),
8067                 },
8068                 .errstr = "R3 !read_ok",
8069                 .result = REJECT,
8070         },
8071         {
8072                 "ld_ind: check calling conv, r4",
8073                 .insns = {
8074                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8075                         BPF_MOV64_IMM(BPF_REG_4, 1),
8076                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
8077                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
8078                         BPF_EXIT_INSN(),
8079                 },
8080                 .errstr = "R4 !read_ok",
8081                 .result = REJECT,
8082         },
8083         {
8084                 "ld_ind: check calling conv, r5",
8085                 .insns = {
8086                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8087                         BPF_MOV64_IMM(BPF_REG_5, 1),
8088                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
8089                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
8090                         BPF_EXIT_INSN(),
8091                 },
8092                 .errstr = "R5 !read_ok",
8093                 .result = REJECT,
8094         },
8095         {
8096                 "ld_ind: check calling conv, r7",
8097                 .insns = {
8098                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
8099                         BPF_MOV64_IMM(BPF_REG_7, 1),
8100                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
8101                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
8102                         BPF_EXIT_INSN(),
8103                 },
8104                 .result = ACCEPT,
8105                 .retval = 1,
8106         },
8107         {
8108                 "check bpf_perf_event_data->sample_period byte load permitted",
8109                 .insns = {
8110                         BPF_MOV64_IMM(BPF_REG_0, 0),
8111 #if __BYTE_ORDER == __LITTLE_ENDIAN
8112                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
8113                                     offsetof(struct bpf_perf_event_data, sample_period)),
8114 #else
8115                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
8116                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
8117 #endif
8118                         BPF_EXIT_INSN(),
8119                 },
8120                 .result = ACCEPT,
8121                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
8122         },
8123         {
8124                 "check bpf_perf_event_data->sample_period half load permitted",
8125                 .insns = {
8126                         BPF_MOV64_IMM(BPF_REG_0, 0),
8127 #if __BYTE_ORDER == __LITTLE_ENDIAN
8128                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8129                                     offsetof(struct bpf_perf_event_data, sample_period)),
8130 #else
8131                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8132                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
8133 #endif
8134                         BPF_EXIT_INSN(),
8135                 },
8136                 .result = ACCEPT,
8137                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
8138         },
8139         {
8140                 "check bpf_perf_event_data->sample_period word load permitted",
8141                 .insns = {
8142                         BPF_MOV64_IMM(BPF_REG_0, 0),
8143 #if __BYTE_ORDER == __LITTLE_ENDIAN
8144                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8145                                     offsetof(struct bpf_perf_event_data, sample_period)),
8146 #else
8147                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8148                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
8149 #endif
8150                         BPF_EXIT_INSN(),
8151                 },
8152                 .result = ACCEPT,
8153                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
8154         },
8155         {
8156                 "check bpf_perf_event_data->sample_period dword load permitted",
8157                 .insns = {
8158                         BPF_MOV64_IMM(BPF_REG_0, 0),
8159                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
8160                                     offsetof(struct bpf_perf_event_data, sample_period)),
8161                         BPF_EXIT_INSN(),
8162                 },
8163                 .result = ACCEPT,
8164                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
8165         },
8166         {
8167                 "check skb->data half load not permitted",
8168                 .insns = {
8169                         BPF_MOV64_IMM(BPF_REG_0, 0),
8170 #if __BYTE_ORDER == __LITTLE_ENDIAN
8171                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8172                                     offsetof(struct __sk_buff, data)),
8173 #else
8174                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8175                                     offsetof(struct __sk_buff, data) + 2),
8176 #endif
8177                         BPF_EXIT_INSN(),
8178                 },
8179                 .result = REJECT,
8180                 .errstr = "invalid bpf_context access",
8181         },
8182         {
8183                 "check skb->tc_classid half load not permitted for lwt prog",
8184                 .insns = {
8185                         BPF_MOV64_IMM(BPF_REG_0, 0),
8186 #if __BYTE_ORDER == __LITTLE_ENDIAN
8187                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8188                                     offsetof(struct __sk_buff, tc_classid)),
8189 #else
8190                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
8191                                     offsetof(struct __sk_buff, tc_classid) + 2),
8192 #endif
8193                         BPF_EXIT_INSN(),
8194                 },
8195                 .result = REJECT,
8196                 .errstr = "invalid bpf_context access",
8197                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8198         },
8199         {
8200                 "bounds checks mixing signed and unsigned, positive bounds",
8201                 .insns = {
8202                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8203                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8204                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8205                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8206                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8207                                      BPF_FUNC_map_lookup_elem),
8208                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8209                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8210                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8211                         BPF_MOV64_IMM(BPF_REG_2, 2),
8212                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
8213                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
8214                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8215                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8216                         BPF_MOV64_IMM(BPF_REG_0, 0),
8217                         BPF_EXIT_INSN(),
8218                 },
8219                 .fixup_map_hash_8b = { 3 },
8220                 .errstr = "unbounded min value",
8221                 .result = REJECT,
8222         },
8223         {
8224                 "bounds checks mixing signed and unsigned",
8225                 .insns = {
8226                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8227                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8228                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8229                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8230                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8231                                      BPF_FUNC_map_lookup_elem),
8232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8233                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8234                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8235                         BPF_MOV64_IMM(BPF_REG_2, -1),
8236                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
8237                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8238                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8239                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8240                         BPF_MOV64_IMM(BPF_REG_0, 0),
8241                         BPF_EXIT_INSN(),
8242                 },
8243                 .fixup_map_hash_8b = { 3 },
8244                 .errstr = "unbounded min value",
8245                 .result = REJECT,
8246         },
8247         {
8248                 "bounds checks mixing signed and unsigned, variant 2",
8249                 .insns = {
8250                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8251                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8253                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8254                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8255                                      BPF_FUNC_map_lookup_elem),
8256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8257                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8258                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8259                         BPF_MOV64_IMM(BPF_REG_2, -1),
8260                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
8261                         BPF_MOV64_IMM(BPF_REG_8, 0),
8262                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
8263                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
8264                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
8265                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
8266                         BPF_MOV64_IMM(BPF_REG_0, 0),
8267                         BPF_EXIT_INSN(),
8268                 },
8269                 .fixup_map_hash_8b = { 3 },
8270                 .errstr = "unbounded min value",
8271                 .result = REJECT,
8272         },
8273         {
8274                 "bounds checks mixing signed and unsigned, variant 3",
8275                 .insns = {
8276                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8277                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8278                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8279                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8280                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8281                                      BPF_FUNC_map_lookup_elem),
8282                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8283                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8284                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8285                         BPF_MOV64_IMM(BPF_REG_2, -1),
8286                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
8287                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
8288                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
8289                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
8290                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
8291                         BPF_MOV64_IMM(BPF_REG_0, 0),
8292                         BPF_EXIT_INSN(),
8293                 },
8294                 .fixup_map_hash_8b = { 3 },
8295                 .errstr = "unbounded min value",
8296                 .result = REJECT,
8297         },
8298         {
8299                 "bounds checks mixing signed and unsigned, variant 4",
8300                 .insns = {
8301                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8302                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8303                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8304                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8305                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8306                                      BPF_FUNC_map_lookup_elem),
8307                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8308                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8309                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8310                         BPF_MOV64_IMM(BPF_REG_2, 1),
8311                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
8312                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8313                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8314                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8315                         BPF_MOV64_IMM(BPF_REG_0, 0),
8316                         BPF_EXIT_INSN(),
8317                 },
8318                 .fixup_map_hash_8b = { 3 },
8319                 .result = ACCEPT,
8320         },
8321         {
8322                 "bounds checks mixing signed and unsigned, variant 5",
8323                 .insns = {
8324                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8325                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8326                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8327                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8328                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8329                                      BPF_FUNC_map_lookup_elem),
8330                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8331                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8332                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8333                         BPF_MOV64_IMM(BPF_REG_2, -1),
8334                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
8335                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
8336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
8337                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
8338                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8339                         BPF_MOV64_IMM(BPF_REG_0, 0),
8340                         BPF_EXIT_INSN(),
8341                 },
8342                 .fixup_map_hash_8b = { 3 },
8343                 .errstr = "unbounded min value",
8344                 .result = REJECT,
8345         },
8346         {
8347                 "bounds checks mixing signed and unsigned, variant 6",
8348                 .insns = {
8349                         BPF_MOV64_IMM(BPF_REG_2, 0),
8350                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
8351                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
8352                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8353                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
8354                         BPF_MOV64_IMM(BPF_REG_6, -1),
8355                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
8356                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
8357                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8358                         BPF_MOV64_IMM(BPF_REG_5, 0),
8359                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
8360                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8361                                      BPF_FUNC_skb_load_bytes),
8362                         BPF_MOV64_IMM(BPF_REG_0, 0),
8363                         BPF_EXIT_INSN(),
8364                 },
8365                 .errstr = "R4 min value is negative, either use unsigned",
8366                 .result = REJECT,
8367         },
8368         {
8369                 "bounds checks mixing signed and unsigned, variant 7",
8370                 .insns = {
8371                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8372                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8373                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8374                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8375                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8376                                      BPF_FUNC_map_lookup_elem),
8377                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8378                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8379                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8380                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
8381                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
8382                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8383                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8384                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8385                         BPF_MOV64_IMM(BPF_REG_0, 0),
8386                         BPF_EXIT_INSN(),
8387                 },
8388                 .fixup_map_hash_8b = { 3 },
8389                 .result = ACCEPT,
8390         },
8391         {
8392                 "bounds checks mixing signed and unsigned, variant 8",
8393                 .insns = {
8394                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8395                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8396                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8397                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8398                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8399                                      BPF_FUNC_map_lookup_elem),
8400                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8401                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8402                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8403                         BPF_MOV64_IMM(BPF_REG_2, -1),
8404                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8405                         BPF_MOV64_IMM(BPF_REG_0, 0),
8406                         BPF_EXIT_INSN(),
8407                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8408                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8409                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8410                         BPF_MOV64_IMM(BPF_REG_0, 0),
8411                         BPF_EXIT_INSN(),
8412                 },
8413                 .fixup_map_hash_8b = { 3 },
8414                 .errstr = "unbounded min value",
8415                 .result = REJECT,
8416         },
8417         {
8418                 "bounds checks mixing signed and unsigned, variant 9",
8419                 .insns = {
8420                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8421                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8422                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8423                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8424                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8425                                      BPF_FUNC_map_lookup_elem),
8426                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
8427                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8428                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8429                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
8430                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8431                         BPF_MOV64_IMM(BPF_REG_0, 0),
8432                         BPF_EXIT_INSN(),
8433                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8434                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8435                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8436                         BPF_MOV64_IMM(BPF_REG_0, 0),
8437                         BPF_EXIT_INSN(),
8438                 },
8439                 .fixup_map_hash_8b = { 3 },
8440                 .result = ACCEPT,
8441         },
8442         {
8443                 "bounds checks mixing signed and unsigned, variant 10",
8444                 .insns = {
8445                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8446                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8447                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8448                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8449                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8450                                      BPF_FUNC_map_lookup_elem),
8451                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8452                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8453                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8454                         BPF_MOV64_IMM(BPF_REG_2, 0),
8455                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8456                         BPF_MOV64_IMM(BPF_REG_0, 0),
8457                         BPF_EXIT_INSN(),
8458                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8459                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8460                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8461                         BPF_MOV64_IMM(BPF_REG_0, 0),
8462                         BPF_EXIT_INSN(),
8463                 },
8464                 .fixup_map_hash_8b = { 3 },
8465                 .errstr = "unbounded min value",
8466                 .result = REJECT,
8467         },
8468         {
8469                 "bounds checks mixing signed and unsigned, variant 11",
8470                 .insns = {
8471                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8472                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8473                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8474                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8475                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8476                                      BPF_FUNC_map_lookup_elem),
8477                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8478                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8479                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8480                         BPF_MOV64_IMM(BPF_REG_2, -1),
8481                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8482                         /* Dead branch. */
8483                         BPF_MOV64_IMM(BPF_REG_0, 0),
8484                         BPF_EXIT_INSN(),
8485                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8486                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8487                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8488                         BPF_MOV64_IMM(BPF_REG_0, 0),
8489                         BPF_EXIT_INSN(),
8490                 },
8491                 .fixup_map_hash_8b = { 3 },
8492                 .errstr = "unbounded min value",
8493                 .result = REJECT,
8494         },
8495         {
8496                 "bounds checks mixing signed and unsigned, variant 12",
8497                 .insns = {
8498                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8499                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8501                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8502                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8503                                      BPF_FUNC_map_lookup_elem),
8504                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8505                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8506                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8507                         BPF_MOV64_IMM(BPF_REG_2, -6),
8508                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8509                         BPF_MOV64_IMM(BPF_REG_0, 0),
8510                         BPF_EXIT_INSN(),
8511                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8512                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8513                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8514                         BPF_MOV64_IMM(BPF_REG_0, 0),
8515                         BPF_EXIT_INSN(),
8516                 },
8517                 .fixup_map_hash_8b = { 3 },
8518                 .errstr = "unbounded min value",
8519                 .result = REJECT,
8520         },
8521         {
8522                 "bounds checks mixing signed and unsigned, variant 13",
8523                 .insns = {
8524                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8525                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8526                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8527                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8528                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8529                                      BPF_FUNC_map_lookup_elem),
8530                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8531                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8532                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8533                         BPF_MOV64_IMM(BPF_REG_2, 2),
8534                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8535                         BPF_MOV64_IMM(BPF_REG_7, 1),
8536                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
8537                         BPF_MOV64_IMM(BPF_REG_0, 0),
8538                         BPF_EXIT_INSN(),
8539                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
8540                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
8541                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
8542                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8543                         BPF_MOV64_IMM(BPF_REG_0, 0),
8544                         BPF_EXIT_INSN(),
8545                 },
8546                 .fixup_map_hash_8b = { 3 },
8547                 .errstr = "unbounded min value",
8548                 .result = REJECT,
8549         },
8550         {
8551                 "bounds checks mixing signed and unsigned, variant 14",
8552                 .insns = {
8553                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
8554                                     offsetof(struct __sk_buff, mark)),
8555                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8556                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8557                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8558                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8559                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8560                                      BPF_FUNC_map_lookup_elem),
8561                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8562                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8563                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8564                         BPF_MOV64_IMM(BPF_REG_2, -1),
8565                         BPF_MOV64_IMM(BPF_REG_8, 2),
8566                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
8567                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
8568                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8569                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8570                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8571                         BPF_MOV64_IMM(BPF_REG_0, 0),
8572                         BPF_EXIT_INSN(),
8573                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
8574                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
8575                 },
8576                 .fixup_map_hash_8b = { 4 },
8577                 .errstr = "R0 invalid mem access 'inv'",
8578                 .result = REJECT,
8579         },
8580         {
8581                 "bounds checks mixing signed and unsigned, variant 15",
8582                 .insns = {
8583                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8584                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8586                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8587                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8588                                      BPF_FUNC_map_lookup_elem),
8589                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8590                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8591                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8592                         BPF_MOV64_IMM(BPF_REG_2, -6),
8593                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8594                         BPF_MOV64_IMM(BPF_REG_0, 0),
8595                         BPF_EXIT_INSN(),
8596                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8597                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
8598                         BPF_MOV64_IMM(BPF_REG_0, 0),
8599                         BPF_EXIT_INSN(),
8600                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8601                         BPF_MOV64_IMM(BPF_REG_0, 0),
8602                         BPF_EXIT_INSN(),
8603                 },
8604                 .fixup_map_hash_8b = { 3 },
8605                 .errstr = "unbounded min value",
8606                 .result = REJECT,
8607                 .result_unpriv = REJECT,
8608         },
8609         {
8610                 "subtraction bounds (map value) variant 1",
8611                 .insns = {
8612                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8613                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8614                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8615                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8616                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8617                                      BPF_FUNC_map_lookup_elem),
8618                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8619                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8620                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
8621                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
8622                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
8623                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
8624                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
8625                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8626                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8627                         BPF_EXIT_INSN(),
8628                         BPF_MOV64_IMM(BPF_REG_0, 0),
8629                         BPF_EXIT_INSN(),
8630                 },
8631                 .fixup_map_hash_8b = { 3 },
8632                 .errstr = "R0 max value is outside of the array range",
8633                 .result = REJECT,
8634         },
8635         {
8636                 "subtraction bounds (map value) variant 2",
8637                 .insns = {
8638                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8639                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8640                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8641                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8642                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8643                                      BPF_FUNC_map_lookup_elem),
8644                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8645                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8646                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
8647                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
8648                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
8649                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
8650                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8651                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8652                         BPF_EXIT_INSN(),
8653                         BPF_MOV64_IMM(BPF_REG_0, 0),
8654                         BPF_EXIT_INSN(),
8655                 },
8656                 .fixup_map_hash_8b = { 3 },
8657                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
8658                 .result = REJECT,
8659         },
8660         {
8661                 "bounds check based on zero-extended MOV",
8662                 .insns = {
8663                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8664                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8665                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8666                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8667                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8668                                      BPF_FUNC_map_lookup_elem),
8669                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8670                         /* r2 = 0x0000'0000'ffff'ffff */
8671                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
8672                         /* r2 = 0 */
8673                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
8674                         /* no-op */
8675                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8676                         /* access at offset 0 */
8677                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8678                         /* exit */
8679                         BPF_MOV64_IMM(BPF_REG_0, 0),
8680                         BPF_EXIT_INSN(),
8681                 },
8682                 .fixup_map_hash_8b = { 3 },
8683                 .result = ACCEPT
8684         },
8685         {
8686                 "bounds check based on sign-extended MOV. test1",
8687                 .insns = {
8688                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8689                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8690                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8691                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8692                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8693                                      BPF_FUNC_map_lookup_elem),
8694                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8695                         /* r2 = 0xffff'ffff'ffff'ffff */
8696                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
8697                         /* r2 = 0xffff'ffff */
8698                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
8699                         /* r0 = <oob pointer> */
8700                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8701                         /* access to OOB pointer */
8702                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8703                         /* exit */
8704                         BPF_MOV64_IMM(BPF_REG_0, 0),
8705                         BPF_EXIT_INSN(),
8706                 },
8707                 .fixup_map_hash_8b = { 3 },
8708                 .errstr = "map_value pointer and 4294967295",
8709                 .result = REJECT
8710         },
8711         {
8712                 "bounds check based on sign-extended MOV. test2",
8713                 .insns = {
8714                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8715                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8717                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8718                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8719                                      BPF_FUNC_map_lookup_elem),
8720                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8721                         /* r2 = 0xffff'ffff'ffff'ffff */
8722                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
8723                         /* r2 = 0xfff'ffff */
8724                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
8725                         /* r0 = <oob pointer> */
8726                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8727                         /* access to OOB pointer */
8728                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8729                         /* exit */
8730                         BPF_MOV64_IMM(BPF_REG_0, 0),
8731                         BPF_EXIT_INSN(),
8732                 },
8733                 .fixup_map_hash_8b = { 3 },
8734                 .errstr = "R0 min value is outside of the array range",
8735                 .result = REJECT
8736         },
8737         {
8738                 "bounds check based on reg_off + var_off + insn_off. test1",
8739                 .insns = {
8740                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8741                                     offsetof(struct __sk_buff, mark)),
8742                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8743                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8744                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8745                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8746                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8747                                      BPF_FUNC_map_lookup_elem),
8748                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8749                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8750                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
8751                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8752                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8753                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8754                         BPF_MOV64_IMM(BPF_REG_0, 0),
8755                         BPF_EXIT_INSN(),
8756                 },
8757                 .fixup_map_hash_8b = { 4 },
8758                 .errstr = "value_size=8 off=1073741825",
8759                 .result = REJECT,
8760                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8761         },
8762         {
8763                 "bounds check based on reg_off + var_off + insn_off. test2",
8764                 .insns = {
8765                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8766                                     offsetof(struct __sk_buff, mark)),
8767                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8768                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8769                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8770                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8771                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8772                                      BPF_FUNC_map_lookup_elem),
8773                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8774                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8775                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
8776                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8778                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8779                         BPF_MOV64_IMM(BPF_REG_0, 0),
8780                         BPF_EXIT_INSN(),
8781                 },
8782                 .fixup_map_hash_8b = { 4 },
8783                 .errstr = "value 1073741823",
8784                 .result = REJECT,
8785                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8786         },
8787         {
8788                 "bounds check after truncation of non-boundary-crossing range",
8789                 .insns = {
8790                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8791                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8792                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8793                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8794                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8795                                      BPF_FUNC_map_lookup_elem),
8796                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8797                         /* r1 = [0x00, 0xff] */
8798                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8799                         BPF_MOV64_IMM(BPF_REG_2, 1),
8800                         /* r2 = 0x10'0000'0000 */
8801                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
8802                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
8803                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8804                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
8805                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8806                         /* r1 = [0x00, 0xff] */
8807                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
8808                         /* r1 = 0 */
8809                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8810                         /* no-op */
8811                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8812                         /* access at offset 0 */
8813                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8814                         /* exit */
8815                         BPF_MOV64_IMM(BPF_REG_0, 0),
8816                         BPF_EXIT_INSN(),
8817                 },
8818                 .fixup_map_hash_8b = { 3 },
8819                 .result = ACCEPT
8820         },
8821         {
8822                 "bounds check after truncation of boundary-crossing range (1)",
8823                 .insns = {
8824                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8825                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8826                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8827                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8828                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8829                                      BPF_FUNC_map_lookup_elem),
8830                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8831                         /* r1 = [0x00, 0xff] */
8832                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8833                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8834                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8836                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8837                          *      [0x0000'0000, 0x0000'007f]
8838                          */
8839                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
8840                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8841                         /* r1 = [0x00, 0xff] or
8842                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8843                          */
8844                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8845                         /* r1 = 0 or
8846                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8847                          */
8848                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8849                         /* no-op or OOB pointer computation */
8850                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8851                         /* potentially OOB access */
8852                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8853                         /* exit */
8854                         BPF_MOV64_IMM(BPF_REG_0, 0),
8855                         BPF_EXIT_INSN(),
8856                 },
8857                 .fixup_map_hash_8b = { 3 },
8858                 /* not actually fully unbounded, but the bound is very high */
8859                 .errstr = "R0 unbounded memory access",
8860                 .result = REJECT
8861         },
8862         {
8863                 "bounds check after truncation of boundary-crossing range (2)",
8864                 .insns = {
8865                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8866                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8867                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8868                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8869                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8870                                      BPF_FUNC_map_lookup_elem),
8871                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8872                         /* r1 = [0x00, 0xff] */
8873                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8874                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8875                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8876                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8877                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8878                          *      [0x0000'0000, 0x0000'007f]
8879                          * difference to previous test: truncation via MOV32
8880                          * instead of ALU32.
