?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[cris-mirror.git] / tools / testing / selftests / bpf / test_verifier.c
blobc73592fa3d4174815de60cbc8ecb411c95cffd40
1 /*
2 * Testsuite for eBPF verifier
3 *
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
5 * Copyright (c) 2017 Facebook
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of version 2 of the GNU General Public
9 * License as published by the Free Software Foundation.
10 */
11
12 #include <endian.h>
13 #include <asm/types.h>
14 #include <linux/types.h>
15 #include <stdint.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <unistd.h>
19 #include <errno.h>
20 #include <string.h>
21 #include <stddef.h>
22 #include <stdbool.h>
23 #include <sched.h>
24 #include <limits.h>
25
26 #include <sys/capability.h>
27 #include <sys/resource.h>
28
29 #include <linux/unistd.h>
30 #include <linux/filter.h>
31 #include <linux/bpf_perf_event.h>
32 #include <linux/bpf.h>
33 #include <linux/if_ether.h>
34
35 #include <bpf/bpf.h>
36
37 #ifdef HAVE_GENHDR
38 # include "autoconf.h"
39 #else
40 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
41 # define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
42 # endif
43 #endif
44
45 #include "../../../include/linux/filter.h"
46
47 #ifndef ARRAY_SIZE
48 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
49 #endif
50
51 #define MAX_INSNS 512
52 #define MAX_FIXUPS 8
53 #define MAX_NR_MAPS 4
54 #define POINTER_VALUE 0xcafe4all
55 #define TEST_DATA_LEN 64
56
57 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
58 #define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
59
60 struct bpf_test {
61 const char *descr;
62 struct bpf_insn insns[MAX_INSNS];
63 int fixup_map1[MAX_FIXUPS];
64 int fixup_map2[MAX_FIXUPS];
65 int fixup_prog[MAX_FIXUPS];
66 int fixup_map_in_map[MAX_FIXUPS];
67 const char *errstr;
68 const char *errstr_unpriv;
69 uint32_t retval;
70 enum {
71 UNDEF,
72 ACCEPT,
73 REJECT
74 } result, result_unpriv;
75 enum bpf_prog_type prog_type;
76 uint8_t flags;
77 };
78
79 /* Note we want this to be 64 bit aligned so that the end of our array is
80 * actually the end of the structure.
81 */
82 #define MAX_ENTRIES 11
83
84 struct test_val {
85 unsigned int index;
86 int foo[MAX_ENTRIES];
87 };
88
89 static struct bpf_test tests[] = {
90 {
91 "add+sub+mul",
92 .insns = {
93 BPF_MOV64_IMM(BPF_REG_1, 1),
94 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
95 BPF_MOV64_IMM(BPF_REG_2, 3),
96 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
97 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
98 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
99 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
100 BPF_EXIT_INSN(),
101 },
102 .result = ACCEPT,
103 .retval = -3,
104 },
105 {
106 "DIV32 by 0, zero check 1",
107 .insns = {
108 BPF_MOV32_IMM(BPF_REG_0, 42),
109 BPF_MOV32_IMM(BPF_REG_1, 0),
110 BPF_MOV32_IMM(BPF_REG_2, 1),
111 BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
112 BPF_EXIT_INSN(),
113 },
114 .result = ACCEPT,
115 .retval = 42,
116 },
117 {
118 "DIV32 by 0, zero check 2",
119 .insns = {
120 BPF_MOV32_IMM(BPF_REG_0, 42),
121 BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
122 BPF_MOV32_IMM(BPF_REG_2, 1),
123 BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
124 BPF_EXIT_INSN(),
125 },
126 .result = ACCEPT,
127 .retval = 42,
128 },
129 {
130 "DIV64 by 0, zero check",
131 .insns = {
132 BPF_MOV32_IMM(BPF_REG_0, 42),
133 BPF_MOV32_IMM(BPF_REG_1, 0),
134 BPF_MOV32_IMM(BPF_REG_2, 1),
135 BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
136 BPF_EXIT_INSN(),
137 },
138 .result = ACCEPT,
139 .retval = 42,
140 },
141 {
142 "MOD32 by 0, zero check 1",
143 .insns = {
144 BPF_MOV32_IMM(BPF_REG_0, 42),
145 BPF_MOV32_IMM(BPF_REG_1, 0),
146 BPF_MOV32_IMM(BPF_REG_2, 1),
147 BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
148 BPF_EXIT_INSN(),