8881                          */
8882                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
8883                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8884                         /* r1 = [0x00, 0xff] or
8885                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8886                          */
8887                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8888                         /* r1 = 0 or
8889                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8890                          */
8891                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8892                         /* no-op or OOB pointer computation */
8893                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8894                         /* potentially OOB access */
8895                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8896                         /* exit */
8897                         BPF_MOV64_IMM(BPF_REG_0, 0),
8898                         BPF_EXIT_INSN(),
8899                 },
8900                 .fixup_map_hash_8b = { 3 },
8901                 /* not actually fully unbounded, but the bound is very high */
8902                 .errstr = "R0 unbounded memory access",
8903                 .result = REJECT
8904         },
8905         {
8906                 "bounds check after wrapping 32-bit addition",
8907                 .insns = {
8908                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8909                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8910                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8911                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8912                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8913                                      BPF_FUNC_map_lookup_elem),
8914                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
8915                         /* r1 = 0x7fff'ffff */
8916                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
8917                         /* r1 = 0xffff'fffe */
8918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8919                         /* r1 = 0 */
8920                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
8921                         /* no-op */
8922                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8923                         /* access at offset 0 */
8924                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8925                         /* exit */
8926                         BPF_MOV64_IMM(BPF_REG_0, 0),
8927                         BPF_EXIT_INSN(),
8928                 },
8929                 .fixup_map_hash_8b = { 3 },
8930                 .result = ACCEPT
8931         },
8932         {
8933                 "bounds check after shift with oversized count operand",
8934                 .insns = {
8935                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8936                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8937                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8938                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8940                                      BPF_FUNC_map_lookup_elem),
8941                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8942                         BPF_MOV64_IMM(BPF_REG_2, 32),
8943                         BPF_MOV64_IMM(BPF_REG_1, 1),
8944                         /* r1 = (u32)1 << (u32)32 = ? */
8945                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
8946                         /* r1 = [0x0000, 0xffff] */
8947                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
8948                         /* computes unknown pointer, potentially OOB */
8949                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8950                         /* potentially OOB access */
8951                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8952                         /* exit */
8953                         BPF_MOV64_IMM(BPF_REG_0, 0),
8954                         BPF_EXIT_INSN(),
8955                 },
8956                 .fixup_map_hash_8b = { 3 },
8957                 .errstr = "R0 max value is outside of the array range",
8958                 .result = REJECT
8959         },
8960         {
8961                 "bounds check after right shift of maybe-negative number",
8962                 .insns = {
8963                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8964                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8965                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8966                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8968                                      BPF_FUNC_map_lookup_elem),
8969                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8970                         /* r1 = [0x00, 0xff] */
8971                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8972                         /* r1 = [-0x01, 0xfe] */
8973                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
8974                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
8975                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8976                         /* r1 = 0 or 0xffff'ffff'ffff */
8977                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8978                         /* computes unknown pointer, potentially OOB */
8979                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8980                         /* potentially OOB access */
8981                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8982                         /* exit */
8983                         BPF_MOV64_IMM(BPF_REG_0, 0),
8984                         BPF_EXIT_INSN(),
8985                 },
8986                 .fixup_map_hash_8b = { 3 },
8987                 .errstr = "R0 unbounded memory access",
8988                 .result = REJECT
8989         },
8990         {
8991                 "bounds check map access with off+size signed 32bit overflow. test1",
8992                 .insns = {
8993                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8994                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8996                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8997                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8998                                      BPF_FUNC_map_lookup_elem),
8999                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9000                         BPF_EXIT_INSN(),
9001                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
9002                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
9003                         BPF_JMP_A(0),
9004                         BPF_EXIT_INSN(),
9005                 },
9006                 .fixup_map_hash_8b = { 3 },
9007                 .errstr = "map_value pointer and 2147483646",
9008                 .result = REJECT
9009         },
9010         {
9011                 "bounds check map access with off+size signed 32bit overflow. test2",
9012                 .insns = {
9013                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9014                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9015                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9016                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9017                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9018                                      BPF_FUNC_map_lookup_elem),
9019                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9020                         BPF_EXIT_INSN(),
9021                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
9022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
9023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
9024                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
9025                         BPF_JMP_A(0),
9026                         BPF_EXIT_INSN(),
9027                 },
9028                 .fixup_map_hash_8b = { 3 },
9029                 .errstr = "pointer offset 1073741822",
9030                 .result = REJECT
9031         },
9032         {
9033                 "bounds check map access with off+size signed 32bit overflow. test3",
9034                 .insns = {
9035                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9036                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9037                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9038                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9039                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9040                                      BPF_FUNC_map_lookup_elem),
9041                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9042                         BPF_EXIT_INSN(),
9043                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
9044                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
9045                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
9046                         BPF_JMP_A(0),
9047                         BPF_EXIT_INSN(),
9048                 },
9049                 .fixup_map_hash_8b = { 3 },
9050                 .errstr = "pointer offset -1073741822",
9051                 .result = REJECT
9052         },
9053         {
9054                 "bounds check map access with off+size signed 32bit overflow. test4",
9055                 .insns = {
9056                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9057                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9058                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9059                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9060                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9061                                      BPF_FUNC_map_lookup_elem),
9062                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9063                         BPF_EXIT_INSN(),
9064                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
9065                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
9066                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
9067                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
9068                         BPF_JMP_A(0),
9069                         BPF_EXIT_INSN(),
9070                 },
9071                 .fixup_map_hash_8b = { 3 },
9072                 .errstr = "map_value pointer and 1000000000000",
9073                 .result = REJECT
9074         },
9075         {
9076                 "pointer/scalar confusion in state equality check (way 1)",
9077                 .insns = {
9078                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9079                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9080                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9081                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9082                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9083                                      BPF_FUNC_map_lookup_elem),
9084                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
9085                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
9086                         BPF_JMP_A(1),
9087                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
9088                         BPF_JMP_A(0),
9089                         BPF_EXIT_INSN(),
9090                 },
9091                 .fixup_map_hash_8b = { 3 },
9092                 .result = ACCEPT,
9093                 .retval = POINTER_VALUE,
9094                 .result_unpriv = REJECT,
9095                 .errstr_unpriv = "R0 leaks addr as return value"
9096         },
9097         {
9098                 "pointer/scalar confusion in state equality check (way 2)",
9099                 .insns = {
9100                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9103                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9104                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9105                                      BPF_FUNC_map_lookup_elem),
9106                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
9107                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
9108                         BPF_JMP_A(1),
9109                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
9110                         BPF_EXIT_INSN(),
9111                 },
9112                 .fixup_map_hash_8b = { 3 },
9113                 .result = ACCEPT,
9114                 .retval = POINTER_VALUE,
9115                 .result_unpriv = REJECT,
9116                 .errstr_unpriv = "R0 leaks addr as return value"
9117         },
9118         {
9119                 "variable-offset ctx access",
9120                 .insns = {
9121                         /* Get an unknown value */
9122                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
9123                         /* Make it small and 4-byte aligned */
9124                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
9125                         /* add it to skb.  We now have either &skb->len or
9126                          * &skb->pkt_type, but we don't know which
9127                          */
9128                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
9129                         /* dereference it */
9130                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9131                         BPF_EXIT_INSN(),
9132                 },
9133                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
9134                 .result = REJECT,
9135                 .prog_type = BPF_PROG_TYPE_LWT_IN,
9136         },
9137         {
9138                 "variable-offset stack access",
9139                 .insns = {
9140                         /* Fill the top 8 bytes of the stack */
9141                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9142                         /* Get an unknown value */
9143                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
9144                         /* Make it small and 4-byte aligned */
9145                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
9146                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
9147                         /* add it to fp.  We now have either fp-4 or fp-8, but
9148                          * we don't know which
9149                          */
9150                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
9151                         /* dereference it */
9152                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
9153                         BPF_EXIT_INSN(),
9154                 },
9155                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
9156                 .result = REJECT,
9157                 .prog_type = BPF_PROG_TYPE_LWT_IN,
9158         },
9159         {
9160                 "indirect variable-offset stack access",
9161                 .insns = {
9162                         /* Fill the top 8 bytes of the stack */
9163                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9164                         /* Get an unknown value */
9165                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
9166                         /* Make it small and 4-byte aligned */
9167                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
9168                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
9169                         /* add it to fp.  We now have either fp-4 or fp-8, but
9170                          * we don't know which
9171                          */
9172                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
9173                         /* dereference it indirectly */
9174                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9175                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9176                                      BPF_FUNC_map_lookup_elem),
9177                         BPF_MOV64_IMM(BPF_REG_0, 0),
9178                         BPF_EXIT_INSN(),
9179                 },
9180                 .fixup_map_hash_8b = { 5 },
9181                 .errstr = "variable stack read R2",
9182                 .result = REJECT,
9183                 .prog_type = BPF_PROG_TYPE_LWT_IN,
9184         },
9185         {
9186                 "direct stack access with 32-bit wraparound. test1",
9187                 .insns = {
9188                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9189                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
9190                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
9191                         BPF_MOV32_IMM(BPF_REG_0, 0),
9192                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
9193                         BPF_EXIT_INSN()
9194                 },
9195                 .errstr = "fp pointer and 2147483647",
9196                 .result = REJECT
9197         },
9198         {
9199                 "direct stack access with 32-bit wraparound. test2",
9200                 .insns = {
9201                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9202                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
9203                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
9204                         BPF_MOV32_IMM(BPF_REG_0, 0),
9205                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
9206                         BPF_EXIT_INSN()
9207                 },
9208                 .errstr = "fp pointer and 1073741823",
9209                 .result = REJECT
9210         },
9211         {
9212                 "direct stack access with 32-bit wraparound. test3",
9213                 .insns = {
9214                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9215                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
9216                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
9217                         BPF_MOV32_IMM(BPF_REG_0, 0),
9218                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
9219                         BPF_EXIT_INSN()
9220                 },
9221                 .errstr = "fp pointer offset 1073741822",
9222                 .result = REJECT
9223         },
9224         {
9225                 "liveness pruning and write screening",
9226                 .insns = {
9227                         /* Get an unknown value */
9228                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
9229                         /* branch conditions teach us nothing about R2 */
9230                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
9231                         BPF_MOV64_IMM(BPF_REG_0, 0),
9232                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
9233                         BPF_MOV64_IMM(BPF_REG_0, 0),
9234                         BPF_EXIT_INSN(),
9235                 },
9236                 .errstr = "R0 !read_ok",
9237                 .result = REJECT,
9238                 .prog_type = BPF_PROG_TYPE_LWT_IN,
9239         },
9240         {
9241                 "varlen_map_value_access pruning",
9242                 .insns = {
9243                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9244                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9245                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9246                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9247                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9248                                      BPF_FUNC_map_lookup_elem),
9249                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
9250                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
9251                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
9252                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
9253                         BPF_MOV32_IMM(BPF_REG_1, 0),
9254                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
9255                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
9256                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
9257                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
9258                                    offsetof(struct test_val, foo)),
9259                         BPF_EXIT_INSN(),
9260                 },
9261                 .fixup_map_hash_48b = { 3 },
9262                 .errstr_unpriv = "R0 leaks addr",
9263                 .errstr = "R0 unbounded memory access",
9264                 .result_unpriv = REJECT,
9265                 .result = REJECT,
9266                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9267         },
9268         {
9269                 "invalid 64-bit BPF_END",
9270                 .insns = {
9271                         BPF_MOV32_IMM(BPF_REG_0, 0),
9272                         {
9273                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
9274                                 .dst_reg = BPF_REG_0,
9275                                 .src_reg = 0,
9276                                 .off   = 0,
9277                                 .imm   = 32,
9278                         },
9279                         BPF_EXIT_INSN(),
9280                 },
9281                 .errstr = "unknown opcode d7",
9282                 .result = REJECT,
9283         },
9284         {
9285                 "XDP, using ifindex from netdev",
9286                 .insns = {
9287                         BPF_MOV64_IMM(BPF_REG_0, 0),
9288                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9289                                     offsetof(struct xdp_md, ingress_ifindex)),
9290                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
9291                         BPF_MOV64_IMM(BPF_REG_0, 1),
9292                         BPF_EXIT_INSN(),
9293                 },
9294                 .result = ACCEPT,
9295                 .prog_type = BPF_PROG_TYPE_XDP,
9296                 .retval = 1,
9297         },
9298         {
9299                 "meta access, test1",
9300                 .insns = {
9301                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9302                                     offsetof(struct xdp_md, data_meta)),
9303                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9304                                     offsetof(struct xdp_md, data)),
9305                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9306                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9307                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9308                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9309                         BPF_MOV64_IMM(BPF_REG_0, 0),
9310                         BPF_EXIT_INSN(),
9311                 },
9312                 .result = ACCEPT,
9313                 .prog_type = BPF_PROG_TYPE_XDP,
9314         },
9315         {
9316                 "meta access, test2",
9317                 .insns = {
9318                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9319                                     offsetof(struct xdp_md, data_meta)),
9320                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9321                                     offsetof(struct xdp_md, data)),
9322                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9323                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
9324                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9325                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9326                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9327                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9328                         BPF_MOV64_IMM(BPF_REG_0, 0),
9329                         BPF_EXIT_INSN(),
9330                 },
9331                 .result = REJECT,
9332                 .errstr = "invalid access to packet, off=-8",
9333                 .prog_type = BPF_PROG_TYPE_XDP,
9334         },
9335         {
9336                 "meta access, test3",
9337                 .insns = {
9338                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9339                                     offsetof(struct xdp_md, data_meta)),
9340                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9341                                     offsetof(struct xdp_md, data_end)),
9342                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9343                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9344                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9345                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9346                         BPF_MOV64_IMM(BPF_REG_0, 0),
9347                         BPF_EXIT_INSN(),
9348                 },
9349                 .result = REJECT,
9350                 .errstr = "invalid access to packet",
9351                 .prog_type = BPF_PROG_TYPE_XDP,
9352         },
9353         {
9354                 "meta access, test4",
9355                 .insns = {
9356                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9357                                     offsetof(struct xdp_md, data_meta)),
9358                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9359                                     offsetof(struct xdp_md, data_end)),
9360                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9361                                     offsetof(struct xdp_md, data)),
9362                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
9363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9364                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9365                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9366                         BPF_MOV64_IMM(BPF_REG_0, 0),
9367                         BPF_EXIT_INSN(),
9368                 },
9369                 .result = REJECT,
9370                 .errstr = "invalid access to packet",
9371                 .prog_type = BPF_PROG_TYPE_XDP,
9372         },
9373         {
9374                 "meta access, test5",
9375                 .insns = {
9376                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9377                                     offsetof(struct xdp_md, data_meta)),
9378                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9379                                     offsetof(struct xdp_md, data)),
9380                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9382                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
9383                         BPF_MOV64_IMM(BPF_REG_2, -8),
9384                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9385                                      BPF_FUNC_xdp_adjust_meta),
9386                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
9387                         BPF_MOV64_IMM(BPF_REG_0, 0),
9388                         BPF_EXIT_INSN(),
9389                 },
9390                 .result = REJECT,
9391                 .errstr = "R3 !read_ok",
9392                 .prog_type = BPF_PROG_TYPE_XDP,
9393         },
9394         {
9395                 "meta access, test6",
9396                 .insns = {
9397                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9398                                     offsetof(struct xdp_md, data_meta)),
9399                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9400                                     offsetof(struct xdp_md, data)),
9401                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9402                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9403                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9405                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
9406                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9407                         BPF_MOV64_IMM(BPF_REG_0, 0),
9408                         BPF_EXIT_INSN(),
9409                 },
9410                 .result = REJECT,
9411                 .errstr = "invalid access to packet",
9412                 .prog_type = BPF_PROG_TYPE_XDP,
9413         },
9414         {
9415                 "meta access, test7",
9416                 .insns = {
9417                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9418                                     offsetof(struct xdp_md, data_meta)),
9419                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9420                                     offsetof(struct xdp_md, data)),
9421                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9422                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9423                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9424                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9425                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9426                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9427                         BPF_MOV64_IMM(BPF_REG_0, 0),
9428                         BPF_EXIT_INSN(),
9429                 },
9430                 .result = ACCEPT,
9431                 .prog_type = BPF_PROG_TYPE_XDP,
9432         },
9433         {
9434                 "meta access, test8",
9435                 .insns = {
9436                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9437                                     offsetof(struct xdp_md, data_meta)),
9438                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9439                                     offsetof(struct xdp_md, data)),
9440                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9441                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
9442                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9443                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9444                         BPF_MOV64_IMM(BPF_REG_0, 0),
9445                         BPF_EXIT_INSN(),
9446                 },
9447                 .result = ACCEPT,
9448                 .prog_type = BPF_PROG_TYPE_XDP,
9449         },
9450         {
9451                 "meta access, test9",
9452                 .insns = {
9453                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9454                                     offsetof(struct xdp_md, data_meta)),
9455                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9456                                     offsetof(struct xdp_md, data)),
9457                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9458                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
9459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
9460                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9461                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9462                         BPF_MOV64_IMM(BPF_REG_0, 0),
9463                         BPF_EXIT_INSN(),
9464                 },
9465                 .result = REJECT,
9466                 .errstr = "invalid access to packet",
9467                 .prog_type = BPF_PROG_TYPE_XDP,
9468         },
9469         {
9470                 "meta access, test10",
9471                 .insns = {
9472                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9473                                     offsetof(struct xdp_md, data_meta)),
9474                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9475                                     offsetof(struct xdp_md, data)),
9476                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9477                                     offsetof(struct xdp_md, data_end)),
9478                         BPF_MOV64_IMM(BPF_REG_5, 42),
9479                         BPF_MOV64_IMM(BPF_REG_6, 24),
9480                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
9481                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
9482                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
9483                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
9484                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
9485                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
9486                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
9487                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
9488                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
9489                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
9490                         BPF_MOV64_IMM(BPF_REG_0, 0),
9491                         BPF_EXIT_INSN(),
9492                 },
9493                 .result = REJECT,
9494                 .errstr = "invalid access to packet",
9495                 .prog_type = BPF_PROG_TYPE_XDP,
9496         },
9497         {
9498                 "meta access, test11",
9499                 .insns = {
9500                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9501                                     offsetof(struct xdp_md, data_meta)),
9502                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9503                                     offsetof(struct xdp_md, data)),
9504                         BPF_MOV64_IMM(BPF_REG_5, 42),
9505                         BPF_MOV64_IMM(BPF_REG_6, 24),
9506                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
9507                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
9508                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
9509                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
9510                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
9511                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
9512                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
9513                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
9514                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
9515                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
9516                         BPF_MOV64_IMM(BPF_REG_0, 0),
9517                         BPF_EXIT_INSN(),
9518                 },
9519                 .result = ACCEPT,
9520                 .prog_type = BPF_PROG_TYPE_XDP,
9521         },
9522         {
9523                 "meta access, test12",
9524                 .insns = {
9525                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9526                                     offsetof(struct xdp_md, data_meta)),
9527                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9528                                     offsetof(struct xdp_md, data)),
9529                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9530                                     offsetof(struct xdp_md, data_end)),
9531                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
9532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
9533                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
9534                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
9535                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
9536                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
9537                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
9538                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9539                         BPF_MOV64_IMM(BPF_REG_0, 0),
9540                         BPF_EXIT_INSN(),
9541                 },
9542                 .result = ACCEPT,
9543                 .prog_type = BPF_PROG_TYPE_XDP,
9544         },
9545         {
9546                 "arithmetic ops make PTR_TO_CTX unusable",
9547                 .insns = {
9548                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
9549                                       offsetof(struct __sk_buff, data) -
9550                                       offsetof(struct __sk_buff, mark)),
9551                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9552                                     offsetof(struct __sk_buff, mark)),
9553                         BPF_EXIT_INSN(),
9554                 },
9555                 .errstr = "dereference of modified ctx ptr",
9556                 .result = REJECT,
9557                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9558         },
9559         {
9560                 "pkt_end - pkt_start is allowed",
9561                 .insns = {
9562                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9563                                     offsetof(struct __sk_buff, data_end)),
9564                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9565                                     offsetof(struct __sk_buff, data)),
9566                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
9567                         BPF_EXIT_INSN(),
9568                 },
9569                 .result = ACCEPT,
9570                 .retval = TEST_DATA_LEN,
9571                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9572         },
9573         {
9574                 "XDP pkt read, pkt_end mangling, bad access 1",
9575                 .insns = {
9576                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9577                                     offsetof(struct xdp_md, data)),
9578                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9579                                     offsetof(struct xdp_md, data_end)),
9580                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9581                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9582                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
9583                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9584                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9585                         BPF_MOV64_IMM(BPF_REG_0, 0),
9586                         BPF_EXIT_INSN(),
9587                 },
9588                 .errstr = "R3 pointer arithmetic on pkt_end",
9589                 .result = REJECT,
9590                 .prog_type = BPF_PROG_TYPE_XDP,
9591         },
9592         {
9593                 "XDP pkt read, pkt_end mangling, bad access 2",
9594                 .insns = {
9595                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9596                                     offsetof(struct xdp_md, data)),
9597                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9598                                     offsetof(struct xdp_md, data_end)),
9599                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9600                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9601                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
9602                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9603                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9604                         BPF_MOV64_IMM(BPF_REG_0, 0),
9605                         BPF_EXIT_INSN(),
9606                 },
9607                 .errstr = "R3 pointer arithmetic on pkt_end",
9608                 .result = REJECT,
9609                 .prog_type = BPF_PROG_TYPE_XDP,
9610         },
9611         {
9612                 "XDP pkt read, pkt_data' > pkt_end, good access",
9613                 .insns = {
9614                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9615                                     offsetof(struct xdp_md, data)),
9616                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9617                                     offsetof(struct xdp_md, data_end)),
9618                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9619                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9620                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9621                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9622                         BPF_MOV64_IMM(BPF_REG_0, 0),
9623                         BPF_EXIT_INSN(),
9624                 },
9625                 .result = ACCEPT,
9626                 .prog_type = BPF_PROG_TYPE_XDP,
9627         },
9628         {
9629                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
9630                 .insns = {
9631                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9632                                     offsetof(struct xdp_md, data)),
9633                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9634                                     offsetof(struct xdp_md, data_end)),
9635                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9636                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9637                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9638                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9639                         BPF_MOV64_IMM(BPF_REG_0, 0),
9640                         BPF_EXIT_INSN(),
9641                 },
9642                 .errstr = "R1 offset is outside of the packet",
9643                 .result = REJECT,
9644                 .prog_type = BPF_PROG_TYPE_XDP,
9645                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9646         },
9647         {
9648                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
9649                 .insns = {
9650                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9651                                     offsetof(struct xdp_md, data)),
9652                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9653                                     offsetof(struct xdp_md, data_end)),
9654                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9655                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9656                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9657                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9658                         BPF_MOV64_IMM(BPF_REG_0, 0),
9659                         BPF_EXIT_INSN(),
9660                 },
9661                 .errstr = "R1 offset is outside of the packet",
9662                 .result = REJECT,
9663                 .prog_type = BPF_PROG_TYPE_XDP,
9664         },
9665         {
9666                 "XDP pkt read, pkt_end > pkt_data', good access",
9667                 .insns = {
9668                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9669                                     offsetof(struct xdp_md, data)),
9670                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9671                                     offsetof(struct xdp_md, data_end)),
9672                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9673                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9674                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9675                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9676                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9677                         BPF_MOV64_IMM(BPF_REG_0, 0),
9678                         BPF_EXIT_INSN(),
9679                 },
9680                 .result = ACCEPT,
9681                 .prog_type = BPF_PROG_TYPE_XDP,
9682                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9683         },
9684         {
9685                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
9686                 .insns = {
9687                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9688                                     offsetof(struct xdp_md, data)),
9689                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9690                                     offsetof(struct xdp_md, data_end)),
9691                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9693                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9694                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9695                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9696                         BPF_MOV64_IMM(BPF_REG_0, 0),
9697                         BPF_EXIT_INSN(),
9698                 },
9699                 .errstr = "R1 offset is outside of the packet",
9700                 .result = REJECT,
9701                 .prog_type = BPF_PROG_TYPE_XDP,
9702         },
9703         {
9704                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
9705                 .insns = {
9706                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9707                                     offsetof(struct xdp_md, data)),
9708                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9709                                     offsetof(struct xdp_md, data_end)),
9710                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9711                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9712                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9713                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9714                         BPF_MOV64_IMM(BPF_REG_0, 0),
9715                         BPF_EXIT_INSN(),
9716                 },
9717                 .errstr = "R1 offset is outside of the packet",
9718                 .result = REJECT,
9719                 .prog_type = BPF_PROG_TYPE_XDP,
9720         },
9721         {
9722                 "XDP pkt read, pkt_data' < pkt_end, good access",
9723                 .insns = {
9724                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9725                                     offsetof(struct xdp_md, data)),
9726                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9727                                     offsetof(struct xdp_md, data_end)),
9728                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9730                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9731                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9732                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9733                         BPF_MOV64_IMM(BPF_REG_0, 0),
9734                         BPF_EXIT_INSN(),
9735                 },
9736                 .result = ACCEPT,
9737                 .prog_type = BPF_PROG_TYPE_XDP,
9738                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9739         },
9740         {
9741                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
9742                 .insns = {
9743                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9744                                     offsetof(struct xdp_md, data)),
9745                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9746                                     offsetof(struct xdp_md, data_end)),
9747                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9748                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9749                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9750                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9751                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9752                         BPF_MOV64_IMM(BPF_REG_0, 0),
9753                         BPF_EXIT_INSN(),
9754                 },
9755                 .errstr = "R1 offset is outside of the packet",
9756                 .result = REJECT,
9757                 .prog_type = BPF_PROG_TYPE_XDP,
9758         },
9759         {
9760                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
9761                 .insns = {
9762                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9763                                     offsetof(struct xdp_md, data)),
9764                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9765                                     offsetof(struct xdp_md, data_end)),
9766                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9767                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9768                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9769                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9770                         BPF_MOV64_IMM(BPF_REG_0, 0),
9771                         BPF_EXIT_INSN(),
9772                 },
9773                 .errstr = "R1 offset is outside of the packet",
9774                 .result = REJECT,
9775                 .prog_type = BPF_PROG_TYPE_XDP,
9776         },
9777         {
9778                 "XDP pkt read, pkt_end < pkt_data', good access",
9779                 .insns = {
9780                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9781                                     offsetof(struct xdp_md, data)),
9782                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9783                                     offsetof(struct xdp_md, data_end)),
9784                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9785                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9786                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9787                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9788                         BPF_MOV64_IMM(BPF_REG_0, 0),
9789                         BPF_EXIT_INSN(),
9790                 },
9791                 .result = ACCEPT,
9792                 .prog_type = BPF_PROG_TYPE_XDP,
9793         },
9794         {
9795                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
9796                 .insns = {
9797                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9798                                     offsetof(struct xdp_md, data)),
9799                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9800                                     offsetof(struct xdp_md, data_end)),
9801                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9802                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9803                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9804                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9805                         BPF_MOV64_IMM(BPF_REG_0, 0),
9806                         BPF_EXIT_INSN(),
9807                 },
9808                 .errstr = "R1 offset is outside of the packet",
9809                 .result = REJECT,
9810                 .prog_type = BPF_PROG_TYPE_XDP,
9811                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9812         },
9813         {
9814                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
9815                 .insns = {
9816                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9817                                     offsetof(struct xdp_md, data)),
9818                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9819                                     offsetof(struct xdp_md, data_end)),
9820                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9821                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9822                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9823                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9824                         BPF_MOV64_IMM(BPF_REG_0, 0),
9825                         BPF_EXIT_INSN(),
9826                 },
9827                 .errstr = "R1 offset is outside of the packet",
9828                 .result = REJECT,
9829                 .prog_type = BPF_PROG_TYPE_XDP,
9830         },
9831         {
9832                 "XDP pkt read, pkt_data' >= pkt_end, good access",
9833                 .insns = {
9834                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9835                                     offsetof(struct xdp_md, data)),
9836                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9837                                     offsetof(struct xdp_md, data_end)),
9838                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9839                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9840                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9841                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9842                         BPF_MOV64_IMM(BPF_REG_0, 0),
9843                         BPF_EXIT_INSN(),
9844                 },
9845                 .result = ACCEPT,
9846                 .prog_type = BPF_PROG_TYPE_XDP,
9847                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9848         },
9849         {
9850                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
9851                 .insns = {
9852                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9853                                     offsetof(struct xdp_md, data)),
9854                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9855                                     offsetof(struct xdp_md, data_end)),
9856                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9857                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9858                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9859                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9860                         BPF_MOV64_IMM(BPF_REG_0, 0),
9861                         BPF_EXIT_INSN(),
9862                 },
9863                 .errstr = "R1 offset is outside of the packet",
9864                 .result = REJECT,
9865                 .prog_type = BPF_PROG_TYPE_XDP,
9866         },
9867         {
9868                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
9869                 .insns = {
9870                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9871                                     offsetof(struct xdp_md, data)),
9872                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9873                                     offsetof(struct xdp_md, data_end)),
9874                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9876                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9877                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9878                         BPF_MOV64_IMM(BPF_REG_0, 0),
9879                         BPF_EXIT_INSN(),
9880                 },
9881                 .errstr = "R1 offset is outside of the packet",
9882                 .result = REJECT,
9883                 .prog_type = BPF_PROG_TYPE_XDP,
9884                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9885         },
9886         {
9887                 "XDP pkt read, pkt_end >= pkt_data', good access",
9888                 .insns = {
9889                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9890                                     offsetof(struct xdp_md, data)),
9891                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9892                                     offsetof(struct xdp_md, data_end)),
9893                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9895                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9896                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9897                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9898                         BPF_MOV64_IMM(BPF_REG_0, 0),
9899                         BPF_EXIT_INSN(),
9900                 },
9901                 .result = ACCEPT,
9902                 .prog_type = BPF_PROG_TYPE_XDP,
9903         },
9904         {
9905                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
9906                 .insns = {
9907                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9908                                     offsetof(struct xdp_md, data)),
9909                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9910                                     offsetof(struct xdp_md, data_end)),
9911                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9912                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9913                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9914                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9915                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9916                         BPF_MOV64_IMM(BPF_REG_0, 0),
9917                         BPF_EXIT_INSN(),
9918                 },
9919                 .errstr = "R1 offset is outside of the packet",
9920                 .result = REJECT,
9921                 .prog_type = BPF_PROG_TYPE_XDP,
9922                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9923         },
9924         {
9925                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
9926                 .insns = {
9927                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9928                                     offsetof(struct xdp_md, data)),
9929                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9930                                     offsetof(struct xdp_md, data_end)),
9931                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9932                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9933                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9934                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9935                         BPF_MOV64_IMM(BPF_REG_0, 0),
9936                         BPF_EXIT_INSN(),
9937                 },
9938                 .errstr = "R1 offset is outside of the packet",
9939                 .result = REJECT,
9940                 .prog_type = BPF_PROG_TYPE_XDP,
9941         },
9942         {
9943                 "XDP pkt read, pkt_data' <= pkt_end, good access",
9944                 .insns = {
9945                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9946                                     offsetof(struct xdp_md, data)),
9947                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9948                                     offsetof(struct xdp_md, data_end)),
9949                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9950                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9951                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9952                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9953                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9954                         BPF_MOV64_IMM(BPF_REG_0, 0),
9955                         BPF_EXIT_INSN(),
9956                 },
9957                 .result = ACCEPT,
9958                 .prog_type = BPF_PROG_TYPE_XDP,
9959         },
9960         {
9961                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
9962                 .insns = {
9963                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9964                                     offsetof(struct xdp_md, data)),
9965                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9966                                     offsetof(struct xdp_md, data_end)),
9967                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9969                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9970                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9971                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9972                         BPF_MOV64_IMM(BPF_REG_0, 0),
9973                         BPF_EXIT_INSN(),
9974                 },
9975                 .errstr = "R1 offset is outside of the packet",
9976                 .result = REJECT,
9977                 .prog_type = BPF_PROG_TYPE_XDP,
9978                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9979         },
9980         {
9981                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
9982                 .insns = {
9983                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9984                                     offsetof(struct xdp_md, data)),
9985                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9986                                     offsetof(struct xdp_md, data_end)),
9987                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9989                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9990                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9991                         BPF_MOV64_IMM(BPF_REG_0, 0),
9992                         BPF_EXIT_INSN(),
9993                 },
9994                 .errstr = "R1 offset is outside of the packet",
9995                 .result = REJECT,
9996                 .prog_type = BPF_PROG_TYPE_XDP,
9997         },
9998         {
9999                 "XDP pkt read, pkt_end <= pkt_data', good access",
10000                 .insns = {
10001                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10002                                     offsetof(struct xdp_md, data)),
10003                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10004                                     offsetof(struct xdp_md, data_end)),
10005                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10007                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10008                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10009                         BPF_MOV64_IMM(BPF_REG_0, 0),
10010                         BPF_EXIT_INSN(),
10011                 },
10012                 .result = ACCEPT,
10013                 .prog_type = BPF_PROG_TYPE_XDP,
10014                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10015         },
10016         {
10017                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
10018                 .insns = {
10019                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10020                                     offsetof(struct xdp_md, data)),
10021                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10022                                     offsetof(struct xdp_md, data_end)),
10023                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10024                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10025                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10026                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10027                         BPF_MOV64_IMM(BPF_REG_0, 0),
10028                         BPF_EXIT_INSN(),
10029                 },
10030                 .errstr = "R1 offset is outside of the packet",
10031                 .result = REJECT,
10032                 .prog_type = BPF_PROG_TYPE_XDP,
10033         },
10034         {
10035                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
10036                 .insns = {
10037                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10038                                     offsetof(struct xdp_md, data)),
10039                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10040                                     offsetof(struct xdp_md, data_end)),
10041                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10042                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10043                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
10044                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10045                         BPF_MOV64_IMM(BPF_REG_0, 0),
10046                         BPF_EXIT_INSN(),
10047                 },
10048                 .errstr = "R1 offset is outside of the packet",
10049                 .result = REJECT,
10050                 .prog_type = BPF_PROG_TYPE_XDP,
10051                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10052         },
10053         {
10054                 "XDP pkt read, pkt_meta' > pkt_data, good access",
10055                 .insns = {
10056                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10057                                     offsetof(struct xdp_md, data_meta)),
10058                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10059                                     offsetof(struct xdp_md, data)),
10060                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10061                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10062                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
10063                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10064                         BPF_MOV64_IMM(BPF_REG_0, 0),
10065                         BPF_EXIT_INSN(),
10066                 },
10067                 .result = ACCEPT,
10068                 .prog_type = BPF_PROG_TYPE_XDP,
10069         },
10070         {
10071                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
10072                 .insns = {
10073                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10074                                     offsetof(struct xdp_md, data_meta)),
10075                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10076                                     offsetof(struct xdp_md, data)),
10077                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10078                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10079                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
10080                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10081                         BPF_MOV64_IMM(BPF_REG_0, 0),
10082                         BPF_EXIT_INSN(),
10083                 },
10084                 .errstr = "R1 offset is outside of the packet",
10085                 .result = REJECT,
10086                 .prog_type = BPF_PROG_TYPE_XDP,
10087                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10088         },
10089         {
10090                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
10091                 .insns = {
10092                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10093                                     offsetof(struct xdp_md, data_meta)),
10094                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10095                                     offsetof(struct xdp_md, data)),
10096                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10097                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10098                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
10099                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10100                         BPF_MOV64_IMM(BPF_REG_0, 0),
10101                         BPF_EXIT_INSN(),
10102                 },
10103                 .errstr = "R1 offset is outside of the packet",
10104                 .result = REJECT,
10105                 .prog_type = BPF_PROG_TYPE_XDP,
10106         },
10107         {
10108                 "XDP pkt read, pkt_data > pkt_meta', good access",
10109                 .insns = {
10110                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10111                                     offsetof(struct xdp_md, data_meta)),
10112                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10113                                     offsetof(struct xdp_md, data)),
10114                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10115                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10116                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
10117                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10118                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10119                         BPF_MOV64_IMM(BPF_REG_0, 0),
10120                         BPF_EXIT_INSN(),
10121                 },
10122                 .result = ACCEPT,
10123                 .prog_type = BPF_PROG_TYPE_XDP,
10124                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10125         },
10126         {
10127                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
10128                 .insns = {
10129                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10130                                     offsetof(struct xdp_md, data_meta)),
10131                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10132                                     offsetof(struct xdp_md, data)),
10133                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10135                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
10136                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10137                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10138                         BPF_MOV64_IMM(BPF_REG_0, 0),
10139                         BPF_EXIT_INSN(),
10140                 },
10141                 .errstr = "R1 offset is outside of the packet",
10142                 .result = REJECT,
10143                 .prog_type = BPF_PROG_TYPE_XDP,
10144         },
10145         {
10146                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
10147                 .insns = {
10148                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10149                                     offsetof(struct xdp_md, data_meta)),
10150                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10151                                     offsetof(struct xdp_md, data)),
10152                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10153                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10154                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
10155                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10156                         BPF_MOV64_IMM(BPF_REG_0, 0),
10157                         BPF_EXIT_INSN(),
10158                 },
10159                 .errstr = "R1 offset is outside of the packet",
10160                 .result = REJECT,
10161                 .prog_type = BPF_PROG_TYPE_XDP,
10162         },
10163         {
10164                 "XDP pkt read, pkt_meta' < pkt_data, good access",
10165                 .insns = {
10166                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10167                                     offsetof(struct xdp_md, data_meta)),
10168                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10169                                     offsetof(struct xdp_md, data)),
10170                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10171                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10172                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
10173                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10174                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10175                         BPF_MOV64_IMM(BPF_REG_0, 0),
10176                         BPF_EXIT_INSN(),
10177                 },
10178                 .result = ACCEPT,
10179                 .prog_type = BPF_PROG_TYPE_XDP,
10180                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10181         },
10182         {
10183                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
10184                 .insns = {
10185                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10186                                     offsetof(struct xdp_md, data_meta)),
10187                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10188                                     offsetof(struct xdp_md, data)),
10189                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10190                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10191                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
10192                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10193                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10194                         BPF_MOV64_IMM(BPF_REG_0, 0),
10195                         BPF_EXIT_INSN(),
10196                 },
10197                 .errstr = "R1 offset is outside of the packet",
10198                 .result = REJECT,
10199                 .prog_type = BPF_PROG_TYPE_XDP,
10200         },
10201         {
10202                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
10203                 .insns = {
10204                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10205                                     offsetof(struct xdp_md, data_meta)),
10206                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10207                                     offsetof(struct xdp_md, data)),
10208                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10210                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
10211                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10212                         BPF_MOV64_IMM(BPF_REG_0, 0),
10213                         BPF_EXIT_INSN(),
10214                 },
10215                 .errstr = "R1 offset is outside of the packet",
10216                 .result = REJECT,
10217                 .prog_type = BPF_PROG_TYPE_XDP,
10218         },
10219         {
10220                 "XDP pkt read, pkt_data < pkt_meta', good access",
10221                 .insns = {
10222                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10223                                     offsetof(struct xdp_md, data_meta)),
10224                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10225                                     offsetof(struct xdp_md, data)),
10226                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10227                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10228                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
10229                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10230                         BPF_MOV64_IMM(BPF_REG_0, 0),
10231                         BPF_EXIT_INSN(),
10232                 },
10233                 .result = ACCEPT,
10234                 .prog_type = BPF_PROG_TYPE_XDP,
10235         },
10236         {
10237                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
10238                 .insns = {
10239                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10240                                     offsetof(struct xdp_md, data_meta)),
10241                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10242                                     offsetof(struct xdp_md, data)),
10243                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10245                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
10246                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10247                         BPF_MOV64_IMM(BPF_REG_0, 0),
10248                         BPF_EXIT_INSN(),
10249                 },
10250                 .errstr = "R1 offset is outside of the packet",
10251                 .result = REJECT,
10252                 .prog_type = BPF_PROG_TYPE_XDP,
10253                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10254         },
10255         {
10256                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
10257                 .insns = {
10258                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10259                                     offsetof(struct xdp_md, data_meta)),
10260                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10261                                     offsetof(struct xdp_md, data)),
10262                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10264                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
10265                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10266                         BPF_MOV64_IMM(BPF_REG_0, 0),
10267                         BPF_EXIT_INSN(),
10268                 },
10269                 .errstr = "R1 offset is outside of the packet",
10270                 .result = REJECT,
10271                 .prog_type = BPF_PROG_TYPE_XDP,
10272         },
10273         {
10274                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
10275                 .insns = {
10276                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10277                                     offsetof(struct xdp_md, data_meta)),
10278                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10279                                     offsetof(struct xdp_md, data)),
10280                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10281                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10282                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
10283                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10284                         BPF_MOV64_IMM(BPF_REG_0, 0),
10285                         BPF_EXIT_INSN(),
10286                 },
10287                 .result = ACCEPT,
10288                 .prog_type = BPF_PROG_TYPE_XDP,
10289                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10290         },
10291         {
10292                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
10293                 .insns = {
10294                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10295                                     offsetof(struct xdp_md, data_meta)),
10296                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10297                                     offsetof(struct xdp_md, data)),
10298                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10299                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10300                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
10301                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10302                         BPF_MOV64_IMM(BPF_REG_0, 0),
10303                         BPF_EXIT_INSN(),
10304                 },
10305                 .errstr = "R1 offset is outside of the packet",
10306                 .result = REJECT,
10307                 .prog_type = BPF_PROG_TYPE_XDP,
10308         },
10309         {
10310                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
10311                 .insns = {
10312                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10313                                     offsetof(struct xdp_md, data_meta)),
10314                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10315                                     offsetof(struct xdp_md, data)),
10316                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10318                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
10319                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10320                         BPF_MOV64_IMM(BPF_REG_0, 0),
10321                         BPF_EXIT_INSN(),
10322                 },
10323                 .errstr = "R1 offset is outside of the packet",
10324                 .result = REJECT,
10325                 .prog_type = BPF_PROG_TYPE_XDP,
10326                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10327         },
10328         {
10329                 "XDP pkt read, pkt_data >= pkt_meta', good access",
10330                 .insns = {
10331                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10332                                     offsetof(struct xdp_md, data_meta)),
10333                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10334                                     offsetof(struct xdp_md, data)),
10335                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10337                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10338                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10339                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10340                         BPF_MOV64_IMM(BPF_REG_0, 0),
10341                         BPF_EXIT_INSN(),
10342                 },
10343                 .result = ACCEPT,
10344                 .prog_type = BPF_PROG_TYPE_XDP,
10345         },
10346         {
10347                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
10348                 .insns = {
10349                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10350                                     offsetof(struct xdp_md, data_meta)),
10351                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10352                                     offsetof(struct xdp_md, data)),
10353                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10354                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10355                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10356                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10357                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10358                         BPF_MOV64_IMM(BPF_REG_0, 0),
10359                         BPF_EXIT_INSN(),
10360                 },
10361                 .errstr = "R1 offset is outside of the packet",
10362                 .result = REJECT,
10363                 .prog_type = BPF_PROG_TYPE_XDP,
10364                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10365         },
10366         {
10367                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
10368                 .insns = {
10369                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10370                                     offsetof(struct xdp_md, data_meta)),
10371                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10372                                     offsetof(struct xdp_md, data)),
10373                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10374                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10375                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10376                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10377                         BPF_MOV64_IMM(BPF_REG_0, 0),
10378                         BPF_EXIT_INSN(),
10379                 },
10380                 .errstr = "R1 offset is outside of the packet",
10381                 .result = REJECT,
10382                 .prog_type = BPF_PROG_TYPE_XDP,
10383         },
10384         {
10385                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
10386                 .insns = {
10387                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10388                                     offsetof(struct xdp_md, data_meta)),
10389                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10390                                     offsetof(struct xdp_md, data)),
10391                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10392                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10393                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10394                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10395                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10396                         BPF_MOV64_IMM(BPF_REG_0, 0),
10397                         BPF_EXIT_INSN(),
10398                 },
10399                 .result = ACCEPT,