149 },
150 .result = ACCEPT,
151 .retval = 42,
152 },
153 {
154 "MOD32 by 0, zero check 2",
155 .insns = {
156 BPF_MOV32_IMM(BPF_REG_0, 42),
157 BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
158 BPF_MOV32_IMM(BPF_REG_2, 1),
159 BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
160 BPF_EXIT_INSN(),
161 },
162 .result = ACCEPT,
163 .retval = 42,
164 },
165 {
166 "MOD64 by 0, zero check",
167 .insns = {
168 BPF_MOV32_IMM(BPF_REG_0, 42),
169 BPF_MOV32_IMM(BPF_REG_1, 0),
170 BPF_MOV32_IMM(BPF_REG_2, 1),
171 BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
172 BPF_EXIT_INSN(),
173 },
174 .result = ACCEPT,
175 .retval = 42,
176 },
177 {
178 "DIV32 by 0, zero check ok, cls",
179 .insns = {
180 BPF_MOV32_IMM(BPF_REG_0, 42),
181 BPF_MOV32_IMM(BPF_REG_1, 2),
182 BPF_MOV32_IMM(BPF_REG_2, 16),
183 BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
184 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
185 BPF_EXIT_INSN(),
186 },
187 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
188 .result = ACCEPT,
189 .retval = 8,
190 },
191 {
192 "DIV32 by 0, zero check 1, cls",
193 .insns = {
194 BPF_MOV32_IMM(BPF_REG_1, 0),
195 BPF_MOV32_IMM(BPF_REG_0, 1),
196 BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
197 BPF_EXIT_INSN(),
198 },
199 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
200 .result = ACCEPT,
201 .retval = 0,
202 },
203 {
204 "DIV32 by 0, zero check 2, cls",
205 .insns = {
206 BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
207 BPF_MOV32_IMM(BPF_REG_0, 1),
208 BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
209 BPF_EXIT_INSN(),
210 },
211 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
212 .result = ACCEPT,
213 .retval = 0,
214 },
215 {
216 "DIV64 by 0, zero check, cls",
217 .insns = {
218 BPF_MOV32_IMM(BPF_REG_1, 0),
219 BPF_MOV32_IMM(BPF_REG_0, 1),
220 BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
221 BPF_EXIT_INSN(),
222 },
223 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
224 .result = ACCEPT,
225 .retval = 0,
226 },
227 {
228 "MOD32 by 0, zero check ok, cls",
229 .insns = {
230 BPF_MOV32_IMM(BPF_REG_0, 42),
231 BPF_MOV32_IMM(BPF_REG_1, 3),
232 BPF_MOV32_IMM(BPF_REG_2, 5),
233 BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
234 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
235 BPF_EXIT_INSN(),
236 },
237 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
238 .result = ACCEPT,
239 .retval = 2,
240 },
241 {
242 "MOD32 by 0, zero check 1, cls",
243 .insns = {
244 BPF_MOV32_IMM(BPF_REG_1, 0),
245 BPF_MOV32_IMM(BPF_REG_0, 1),
246 BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
247 BPF_EXIT_INSN(),
248 },
249 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
250 .result = ACCEPT,
251 .retval = 1,
252 },
253 {
254 "MOD32 by 0, zero check 2, cls",
255 .insns = {
256 BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
257 BPF_MOV32_IMM(BPF_REG_0, 1),
258 BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
259 BPF_EXIT_INSN(),
260 },
261 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
262 .result = ACCEPT,
263 .retval = 1,
264 },
265 {
266 "MOD64 by 0, zero check 1, cls",
267 .insns = {
268 BPF_MOV32_IMM(BPF_REG_1, 0),
269 BPF_MOV32_IMM(BPF_REG_0, 2),
270 BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
271 BPF_EXIT_INSN(),
272 },
273 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
274 .result = ACCEPT,
275 .retval = 2,
276 },
277 {
278 "MOD64 by 0, zero check 2, cls",
279 .insns = {
280 BPF_MOV32_IMM(BPF_REG_1, 0),
281 BPF_MOV32_IMM(BPF_REG_0, -1),
282 BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
283 BPF_EXIT_INSN(),
284 },
285 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
286 .result = ACCEPT,
287 .retval = -1,
288 },
289 /* Just make sure that JITs used udiv/umod as otherwise we get
290 * an exception from INT_MIN/-1 overflow similarly as with div
291 * by zero.
292 */
293 {
294 "DIV32 overflow, check 1",
295 .insns = {
296 BPF_MOV32_IMM(BPF_REG_1, -1),
297 BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
298 BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
299 BPF_EXIT_INSN(),
300 },
301 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
302 .result = ACCEPT,
303 .retval = 0,
304 },
305 {
306 "DIV32 overflow, check 2",
307 .insns = {
308 BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
309 BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
310 BPF_EXIT_INSN(),
311 },
312 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
313 .result = ACCEPT,
314 .retval = 0,
315 },
316 {
317 "DIV64 overflow, check 1",
318 .insns = {
319 BPF_MOV64_IMM(BPF_REG_1, -1),
320 BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
321 BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
322 BPF_EXIT_INSN(),
323 },
324 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
325 .result = ACCEPT,
326 .retval = 0,
327 },
328 {
329 "DIV64 overflow, check 2",
330 .insns = {
331 BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
332 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
333 BPF_EXIT_INSN(),
334 },
335 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
336 .result = ACCEPT,
337 .retval = 0,
338 },
339 {
340 "MOD32 overflow, check 1",
341 .insns = {
342 BPF_MOV32_IMM(BPF_REG_1, -1),
343 BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
344 BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
345 BPF_EXIT_INSN(),
346 },
347 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
348 .result = ACCEPT,
349 .retval = INT_MIN,
350 },
351 {
352 "MOD32 overflow, check 2",
353 .insns = {
354 BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
355 BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
356 BPF_EXIT_INSN(),
357 },
358 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
359 .result = ACCEPT,
360 .retval = INT_MIN,
361 },
362 {
363 "MOD64 overflow, check 1",
364 .insns = {
365 BPF_MOV64_IMM(BPF_REG_1, -1),
366 BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
367 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
368 BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
369 BPF_MOV32_IMM(BPF_REG_0, 0),
370 BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
371 BPF_MOV32_IMM(BPF_REG_0, 1),
372 BPF_EXIT_INSN(),
373 },
374 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
375 .result = ACCEPT,
376 .retval = 1,
377 },
378 {
379 "MOD64 overflow, check 2",
380 .insns = {
381 BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
382 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
383 BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
384 BPF_MOV32_IMM(BPF_REG_0, 0),
385 BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
386 BPF_MOV32_IMM(BPF_REG_0, 1),
387 BPF_EXIT_INSN(),
388 },
389 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
390 .result = ACCEPT,
391 .retval = 1,
392 },
393 {
394 "xor32 zero extend check",
395 .insns = {
396 BPF_MOV32_IMM(BPF_REG_2, -1),
397 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
398 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
399 BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
400 BPF_MOV32_IMM(BPF_REG_0, 2),
401 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
402 BPF_MOV32_IMM(BPF_REG_0, 1),
403 BPF_EXIT_INSN(),
404 },
405 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
406 .result = ACCEPT,
407 .retval = 1,
408 },
409 {
410 "empty prog",
411 .insns = {
412 },
413 .errstr = "unknown opcode 00",
414 .result = REJECT,
415 },
416 {
417 "only exit insn",
418 .insns = {
419 BPF_EXIT_INSN(),
420 },
421 .errstr = "R0 !read_ok",
422 .result = REJECT,
423 },
424 {
425 "unreachable",
426 .insns = {
427 BPF_EXIT_INSN(),
428 BPF_EXIT_INSN(),
429 },
430 .errstr = "unreachable",
431 .result = REJECT,
432 },
433 {
434 "unreachable2",
435 .insns = {
436 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
437 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
438 BPF_EXIT_INSN(),
439 },
440 .errstr = "unreachable",
441 .result = REJECT,
442 },
443 {
444 "out of range jump",
445 .insns = {
446 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
447 BPF_EXIT_INSN(),
448 },
449 .errstr = "jump out of range",
450 .result = REJECT,
451 },
452 {
453 "out of range jump2",
454 .insns = {
455 BPF_JMP_IMM(BPF_JA, 0, 0, -2),
456 BPF_EXIT_INSN(),
457 },
458 .errstr = "jump out of range",
459 .result = REJECT,
460 },
461 {
462 "test1 ld_imm64",
463 .insns = {
464 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
465 BPF_LD_IMM64(BPF_REG_0, 0),
466 BPF_LD_IMM64(BPF_REG_0, 0),
467 BPF_LD_IMM64(BPF_REG_0, 1),
468 BPF_LD_IMM64(BPF_REG_0, 1),
469 BPF_MOV64_IMM(BPF_REG_0, 2),
470 BPF_EXIT_INSN(),
471 },
472 .errstr = "invalid BPF_LD_IMM insn",
473 .errstr_unpriv = "R1 pointer comparison",
474 .result = REJECT,
475 },
476 {
477 "test2 ld_imm64",
478 .insns = {
479 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
480 BPF_LD_IMM64(BPF_REG_0, 0),
481 BPF_LD_IMM64(BPF_REG_0, 0),
482 BPF_LD_IMM64(BPF_REG_0, 1),
483 BPF_LD_IMM64(BPF_REG_0, 1),
484 BPF_EXIT_INSN(),
485 },
486 .errstr = "invalid BPF_LD_IMM insn",
487 .errstr_unpriv = "R1 pointer comparison",
488 .result = REJECT,
489 },
490 {
491 "test3 ld_imm64",
492 .insns = {
493 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
494 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
495 BPF_LD_IMM64(BPF_REG_0, 0),
496 BPF_LD_IMM64(BPF_REG_0, 0),
497 BPF_LD_IMM64(BPF_REG_0, 1),
498 BPF_LD_IMM64(BPF_REG_0, 1),
499 BPF_EXIT_INSN(),
500 },
501 .errstr = "invalid bpf_ld_imm64 insn",
502 .result = REJECT,
503 },
504 {
505 "test4 ld_imm64",
506 .insns = {
507 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
508 BPF_EXIT_INSN(),
509 },
510 .errstr = "invalid bpf_ld_imm64 insn",
511 .result = REJECT,
512 },
513 {
514 "test5 ld_imm64",
515 .insns = {
516 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
517 },
518 .errstr = "invalid bpf_ld_imm64 insn",
519 .result = REJECT,
520 },
521 {
522 "test6 ld_imm64",
523 .insns = {
524 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
525 BPF_RAW_INSN(0, 0, 0, 0, 0),
526 BPF_EXIT_INSN(),
527 },
528 .result = ACCEPT,