10400                 .prog_type = BPF_PROG_TYPE_XDP,
10401         },
10402         {
10403                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
10404                 .insns = {
10405                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10406                                     offsetof(struct xdp_md, data_meta)),
10407                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10408                                     offsetof(struct xdp_md, data)),
10409                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10411                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10412                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10413                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10414                         BPF_MOV64_IMM(BPF_REG_0, 0),
10415                         BPF_EXIT_INSN(),
10416                 },
10417                 .errstr = "R1 offset is outside of the packet",
10418                 .result = REJECT,
10419                 .prog_type = BPF_PROG_TYPE_XDP,
10420                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10421         },
10422         {
10423                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
10424                 .insns = {
10425                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10426                                     offsetof(struct xdp_md, data_meta)),
10427                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10428                                     offsetof(struct xdp_md, data)),
10429                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10430                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10431                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10432                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10433                         BPF_MOV64_IMM(BPF_REG_0, 0),
10434                         BPF_EXIT_INSN(),
10435                 },
10436                 .errstr = "R1 offset is outside of the packet",
10437                 .result = REJECT,
10438                 .prog_type = BPF_PROG_TYPE_XDP,
10439         },
10440         {
10441                 "XDP pkt read, pkt_data <= pkt_meta', good access",
10442                 .insns = {
10443                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10444                                     offsetof(struct xdp_md, data_meta)),
10445                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10446                                     offsetof(struct xdp_md, data)),
10447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10449                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10450                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10451                         BPF_MOV64_IMM(BPF_REG_0, 0),
10452                         BPF_EXIT_INSN(),
10453                 },
10454                 .result = ACCEPT,
10455                 .prog_type = BPF_PROG_TYPE_XDP,
10456                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10457         },
10458         {
10459                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
10460                 .insns = {
10461                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10462                                     offsetof(struct xdp_md, data_meta)),
10463                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10464                                     offsetof(struct xdp_md, data)),
10465                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10466                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10467                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10468                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10469                         BPF_MOV64_IMM(BPF_REG_0, 0),
10470                         BPF_EXIT_INSN(),
10471                 },
10472                 .errstr = "R1 offset is outside of the packet",
10473                 .result = REJECT,
10474                 .prog_type = BPF_PROG_TYPE_XDP,
10475         },
10476         {
10477                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
10478                 .insns = {
10479                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10480                                     offsetof(struct xdp_md, data_meta)),
10481                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10482                                     offsetof(struct xdp_md, data)),
10483                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10485                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
10486                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10487                         BPF_MOV64_IMM(BPF_REG_0, 0),
10488                         BPF_EXIT_INSN(),
10489                 },
10490                 .errstr = "R1 offset is outside of the packet",
10491                 .result = REJECT,
10492                 .prog_type = BPF_PROG_TYPE_XDP,
10493                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10494         },
10495         {
10496                 "check deducing bounds from const, 1",
10497                 .insns = {
10498                         BPF_MOV64_IMM(BPF_REG_0, 1),
10499                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
10500                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10501                         BPF_EXIT_INSN(),
10502                 },
10503                 .result = REJECT,
10504                 .errstr = "R0 tried to subtract pointer from scalar",
10505         },
10506         {
10507                 "check deducing bounds from const, 2",
10508                 .insns = {
10509                         BPF_MOV64_IMM(BPF_REG_0, 1),
10510                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
10511                         BPF_EXIT_INSN(),
10512                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
10513                         BPF_EXIT_INSN(),
10514                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10515                         BPF_EXIT_INSN(),
10516                 },
10517                 .result = ACCEPT,
10518                 .retval = 1,
10519         },
10520         {
10521                 "check deducing bounds from const, 3",
10522                 .insns = {
10523                         BPF_MOV64_IMM(BPF_REG_0, 0),
10524                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
10525                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10526                         BPF_EXIT_INSN(),
10527                 },
10528                 .result = REJECT,
10529                 .errstr = "R0 tried to subtract pointer from scalar",
10530         },
10531         {
10532                 "check deducing bounds from const, 4",
10533                 .insns = {
10534                         BPF_MOV64_IMM(BPF_REG_0, 0),
10535                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
10536                         BPF_EXIT_INSN(),
10537                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10538                         BPF_EXIT_INSN(),
10539                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10540                         BPF_EXIT_INSN(),
10541                 },
10542                 .result = ACCEPT,
10543         },
10544         {
10545                 "check deducing bounds from const, 5",
10546                 .insns = {
10547                         BPF_MOV64_IMM(BPF_REG_0, 0),
10548                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10549                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10550                         BPF_EXIT_INSN(),
10551                 },
10552                 .result = REJECT,
10553                 .errstr = "R0 tried to subtract pointer from scalar",
10554         },
10555         {
10556                 "check deducing bounds from const, 6",
10557                 .insns = {
10558                         BPF_MOV64_IMM(BPF_REG_0, 0),
10559                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10560                         BPF_EXIT_INSN(),
10561                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10562                         BPF_EXIT_INSN(),
10563                 },
10564                 .result = REJECT,
10565                 .errstr = "R0 tried to subtract pointer from scalar",
10566         },
10567         {
10568                 "check deducing bounds from const, 7",
10569                 .insns = {
10570                         BPF_MOV64_IMM(BPF_REG_0, ~0),
10571                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
10572                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10573                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10574                                     offsetof(struct __sk_buff, mark)),
10575                         BPF_EXIT_INSN(),
10576                 },
10577                 .result = REJECT,
10578                 .errstr = "dereference of modified ctx ptr",
10579         },
10580         {
10581                 "check deducing bounds from const, 8",
10582                 .insns = {
10583                         BPF_MOV64_IMM(BPF_REG_0, ~0),
10584                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10585                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
10586                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10587                                     offsetof(struct __sk_buff, mark)),
10588                         BPF_EXIT_INSN(),
10589                 },
10590                 .result = REJECT,
10591                 .errstr = "dereference of modified ctx ptr",
10592         },
10593         {
10594                 "check deducing bounds from const, 9",
10595                 .insns = {
10596                         BPF_MOV64_IMM(BPF_REG_0, 0),
10597                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
10598                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10599                         BPF_EXIT_INSN(),
10600                 },
10601                 .result = REJECT,
10602                 .errstr = "R0 tried to subtract pointer from scalar",
10603         },
10604         {
10605                 "check deducing bounds from const, 10",
10606                 .insns = {
10607                         BPF_MOV64_IMM(BPF_REG_0, 0),
10608                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
10609                         /* Marks reg as unknown. */
10610                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
10611                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10612                         BPF_EXIT_INSN(),
10613                 },
10614                 .result = REJECT,
10615                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
10616         },
10617         {
10618                 "bpf_exit with invalid return code. test1",
10619                 .insns = {
10620                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10621                         BPF_EXIT_INSN(),
10622                 },
10623                 .errstr = "R0 has value (0x0; 0xffffffff)",
10624                 .result = REJECT,
10625                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10626         },
10627         {
10628                 "bpf_exit with invalid return code. test2",
10629                 .insns = {
10630                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10631                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
10632                         BPF_EXIT_INSN(),
10633                 },
10634                 .result = ACCEPT,
10635                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10636         },
10637         {
10638                 "bpf_exit with invalid return code. test3",
10639                 .insns = {
10640                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10641                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
10642                         BPF_EXIT_INSN(),
10643                 },
10644                 .errstr = "R0 has value (0x0; 0x3)",
10645                 .result = REJECT,
10646                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10647         },
10648         {
10649                 "bpf_exit with invalid return code. test4",
10650                 .insns = {
10651                         BPF_MOV64_IMM(BPF_REG_0, 1),
10652                         BPF_EXIT_INSN(),
10653                 },
10654                 .result = ACCEPT,
10655                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10656         },
10657         {
10658                 "bpf_exit with invalid return code. test5",
10659                 .insns = {
10660                         BPF_MOV64_IMM(BPF_REG_0, 2),
10661                         BPF_EXIT_INSN(),
10662                 },
10663                 .errstr = "R0 has value (0x2; 0x0)",
10664                 .result = REJECT,
10665                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10666         },
10667         {
10668                 "bpf_exit with invalid return code. test6",
10669                 .insns = {
10670                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10671                         BPF_EXIT_INSN(),
10672                 },
10673                 .errstr = "R0 is not a known value (ctx)",
10674                 .result = REJECT,
10675                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10676         },
10677         {
10678                 "bpf_exit with invalid return code. test7",
10679                 .insns = {
10680                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10681                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
10682                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
10683                         BPF_EXIT_INSN(),
10684                 },
10685                 .errstr = "R0 has unknown scalar value",
10686                 .result = REJECT,
10687                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10688         },
10689         {
10690                 "calls: basic sanity",
10691                 .insns = {
10692                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10693                         BPF_MOV64_IMM(BPF_REG_0, 1),
10694                         BPF_EXIT_INSN(),
10695                         BPF_MOV64_IMM(BPF_REG_0, 2),
10696                         BPF_EXIT_INSN(),
10697                 },
10698                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10699                 .result = ACCEPT,
10700         },
10701         {
10702                 "calls: not on unpriviledged",
10703                 .insns = {
10704                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10705                         BPF_MOV64_IMM(BPF_REG_0, 1),
10706                         BPF_EXIT_INSN(),
10707                         BPF_MOV64_IMM(BPF_REG_0, 2),
10708                         BPF_EXIT_INSN(),
10709                 },
10710                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
10711                 .result_unpriv = REJECT,
10712                 .result = ACCEPT,
10713                 .retval = 1,
10714         },
10715         {
10716                 "calls: div by 0 in subprog",
10717                 .insns = {
10718                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10719                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10720                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10721                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10722                                     offsetof(struct __sk_buff, data_end)),
10723                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10724                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10725                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10726                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10727                         BPF_MOV64_IMM(BPF_REG_0, 1),
10728                         BPF_EXIT_INSN(),
10729                         BPF_MOV32_IMM(BPF_REG_2, 0),
10730                         BPF_MOV32_IMM(BPF_REG_3, 1),
10731                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
10732                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10733                                     offsetof(struct __sk_buff, data)),
10734                         BPF_EXIT_INSN(),
10735                 },
10736                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10737                 .result = ACCEPT,
10738                 .retval = 1,
10739         },
10740         {
10741                 "calls: multiple ret types in subprog 1",
10742                 .insns = {
10743                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10744                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10745                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10746                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10747                                     offsetof(struct __sk_buff, data_end)),
10748                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10749                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10750                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10751                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10752                         BPF_MOV64_IMM(BPF_REG_0, 1),
10753                         BPF_EXIT_INSN(),
10754                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10755                                     offsetof(struct __sk_buff, data)),
10756                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10757                         BPF_MOV32_IMM(BPF_REG_0, 42),
10758                         BPF_EXIT_INSN(),
10759                 },
10760                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10761                 .result = REJECT,
10762                 .errstr = "R0 invalid mem access 'inv'",
10763         },
10764         {
10765                 "calls: multiple ret types in subprog 2",
10766                 .insns = {
10767                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10768                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10769                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10770                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10771                                     offsetof(struct __sk_buff, data_end)),
10772                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10773                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10774                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10775                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10776                         BPF_MOV64_IMM(BPF_REG_0, 1),
10777                         BPF_EXIT_INSN(),
10778                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10779                                     offsetof(struct __sk_buff, data)),
10780                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10781                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
10782                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10783                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10784                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10785                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10786                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10787                                      BPF_FUNC_map_lookup_elem),
10788                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10789                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
10790                                     offsetof(struct __sk_buff, data)),
10791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
10792                         BPF_EXIT_INSN(),
10793                 },
10794                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10795                 .fixup_map_hash_8b = { 16 },
10796                 .result = REJECT,
10797                 .errstr = "R0 min value is outside of the array range",
10798         },
10799         {
10800                 "calls: overlapping caller/callee",
10801                 .insns = {
10802                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
10803                         BPF_MOV64_IMM(BPF_REG_0, 1),
10804                         BPF_EXIT_INSN(),
10805                 },
10806                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10807                 .errstr = "last insn is not an exit or jmp",
10808                 .result = REJECT,
10809         },
10810         {
10811                 "calls: wrong recursive calls",
10812                 .insns = {
10813                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10814                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10815                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10816                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10817                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10818                         BPF_MOV64_IMM(BPF_REG_0, 1),
10819                         BPF_EXIT_INSN(),
10820                 },
10821                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10822                 .errstr = "jump out of range",
10823                 .result = REJECT,
10824         },
10825         {
10826                 "calls: wrong src reg",
10827                 .insns = {
10828                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
10829                         BPF_MOV64_IMM(BPF_REG_0, 1),
10830                         BPF_EXIT_INSN(),
10831                 },
10832                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10833                 .errstr = "BPF_CALL uses reserved fields",
10834                 .result = REJECT,
10835         },
10836         {
10837                 "calls: wrong off value",
10838                 .insns = {
10839                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
10840                         BPF_MOV64_IMM(BPF_REG_0, 1),
10841                         BPF_EXIT_INSN(),
10842                         BPF_MOV64_IMM(BPF_REG_0, 2),
10843                         BPF_EXIT_INSN(),
10844                 },
10845                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10846                 .errstr = "BPF_CALL uses reserved fields",
10847                 .result = REJECT,
10848         },
10849         {
10850                 "calls: jump back loop",
10851                 .insns = {
10852                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10853                         BPF_MOV64_IMM(BPF_REG_0, 1),
10854                         BPF_EXIT_INSN(),
10855                 },
10856                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10857                 .errstr = "back-edge from insn 0 to 0",
10858                 .result = REJECT,
10859         },
10860         {
10861                 "calls: conditional call",
10862                 .insns = {
10863                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10864                                     offsetof(struct __sk_buff, mark)),
10865                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10866                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10867                         BPF_MOV64_IMM(BPF_REG_0, 1),
10868                         BPF_EXIT_INSN(),
10869                         BPF_MOV64_IMM(BPF_REG_0, 2),
10870                         BPF_EXIT_INSN(),
10871                 },
10872                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10873                 .errstr = "jump out of range",
10874                 .result = REJECT,
10875         },
10876         {
10877                 "calls: conditional call 2",
10878                 .insns = {
10879                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10880                                     offsetof(struct __sk_buff, mark)),
10881                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10882                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10883                         BPF_MOV64_IMM(BPF_REG_0, 1),
10884                         BPF_EXIT_INSN(),
10885                         BPF_MOV64_IMM(BPF_REG_0, 2),
10886                         BPF_EXIT_INSN(),
10887                         BPF_MOV64_IMM(BPF_REG_0, 3),
10888                         BPF_EXIT_INSN(),
10889                 },
10890                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10891                 .result = ACCEPT,
10892         },
10893         {
10894                 "calls: conditional call 3",
10895                 .insns = {
10896                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10897                                     offsetof(struct __sk_buff, mark)),
10898                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10899                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10900                         BPF_MOV64_IMM(BPF_REG_0, 1),
10901                         BPF_EXIT_INSN(),
10902                         BPF_MOV64_IMM(BPF_REG_0, 1),
10903                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10904                         BPF_MOV64_IMM(BPF_REG_0, 3),
10905                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10906                 },
10907                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10908                 .errstr = "back-edge from insn",
10909                 .result = REJECT,
10910         },
10911         {
10912                 "calls: conditional call 4",
10913                 .insns = {
10914                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10915                                     offsetof(struct __sk_buff, mark)),
10916                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10917                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10918                         BPF_MOV64_IMM(BPF_REG_0, 1),
10919                         BPF_EXIT_INSN(),
10920                         BPF_MOV64_IMM(BPF_REG_0, 1),
10921                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
10922                         BPF_MOV64_IMM(BPF_REG_0, 3),
10923                         BPF_EXIT_INSN(),
10924                 },
10925                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10926                 .result = ACCEPT,
10927         },
10928         {
10929                 "calls: conditional call 5",
10930                 .insns = {
10931                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10932                                     offsetof(struct __sk_buff, mark)),
10933                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10934                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10935                         BPF_MOV64_IMM(BPF_REG_0, 1),
10936                         BPF_EXIT_INSN(),
10937                         BPF_MOV64_IMM(BPF_REG_0, 1),
10938                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10939                         BPF_MOV64_IMM(BPF_REG_0, 3),
10940                         BPF_EXIT_INSN(),
10941                 },
10942                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10943                 .errstr = "back-edge from insn",
10944                 .result = REJECT,
10945         },
10946         {
10947                 "calls: conditional call 6",
10948                 .insns = {
10949                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10950                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
10951                         BPF_EXIT_INSN(),
10952                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10953                                     offsetof(struct __sk_buff, mark)),
10954                         BPF_EXIT_INSN(),
10955                 },
10956                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10957                 .errstr = "back-edge from insn",
10958                 .result = REJECT,
10959         },
10960         {
10961                 "calls: using r0 returned by callee",
10962                 .insns = {
10963                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10964                         BPF_EXIT_INSN(),
10965                         BPF_MOV64_IMM(BPF_REG_0, 2),
10966                         BPF_EXIT_INSN(),
10967                 },
10968                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10969                 .result = ACCEPT,
10970         },
10971         {
10972                 "calls: using uninit r0 from callee",
10973                 .insns = {
10974                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10975                         BPF_EXIT_INSN(),
10976                         BPF_EXIT_INSN(),
10977                 },
10978                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10979                 .errstr = "!read_ok",
10980                 .result = REJECT,
10981         },
10982         {
10983                 "calls: callee is using r1",
10984                 .insns = {
10985                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10986                         BPF_EXIT_INSN(),
10987                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10988                                     offsetof(struct __sk_buff, len)),
10989                         BPF_EXIT_INSN(),
10990                 },
10991                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
10992                 .result = ACCEPT,
10993                 .retval = TEST_DATA_LEN,
10994         },
10995         {
10996                 "calls: callee using args1",
10997                 .insns = {
10998                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10999                         BPF_EXIT_INSN(),
11000                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
11001                         BPF_EXIT_INSN(),
11002                 },
11003                 .errstr_unpriv = "allowed for root only",
11004                 .result_unpriv = REJECT,
11005                 .result = ACCEPT,
11006                 .retval = POINTER_VALUE,
11007         },
11008         {
11009                 "calls: callee using wrong args2",
11010                 .insns = {
11011                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11012                         BPF_EXIT_INSN(),
11013                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11014                         BPF_EXIT_INSN(),
11015                 },
11016                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11017                 .errstr = "R2 !read_ok",
11018                 .result = REJECT,
11019         },
11020         {
11021                 "calls: callee using two args",
11022                 .insns = {
11023                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11024                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
11025                                     offsetof(struct __sk_buff, len)),
11026                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
11027                                     offsetof(struct __sk_buff, len)),
11028                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11029                         BPF_EXIT_INSN(),
11030                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
11031                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
11032                         BPF_EXIT_INSN(),
11033                 },
11034                 .errstr_unpriv = "allowed for root only",
11035                 .result_unpriv = REJECT,
11036                 .result = ACCEPT,
11037                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
11038         },
11039         {
11040                 "calls: callee changing pkt pointers",
11041                 .insns = {
11042                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11043                                     offsetof(struct xdp_md, data)),
11044                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
11045                                     offsetof(struct xdp_md, data_end)),
11046                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
11047                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
11048                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
11049                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11050                         /* clear_all_pkt_pointers() has to walk all frames
11051                          * to make sure that pkt pointers in the caller
11052                          * are cleared when callee is calling a helper that
11053                          * adjusts packet size
11054                          */
11055                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11056                         BPF_MOV32_IMM(BPF_REG_0, 0),
11057                         BPF_EXIT_INSN(),
11058                         BPF_MOV64_IMM(BPF_REG_2, 0),
11059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11060                                      BPF_FUNC_xdp_adjust_head),
11061                         BPF_EXIT_INSN(),
11062                 },
11063                 .result = REJECT,
11064                 .errstr = "R6 invalid mem access 'inv'",
11065                 .prog_type = BPF_PROG_TYPE_XDP,
11066         },
11067         {
11068                 "calls: two calls with args",
11069                 .insns = {
11070                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11071                         BPF_EXIT_INSN(),
11072                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11073                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11074                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11075                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11076                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11077                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11078                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11079                         BPF_EXIT_INSN(),
11080                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
11081                                     offsetof(struct __sk_buff, len)),
11082                         BPF_EXIT_INSN(),
11083                 },
11084                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11085                 .result = ACCEPT,
11086                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
11087         },
11088         {
11089                 "calls: calls with stack arith",
11090                 .insns = {
11091                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11092                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
11093                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11094                         BPF_EXIT_INSN(),
11095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
11096                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11097                         BPF_EXIT_INSN(),
11098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
11099                         BPF_MOV64_IMM(BPF_REG_0, 42),
11100                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
11101                         BPF_EXIT_INSN(),
11102                 },
11103                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11104                 .result = ACCEPT,
11105                 .retval = 42,
11106         },
11107         {
11108                 "calls: calls with misaligned stack access",
11109                 .insns = {
11110                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
11112                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11113                         BPF_EXIT_INSN(),
11114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
11115                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11116                         BPF_EXIT_INSN(),
11117                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
11118                         BPF_MOV64_IMM(BPF_REG_0, 42),
11119                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
11120                         BPF_EXIT_INSN(),
11121                 },
11122                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11123                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
11124                 .errstr = "misaligned stack access",
11125                 .result = REJECT,
11126         },
11127         {
11128                 "calls: calls control flow, jump test",
11129                 .insns = {
11130                         BPF_MOV64_IMM(BPF_REG_0, 42),
11131                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11132                         BPF_MOV64_IMM(BPF_REG_0, 43),
11133                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11134                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
11135                         BPF_EXIT_INSN(),
11136                 },
11137                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11138                 .result = ACCEPT,
11139                 .retval = 43,
11140         },
11141         {
11142                 "calls: calls control flow, jump test 2",
11143                 .insns = {
11144                         BPF_MOV64_IMM(BPF_REG_0, 42),
11145                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11146                         BPF_MOV64_IMM(BPF_REG_0, 43),
11147                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11148                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
11149                         BPF_EXIT_INSN(),
11150                 },
11151                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11152                 .errstr = "jump out of range from insn 1 to 4",
11153                 .result = REJECT,
11154         },
11155         {
11156                 "calls: two calls with bad jump",
11157                 .insns = {
11158                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11159                         BPF_EXIT_INSN(),
11160                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11161                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11162                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11163                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11164                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11165                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11166                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11167                         BPF_EXIT_INSN(),
11168                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
11169                                     offsetof(struct __sk_buff, len)),
11170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
11171                         BPF_EXIT_INSN(),
11172                 },
11173                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11174                 .errstr = "jump out of range from insn 11 to 9",
11175                 .result = REJECT,
11176         },
11177         {
11178                 "calls: recursive call. test1",
11179                 .insns = {
11180                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11181                         BPF_EXIT_INSN(),
11182                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
11183                         BPF_EXIT_INSN(),
11184                 },
11185                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11186                 .errstr = "back-edge",
11187                 .result = REJECT,
11188         },
11189         {
11190                 "calls: recursive call. test2",
11191                 .insns = {
11192                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11193                         BPF_EXIT_INSN(),
11194                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
11195                         BPF_EXIT_INSN(),
11196                 },
11197                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11198                 .errstr = "back-edge",
11199                 .result = REJECT,
11200         },
11201         {
11202                 "calls: unreachable code",
11203                 .insns = {
11204                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11205                         BPF_EXIT_INSN(),
11206                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11207                         BPF_EXIT_INSN(),
11208                         BPF_MOV64_IMM(BPF_REG_0, 0),
11209                         BPF_EXIT_INSN(),
11210                         BPF_MOV64_IMM(BPF_REG_0, 0),
11211                         BPF_EXIT_INSN(),
11212                 },
11213                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11214                 .errstr = "unreachable insn 6",