529 },
530 {
531 "test7 ld_imm64",
532 .insns = {
533 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
534 BPF_RAW_INSN(0, 0, 0, 0, 1),
535 BPF_EXIT_INSN(),
536 },
537 .result = ACCEPT,
538 .retval = 1,
539 },
540 {
541 "test8 ld_imm64",
542 .insns = {
543 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
544 BPF_RAW_INSN(0, 0, 0, 0, 1),
545 BPF_EXIT_INSN(),
546 },
547 .errstr = "uses reserved fields",
548 .result = REJECT,
549 },
550 {
551 "test9 ld_imm64",
552 .insns = {
553 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
554 BPF_RAW_INSN(0, 0, 0, 1, 1),
555 BPF_EXIT_INSN(),
556 },
557 .errstr = "invalid bpf_ld_imm64 insn",
558 .result = REJECT,
559 },
560 {
561 "test10 ld_imm64",
562 .insns = {
563 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
564 BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
565 BPF_EXIT_INSN(),
566 },
567 .errstr = "invalid bpf_ld_imm64 insn",
568 .result = REJECT,
569 },
570 {
571 "test11 ld_imm64",
572 .insns = {
573 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
574 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
575 BPF_EXIT_INSN(),
576 },
577 .errstr = "invalid bpf_ld_imm64 insn",
578 .result = REJECT,
579 },
580 {
581 "test12 ld_imm64",
582 .insns = {
583 BPF_MOV64_IMM(BPF_REG_1, 0),
584 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
585 BPF_RAW_INSN(0, 0, 0, 0, 1),
586 BPF_EXIT_INSN(),
587 },
588 .errstr = "not pointing to valid bpf_map",
589 .result = REJECT,
590 },
591 {
592 "test13 ld_imm64",
593 .insns = {
594 BPF_MOV64_IMM(BPF_REG_1, 0),
595 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
596 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
597 BPF_EXIT_INSN(),
598 },
599 .errstr = "invalid bpf_ld_imm64 insn",
600 .result = REJECT,
601 },
602 {
603 "arsh32 on imm",
604 .insns = {
605 BPF_MOV64_IMM(BPF_REG_0, 1),
606 BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
607 BPF_EXIT_INSN(),
608 },
609 .result = REJECT,
610 .errstr = "unknown opcode c4",
611 },
612 {
613 "arsh32 on reg",
614 .insns = {
615 BPF_MOV64_IMM(BPF_REG_0, 1),
616 BPF_MOV64_IMM(BPF_REG_1, 5),
617 BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
618 BPF_EXIT_INSN(),
619 },
620 .result = REJECT,
621 .errstr = "unknown opcode cc",
622 },
623 {
624 "arsh64 on imm",
625 .insns = {
626 BPF_MOV64_IMM(BPF_REG_0, 1),
627 BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
628 BPF_EXIT_INSN(),
629 },
630 .result = ACCEPT,
631 },
632 {
633 "arsh64 on reg",
634 .insns = {
635 BPF_MOV64_IMM(BPF_REG_0, 1),
636 BPF_MOV64_IMM(BPF_REG_1, 5),
637 BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
638 BPF_EXIT_INSN(),
639 },
640 .result = ACCEPT,
641 },
642 {
643 "no bpf_exit",
644 .insns = {
645 BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
646 },
647 .errstr = "not an exit",
648 .result = REJECT,
649 },
650 {
651 "loop (back-edge)",
652 .insns = {
653 BPF_JMP_IMM(BPF_JA, 0, 0, -1),
654 BPF_EXIT_INSN(),
655 },
656 .errstr = "back-edge",
657 .result = REJECT,
658 },
659 {
660 "loop2 (back-edge)",
661 .insns = {
662 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
663 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
664 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
665 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
666 BPF_EXIT_INSN(),
667 },
668 .errstr = "back-edge",
669 .result = REJECT,
670 },
671 {
672 "conditional loop",
673 .insns = {
674 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
675 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
676 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
677 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
678 BPF_EXIT_INSN(),
679 },
680 .errstr = "back-edge",
681 .result = REJECT,
682 },
683 {
684 "read uninitialized register",
685 .insns = {
686 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
687 BPF_EXIT_INSN(),
688 },
689 .errstr = "R2 !read_ok",
690 .result = REJECT,
691 },
692 {
693 "read invalid register",
694 .insns = {
695 BPF_MOV64_REG(BPF_REG_0, -1),
696 BPF_EXIT_INSN(),
697 },
698 .errstr = "R15 is invalid",
699 .result = REJECT,
700 },
701 {
702 "program doesn't init R0 before exit",
703 .insns = {
704 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
705 BPF_EXIT_INSN(),
706 },
707 .errstr = "R0 !read_ok",
708 .result = REJECT,
709 },
710 {
711 "program doesn't init R0 before exit in all branches",
712 .insns = {
713 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
714 BPF_MOV64_IMM(BPF_REG_0, 1),
715 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
716 BPF_EXIT_INSN(),
717 },
718 .errstr = "R0 !read_ok",
719 .errstr_unpriv = "R1 pointer comparison",
720 .result = REJECT,
721 },
722 {
723 "stack out of bounds",
724 .insns = {
725 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
726 BPF_EXIT_INSN(),
727 },
728 .errstr = "invalid stack",
729 .result = REJECT,
730 },
731 {
732 "invalid call insn1",
733 .insns = {
734 BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
735 BPF_EXIT_INSN(),
736 },
737 .errstr = "unknown opcode 8d",
738 .result = REJECT,
739 },
740 {
741 "invalid call insn2",
742 .insns = {
743 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
744 BPF_EXIT_INSN(),
745 },
746 .errstr = "BPF_CALL uses reserved",
747 .result = REJECT,
748 },
749 {
750 "invalid function call",
751 .insns = {
752 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
753 BPF_EXIT_INSN(),
754 },
755 .errstr = "invalid func unknown#1234567",
756 .result = REJECT,
757 },
758 {
759 "uninitialized stack1",
760 .insns = {
761 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
762 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
763 BPF_LD_MAP_FD(BPF_REG_1, 0),
764 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
765 BPF_FUNC_map_lookup_elem),
766 BPF_EXIT_INSN(),
767 },
768 .fixup_map1 = { 2 },
769 .errstr = "invalid indirect read from stack",
770 .result = REJECT,
771 },
772 {
773 "uninitialized stack2",
774 .insns = {
775 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
776 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
777 BPF_EXIT_INSN(),
778 },
779 .errstr = "invalid read from stack",
780 .result = REJECT,
781 },
782 {
783 "invalid fp arithmetic",
784 /* If this gets ever changed, make sure JITs can deal with it. */
785 .insns = {
786 BPF_MOV64_IMM(BPF_REG_0, 0),
787 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
788 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
789 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
790 BPF_EXIT_INSN(),
791 },
792 .errstr = "R1 subtraction from stack pointer",
793 .result = REJECT,
794 },
795 {
796 "non-invalid fp arithmetic",
797 .insns = {
798 BPF_MOV64_IMM(BPF_REG_0, 0),
799 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
800 BPF_EXIT_INSN(),
801 },
802 .result = ACCEPT,
803 },
804 {
805 "invalid argument register",
806 .insns = {
807 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
808 BPF_FUNC_get_cgroup_classid),
809 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
810 BPF_FUNC_get_cgroup_classid),
811 BPF_EXIT_INSN(),
812 },
813 .errstr = "R1 !read_ok",
814 .result = REJECT,
815 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
816 },
817 {
818 "non-invalid argument register",
819 .insns = {
820 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
821 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
822 BPF_FUNC_get_cgroup_classid),
823 BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
824 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
825 BPF_FUNC_get_cgroup_classid),
826 BPF_EXIT_INSN(),
827 },
828 .result = ACCEPT,
829 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
830 },
831 {
832 "check valid spill/fill",
833 .insns = {
834 /* spill R1(ctx) into stack */
835 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
836 /* fill it back into R2 */
837 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
838 /* should be able to access R0 = *(R2 + 8) */
839 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
840 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
841 BPF_EXIT_INSN(),
842 },
843 .errstr_unpriv = "R0 leaks addr",
844 .result = ACCEPT,
845 .result_unpriv = REJECT,
846 .retval = POINTER_VALUE,
847 },
848 {
849 "check valid spill/fill, skb mark",
850 .insns = {
851 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
852 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
853 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
854 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
855 offsetof(struct __sk_buff, mark)),
856 BPF_EXIT_INSN(),
857 },
858 .result = ACCEPT,
859 .result_unpriv = ACCEPT,
860 },
861 {
862 "check corrupted spill/fill",
863 .insns = {
864 /* spill R1(ctx) into stack */
865 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
866 /* mess up with R1 pointer on stack */
867 BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
868 /* fill back into R0 should fail */
869 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
870 BPF_EXIT_INSN(),
871 },
872 .errstr_unpriv = "attempt to corrupt spilled",
873 .errstr = "corrupted spill",
874 .result = REJECT,
875 },
876 {
877 "invalid src register in STX",
878 .insns = {
879 BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
880 BPF_EXIT_INSN(),
881 },
882 .errstr = "R15 is invalid",
883 .result = REJECT,
884 },
885 {
886 "invalid dst register in STX",
887 .insns = {
888 BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
889 BPF_EXIT_INSN(),
890 },
891 .errstr = "R14 is invalid",
892 .result = REJECT,
893 },
894 {
895 "invalid dst register in ST",
896 .insns = {
897 BPF_ST_MEM(BPF_B, 14, -1, -1),
898 BPF_EXIT_INSN(),
899 },
900 .errstr = "R14 is invalid",
901 .result = REJECT,
902 },
903 {
904 "invalid src register in LDX",
905 .insns = {
906 BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
907 BPF_EXIT_INSN(),
908 },
909 .errstr = "R12 is invalid",
910 .result = REJECT,
911 },
912 {
913 "invalid dst register in LDX",
914 .insns = {
915 BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
916 BPF_EXIT_INSN(),
917 },
918 .errstr = "R11 is invalid",
919 .result = REJECT,
920 },
921 {
922 "junk insn",
923 .insns = {
924 BPF_RAW_INSN(0, 0, 0, 0, 0),
925 BPF_EXIT_INSN(),
926 },
927 .errstr = "unknown opcode 00",
928 .result = REJECT,
929 },
930 {
931 "junk insn2",
932 .insns = {
933 BPF_RAW_INSN(1, 0, 0, 0, 0),
934 BPF_EXIT_INSN(),
935 },
936 .errstr = "BPF_LDX uses reserved fields",
937 .result = REJECT,
938 },
939 {
940 "junk insn3",
941 .insns = {
942 BPF_RAW_INSN(-1, 0, 0, 0, 0),
943 BPF_EXIT_INSN(),
944 },
945 .errstr = "unknown opcode ff",
946 .result = REJECT,
947 },
948 {
949 "junk insn4",
950 .insns = {
951 BPF_RAW_INSN(-1, -1, -1, -1, -1),
952 BPF_EXIT_INSN(),
953 },
954 .errstr = "unknown opcode ff",
955 .result = REJECT,
956 },
957 {
958 "junk insn5",
959 .insns = {
960 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
961 BPF_EXIT_INSN(),
962 },
963 .errstr = "BPF_ALU uses reserved fields",
964 .result = REJECT,
965 },
966 {
967 "misaligned read from stack",
968 .insns = {
969 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
970 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
971 BPF_EXIT_INSN(),
972 },
973 .errstr = "misaligned stack access",
974 .result = REJECT,
975 },
976 {
977 "invalid map_fd for function call",
978 .insns = {
979 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
980 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
981 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
982 BPF_LD_MAP_FD(BPF_REG_1, 0),
983 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
984 BPF_FUNC_map_delete_elem),
985 BPF_EXIT_INSN(),
986 },
987 .errstr = "fd 0 is not pointing to valid bpf_map",
988 .result = REJECT,
989 },
990 {
991 "don't check return value before access",
992 .insns = {
993 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
994 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
995 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
996 BPF_LD_MAP_FD(BPF_REG_1, 0),
997 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
998 BPF_FUNC_map_lookup_elem),
999 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1000 BPF_EXIT_INSN(),
1001 },
1002 .fixup_map1 = { 3 },
1003 .errstr = "R0 invalid mem access 'map_value_or_null'",
1004 .result = REJECT,
1005 },
1006 {
1007 "access memory with incorrect alignment",
1008 .insns = {