11215                 .result = REJECT,
11216         },
11217         {
11218                 "calls: invalid call",
11219                 .insns = {
11220                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11221                         BPF_EXIT_INSN(),
11222                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
11223                         BPF_EXIT_INSN(),
11224                 },
11225                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11226                 .errstr = "invalid destination",
11227                 .result = REJECT,
11228         },
11229         {
11230                 "calls: invalid call 2",
11231                 .insns = {
11232                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11233                         BPF_EXIT_INSN(),
11234                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
11235                         BPF_EXIT_INSN(),
11236                 },
11237                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11238                 .errstr = "invalid destination",
11239                 .result = REJECT,
11240         },
11241         {
11242                 "calls: jumping across function bodies. test1",
11243                 .insns = {
11244                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11245                         BPF_MOV64_IMM(BPF_REG_0, 0),
11246                         BPF_EXIT_INSN(),
11247                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
11248                         BPF_EXIT_INSN(),
11249                 },
11250                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11251                 .errstr = "jump out of range",
11252                 .result = REJECT,
11253         },
11254         {
11255                 "calls: jumping across function bodies. test2",
11256                 .insns = {
11257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
11258                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11259                         BPF_MOV64_IMM(BPF_REG_0, 0),
11260                         BPF_EXIT_INSN(),
11261                         BPF_EXIT_INSN(),
11262                 },
11263                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11264                 .errstr = "jump out of range",
11265                 .result = REJECT,
11266         },
11267         {
11268                 "calls: call without exit",
11269                 .insns = {
11270                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11271                         BPF_EXIT_INSN(),
11272                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11273                         BPF_EXIT_INSN(),
11274                         BPF_MOV64_IMM(BPF_REG_0, 0),
11275                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
11276                 },
11277                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11278                 .errstr = "not an exit",
11279                 .result = REJECT,
11280         },
11281         {
11282                 "calls: call into middle of ld_imm64",
11283                 .insns = {
11284                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11285                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11286                         BPF_MOV64_IMM(BPF_REG_0, 0),
11287                         BPF_EXIT_INSN(),
11288                         BPF_LD_IMM64(BPF_REG_0, 0),
11289                         BPF_EXIT_INSN(),
11290                 },
11291                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11292                 .errstr = "last insn",
11293                 .result = REJECT,
11294         },
11295         {
11296                 "calls: call into middle of other call",
11297                 .insns = {
11298                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11299                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11300                         BPF_MOV64_IMM(BPF_REG_0, 0),
11301                         BPF_EXIT_INSN(),
11302                         BPF_MOV64_IMM(BPF_REG_0, 0),
11303                         BPF_MOV64_IMM(BPF_REG_0, 0),
11304                         BPF_EXIT_INSN(),
11305                 },
11306                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11307                 .errstr = "last insn",
11308                 .result = REJECT,
11309         },
11310         {
11311                 "calls: ld_abs with changing ctx data in callee",
11312                 .insns = {
11313                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11314                         BPF_LD_ABS(BPF_B, 0),
11315                         BPF_LD_ABS(BPF_H, 0),
11316                         BPF_LD_ABS(BPF_W, 0),
11317                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
11318                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
11319                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
11320                         BPF_LD_ABS(BPF_B, 0),
11321                         BPF_LD_ABS(BPF_H, 0),
11322                         BPF_LD_ABS(BPF_W, 0),
11323                         BPF_EXIT_INSN(),
11324                         BPF_MOV64_IMM(BPF_REG_2, 1),
11325                         BPF_MOV64_IMM(BPF_REG_3, 2),
11326                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11327                                      BPF_FUNC_skb_vlan_push),
11328                         BPF_EXIT_INSN(),
11329                 },
11330                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11331                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
11332                 .result = REJECT,
11333         },
11334         {
11335                 "calls: two calls with bad fallthrough",
11336                 .insns = {
11337                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11338                         BPF_EXIT_INSN(),
11339                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11340                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11341                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11342                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11343                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11344                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11345                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11346                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
11347                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
11348                                     offsetof(struct __sk_buff, len)),
11349                         BPF_EXIT_INSN(),
11350                 },
11351                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11352                 .errstr = "not an exit",
11353                 .result = REJECT,
11354         },
11355         {
11356                 "calls: two calls with stack read",
11357                 .insns = {
11358                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11359                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11361                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11362                         BPF_EXIT_INSN(),
11363                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11364                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11365                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11366                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11367                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11368                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11369                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11370                         BPF_EXIT_INSN(),
11371                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
11372                         BPF_EXIT_INSN(),
11373                 },
11374                 .prog_type = BPF_PROG_TYPE_XDP,
11375                 .result = ACCEPT,
11376         },
11377         {
11378                 "calls: two calls with stack write",
11379                 .insns = {
11380                         /* main prog */
11381                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11382                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11383                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11386                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11387                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11388                         BPF_EXIT_INSN(),
11389
11390                         /* subprog 1 */
11391                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11392                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11393                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
11394                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
11395                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11396                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11397                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
11398                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
11399                         /* write into stack frame of main prog */
11400                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11401                         BPF_EXIT_INSN(),
11402
11403                         /* subprog 2 */
11404                         /* read from stack frame of main prog */
11405                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
11406                         BPF_EXIT_INSN(),
11407                 },
11408                 .prog_type = BPF_PROG_TYPE_XDP,
11409                 .result = ACCEPT,
11410         },
11411         {
11412                 "calls: stack overflow using two frames (pre-call access)",
11413                 .insns = {
11414                         /* prog 1 */
11415                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11416                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
11417                         BPF_EXIT_INSN(),
11418
11419                         /* prog 2 */
11420                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11421                         BPF_MOV64_IMM(BPF_REG_0, 0),
11422                         BPF_EXIT_INSN(),
11423                 },
11424                 .prog_type = BPF_PROG_TYPE_XDP,
11425                 .errstr = "combined stack size",
11426                 .result = REJECT,
11427         },
11428         {
11429                 "calls: stack overflow using two frames (post-call access)",
11430                 .insns = {
11431                         /* prog 1 */
11432                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
11433                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11434                         BPF_EXIT_INSN(),
11435
11436                         /* prog 2 */
11437                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11438                         BPF_MOV64_IMM(BPF_REG_0, 0),
11439                         BPF_EXIT_INSN(),
11440                 },
11441                 .prog_type = BPF_PROG_TYPE_XDP,
11442                 .errstr = "combined stack size",
11443                 .result = REJECT,
11444         },
11445         {
11446                 "calls: stack depth check using three frames. test1",
11447                 .insns = {
11448                         /* main */
11449                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11450                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
11451                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
11452                         BPF_MOV64_IMM(BPF_REG_0, 0),
11453                         BPF_EXIT_INSN(),
11454                         /* A */
11455                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11456                         BPF_EXIT_INSN(),
11457                         /* B */
11458                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
11459                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11460                         BPF_EXIT_INSN(),
11461                 },
11462                 .prog_type = BPF_PROG_TYPE_XDP,
11463                 /* stack_main=32, stack_A=256, stack_B=64
11464                  * and max(main+A, main+A+B) < 512
11465                  */
11466                 .result = ACCEPT,
11467         },
11468         {
11469                 "calls: stack depth check using three frames. test2",
11470                 .insns = {
11471                         /* main */
11472                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11473                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
11474                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
11475                         BPF_MOV64_IMM(BPF_REG_0, 0),
11476                         BPF_EXIT_INSN(),
11477                         /* A */
11478                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11479                         BPF_EXIT_INSN(),
11480                         /* B */
11481                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
11482                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11483                         BPF_EXIT_INSN(),
11484                 },
11485                 .prog_type = BPF_PROG_TYPE_XDP,
11486                 /* stack_main=32, stack_A=64, stack_B=256
11487                  * and max(main+A, main+A+B) < 512
11488                  */
11489                 .result = ACCEPT,
11490         },
11491         {
11492                 "calls: stack depth check using three frames. test3",
11493                 .insns = {
11494                         /* main */
11495                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11496                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
11497                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11498                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
11499                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
11500                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11501                         BPF_MOV64_IMM(BPF_REG_0, 0),
11502                         BPF_EXIT_INSN(),
11503                         /* A */
11504                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
11505                         BPF_EXIT_INSN(),
11506                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
11507                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
11508                         /* B */
11509                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
11510                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
11511                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11512                         BPF_EXIT_INSN(),
11513                 },
11514                 .prog_type = BPF_PROG_TYPE_XDP,
11515                 /* stack_main=64, stack_A=224, stack_B=256
11516                  * and max(main+A, main+A+B) > 512
11517                  */
11518                 .errstr = "combined stack",
11519                 .result = REJECT,
11520         },
11521         {
11522                 "calls: stack depth check using three frames. test4",
11523                 /* void main(void) {
11524                  *   func1(0);
11525                  *   func1(1);
11526                  *   func2(1);
11527                  * }
11528                  * void func1(int alloc_or_recurse) {
11529                  *   if (alloc_or_recurse) {
11530                  *     frame_pointer[-300] = 1;
11531                  *   } else {
11532                  *     func2(alloc_or_recurse);
11533                  *   }
11534                  * }
11535                  * void func2(int alloc_or_recurse) {
11536                  *   if (alloc_or_recurse) {
11537                  *     frame_pointer[-300] = 1;
11538                  *   }
11539                  * }
11540                  */
11541                 .insns = {
11542                         /* main */
11543                         BPF_MOV64_IMM(BPF_REG_1, 0),
11544                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
11545                         BPF_MOV64_IMM(BPF_REG_1, 1),
11546                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11547                         BPF_MOV64_IMM(BPF_REG_1, 1),
11548                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
11549                         BPF_MOV64_IMM(BPF_REG_0, 0),
11550                         BPF_EXIT_INSN(),
11551                         /* A */
11552                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
11553                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11554                         BPF_EXIT_INSN(),
11555                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
11556                         BPF_EXIT_INSN(),
11557                         /* B */
11558                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
11559                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11560                         BPF_EXIT_INSN(),
11561                 },
11562                 .prog_type = BPF_PROG_TYPE_XDP,
11563                 .result = REJECT,
11564                 .errstr = "combined stack",
11565         },
11566         {
11567                 "calls: stack depth check using three frames. test5",
11568                 .insns = {
11569                         /* main */
11570                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
11571                         BPF_EXIT_INSN(),
11572                         /* A */
11573                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
11574                         BPF_EXIT_INSN(),
11575                         /* B */
11576                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
11577                         BPF_EXIT_INSN(),
11578                         /* C */
11579                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
11580                         BPF_EXIT_INSN(),
11581                         /* D */
11582                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
11583                         BPF_EXIT_INSN(),
11584                         /* E */
11585                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
11586                         BPF_EXIT_INSN(),
11587                         /* F */
11588                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
11589                         BPF_EXIT_INSN(),
11590                         /* G */
11591                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
11592                         BPF_EXIT_INSN(),
11593                         /* H */
11594                         BPF_MOV64_IMM(BPF_REG_0, 0),
11595                         BPF_EXIT_INSN(),
11596                 },
11597                 .prog_type = BPF_PROG_TYPE_XDP,
11598                 .errstr = "call stack",
11599                 .result = REJECT,
11600         },
11601         {
11602                 "calls: spill into caller stack frame",
11603                 .insns = {
11604                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11605                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11606                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11607                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11608                         BPF_EXIT_INSN(),
11609                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
11610                         BPF_MOV64_IMM(BPF_REG_0, 0),
11611                         BPF_EXIT_INSN(),
11612                 },
11613                 .prog_type = BPF_PROG_TYPE_XDP,
11614                 .errstr = "cannot spill",
11615                 .result = REJECT,
11616         },
11617         {
11618                 "calls: write into caller stack frame",
11619                 .insns = {
11620                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11621                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11622                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11623                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11624                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11625                         BPF_EXIT_INSN(),
11626                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
11627                         BPF_MOV64_IMM(BPF_REG_0, 0),
11628                         BPF_EXIT_INSN(),
11629                 },
11630                 .prog_type = BPF_PROG_TYPE_XDP,
11631                 .result = ACCEPT,
11632                 .retval = 42,
11633         },
11634         {
11635                 "calls: write into callee stack frame",
11636                 .insns = {
11637                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11638                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
11639                         BPF_EXIT_INSN(),
11640                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
11641                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
11642                         BPF_EXIT_INSN(),
11643                 },
11644                 .prog_type = BPF_PROG_TYPE_XDP,
11645                 .errstr = "cannot return stack pointer",
11646                 .result = REJECT,
11647         },
11648         {
11649                 "calls: two calls with stack write and void return",
11650                 .insns = {
11651                         /* main prog */
11652                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11653                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11654                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11655                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11656                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11657                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11658                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11659                         BPF_EXIT_INSN(),
11660
11661                         /* subprog 1 */
11662                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11663                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11664                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11665                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11666                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11667                         BPF_EXIT_INSN(),
11668
11669                         /* subprog 2 */
11670                         /* write into stack frame of main prog */
11671                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
11672                         BPF_EXIT_INSN(), /* void return */
11673                 },
11674                 .prog_type = BPF_PROG_TYPE_XDP,
11675                 .result = ACCEPT,
11676         },
11677         {
11678                 "calls: ambiguous return value",
11679                 .insns = {
11680                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11681                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
11682                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11683                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11684                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11685                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11686                         BPF_EXIT_INSN(),
11687                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
11688                         BPF_MOV64_IMM(BPF_REG_0, 0),
11689                         BPF_EXIT_INSN(),
11690                 },
11691                 .errstr_unpriv = "allowed for root only",
11692                 .result_unpriv = REJECT,
11693                 .errstr = "R0 !read_ok",
11694                 .result = REJECT,
11695         },
11696         {
11697                 "calls: two calls that return map_value",
11698                 .insns = {
11699                         /* main prog */
11700                         /* pass fp-16, fp-8 into a function */
11701                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11703                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11704                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11705                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
11706
11707                         /* fetch map_value_ptr from the stack of this function */
11708                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11709                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11710                         /* write into map value */
11711                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11712                         /* fetch secound map_value_ptr from the stack */
11713                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11714                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11715                         /* write into map value */
11716                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11717                         BPF_MOV64_IMM(BPF_REG_0, 0),
11718                         BPF_EXIT_INSN(),
11719
11720                         /* subprog 1 */
11721                         /* call 3rd function twice */
11722                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11723                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11724                         /* first time with fp-8 */
11725                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11726                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11727                         /* second time with fp-16 */
11728                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11729                         BPF_EXIT_INSN(),
11730
11731                         /* subprog 2 */
11732                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11733                         /* lookup from map */
11734                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11735                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11736                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11737                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11738                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11739                                      BPF_FUNC_map_lookup_elem),
11740                         /* write map_value_ptr into stack frame of main prog */
11741                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11742                         BPF_MOV64_IMM(BPF_REG_0, 0),
11743                         BPF_EXIT_INSN(), /* return 0 */
11744                 },
11745                 .prog_type = BPF_PROG_TYPE_XDP,
11746                 .fixup_map_hash_8b = { 23 },
11747                 .result = ACCEPT,
11748         },
11749         {
11750                 "calls: two calls that return map_value with bool condition",
11751                 .insns = {
11752                         /* main prog */
11753                         /* pass fp-16, fp-8 into a function */
11754                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11756                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11757                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11758                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11759                         BPF_MOV64_IMM(BPF_REG_0, 0),
11760                         BPF_EXIT_INSN(),
11761
11762                         /* subprog 1 */
11763                         /* call 3rd function twice */
11764                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11765                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11766                         /* first time with fp-8 */
11767                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11768                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11769                         /* fetch map_value_ptr from the stack of this function */
11770                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11771                         /* write into map value */
11772                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11773                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11774                         /* second time with fp-16 */
11775                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11776                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11777                         /* fetch secound map_value_ptr from the stack */
11778                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11779                         /* write into map value */
11780                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11781                         BPF_EXIT_INSN(),
11782
11783                         /* subprog 2 */
11784                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11785                         /* lookup from map */
11786                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11787                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11788                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11789                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11790                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11791                                      BPF_FUNC_map_lookup_elem),
11792                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11793                         BPF_MOV64_IMM(BPF_REG_0, 0),
11794                         BPF_EXIT_INSN(), /* return 0 */
11795                         /* write map_value_ptr into stack frame of main prog */
11796                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11797                         BPF_MOV64_IMM(BPF_REG_0, 1),
11798                         BPF_EXIT_INSN(), /* return 1 */
11799                 },
11800                 .prog_type = BPF_PROG_TYPE_XDP,
11801                 .fixup_map_hash_8b = { 23 },
11802                 .result = ACCEPT,
11803         },
11804         {
11805                 "calls: two calls that return map_value with incorrect bool check",
11806                 .insns = {
11807                         /* main prog */
11808                         /* pass fp-16, fp-8 into a function */
11809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11810                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11811                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11812                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11813                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11814                         BPF_MOV64_IMM(BPF_REG_0, 0),
11815                         BPF_EXIT_INSN(),
11816
11817                         /* subprog 1 */
11818                         /* call 3rd function twice */
11819                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11820                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11821                         /* first time with fp-8 */
11822                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11823                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11824                         /* fetch map_value_ptr from the stack of this function */
11825                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11826                         /* write into map value */
11827                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11828                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11829                         /* second time with fp-16 */
11830                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11831                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11832                         /* fetch secound map_value_ptr from the stack */
11833                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11834                         /* write into map value */
11835                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11836                         BPF_EXIT_INSN(),
11837
11838                         /* subprog 2 */
11839                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11840                         /* lookup from map */
11841                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11842                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11843                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11844                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11845                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11846                                      BPF_FUNC_map_lookup_elem),
11847                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11848                         BPF_MOV64_IMM(BPF_REG_0, 0),
11849                         BPF_EXIT_INSN(), /* return 0 */
11850                         /* write map_value_ptr into stack frame of main prog */
11851                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11852                         BPF_MOV64_IMM(BPF_REG_0, 1),
11853                         BPF_EXIT_INSN(), /* return 1 */
11854                 },
11855                 .prog_type = BPF_PROG_TYPE_XDP,
11856                 .fixup_map_hash_8b = { 23 },
11857                 .result = REJECT,
11858                 .errstr = "invalid read from stack off -16+0 size 8",
11859         },
11860         {
11861                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
11862                 .insns = {
11863                         /* main prog */
11864                         /* pass fp-16, fp-8 into a function */
11865                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11866                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11867                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11868                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11869                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11870                         BPF_MOV64_IMM(BPF_REG_0, 0),
11871                         BPF_EXIT_INSN(),
11872
11873                         /* subprog 1 */
11874                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11875                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11876                         /* 1st lookup from map */
11877                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11878                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11879                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11880                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11881                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11882                                      BPF_FUNC_map_lookup_elem),
11883                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11884                         BPF_MOV64_IMM(BPF_REG_8, 0),
11885                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11886                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11887                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11888                         BPF_MOV64_IMM(BPF_REG_8, 1),
11889
11890                         /* 2nd lookup from map */
11891                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11892                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11893                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11894                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11895                                      BPF_FUNC_map_lookup_elem),
11896                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11897                         BPF_MOV64_IMM(BPF_REG_9, 0),
11898                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11899                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11900                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11901                         BPF_MOV64_IMM(BPF_REG_9, 1),
11902
11903                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11904                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11905                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11906                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11907                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11908                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11909                         BPF_EXIT_INSN(),
11910
11911                         /* subprog 2 */
11912                         /* if arg2 == 1 do *arg1 = 0 */
11913                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11914                         /* fetch map_value_ptr from the stack of this function */
11915                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11916                         /* write into map value */
11917                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11918
11919                         /* if arg4 == 1 do *arg3 = 0 */
11920                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11921                         /* fetch map_value_ptr from the stack of this function */
11922                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11923                         /* write into map value */
11924                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11925                         BPF_EXIT_INSN(),
11926                 },
11927                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11928                 .fixup_map_hash_8b = { 12, 22 },
11929                 .result = REJECT,
11930                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11931         },
11932         {
11933                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
11934                 .insns = {
11935                         /* main prog */
11936                         /* pass fp-16, fp-8 into a function */
11937                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11938                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11939                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11941                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11942                         BPF_MOV64_IMM(BPF_REG_0, 0),
11943                         BPF_EXIT_INSN(),
11944
11945                         /* subprog 1 */
11946                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11947                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11948                         /* 1st lookup from map */
11949                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11950                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11951                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11952                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11953                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11954                                      BPF_FUNC_map_lookup_elem),
11955                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11956                         BPF_MOV64_IMM(BPF_REG_8, 0),
11957                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11958                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11959                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11960                         BPF_MOV64_IMM(BPF_REG_8, 1),
11961
11962                         /* 2nd lookup from map */
11963                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11964                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11965                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11966                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11967                                      BPF_FUNC_map_lookup_elem),
11968                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11969                         BPF_MOV64_IMM(BPF_REG_9, 0),
11970                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11971                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11972                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11973                         BPF_MOV64_IMM(BPF_REG_9, 1),
11974
11975                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11976                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11978                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11979                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11980                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11981                         BPF_EXIT_INSN(),
11982
11983                         /* subprog 2 */
11984                         /* if arg2 == 1 do *arg1 = 0 */
11985                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11986                         /* fetch map_value_ptr from the stack of this function */