1009 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1010 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1012 BPF_LD_MAP_FD(BPF_REG_1, 0),
1013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1014 BPF_FUNC_map_lookup_elem),
1015 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1016 BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1017 BPF_EXIT_INSN(),
1018 },
1019 .fixup_map1 = { 3 },
1020 .errstr = "misaligned value access",
1021 .result = REJECT,
1022 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1023 },
1024 {
1025 "sometimes access memory with incorrect alignment",
1026 .insns = {
1027 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1028 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1029 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1030 BPF_LD_MAP_FD(BPF_REG_1, 0),
1031 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1032 BPF_FUNC_map_lookup_elem),
1033 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1034 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1035 BPF_EXIT_INSN(),
1036 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1037 BPF_EXIT_INSN(),
1038 },
1039 .fixup_map1 = { 3 },
1040 .errstr = "R0 invalid mem access",
1041 .errstr_unpriv = "R0 leaks addr",
1042 .result = REJECT,
1043 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1044 },
1045 {
1046 "jump test 1",
1047 .insns = {
1048 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1049 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1050 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1051 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1052 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1053 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1054 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1055 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1056 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1057 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1058 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1059 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1060 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1061 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1062 BPF_MOV64_IMM(BPF_REG_0, 0),
1063 BPF_EXIT_INSN(),
1064 },
1065 .errstr_unpriv = "R1 pointer comparison",
1066 .result_unpriv = REJECT,
1067 .result = ACCEPT,
1068 },
1069 {
1070 "jump test 2",
1071 .insns = {
1072 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1073 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1074 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1075 BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1076 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1077 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1078 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1079 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1080 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1081 BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1082 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1083 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1084 BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1085 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1086 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1087 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1088 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1089 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1090 BPF_MOV64_IMM(BPF_REG_0, 0),
1091 BPF_EXIT_INSN(),
1092 },
1093 .errstr_unpriv = "R1 pointer comparison",
1094 .result_unpriv = REJECT,
1095 .result = ACCEPT,
1096 },
1097 {
1098 "jump test 3",
1099 .insns = {
1100 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1101 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1102 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1104 BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1105 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1106 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1107 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1108 BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1109 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1110 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1111 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1112 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1113 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1114 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1115 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1116 BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1117 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1118 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1119 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1120 BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1121 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1122 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1123 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1124 BPF_LD_MAP_FD(BPF_REG_1, 0),
1125 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1126 BPF_FUNC_map_delete_elem),
1127 BPF_EXIT_INSN(),
1128 },
1129 .fixup_map1 = { 24 },
1130 .errstr_unpriv = "R1 pointer comparison",
1131 .result_unpriv = REJECT,
1132 .result = ACCEPT,
1133 .retval = -ENOENT,
1134 },
1135 {
1136 "jump test 4",
1137 .insns = {
1138 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1139 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1140 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1141 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1142 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1143 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1144 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1145 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1146 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1147 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1148 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1149 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1150 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1151 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1152 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1153 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1154 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1155 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1156 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1157 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1158 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1159 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1160 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1161 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1162 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1163 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1164 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1165 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1166 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1167 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1168 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1169 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1170 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1171 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1172 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1173 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1174 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1175 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1176 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1177 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1178 BPF_MOV64_IMM(BPF_REG_0, 0),
1179 BPF_EXIT_INSN(),
1180 },
1181 .errstr_unpriv = "R1 pointer comparison",
1182 .result_unpriv = REJECT,
1183 .result = ACCEPT,
1184 },
1185 {
1186 "jump test 5",
1187 .insns = {
1188 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1189 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1190 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1191 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1192 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1193 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1194 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1195 BPF_MOV64_IMM(BPF_REG_0, 0),
1196 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1197 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1198 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1199 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1200 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1201 BPF_MOV64_IMM(BPF_REG_0, 0),
1202 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1203 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1204 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1205 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1206 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1207 BPF_MOV64_IMM(BPF_REG_0, 0),
1208 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1209 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1210 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1211 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1212 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1213 BPF_MOV64_IMM(BPF_REG_0, 0),
1214 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1215 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1216 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1217 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1218 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1219 BPF_MOV64_IMM(BPF_REG_0, 0),
1220 BPF_EXIT_INSN(),
1221 },
1222 .errstr_unpriv = "R1 pointer comparison",
1223 .result_unpriv = REJECT,
1224 .result = ACCEPT,
1225 },
1226 {
1227 "access skb fields ok",
1228 .insns = {
1229 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1230 offsetof(struct __sk_buff, len)),
1231 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1232 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1233 offsetof(struct __sk_buff, mark)),
1234 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1235 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1236 offsetof(struct __sk_buff, pkt_type)),
1237 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1238 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1239 offsetof(struct __sk_buff, queue_mapping)),
1240 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1241 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1242 offsetof(struct __sk_buff, protocol)),
1243 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1244 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1245 offsetof(struct __sk_buff, vlan_present)),
1246 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1247 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1248 offsetof(struct __sk_buff, vlan_tci)),
1249 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1250 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1251 offsetof(struct __sk_buff, napi_id)),
1252 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1253 BPF_EXIT_INSN(),
1254 },
1255 .result = ACCEPT,
1256 },
1257 {
1258 "access skb fields bad1",
1259 .insns = {
1260 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1261 BPF_EXIT_INSN(),
1262 },
1263 .errstr = "invalid bpf_context access",
1264 .result = REJECT,
1265 },
1266 {
1267 "access skb fields bad2",
1268 .insns = {
1269 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1270 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1271 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1272 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1273 BPF_LD_MAP_FD(BPF_REG_1, 0),
1274 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1275 BPF_FUNC_map_lookup_elem),
1276 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1277 BPF_EXIT_INSN(),
1278 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1279 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1280 offsetof(struct __sk_buff, pkt_type)),
1281 BPF_EXIT_INSN(),
1282 },
1283 .fixup_map1 = { 4 },
1284 .errstr = "different pointers",
1285 .errstr_unpriv = "R1 pointer comparison",
1286 .result = REJECT,
1287 },
1288 {
1289 "access skb fields bad3",
1290 .insns = {
1291 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1292 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1293 offsetof(struct __sk_buff, pkt_type)),