11987                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11988                         /* write into map value */
11989                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11990
11991                         /* if arg4 == 1 do *arg3 = 0 */
11992                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11993                         /* fetch map_value_ptr from the stack of this function */
11994                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11995                         /* write into map value */
11996                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11997                         BPF_EXIT_INSN(),
11998                 },
11999                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12000                 .fixup_map_hash_8b = { 12, 22 },
12001                 .result = ACCEPT,
12002         },
12003         {
12004                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
12005                 .insns = {
12006                         /* main prog */
12007                         /* pass fp-16, fp-8 into a function */
12008                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
12009                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
12010                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12011                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
12012                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
12013                         BPF_MOV64_IMM(BPF_REG_0, 0),
12014                         BPF_EXIT_INSN(),
12015
12016                         /* subprog 1 */
12017                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12018                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
12019                         /* 1st lookup from map */
12020                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
12021                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
12023                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12024                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12025                                      BPF_FUNC_map_lookup_elem),
12026                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12027                         BPF_MOV64_IMM(BPF_REG_8, 0),
12028                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12029                         /* write map_value_ptr into stack frame of main prog at fp-8 */
12030                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
12031                         BPF_MOV64_IMM(BPF_REG_8, 1),
12032
12033                         /* 2nd lookup from map */
12034                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12035                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
12036                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12037                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12038                                      BPF_FUNC_map_lookup_elem),
12039                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12040                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
12041                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12042                         /* write map_value_ptr into stack frame of main prog at fp-16 */
12043                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
12044                         BPF_MOV64_IMM(BPF_REG_9, 1),
12045
12046                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
12047                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
12048                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
12049                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
12050                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
12051                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
12052                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
12053
12054                         /* subprog 2 */
12055                         /* if arg2 == 1 do *arg1 = 0 */
12056                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
12057                         /* fetch map_value_ptr from the stack of this function */
12058                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
12059                         /* write into map value */
12060                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
12061
12062                         /* if arg4 == 1 do *arg3 = 0 */
12063                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
12064                         /* fetch map_value_ptr from the stack of this function */
12065                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
12066                         /* write into map value */
12067                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
12068                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
12069                 },
12070                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12071                 .fixup_map_hash_8b = { 12, 22 },
12072                 .result = REJECT,
12073                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
12074         },
12075         {
12076                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
12077                 .insns = {
12078                         /* main prog */
12079                         /* pass fp-16, fp-8 into a function */
12080                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
12081                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
12082                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12083                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
12084                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
12085                         BPF_MOV64_IMM(BPF_REG_0, 0),
12086                         BPF_EXIT_INSN(),
12087
12088                         /* subprog 1 */
12089                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12090                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
12091                         /* 1st lookup from map */
12092                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12093                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12095                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12096                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12097                                      BPF_FUNC_map_lookup_elem),
12098                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
12099                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
12100                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12101                         BPF_MOV64_IMM(BPF_REG_8, 0),
12102                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12103                         BPF_MOV64_IMM(BPF_REG_8, 1),
12104
12105                         /* 2nd lookup from map */
12106                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12107                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12108                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12109                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12110                                      BPF_FUNC_map_lookup_elem),
12111                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
12112                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
12113                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12114                         BPF_MOV64_IMM(BPF_REG_9, 0),
12115                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12116                         BPF_MOV64_IMM(BPF_REG_9, 1),
12117
12118                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
12119                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12120                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
12121                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
12122                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
12123                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
12124                         BPF_EXIT_INSN(),
12125
12126                         /* subprog 2 */
12127                         /* if arg2 == 1 do *arg1 = 0 */
12128                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
12129                         /* fetch map_value_ptr from the stack of this function */
12130                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
12131                         /* write into map value */
12132                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
12133
12134                         /* if arg4 == 1 do *arg3 = 0 */
12135                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
12136                         /* fetch map_value_ptr from the stack of this function */
12137                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
12138                         /* write into map value */
12139                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
12140                         BPF_EXIT_INSN(),
12141                 },
12142                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12143                 .fixup_map_hash_8b = { 12, 22 },
12144                 .result = ACCEPT,
12145         },
12146         {
12147                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
12148                 .insns = {
12149                         /* main prog */
12150                         /* pass fp-16, fp-8 into a function */
12151                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
12152                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
12153                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12154                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
12155                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
12156                         BPF_MOV64_IMM(BPF_REG_0, 0),
12157                         BPF_EXIT_INSN(),
12158
12159                         /* subprog 1 */
12160                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12161                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
12162                         /* 1st lookup from map */
12163                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12164                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12165                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12166                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12167                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12168                                      BPF_FUNC_map_lookup_elem),
12169                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
12170                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
12171                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12172                         BPF_MOV64_IMM(BPF_REG_8, 0),
12173                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12174                         BPF_MOV64_IMM(BPF_REG_8, 1),
12175
12176                         /* 2nd lookup from map */
12177                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12178                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12179                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12180                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12181                                      BPF_FUNC_map_lookup_elem),
12182                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
12183                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
12184                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12185                         BPF_MOV64_IMM(BPF_REG_9, 0),
12186                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12187                         BPF_MOV64_IMM(BPF_REG_9, 1),
12188
12189                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
12190                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12191                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
12192                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
12193                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
12194                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
12195                         BPF_EXIT_INSN(),
12196
12197                         /* subprog 2 */
12198                         /* if arg2 == 1 do *arg1 = 0 */
12199                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
12200                         /* fetch map_value_ptr from the stack of this function */
12201                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
12202                         /* write into map value */
12203                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
12204
12205                         /* if arg4 == 0 do *arg3 = 0 */
12206                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
12207                         /* fetch map_value_ptr from the stack of this function */
12208                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
12209                         /* write into map value */
12210                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
12211                         BPF_EXIT_INSN(),
12212                 },
12213                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12214                 .fixup_map_hash_8b = { 12, 22 },
12215                 .result = REJECT,
12216                 .errstr = "R0 invalid mem access 'inv'",
12217         },
12218         {
12219                 "calls: pkt_ptr spill into caller stack",
12220                 .insns = {
12221                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12223                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
12224                         BPF_EXIT_INSN(),
12225
12226                         /* subprog 1 */
12227                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12228                                     offsetof(struct __sk_buff, data)),
12229                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12230                                     offsetof(struct __sk_buff, data_end)),
12231                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12232                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12233                         /* spill unchecked pkt_ptr into stack of caller */
12234                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12235                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12236                         /* now the pkt range is verified, read pkt_ptr from stack */
12237                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
12238                         /* write 4 bytes into packet */
12239                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12240                         BPF_EXIT_INSN(),
12241                 },
12242                 .result = ACCEPT,
12243                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12244                 .retval = POINTER_VALUE,
12245         },
12246         {
12247                 "calls: pkt_ptr spill into caller stack 2",
12248                 .insns = {
12249                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12251                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12252                         /* Marking is still kept, but not in all cases safe. */
12253                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12254                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12255                         BPF_EXIT_INSN(),
12256
12257                         /* subprog 1 */
12258                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12259                                     offsetof(struct __sk_buff, data)),
12260                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12261                                     offsetof(struct __sk_buff, data_end)),
12262                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12264                         /* spill unchecked pkt_ptr into stack of caller */
12265                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12266                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12267                         /* now the pkt range is verified, read pkt_ptr from stack */
12268                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
12269                         /* write 4 bytes into packet */
12270                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12271                         BPF_EXIT_INSN(),
12272                 },
12273                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12274                 .errstr = "invalid access to packet",
12275                 .result = REJECT,
12276         },
12277         {
12278                 "calls: pkt_ptr spill into caller stack 3",
12279                 .insns = {
12280                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12281                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12282                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12283                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12284                         /* Marking is still kept and safe here. */
12285                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12286                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12287                         BPF_EXIT_INSN(),
12288
12289                         /* subprog 1 */
12290                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12291                                     offsetof(struct __sk_buff, data)),
12292                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12293                                     offsetof(struct __sk_buff, data_end)),
12294                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12295                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12296                         /* spill unchecked pkt_ptr into stack of caller */
12297                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12298                         BPF_MOV64_IMM(BPF_REG_5, 0),
12299                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12300                         BPF_MOV64_IMM(BPF_REG_5, 1),
12301                         /* now the pkt range is verified, read pkt_ptr from stack */
12302                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
12303                         /* write 4 bytes into packet */
12304                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12305                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12306                         BPF_EXIT_INSN(),
12307                 },
12308                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12309                 .result = ACCEPT,
12310                 .retval = 1,
12311         },
12312         {
12313                 "calls: pkt_ptr spill into caller stack 4",
12314                 .insns = {
12315                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12316                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12317                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12318                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12319                         /* Check marking propagated. */
12320                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12321                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12322                         BPF_EXIT_INSN(),
12323
12324                         /* subprog 1 */
12325                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12326                                     offsetof(struct __sk_buff, data)),
12327                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12328                                     offsetof(struct __sk_buff, data_end)),
12329                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12331                         /* spill unchecked pkt_ptr into stack of caller */
12332                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12333                         BPF_MOV64_IMM(BPF_REG_5, 0),
12334                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12335                         BPF_MOV64_IMM(BPF_REG_5, 1),
12336                         /* don't read back pkt_ptr from stack here */
12337                         /* write 4 bytes into packet */
12338                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12339                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12340                         BPF_EXIT_INSN(),
12341                 },
12342                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12343                 .result = ACCEPT,
12344                 .retval = 1,
12345         },
12346         {
12347                 "calls: pkt_ptr spill into caller stack 5",
12348                 .insns = {
12349                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12351                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
12352                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12353                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12354                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12355                         BPF_EXIT_INSN(),
12356
12357                         /* subprog 1 */
12358                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12359                                     offsetof(struct __sk_buff, data)),
12360                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12361                                     offsetof(struct __sk_buff, data_end)),
12362                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12364                         BPF_MOV64_IMM(BPF_REG_5, 0),
12365                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12366                         /* spill checked pkt_ptr into stack of caller */
12367                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12368                         BPF_MOV64_IMM(BPF_REG_5, 1),
12369                         /* don't read back pkt_ptr from stack here */
12370                         /* write 4 bytes into packet */
12371                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12372                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12373                         BPF_EXIT_INSN(),
12374                 },
12375                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12376                 .errstr = "same insn cannot be used with different",
12377                 .result = REJECT,
12378         },
12379         {
12380                 "calls: pkt_ptr spill into caller stack 6",
12381                 .insns = {
12382                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12383                                     offsetof(struct __sk_buff, data_end)),
12384                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12386                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12387                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12388                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12389                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12390                         BPF_EXIT_INSN(),
12391
12392                         /* subprog 1 */
12393                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12394                                     offsetof(struct __sk_buff, data)),
12395                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12396                                     offsetof(struct __sk_buff, data_end)),
12397                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12398                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12399                         BPF_MOV64_IMM(BPF_REG_5, 0),
12400                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12401                         /* spill checked pkt_ptr into stack of caller */
12402                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12403                         BPF_MOV64_IMM(BPF_REG_5, 1),
12404                         /* don't read back pkt_ptr from stack here */
12405                         /* write 4 bytes into packet */
12406                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12407                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12408                         BPF_EXIT_INSN(),
12409                 },
12410                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12411                 .errstr = "R4 invalid mem access",
12412                 .result = REJECT,
12413         },
12414         {
12415                 "calls: pkt_ptr spill into caller stack 7",
12416                 .insns = {
12417                         BPF_MOV64_IMM(BPF_REG_2, 0),
12418                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12419                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12420                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12421                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12422                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12423                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12424                         BPF_EXIT_INSN(),
12425
12426                         /* subprog 1 */
12427                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12428                                     offsetof(struct __sk_buff, data)),
12429                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12430                                     offsetof(struct __sk_buff, data_end)),
12431                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12433                         BPF_MOV64_IMM(BPF_REG_5, 0),
12434                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12435                         /* spill checked pkt_ptr into stack of caller */
12436                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12437                         BPF_MOV64_IMM(BPF_REG_5, 1),
12438                         /* don't read back pkt_ptr from stack here */
12439                         /* write 4 bytes into packet */
12440                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12441                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12442                         BPF_EXIT_INSN(),
12443                 },
12444                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12445                 .errstr = "R4 invalid mem access",
12446                 .result = REJECT,
12447         },
12448         {
12449                 "calls: pkt_ptr spill into caller stack 8",
12450                 .insns = {
12451                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12452                                     offsetof(struct __sk_buff, data)),
12453                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12454                                     offsetof(struct __sk_buff, data_end)),
12455                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12457                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
12458                         BPF_EXIT_INSN(),
12459                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12461                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12462                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12463                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12464                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12465                         BPF_EXIT_INSN(),
12466
12467                         /* subprog 1 */
12468                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12469                                     offsetof(struct __sk_buff, data)),
12470                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12471                                     offsetof(struct __sk_buff, data_end)),
12472                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12473                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12474                         BPF_MOV64_IMM(BPF_REG_5, 0),
12475                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12476                         /* spill checked pkt_ptr into stack of caller */
12477                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12478                         BPF_MOV64_IMM(BPF_REG_5, 1),
12479                         /* don't read back pkt_ptr from stack here */
12480                         /* write 4 bytes into packet */
12481                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12482                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12483                         BPF_EXIT_INSN(),
12484                 },
12485                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12486                 .result = ACCEPT,
12487         },
12488         {
12489                 "calls: pkt_ptr spill into caller stack 9",
12490                 .insns = {
12491                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12492                                     offsetof(struct __sk_buff, data)),
12493                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12494                                     offsetof(struct __sk_buff, data_end)),
12495                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12496                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12497                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
12498                         BPF_EXIT_INSN(),
12499                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12501                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12502                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12503                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12504                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12505                         BPF_EXIT_INSN(),
12506
12507                         /* subprog 1 */
12508                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12509                                     offsetof(struct __sk_buff, data)),
12510                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12511                                     offsetof(struct __sk_buff, data_end)),
12512                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12513                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12514                         BPF_MOV64_IMM(BPF_REG_5, 0),
12515                         /* spill unchecked pkt_ptr into stack of caller */
12516                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12517                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12518                         BPF_MOV64_IMM(BPF_REG_5, 1),
12519                         /* don't read back pkt_ptr from stack here */
12520                         /* write 4 bytes into packet */
12521                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12522                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12523                         BPF_EXIT_INSN(),
12524                 },
12525                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12526                 .errstr = "invalid access to packet",
12527                 .result = REJECT,
12528         },
12529         {
12530                 "calls: caller stack init to zero or map_value_or_null",
12531                 .insns = {
12532                         BPF_MOV64_IMM(BPF_REG_0, 0),
12533                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12534                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12536                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12537                         /* fetch map_value_or_null or const_zero from stack */
12538                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12539                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
12540                         /* store into map_value */
12541                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
12542                         BPF_EXIT_INSN(),
12543
12544                         /* subprog 1 */
12545                         /* if (ctx == 0) return; */
12546                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
12547                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
12548                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
12549                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12550                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12551                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12552                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12553                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12554                                      BPF_FUNC_map_lookup_elem),
12555                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
12556                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
12557                         BPF_EXIT_INSN(),
12558                 },
12559                 .fixup_map_hash_8b = { 13 },
12560                 .result = ACCEPT,
12561                 .prog_type = BPF_PROG_TYPE_XDP,
12562         },
12563         {
12564                 "calls: stack init to zero and pruning",
12565                 .insns = {
12566                         /* first make allocated_stack 16 byte */
12567                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
12568                         /* now fork the execution such that the false branch
12569                          * of JGT insn will be verified second and it skisp zero
12570                          * init of fp-8 stack slot. If stack liveness marking
12571                          * is missing live_read marks from call map_lookup
12572                          * processing then pruning will incorrectly assume
12573                          * that fp-8 stack slot was unused in the fall-through
12574                          * branch and will accept the program incorrectly
12575                          */
12576                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
12577                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12578                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
12579                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12580                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12581                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12582                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12583                                      BPF_FUNC_map_lookup_elem),
12584                         BPF_EXIT_INSN(),
12585                 },
12586                 .fixup_map_hash_48b = { 6 },
12587                 .errstr = "invalid indirect read from stack off -8+0 size 8",
12588                 .result = REJECT,
12589                 .prog_type = BPF_PROG_TYPE_XDP,
12590         },
12591         {
12592                 "calls: two calls returning different map pointers for lookup (hash, array)",
12593                 .insns = {
12594                         /* main prog */
12595                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
12596                         BPF_CALL_REL(11),
12597                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12598                         BPF_CALL_REL(12),
12599                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12600                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12601                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12603                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12604                                      BPF_FUNC_map_lookup_elem),
12605                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12606                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
12607                                    offsetof(struct test_val, foo)),
12608                         BPF_MOV64_IMM(BPF_REG_0, 1),
12609                         BPF_EXIT_INSN(),
12610                         /* subprog 1 */
12611                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12612                         BPF_EXIT_INSN(),
12613                         /* subprog 2 */
12614                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12615                         BPF_EXIT_INSN(),
12616                 },
12617                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12618                 .fixup_map_hash_48b = { 13 },
12619                 .fixup_map_array_48b = { 16 },
12620                 .result = ACCEPT,
12621                 .retval = 1,
12622         },
12623         {
12624                 "calls: two calls returning different map pointers for lookup (hash, map in map)",
12625                 .insns = {
12626                         /* main prog */
12627                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
12628                         BPF_CALL_REL(11),
12629                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12630                         BPF_CALL_REL(12),
12631                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12632                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12633                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12634                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12635                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12636                                      BPF_FUNC_map_lookup_elem),
12637                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12638                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
12639                                    offsetof(struct test_val, foo)),
12640                         BPF_MOV64_IMM(BPF_REG_0, 1),
12641                         BPF_EXIT_INSN(),
12642                         /* subprog 1 */
12643                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12644                         BPF_EXIT_INSN(),
12645                         /* subprog 2 */
12646                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12647                         BPF_EXIT_INSN(),
12648                 },
12649                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12650                 .fixup_map_in_map = { 16 },
12651                 .fixup_map_array_48b = { 13 },
12652                 .result = REJECT,
12653                 .errstr = "R0 invalid mem access 'map_ptr'",
12654         },
12655         {
12656                 "cond: two branches returning different map pointers for lookup (tail, tail)",
12657                 .insns = {
12658                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
12659                                     offsetof(struct __sk_buff, mark)),
12660                         BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
12661                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12662                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12663                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12664                         BPF_MOV64_IMM(BPF_REG_3, 7),
12665                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12666                                      BPF_FUNC_tail_call),
12667                         BPF_MOV64_IMM(BPF_REG_0, 1),
12668                         BPF_EXIT_INSN(),
12669                 },
12670                 .fixup_prog1 = { 5 },
12671                 .fixup_prog2 = { 2 },
12672                 .result_unpriv = REJECT,
12673                 .errstr_unpriv = "tail_call abusing map_ptr",
12674                 .result = ACCEPT,
12675                 .retval = 42,
12676         },
12677         {
12678                 "cond: two branches returning same map pointers for lookup (tail, tail)",
12679                 .insns = {
12680                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
12681                                     offsetof(struct __sk_buff, mark)),
12682                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
12683                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12684                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12685                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12686                         BPF_MOV64_IMM(BPF_REG_3, 7),
12687                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12688                                      BPF_FUNC_tail_call),
12689                         BPF_MOV64_IMM(BPF_REG_0, 1),
12690                         BPF_EXIT_INSN(),
12691                 },
12692                 .fixup_prog2 = { 2, 5 },
12693                 .result_unpriv = ACCEPT,
12694                 .result = ACCEPT,
12695                 .retval = 42,
12696         },
12697         {
12698                 "search pruning: all branches should be verified (nop operation)",
12699                 .insns = {
12700                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12701                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12702                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12703                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12704                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12705                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
12706                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12707                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12708                         BPF_MOV64_IMM(BPF_REG_4, 0),
12709                         BPF_JMP_A(1),
12710                         BPF_MOV64_IMM(BPF_REG_4, 1),
12711                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12712                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12713                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12714                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
12715                         BPF_MOV64_IMM(BPF_REG_6, 0),
12716                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
12717                         BPF_EXIT_INSN(),
12718                 },
12719                 .fixup_map_hash_8b = { 3 },
12720                 .errstr = "R6 invalid mem access 'inv'",
12721                 .result = REJECT,
12722                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12723         },
12724         {
12725                 "search pruning: all branches should be verified (invalid stack access)",
12726                 .insns = {
12727                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12728                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12729                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12730                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12731                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12732                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
12733                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12734                         BPF_MOV64_IMM(BPF_REG_4, 0),
12735                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12736                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12737                         BPF_JMP_A(1),
12738                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
12739                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12740                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12741                         BPF_EXIT_INSN(),
12742                 },
12743                 .fixup_map_hash_8b = { 3 },
12744                 .errstr = "invalid read from stack off -16+0 size 8",
12745                 .result = REJECT,
12746                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12747         },
12748         {
12749                 "jit: lsh, rsh, arsh by 1",
12750                 .insns = {
12751                         BPF_MOV64_IMM(BPF_REG_0, 1),
12752                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
12753                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
12754                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
12755                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
12756                         BPF_EXIT_INSN(),
12757                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
12758                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
12759                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
12760                         BPF_EXIT_INSN(),
12761                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
12762                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
12763                         BPF_EXIT_INSN(),
12764                         BPF_MOV64_IMM(BPF_REG_0, 2),
12765                         BPF_EXIT_INSN(),
12766                 },
12767                 .result = ACCEPT,
12768                 .retval = 2,
12769         },
12770         {
12771                 "jit: mov32 for ldimm64, 1",
12772                 .insns = {
12773                         BPF_MOV64_IMM(BPF_REG_0, 2),
12774                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
12775                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
12776                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
12777                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12778                         BPF_MOV64_IMM(BPF_REG_0, 1),
12779                         BPF_EXIT_INSN(),
12780                 },
12781                 .result = ACCEPT,
12782                 .retval = 2,
12783         },
12784         {
12785                 "jit: mov32 for ldimm64, 2",
12786                 .insns = {
12787                         BPF_MOV64_IMM(BPF_REG_0, 1),
12788                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
12789                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
12790                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12791                         BPF_MOV64_IMM(BPF_REG_0, 2),
12792                         BPF_EXIT_INSN(),
12793                 },
12794                 .result = ACCEPT,
12795                 .retval = 2,
12796         },
12797         {
12798                 "jit: various mul tests",
12799                 .insns = {
12800                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12801                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12802                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
12803                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12804                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12805                         BPF_MOV64_IMM(BPF_REG_0, 1),
12806                         BPF_EXIT_INSN(),
12807                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12808                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12809                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12810                         BPF_MOV64_IMM(BPF_REG_0, 1),
12811                         BPF_EXIT_INSN(),
12812                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
12813                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12814                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12815                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12816                         BPF_MOV64_IMM(BPF_REG_0, 1),
12817                         BPF_EXIT_INSN(),
12818                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12819                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12820                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12821                         BPF_MOV64_IMM(BPF_REG_0, 1),
12822                         BPF_EXIT_INSN(),
12823                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
12824                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
12825                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12826                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
12827                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
12828                         BPF_MOV64_IMM(BPF_REG_0, 1),
12829                         BPF_EXIT_INSN(),
12830                         BPF_MOV64_IMM(BPF_REG_0, 2),
12831                         BPF_EXIT_INSN(),
12832                 },
12833                 .result = ACCEPT,
12834                 .retval = 2,
12835         },
12836         {
12837                 "xadd/w check unaligned stack",
12838                 .insns = {
12839                         BPF_MOV64_IMM(BPF_REG_0, 1),
12840                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12841                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
12842                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12843                         BPF_EXIT_INSN(),
12844                 },
12845                 .result = REJECT,
12846                 .errstr = "misaligned stack access off",
12847                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12848         },
12849         {
12850                 "xadd/w check unaligned map",
12851                 .insns = {
12852                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12853                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12855                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12856                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12857                                      BPF_FUNC_map_lookup_elem),
12858                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
12859                         BPF_EXIT_INSN(),
12860                         BPF_MOV64_IMM(BPF_REG_1, 1),
12861                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
12862                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
12863                         BPF_EXIT_INSN(),
12864                 },
12865                 .fixup_map_hash_8b = { 3 },
12866                 .result = REJECT,
12867                 .errstr = "misaligned value access off",
12868                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12869         },
12870         {
12871                 "xadd/w check unaligned pkt",
12872                 .insns = {
12873                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12874                                     offsetof(struct xdp_md, data)),
12875                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12876                                     offsetof(struct xdp_md, data_end)),
12877                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
12878                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
12879                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
12880                         BPF_MOV64_IMM(BPF_REG_0, 99),
12881                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
12882                         BPF_MOV64_IMM(BPF_REG_0, 1),
12883                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12884                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
12885                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
12886                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
12887                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
12888                         BPF_EXIT_INSN(),
12889                 },
12890                 .result = REJECT,
12891                 .errstr = "BPF_XADD stores into R2 pkt is not allowed",
12892                 .prog_type = BPF_PROG_TYPE_XDP,
12893         },
12894         {
12895                 "xadd/w check whether src/dst got mangled, 1",
12896                 .insns = {
12897                         BPF_MOV64_IMM(BPF_REG_0, 1),
12898                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12899                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12900                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12901                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12902                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12903                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12904                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12905                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12906                         BPF_EXIT_INSN(),
12907                         BPF_MOV64_IMM(BPF_REG_0, 42),
12908                         BPF_EXIT_INSN(),
12909                 },
12910                 .result = ACCEPT,
12911                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12912                 .retval = 3,
12913         },
12914         {
12915                 "xadd/w check whether src/dst got mangled, 2",
12916                 .insns = {
12917                         BPF_MOV64_IMM(BPF_REG_0, 1),
12918                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12919                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12920                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12921                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12922                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12923                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12924                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12925                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
12926                         BPF_EXIT_INSN(),
12927                         BPF_MOV64_IMM(BPF_REG_0, 42),
12928                         BPF_EXIT_INSN(),
12929                 },
12930                 .result = ACCEPT,
12931                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12932                 .retval = 3,
12933         },
12934         {
12935                 "bpf_get_stack return R0 within range",
12936                 .insns = {
12937                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12938                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12939                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12941                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12942                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12943                                      BPF_FUNC_map_lookup_elem),
12944                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
12945                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
12946                         BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
12947                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12948                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12949                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
12950                         BPF_MOV64_IMM(BPF_REG_4, 256),
12951                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12952                         BPF_MOV64_IMM(BPF_REG_1, 0),
12953                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
12954                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
12955                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
12956                         BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
12957                         BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
12958                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12959                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
12960                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
12961                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
12962                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
12963                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12964                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
12965                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12966                         BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
12967                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
12968                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
12969                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12970                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
12971                         BPF_MOV64_IMM(BPF_REG_4, 0),
12972                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12973                         BPF_EXIT_INSN(),
12974                 },
12975                 .fixup_map_hash_48b = { 4 },
12976                 .result = ACCEPT,
12977                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12978         },
12979         {
12980                 "ld_abs: invalid op 1",
12981                 .insns = {
12982                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12983                         BPF_LD_ABS(BPF_DW, 0),
12984                         BPF_EXIT_INSN(),
12985                 },
12986                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12987                 .result = REJECT,
12988                 .errstr = "unknown opcode",
12989         },
12990         {
12991                 "ld_abs: invalid op 2",
12992                 .insns = {
12993                         BPF_MOV32_IMM(BPF_REG_0, 256),
12994                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12995                         BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
12996                         BPF_EXIT_INSN(),
12997                 },
12998                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12999                 .result = REJECT,
13000                 .errstr = "unknown opcode",
13001         },
13002         {
13003                 "ld_abs: nmap reduced",
13004                 .insns = {
13005                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13006                         BPF_LD_ABS(BPF_H, 12),
13007                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
13008                         BPF_LD_ABS(BPF_H, 12),
13009                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
13010                         BPF_MOV32_IMM(BPF_REG_0, 18),
13011                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
13012                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
13013                         BPF_LD_IND(BPF_W, BPF_REG_7, 14),
13014                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
13015                         BPF_MOV32_IMM(BPF_REG_0, 280971478),
13016                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
13017                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
13018                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
13019                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
13020                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
13021                         BPF_LD_ABS(BPF_H, 12),
13022                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
13023                         BPF_MOV32_IMM(BPF_REG_0, 22),
13024                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
13025                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
13026                         BPF_LD_IND(BPF_H, BPF_REG_7, 14),
13027                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
13028                         BPF_MOV32_IMM(BPF_REG_0, 17366),
13029                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
13030                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
13031                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
13032                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
13033                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
13034                         BPF_MOV32_IMM(BPF_REG_0, 256),
13035                         BPF_EXIT_INSN(),
13036                         BPF_MOV32_IMM(BPF_REG_0, 0),
13037                         BPF_EXIT_INSN(),
13038                 },
13039                 .data = {
13040                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
13041                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
13042                         0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
13043                 },
13044                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13045                 .result = ACCEPT,
13046                 .retval = 256,
13047         },
13048         {
13049                 "ld_abs: div + abs, test 1",
13050                 .insns = {
13051                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
13052                         BPF_LD_ABS(BPF_B, 3),
13053                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
13054                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
13055                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
13056                         BPF_LD_ABS(BPF_B, 4),
13057                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
13058                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
13059                         BPF_EXIT_INSN(),
13060                 },
13061                 .data = {
13062                         10, 20, 30, 40, 50,
13063                 },
13064                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13065                 .result = ACCEPT,
13066                 .retval = 10,
13067         },
13068         {
13069                 "ld_abs: div + abs, test 2",
13070                 .insns = {
13071                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
13072                         BPF_LD_ABS(BPF_B, 3),
13073                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
13074                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
13075                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
13076                         BPF_LD_ABS(BPF_B, 128),
13077                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
13078                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
13079                         BPF_EXIT_INSN(),
13080                 },
13081                 .data = {
13082                         10, 20, 30, 40, 50,
13083                 },
13084                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13085                 .result = ACCEPT,
13086                 .retval = 0,
13087         },
13088         {
13089                 "ld_abs: div + abs, test 3",
13090                 .insns = {
13091                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
13092                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
13093                         BPF_LD_ABS(BPF_B, 3),
13094                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
13095                         BPF_EXIT_INSN(),
13096                 },
13097                 .data = {
13098                         10, 20, 30, 40, 50,
13099                 },
13100                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13101                 .result = ACCEPT,
13102                 .retval = 0,
13103         },
13104         {
13105                 "ld_abs: div + abs, test 4",
13106                 .insns = {
13107                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
13108                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
13109                         BPF_LD_ABS(BPF_B, 256),
13110                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
13111                         BPF_EXIT_INSN(),
13112                 },
13113                 .data = {
13114                         10, 20, 30, 40, 50,
13115                 },
13116                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13117                 .result = ACCEPT,
13118                 .retval = 0,
13119         },
13120         {
13121                 "ld_abs: vlan + abs, test 1",
13122                 .insns = { },
13123                 .data = {
13124                         0x34,
13125                 },
13126                 .fill_helper = bpf_fill_ld_abs_vlan_push_pop,
13127                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13128                 .result = ACCEPT,
13129                 .retval = 0xbef,
13130         },
13131         {
13132                 "ld_abs: vlan + abs, test 2",
13133                 .insns = {
13134                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13135                         BPF_LD_ABS(BPF_B, 0),
13136                         BPF_LD_ABS(BPF_H, 0),
13137                         BPF_LD_ABS(BPF_W, 0),
13138                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
13139                         BPF_MOV64_IMM(BPF_REG_6, 0),
13140                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13141                         BPF_MOV64_IMM(BPF_REG_2, 1),
13142                         BPF_MOV64_IMM(BPF_REG_3, 2),
13143                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13144                                      BPF_FUNC_skb_vlan_push),
13145                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
13146                         BPF_LD_ABS(BPF_B, 0),
13147                         BPF_LD_ABS(BPF_H, 0),
13148                         BPF_LD_ABS(BPF_W, 0),
13149                         BPF_MOV64_IMM(BPF_REG_0, 42),
13150                         BPF_EXIT_INSN(),
13151                 },
13152                 .data = {
13153                         0x34,
13154                 },
13155                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13156                 .result = ACCEPT,
13157                 .retval = 42,
13158         },
13159         {
13160                 "ld_abs: jump around ld_abs",
13161                 .insns = { },
13162                 .data = {
13163                         10, 11,
13164                 },
13165                 .fill_helper = bpf_fill_jump_around_ld_abs,
13166                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13167                 .result = ACCEPT,
13168                 .retval = 10,
13169         },
13170         {
13171                 "ld_dw: xor semi-random 64 bit imms, test 1",
13172                 .insns = { },
13173                 .data = { },
13174                 .fill_helper = bpf_fill_rand_ld_dw,
13175                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13176                 .result = ACCEPT,
13177                 .retval = 4090,
13178         },
13179         {
13180                 "ld_dw: xor semi-random 64 bit imms, test 2",
13181                 .insns = { },
13182                 .data = { },
13183                 .fill_helper = bpf_fill_rand_ld_dw,
13184                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13185                 .result = ACCEPT,
13186                 .retval = 2047,
13187         },
13188         {
13189                 "ld_dw: xor semi-random 64 bit imms, test 3",
13190                 .insns = { },
13191                 .data = { },
13192                 .fill_helper = bpf_fill_rand_ld_dw,
13193                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13194                 .result = ACCEPT,
13195                 .retval = 511,
13196         },
13197         {
13198                 "ld_dw: xor semi-random 64 bit imms, test 4",
13199                 .insns = { },
13200                 .data = { },
13201                 .fill_helper = bpf_fill_rand_ld_dw,
13202                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13203                 .result = ACCEPT,
13204                 .retval = 5,
13205         },
13206         {
13207                 "pass unmodified ctx pointer to helper",
13208                 .insns = {
13209                         BPF_MOV64_IMM(BPF_REG_2, 0),
13210                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13211                                      BPF_FUNC_csum_update),
13212                         BPF_MOV64_IMM(BPF_REG_0, 0),
13213                         BPF_EXIT_INSN(),
13214                 },
13215                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13216                 .result = ACCEPT,
13217         },
13218         {
13219                 "reference tracking: leak potential reference",
13220                 .insns = {
13221                         BPF_SK_LOOKUP,
13222                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), /* leak reference */
13223                         BPF_EXIT_INSN(),
13224                 },
13225                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13226                 .errstr = "Unreleased reference",
13227                 .result = REJECT,
13228         },
13229         {
13230                 "reference tracking: leak potential reference on stack",
13231                 .insns = {
13232                         BPF_SK_LOOKUP,
13233                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13235                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13236                         BPF_MOV64_IMM(BPF_REG_0, 0),
13237                         BPF_EXIT_INSN(),
13238                 },
13239                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13240                 .errstr = "Unreleased reference",
13241                 .result = REJECT,
13242         },
13243         {
13244                 "reference tracking: leak potential reference on stack 2",
13245                 .insns = {
13246                         BPF_SK_LOOKUP,
13247                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13248                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13249                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13250                         BPF_MOV64_IMM(BPF_REG_0, 0),
13251                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
13252                         BPF_EXIT_INSN(),
13253                 },
13254                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13255                 .errstr = "Unreleased reference",
13256                 .result = REJECT,
13257         },
13258         {
13259                 "reference tracking: zero potential reference",
13260                 .insns = {
13261                         BPF_SK_LOOKUP,
13262                         BPF_MOV64_IMM(BPF_REG_0, 0), /* leak reference */
13263                         BPF_EXIT_INSN(),
13264                 },
13265                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13266                 .errstr = "Unreleased reference",
13267                 .result = REJECT,
13268         },
13269         {
13270                 "reference tracking: copy and zero potential references",
13271                 .insns = {
13272                         BPF_SK_LOOKUP,
13273                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
13274                         BPF_MOV64_IMM(BPF_REG_0, 0),
13275                         BPF_MOV64_IMM(BPF_REG_7, 0), /* leak reference */
13276                         BPF_EXIT_INSN(),
13277                 },
13278                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13279                 .errstr = "Unreleased reference",
13280                 .result = REJECT,
13281         },
13282         {
13283                 "reference tracking: release reference without check",
13284                 .insns = {
13285                         BPF_SK_LOOKUP,
13286                         /* reference in r0 may be NULL */
13287                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13288                         BPF_MOV64_IMM(BPF_REG_2, 0),
13289                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13290                         BPF_EXIT_INSN(),
13291                 },
13292                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13293                 .errstr = "type=sock_or_null expected=sock",
13294                 .result = REJECT,
13295         },
13296         {
13297                 "reference tracking: release reference",
13298                 .insns = {
13299                         BPF_SK_LOOKUP,
13300                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13301                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13302                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13303                         BPF_EXIT_INSN(),
13304                 },
13305                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13306                 .result = ACCEPT,
13307         },
13308         {
13309                 "reference tracking: release reference 2",
13310                 .insns = {
13311                         BPF_SK_LOOKUP,
13312                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13313                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
13314                         BPF_EXIT_INSN(),
13315                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13316                         BPF_EXIT_INSN(),
13317                 },
13318                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13319                 .result = ACCEPT,
13320         },
13321         {
13322                 "reference tracking: release reference twice",
13323                 .insns = {
13324                         BPF_SK_LOOKUP,
13325                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13326                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13327                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13328                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13329                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13330                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13331                         BPF_EXIT_INSN(),
13332                 },
13333                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13334                 .errstr = "type=inv expected=sock",
13335                 .result = REJECT,
13336         },
13337         {
13338                 "reference tracking: release reference twice inside branch",
13339                 .insns = {
13340                         BPF_SK_LOOKUP,
13341                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13342                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13343                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), /* goto end */
13344                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13345                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13346                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13347                         BPF_EXIT_INSN(),
13348                 },
13349                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13350                 .errstr = "type=inv expected=sock",
13351                 .result = REJECT,
13352         },
13353         {
13354                 "reference tracking: alloc, check, free in one subbranch",
13355                 .insns = {
13356                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13357                                     offsetof(struct __sk_buff, data)),
13358                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13359                                     offsetof(struct __sk_buff, data_end)),
13360                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13361                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
13362                         /* if (offsetof(skb, mark) > data_len) exit; */
13363                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
13364                         BPF_EXIT_INSN(),
13365                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
13366                                     offsetof(struct __sk_buff, mark)),
13367                         BPF_SK_LOOKUP,
13368                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 1), /* mark == 0? */
13369                         /* Leak reference in R0 */
13370                         BPF_EXIT_INSN(),
13371                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13372                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13373                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13374                         BPF_EXIT_INSN(),
13375                 },
13376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13377                 .errstr = "Unreleased reference",
13378                 .result = REJECT,
13379         },
13380         {
13381                 "reference tracking: alloc, check, free in both subbranches",
13382                 .insns = {
13383                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13384                                     offsetof(struct __sk_buff, data)),
13385                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13386                                     offsetof(struct __sk_buff, data_end)),
13387                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
13389                         /* if (offsetof(skb, mark) > data_len) exit; */
13390                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
13391                         BPF_EXIT_INSN(),
13392                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
13393                                     offsetof(struct __sk_buff, mark)),
13394                         BPF_SK_LOOKUP,
13395                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 4), /* mark == 0? */
13396                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13397                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13398                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13399                         BPF_EXIT_INSN(),
13400                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13401                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13402                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13403                         BPF_EXIT_INSN(),
13404                 },
13405                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13406                 .result = ACCEPT,
13407         },
13408         {
13409                 "reference tracking in call: free reference in subprog",
13410                 .insns = {
13411                         BPF_SK_LOOKUP,
13412                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
13413                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13414                         BPF_MOV64_IMM(BPF_REG_0, 0),
13415                         BPF_EXIT_INSN(),
13416
13417                         /* subprog 1 */
13418                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
13419                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
13420                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13421                         BPF_EXIT_INSN(),
13422                 },
13423                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13424                 .result = ACCEPT,
13425         },
13426         {
13427                 "pass modified ctx pointer to helper, 1",
13428                 .insns = {
13429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
13430                         BPF_MOV64_IMM(BPF_REG_2, 0),
13431                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13432                                      BPF_FUNC_csum_update),
13433                         BPF_MOV64_IMM(BPF_REG_0, 0),
13434                         BPF_EXIT_INSN(),
13435                 },
13436                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13437                 .result = REJECT,
13438                 .errstr = "dereference of modified ctx ptr",
13439         },
13440         {
13441                 "pass modified ctx pointer to helper, 2",
13442                 .insns = {
13443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
13444                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13445                                      BPF_FUNC_get_socket_cookie),
13446                         BPF_MOV64_IMM(BPF_REG_0, 0),
13447                         BPF_EXIT_INSN(),
13448                 },
13449                 .result_unpriv = REJECT,
13450                 .result = REJECT,
13451                 .errstr_unpriv = "dereference of modified ctx ptr",
13452                 .errstr = "dereference of modified ctx ptr",
13453         },
13454         {
13455                 "pass modified ctx pointer to helper, 3",
13456                 .insns = {
13457                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
13458                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
13459                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
13460                         BPF_MOV64_IMM(BPF_REG_2, 0),
13461                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13462                                      BPF_FUNC_csum_update),
13463                         BPF_MOV64_IMM(BPF_REG_0, 0),
13464                         BPF_EXIT_INSN(),
13465                 },
13466                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13467                 .result = REJECT,
13468                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
13469         },
13470         {
13471                 "mov64 src == dst",
13472                 .insns = {
13473                         BPF_MOV64_IMM(BPF_REG_2, 0),
13474                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
13475                         // Check bounds are OK
13476                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
13477                         BPF_MOV64_IMM(BPF_REG_0, 0),
13478                         BPF_EXIT_INSN(),
13479                 },
13480                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13481                 .result = ACCEPT,
13482         },
13483         {
13484                 "mov64 src != dst",
13485                 .insns = {
13486                         BPF_MOV64_IMM(BPF_REG_3, 0),
13487                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
13488                         // Check bounds are OK
13489                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
13490                         BPF_MOV64_IMM(BPF_REG_0, 0),
13491                         BPF_EXIT_INSN(),
13492                 },
13493                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13494                 .result = ACCEPT,
13495         },
13496         {
13497                 "reference tracking in call: free reference in subprog and outside",
13498                 .insns = {
13499                         BPF_SK_LOOKUP,
13500                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
13501                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13502                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
13503                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13504                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13505                         BPF_EXIT_INSN(),
13506
13507                         /* subprog 1 */
13508                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
13509                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
13510                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13511                         BPF_EXIT_INSN(),
13512                 },
13513                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13514                 .errstr = "type=inv expected=sock",
13515                 .result = REJECT,
13516         },
13517         {
13518                 "reference tracking in call: alloc & leak reference in subprog",
13519                 .insns = {
13520                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13521                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13522                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
13523                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13524                         BPF_MOV64_IMM(BPF_REG_0, 0),
13525                         BPF_EXIT_INSN(),
13526
13527                         /* subprog 1 */
13528                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_4),
13529                         BPF_SK_LOOKUP,
13530                         /* spill unchecked sk_ptr into stack of caller */
13531                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
13532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13533                         BPF_EXIT_INSN(),
13534                 },
13535                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13536                 .errstr = "Unreleased reference",
13537                 .result = REJECT,
13538         },
13539         {
13540                 "reference tracking in call: alloc in subprog, release outside",
13541                 .insns = {
13542                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13543                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
13544                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13545                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13546                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13547                         BPF_EXIT_INSN(),
13548
13549                         /* subprog 1 */
13550                         BPF_SK_LOOKUP,
13551                         BPF_EXIT_INSN(), /* return sk */
13552                 },
13553                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13554                 .retval = POINTER_VALUE,
13555                 .result = ACCEPT,
13556         },
13557         {
13558                 "reference tracking in call: sk_ptr leak into caller stack",
13559                 .insns = {
13560                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13561                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13562                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13563                         BPF_MOV64_IMM(BPF_REG_0, 0),
13564                         BPF_EXIT_INSN(),
13565
13566                         /* subprog 1 */
13567                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13569                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
13570                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
13571                         /* spill unchecked sk_ptr into stack of caller */
13572                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13573                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13574                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
13575                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13576                         BPF_EXIT_INSN(),
13577
13578                         /* subprog 2 */
13579                         BPF_SK_LOOKUP,
13580                         BPF_EXIT_INSN(),
13581                 },
13582                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13583                 .errstr = "Unreleased reference",
13584                 .result = REJECT,
13585         },
13586         {
13587                 "reference tracking in call: sk_ptr spill into caller stack",
13588                 .insns = {
13589                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13590                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13591                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13592                         BPF_MOV64_IMM(BPF_REG_0, 0),
13593                         BPF_EXIT_INSN(),
13594
13595                         /* subprog 1 */
13596                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13598                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
13599                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
13600                         /* spill unchecked sk_ptr into stack of caller */
13601                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13603                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
13604                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13605                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13606                         /* now the sk_ptr is verified, free the reference */
13607                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_4, 0),
13608                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13609                         BPF_EXIT_INSN(),
13610
13611                         /* subprog 2 */
13612                         BPF_SK_LOOKUP,
13613                         BPF_EXIT_INSN(),
13614                 },
13615                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13616                 .result = ACCEPT,
13617         },
13618         {
13619                 "reference tracking: allow LD_ABS",
13620                 .insns = {
13621                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13622                         BPF_SK_LOOKUP,
13623                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13624                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13625                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13626                         BPF_LD_ABS(BPF_B, 0),
13627                         BPF_LD_ABS(BPF_H, 0),
13628                         BPF_LD_ABS(BPF_W, 0),
13629                         BPF_EXIT_INSN(),
13630                 },
13631                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13632                 .result = ACCEPT,
13633         },
13634         {
13635                 "reference tracking: forbid LD_ABS while holding reference",
13636                 .insns = {
13637                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13638                         BPF_SK_LOOKUP,
13639                         BPF_LD_ABS(BPF_B, 0),
13640                         BPF_LD_ABS(BPF_H, 0),
13641                         BPF_LD_ABS(BPF_W, 0),
13642                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13643                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13644                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13645                         BPF_EXIT_INSN(),
13646                 },
13647                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13648                 .errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
13649                 .result = REJECT,
13650         },
13651         {
13652                 "reference tracking: allow LD_IND",
13653                 .insns = {
13654                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13655                         BPF_SK_LOOKUP,
13656                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13657                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13658                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13659                         BPF_MOV64_IMM(BPF_REG_7, 1),
13660                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
13661                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
13662                         BPF_EXIT_INSN(),
13663                 },
13664                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13665                 .result = ACCEPT,
13666                 .retval = 1,
13667         },
13668         {
13669                 "reference tracking: forbid LD_IND while holding reference",
13670                 .insns = {
13671                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13672                         BPF_SK_LOOKUP,
13673                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
13674                         BPF_MOV64_IMM(BPF_REG_7, 1),
13675                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
13676                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
13677                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_4),
13678                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13679                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13680                         BPF_EXIT_INSN(),
13681                 },
13682                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13683                 .errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
13684                 .result = REJECT,
13685         },
13686         {
13687                 "reference tracking: check reference or tail call",
13688                 .insns = {
13689                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13690                         BPF_SK_LOOKUP,
13691                         /* if (sk) bpf_sk_release() */
13692                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13693                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 7),
13694                         /* bpf_tail_call() */
13695                         BPF_MOV64_IMM(BPF_REG_3, 2),
13696                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13697                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13698                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13699                                      BPF_FUNC_tail_call),
13700                         BPF_MOV64_IMM(BPF_REG_0, 0),
13701                         BPF_EXIT_INSN(),
13702                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13703                         BPF_EXIT_INSN(),
13704                 },
13705                 .fixup_prog1 = { 17 },
13706                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13707                 .result = ACCEPT,
13708         },
13709         {
13710                 "reference tracking: release reference then tail call",
13711                 .insns = {
13712                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13713                         BPF_SK_LOOKUP,
13714                         /* if (sk) bpf_sk_release() */
13715                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13716                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13717                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13718                         /* bpf_tail_call() */
13719                         BPF_MOV64_IMM(BPF_REG_3, 2),
13720                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13721                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13722                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13723                                      BPF_FUNC_tail_call),
13724                         BPF_MOV64_IMM(BPF_REG_0, 0),
13725                         BPF_EXIT_INSN(),
13726                 },
13727                 .fixup_prog1 = { 18 },
13728                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13729                 .result = ACCEPT,
13730         },
13731         {
13732                 "reference tracking: leak possible reference over tail call",
13733                 .insns = {
13734                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13735                         /* Look up socket and store in REG_6 */
13736                         BPF_SK_LOOKUP,
13737                         /* bpf_tail_call() */
13738                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13739                         BPF_MOV64_IMM(BPF_REG_3, 2),
13740                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13741                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13742                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13743                                      BPF_FUNC_tail_call),
13744                         BPF_MOV64_IMM(BPF_REG_0, 0),
13745                         /* if (sk) bpf_sk_release() */
13746                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13747                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13748                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13749                         BPF_EXIT_INSN(),
13750                 },
13751                 .fixup_prog1 = { 16 },
13752                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13753                 .errstr = "tail_call would lead to reference leak",
13754                 .result = REJECT,
13755         },
13756         {
13757                 "reference tracking: leak checked reference over tail call",
13758                 .insns = {
13759                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13760                         /* Look up socket and store in REG_6 */
13761                         BPF_SK_LOOKUP,
13762                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13763                         /* if (!sk) goto end */
13764                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
13765                         /* bpf_tail_call() */
13766                         BPF_MOV64_IMM(BPF_REG_3, 0),
13767                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13768                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13769                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13770                                      BPF_FUNC_tail_call),
13771                         BPF_MOV64_IMM(BPF_REG_0, 0),
13772                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13773                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13774                         BPF_EXIT_INSN(),
13775                 },
13776                 .fixup_prog1 = { 17 },
13777                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13778                 .errstr = "tail_call would lead to reference leak",
13779                 .result = REJECT,
13780         },
13781         {
13782                 "reference tracking: mangle and release sock_or_null",
13783                 .insns = {
13784                         BPF_SK_LOOKUP,
13785                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
13787                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13788                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13789                         BPF_EXIT_INSN(),
13790                 },
13791                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13792                 .errstr = "R1 pointer arithmetic on sock_or_null prohibited",
13793                 .result = REJECT,
13794         },
13795         {
13796                 "reference tracking: mangle and release sock",
13797                 .insns = {
13798                         BPF_SK_LOOKUP,
13799                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13800                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13801                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
13802                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13803                         BPF_EXIT_INSN(),
13804                 },
13805                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13806                 .errstr = "R1 pointer arithmetic on sock prohibited",
13807                 .result = REJECT,
13808         },
13809         {
13810                 "reference tracking: access member",
13811                 .insns = {
13812                         BPF_SK_LOOKUP,
13813                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13814                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13815                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
13816                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13817                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13818                         BPF_EXIT_INSN(),
13819                 },
13820                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13821                 .result = ACCEPT,
13822         },
13823         {
13824                 "reference tracking: write to member",
13825                 .insns = {
13826                         BPF_SK_LOOKUP,
13827                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13828                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
13829                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13830                         BPF_LD_IMM64(BPF_REG_2, 42),
13831                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
13832                                     offsetof(struct bpf_sock, mark)),
13833                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13834                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13835                         BPF_LD_IMM64(BPF_REG_0, 0),
13836                         BPF_EXIT_INSN(),
13837                 },
13838                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13839                 .errstr = "cannot write into socket",
13840                 .result = REJECT,
13841         },
13842         {
13843                 "reference tracking: invalid 64-bit access of member",
13844                 .insns = {
13845                         BPF_SK_LOOKUP,
13846                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13847                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13848                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
13849                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13850                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13851                         BPF_EXIT_INSN(),
13852                 },
13853                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13854                 .errstr = "invalid bpf_sock access off=0 size=8",
13855                 .result = REJECT,
13856         },
13857         {
13858                 "reference tracking: access after release",
13859                 .insns = {
13860                         BPF_SK_LOOKUP,
13861                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13862                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13863                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13864                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
13865                         BPF_EXIT_INSN(),
13866                 },
13867                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13868                 .errstr = "!read_ok",
13869                 .result = REJECT,
13870         },
13871         {
13872                 "reference tracking: direct access for lookup",
13873                 .insns = {
13874                         /* Check that the packet is at least 64B long */
13875                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13876                                     offsetof(struct __sk_buff, data)),
13877                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13878                                     offsetof(struct __sk_buff, data_end)),
13879                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13880                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
13881                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
13882                         /* sk = sk_lookup_tcp(ctx, skb->data, ...) */
13883                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct bpf_sock_tuple)),
13884                         BPF_MOV64_IMM(BPF_REG_4, 0),
13885                         BPF_MOV64_IMM(BPF_REG_5, 0),
13886                         BPF_EMIT_CALL(BPF_FUNC_sk_lookup_tcp),
13887                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13888                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13889                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
13890                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13891                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13892                         BPF_EXIT_INSN(),
13893                 },
13894                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13895                 .result = ACCEPT,
13896         },
13897 };
13898
13899 static int probe_filter_length(const struct bpf_insn *fp)
13900 {
13901         int len;
13902
13903         for (len = MAX_INSNS - 1; len > 0; --len)
13904                 if (fp[len].code != 0 || fp[len].imm != 0)
13905                         break;
13906         return len + 1;
13907 }
13908
13909 static int create_map(uint32_t type, uint32_t size_key,
13910                       uint32_t size_value, uint32_t max_elem)
13911 {
13912         int fd;
13913
13914         fd = bpf_create_map(type, size_key, size_value, max_elem,
13915                             type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);
13916         if (fd < 0)
13917                 printf("Failed to create hash map '%s'!\n", strerror(errno));
13918
13919         return fd;
13920 }
13921
13922 static int create_prog_dummy1(enum bpf_map_type prog_type)
13923 {
13924         struct bpf_insn prog[] = {
13925                 BPF_MOV64_IMM(BPF_REG_0, 42),
13926                 BPF_EXIT_INSN(),
13927         };
13928
13929         return bpf_load_program(prog_type, prog,
13930                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
13931 }
13932
13933 static int create_prog_dummy2(enum bpf_map_type prog_type, int mfd, int idx)
13934 {
13935         struct bpf_insn prog[] = {
13936                 BPF_MOV64_IMM(BPF_REG_3, idx),
13937                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
13938                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13939                              BPF_FUNC_tail_call),
13940                 BPF_MOV64_IMM(BPF_REG_0, 41),
13941                 BPF_EXIT_INSN(),
13942         };
13943
13944         return bpf_load_program(prog_type, prog,
13945                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
13946 }
13947
13948 static int create_prog_array(enum bpf_map_type prog_type, uint32_t max_elem,
13949                              int p1key)
13950 {
13951         int p2key = 1;
13952         int mfd, p1fd, p2fd;
13953
13954         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
13955                              sizeof(int), max_elem, 0);
13956         if (mfd < 0) {
13957                 printf("Failed to create prog array '%s'!\n", strerror(errno));
13958                 return -1;
13959         }
13960
13961         p1fd = create_prog_dummy1(prog_type);
13962         p2fd = create_prog_dummy2(prog_type, mfd, p2key);
13963         if (p1fd < 0 || p2fd < 0)
13964                 goto out;
13965         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
13966                 goto out;
13967         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
13968                 goto out;
13969         close(p2fd);
13970         close(p1fd);
13971
13972         return mfd;
13973 out:
13974         close(p2fd);
13975         close(p1fd);
13976         close(mfd);
13977         return -1;
13978 }
13979
13980 static int create_map_in_map(void)
13981 {
13982         int inner_map_fd, outer_map_fd;
13983
13984         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
13985                                       sizeof(int), 1, 0);
13986         if (inner_map_fd < 0) {
13987                 printf("Failed to create array '%s'!\n", strerror(errno));
13988                 return inner_map_fd;
13989         }
13990
13991         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
13992                                              sizeof(int), inner_map_fd, 1, 0);
13993         if (outer_map_fd < 0)
13994                 printf("Failed to create array of maps '%s'!\n",
13995                        strerror(errno));
13996
13997         close(inner_map_fd);
13998
13999         return outer_map_fd;
14000 }
14001
14002 static int create_cgroup_storage(bool percpu)
14003 {
14004         enum bpf_map_type type = percpu ? BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE :
14005                 BPF_MAP_TYPE_CGROUP_STORAGE;
14006         int fd;
14007
14008         fd = bpf_create_map(type, sizeof(struct bpf_cgroup_storage_key),
14009                             TEST_DATA_LEN, 0, 0);
14010         if (fd < 0)
14011                 printf("Failed to create cgroup storage '%s'!\n",
14012                        strerror(errno));
14013
14014         return fd;
14015 }
14016
14017 static char bpf_vlog[UINT_MAX >> 8];
14018
14019 static void do_test_fixup(struct bpf_test *test, enum bpf_map_type prog_type,
14020                           struct bpf_insn *prog, int *map_fds)
14021 {
14022         int *fixup_map_hash_8b = test->fixup_map_hash_8b;
14023         int *fixup_map_hash_48b = test->fixup_map_hash_48b;
14024         int *fixup_map_hash_16b = test->fixup_map_hash_16b;
14025         int *fixup_map_array_48b = test->fixup_map_array_48b;
14026         int *fixup_map_sockmap = test->fixup_map_sockmap;
14027         int *fixup_map_sockhash = test->fixup_map_sockhash;
14028         int *fixup_map_xskmap = test->fixup_map_xskmap;
14029         int *fixup_map_stacktrace = test->fixup_map_stacktrace;
14030         int *fixup_prog1 = test->fixup_prog1;
14031         int *fixup_prog2 = test->fixup_prog2;
14032         int *fixup_map_in_map = test->fixup_map_in_map;
14033         int *fixup_cgroup_storage = test->fixup_cgroup_storage;
14034         int *fixup_percpu_cgroup_storage = test->fixup_percpu_cgroup_storage;
14035
14036         if (test->fill_helper)
14037                 test->fill_helper(test);
14038
14039         /* Allocating HTs with 1 elem is fine here, since we only test
14040          * for verifier and not do a runtime lookup, so the only thing
14041          * that really matters is value size in this case.
14042          */
14043         if (*fixup_map_hash_8b) {
14044                 map_fds[0] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
14045                                         sizeof(long long), 1);
14046                 do {
14047                         prog[*fixup_map_hash_8b].imm = map_fds[0];
14048                         fixup_map_hash_8b++;
14049                 } while (*fixup_map_hash_8b);
14050         }
14051
14052         if (*fixup_map_hash_48b) {
14053                 map_fds[1] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
14054                                         sizeof(struct test_val), 1);
14055                 do {
14056                         prog[*fixup_map_hash_48b].imm = map_fds[1];
14057                         fixup_map_hash_48b++;
14058                 } while (*fixup_map_hash_48b);
14059         }
14060
14061         if (*fixup_map_hash_16b) {
14062                 map_fds[2] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
14063                                         sizeof(struct other_val), 1);
14064                 do {
14065                         prog[*fixup_map_hash_16b].imm = map_fds[2];
14066                         fixup_map_hash_16b++;
14067                 } while (*fixup_map_hash_16b);
14068         }
14069
14070         if (*fixup_map_array_48b) {
14071                 map_fds[3] = create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
14072                                         sizeof(struct test_val), 1);
14073                 do {
14074                         prog[*fixup_map_array_48b].imm = map_fds[3];
14075                         fixup_map_array_48b++;
14076                 } while (*fixup_map_array_48b);
14077         }
14078
14079         if (*fixup_prog1) {
14080                 map_fds[4] = create_prog_array(prog_type, 4, 0);
14081                 do {
14082                         prog[*fixup_prog1].imm = map_fds[4];
14083                         fixup_prog1++;
14084                 } while (*fixup_prog1);
14085         }
14086
14087         if (*fixup_prog2) {
14088                 map_fds[5] = create_prog_array(prog_type, 8, 7);
14089                 do {
14090                         prog[*fixup_prog2].imm = map_fds[5];
14091                         fixup_prog2++;
14092                 } while (*fixup_prog2);
14093         }
14094
14095         if (*fixup_map_in_map) {
14096                 map_fds[6] = create_map_in_map();
14097                 do {
14098                         prog[*fixup_map_in_map].imm = map_fds[6];
14099                         fixup_map_in_map++;
14100                 } while (*fixup_map_in_map);
14101         }
14102
14103         if (*fixup_cgroup_storage) {
14104                 map_fds[7] = create_cgroup_storage(false);
14105                 do {
14106                         prog[*fixup_cgroup_storage].imm = map_fds[7];
14107                         fixup_cgroup_storage++;
14108                 } while (*fixup_cgroup_storage);
14109         }
14110
14111         if (*fixup_percpu_cgroup_storage) {
14112                 map_fds[8] = create_cgroup_storage(true);
14113                 do {
14114                         prog[*fixup_percpu_cgroup_storage].imm = map_fds[8];
14115                         fixup_percpu_cgroup_storage++;
14116                 } while (*fixup_percpu_cgroup_storage);
14117         }
14118         if (*fixup_map_sockmap) {
14119                 map_fds[9] = create_map(BPF_MAP_TYPE_SOCKMAP, sizeof(int),
14120                                         sizeof(int), 1);
14121                 do {
14122                         prog[*fixup_map_sockmap].imm = map_fds[9];
14123                         fixup_map_sockmap++;
14124                 } while (*fixup_map_sockmap);
14125         }
14126         if (*fixup_map_sockhash) {
14127                 map_fds[10] = create_map(BPF_MAP_TYPE_SOCKHASH, sizeof(int),
14128                                         sizeof(int), 1);
14129                 do {
14130                         prog[*fixup_map_sockhash].imm = map_fds[10];
14131                         fixup_map_sockhash++;
14132                 } while (*fixup_map_sockhash);
14133         }
14134         if (*fixup_map_xskmap) {
14135                 map_fds[11] = create_map(BPF_MAP_TYPE_XSKMAP, sizeof(int),
14136                                         sizeof(int), 1);
14137                 do {
14138                         prog[*fixup_map_xskmap].imm = map_fds[11];
14139                         fixup_map_xskmap++;
14140                 } while (*fixup_map_xskmap);
14141         }
14142         if (*fixup_map_stacktrace) {
14143                 map_fds[12] = create_map(BPF_MAP_TYPE_STACK_TRACE, sizeof(u32),
14144                                          sizeof(u64), 1);
14145                 do {
14146                         prog[*fixup_map_stacktrace].imm = map_fds[12];
14147                         fixup_map_stacktrace++;
14148                 } while (fixup_map_stacktrace);
14149         }
14150 }
14151
14152 static void do_test_single(struct bpf_test *test, bool unpriv,
14153                            int *passes, int *errors)
14154 {
14155         int fd_prog, expected_ret, reject_from_alignment;
14156         int prog_len, prog_type = test->prog_type;
14157         struct bpf_insn *prog = test->insns;
14158         int map_fds[MAX_NR_MAPS];
14159         const char *expected_err;
14160         uint32_t retval;
14161         int i, err;
14162
14163         for (i = 0; i < MAX_NR_MAPS; i++)
14164                 map_fds[i] = -1;
14165
14166         if (!prog_type)
14167                 prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
14168         do_test_fixup(test, prog_type, prog, map_fds);
14169         prog_len = probe_filter_length(prog);
14170
14171         fd_prog = bpf_verify_program(prog_type, prog, prog_len,
14172                                      test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
14173                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
14174
14175         expected_ret = unpriv && test->result_unpriv != UNDEF ?
14176                        test->result_unpriv : test->result;
14177         expected_err = unpriv && test->errstr_unpriv ?
14178                        test->errstr_unpriv : test->errstr;
14179
14180         reject_from_alignment = fd_prog < 0 &&
14181                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
14182                                 strstr(bpf_vlog, "Unknown alignment.");
14183 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
14184         if (reject_from_alignment) {
14185                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
14186                        strerror(errno));
14187                 goto fail_log;
14188         }
14189 #endif
14190         if (expected_ret == ACCEPT) {
14191                 if (fd_prog < 0 && !reject_from_alignment) {
14192                         printf("FAIL\nFailed to load prog '%s'!\n",
14193                                strerror(errno));
14194                         goto fail_log;
14195                 }
14196         } else {
14197                 if (fd_prog >= 0) {
14198                         printf("FAIL\nUnexpected success to load!\n");
14199                         goto fail_log;
14200                 }
14201                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
14202                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
14203                               expected_err, bpf_vlog);
14204                         goto fail_log;
14205                 }
14206         }
14207
14208         if (fd_prog >= 0) {
14209                 __u8 tmp[TEST_DATA_LEN << 2];
14210                 __u32 size_tmp = sizeof(tmp);
14211
14212                 err = bpf_prog_test_run(fd_prog, 1, test->data,
14213                                         sizeof(test->data), tmp, &size_tmp,
14214                                         &retval, NULL);
14215                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
14216                         printf("Unexpected bpf_prog_test_run error\n");
14217                         goto fail_log;
14218                 }
14219                 if (!err && retval != test->retval &&
14220                     test->retval != POINTER_VALUE) {
14221                         printf("FAIL retval %d != %d\n", retval, test->retval);
14222                         goto fail_log;
14223                 }
14224         }
14225         (*passes)++;
14226         printf("OK%s\n", reject_from_alignment ?
14227                " (NOTE: reject due to unknown alignment)" : "");
14228 close_fds:
14229         close(fd_prog);
14230         for (i = 0; i < MAX_NR_MAPS; i++)
14231                 close(map_fds[i]);
14232         sched_yield();
14233         return;
14234 fail_log:
14235         (*errors)++;
14236         printf("%s", bpf_vlog);
14237         goto close_fds;
14238 }
14239
14240 static bool is_admin(void)
14241 {
14242         cap_t caps;
14243         cap_flag_value_t sysadmin = CAP_CLEAR;
14244         const cap_value_t cap_val = CAP_SYS_ADMIN;
14245
14246 #ifdef CAP_IS_SUPPORTED
14247         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
14248                 perror("cap_get_flag");
14249                 return false;
14250         }
14251 #endif
14252         caps = cap_get_proc();
14253         if (!caps) {
14254                 perror("cap_get_proc");
14255                 return false;
14256         }
14257         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
14258                 perror("cap_get_flag");
14259         if (cap_free(caps))
14260                 perror("cap_free");
14261         return (sysadmin == CAP_SET);
14262 }
14263
14264 static int set_admin(bool admin)
14265 {
14266         cap_t caps;
14267         const cap_value_t cap_val = CAP_SYS_ADMIN;
14268         int ret = -1;
14269
14270         caps = cap_get_proc();
14271         if (!caps) {
14272                 perror("cap_get_proc");
14273                 return -1;
14274         }
14275         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
14276                                 admin ? CAP_SET : CAP_CLEAR)) {
14277                 perror("cap_set_flag");
14278                 goto out;
14279         }
14280         if (cap_set_proc(caps)) {
14281                 perror("cap_set_proc");
14282                 goto out;
14283         }
14284         ret = 0;
14285 out:
14286         if (cap_free(caps))
14287                 perror("cap_free");
14288         return ret;
14289 }
14290
14291 static void get_unpriv_disabled()
14292 {
14293         char buf[2];
14294         FILE *fd;
14295
14296         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
14297         if (!fd) {
14298                 perror("fopen /proc/sys/"UNPRIV_SYSCTL);
14299                 unpriv_disabled = true;
14300                 return;
14301         }
14302         if (fgets(buf, 2, fd) == buf && atoi(buf))
14303                 unpriv_disabled = true;
14304         fclose(fd);
14305 }
14306
14307 static bool test_as_unpriv(struct bpf_test *test)
14308 {
14309         return !test->prog_type ||
14310                test->prog_type == BPF_PROG_TYPE_SOCKET_FILTER ||
14311                test->prog_type == BPF_PROG_TYPE_CGROUP_SKB;
14312 }
14313
14314 static int do_test(bool unpriv, unsigned int from, unsigned int to)
14315 {
14316         int i, passes = 0, errors = 0, skips = 0;
14317
14318         for (i = from; i < to; i++) {
14319                 struct bpf_test *test = &tests[i];
14320
14321                 /* Program types that are not supported by non-root we
14322                  * skip right away.
14323                  */
14324                 if (test_as_unpriv(test) && unpriv_disabled) {
14325                         printf("#%d/u %s SKIP\n", i, test->descr);
14326                         skips++;
14327                 } else if (test_as_unpriv(test)) {
14328                         if (!unpriv)
14329                                 set_admin(false);
14330                         printf("#%d/u %s ", i, test->descr);
14331                         do_test_single(test, true, &passes, &errors);
14332                         if (!unpriv)
14333                                 set_admin(true);
14334                 }
14335
14336                 if (unpriv) {
14337                         printf("#%d/p %s SKIP\n", i, test->descr);
14338                         skips++;
14339                 } else {
14340                         printf("#%d/p %s ", i, test->descr);
14341                         do_test_single(test, false, &passes, &errors);
14342                 }
14343         }
14344
14345         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
14346                skips, errors);
14347         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
14348 }
14349
14350 int main(int argc, char **argv)
14351 {
14352         unsigned int from = 0, to = ARRAY_SIZE(tests);
14353         bool unpriv = !is_admin();
14354
14355         if (argc == 3) {
14356                 unsigned int l = atoi(argv[argc - 2]);
14357                 unsigned int u = atoi(argv[argc - 1]);
14358
14359                 if (l < to && u < to) {
14360                         from = l;
14361                         to   = u + 1;
14362                 }
14363         } else if (argc == 2) {
14364                 unsigned int t = atoi(argv[argc - 1]);
14365
14366                 if (t < to) {
14367                         from = t;
14368                         to   = t + 1;
14369                 }
14370         }
14371
14372         get_unpriv_disabled();
14373         if (unpriv && unpriv_disabled) {
14374                 printf("Cannot run as unprivileged user with sysctl %s.\n",
14375                        UNPRIV_SYSCTL);
14376                 return EXIT_FAILURE;
14377         }
14378
14379         bpf_semi_rand_init();
14380         return do_test(unpriv, from, to);
14381 }