1294 BPF_EXIT_INSN(),
1295 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1296 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1298 BPF_LD_MAP_FD(BPF_REG_1, 0),
1299 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1300 BPF_FUNC_map_lookup_elem),
1301 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1302 BPF_EXIT_INSN(),
1303 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1304 BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1305 },
1306 .fixup_map1 = { 6 },
1307 .errstr = "different pointers",
1308 .errstr_unpriv = "R1 pointer comparison",
1309 .result = REJECT,
1310 },
1311 {
1312 "access skb fields bad4",
1313 .insns = {
1314 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1315 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1316 offsetof(struct __sk_buff, len)),
1317 BPF_MOV64_IMM(BPF_REG_0, 0),
1318 BPF_EXIT_INSN(),
1319 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1320 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1321 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1322 BPF_LD_MAP_FD(BPF_REG_1, 0),
1323 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1324 BPF_FUNC_map_lookup_elem),
1325 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1326 BPF_EXIT_INSN(),
1327 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1328 BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1329 },
1330 .fixup_map1 = { 7 },
1331 .errstr = "different pointers",
1332 .errstr_unpriv = "R1 pointer comparison",
1333 .result = REJECT,
1334 },
1335 {
1336 "invalid access __sk_buff family",
1337 .insns = {
1338 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1339 offsetof(struct __sk_buff, family)),
1340 BPF_EXIT_INSN(),
1341 },
1342 .errstr = "invalid bpf_context access",
1343 .result = REJECT,
1344 },
1345 {
1346 "invalid access __sk_buff remote_ip4",
1347 .insns = {
1348 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1349 offsetof(struct __sk_buff, remote_ip4)),
1350 BPF_EXIT_INSN(),
1351 },
1352 .errstr = "invalid bpf_context access",
1353 .result = REJECT,
1354 },
1355 {
1356 "invalid access __sk_buff local_ip4",
1357 .insns = {
1358 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1359 offsetof(struct __sk_buff, local_ip4)),
1360 BPF_EXIT_INSN(),
1361 },
1362 .errstr = "invalid bpf_context access",
1363 .result = REJECT,
1364 },
1365 {
1366 "invalid access __sk_buff remote_ip6",
1367 .insns = {
1368 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1369 offsetof(struct __sk_buff, remote_ip6)),
1370 BPF_EXIT_INSN(),
1371 },
1372 .errstr = "invalid bpf_context access",
1373 .result = REJECT,
1374 },
1375 {
1376 "invalid access __sk_buff local_ip6",
1377 .insns = {
1378 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1379 offsetof(struct __sk_buff, local_ip6)),
1380 BPF_EXIT_INSN(),
1381 },
1382 .errstr = "invalid bpf_context access",
1383 .result = REJECT,
1384 },
1385 {
1386 "invalid access __sk_buff remote_port",
1387 .insns = {
1388 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1389 offsetof(struct __sk_buff, remote_port)),
1390 BPF_EXIT_INSN(),
1391 },
1392 .errstr = "invalid bpf_context access",
1393 .result = REJECT,
1394 },
1395 {
1396 "invalid access __sk_buff remote_port",
1397 .insns = {
1398 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1399 offsetof(struct __sk_buff, local_port)),
1400 BPF_EXIT_INSN(),
1401 },
1402 .errstr = "invalid bpf_context access",
1403 .result = REJECT,
1404 },
1405 {
1406 "valid access __sk_buff family",
1407 .insns = {
1408 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1409 offsetof(struct __sk_buff, family)),
1410 BPF_EXIT_INSN(),
1411 },
1412 .result = ACCEPT,
1413 .prog_type = BPF_PROG_TYPE_SK_SKB,
1414 },
1415 {
1416 "valid access __sk_buff remote_ip4",
1417 .insns = {
1418 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1419 offsetof(struct __sk_buff, remote_ip4)),
1420 BPF_EXIT_INSN(),
1421 },
1422 .result = ACCEPT,
1423 .prog_type = BPF_PROG_TYPE_SK_SKB,
1424 },
1425 {
1426 "valid access __sk_buff local_ip4",
1427 .insns = {
1428 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1429 offsetof(struct __sk_buff, local_ip4)),
1430 BPF_EXIT_INSN(),
1431 },
1432 .result = ACCEPT,
1433 .prog_type = BPF_PROG_TYPE_SK_SKB,
1434 },
1435 {
1436 "valid access __sk_buff remote_ip6",
1437 .insns = {
1438 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1439 offsetof(struct __sk_buff, remote_ip6[0])),
1440 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1441 offsetof(struct __sk_buff, remote_ip6[1])),
1442 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1443 offsetof(struct __sk_buff, remote_ip6[2])),
1444 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1445 offsetof(struct __sk_buff, remote_ip6[3])),
1446 BPF_EXIT_INSN(),
1447 },
1448 .result = ACCEPT,
1449 .prog_type = BPF_PROG_TYPE_SK_SKB,
1450 },
1451 {
1452 "valid access __sk_buff local_ip6",
1453 .insns = {
1454 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1455 offsetof(struct __sk_buff, local_ip6[0])),
1456 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1457 offsetof(struct __sk_buff, local_ip6[1])),
1458 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1459 offsetof(struct __sk_buff, local_ip6[2])),
1460 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1461 offsetof(struct __sk_buff, local_ip6[3])),
1462 BPF_EXIT_INSN(),
1463 },
1464 .result = ACCEPT,
1465 .prog_type = BPF_PROG_TYPE_SK_SKB,
1466 },
1467 {
1468 "valid access __sk_buff remote_port",
1469 .insns = {
1470 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1471 offsetof(struct __sk_buff, remote_port)),
1472 BPF_EXIT_INSN(),
1473 },
1474 .result = ACCEPT,
1475 .prog_type = BPF_PROG_TYPE_SK_SKB,
1476 },
1477 {
1478 "valid access __sk_buff remote_port",
1479 .insns = {
1480 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1481 offsetof(struct __sk_buff, local_port)),
1482 BPF_EXIT_INSN(),
1483 },
1484 .result = ACCEPT,
1485 .prog_type = BPF_PROG_TYPE_SK_SKB,
1486 },
1487 {
1488 "invalid access of tc_classid for SK_SKB",
1489 .insns = {
1490 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1491 offsetof(struct __sk_buff, tc_classid)),
1492 BPF_EXIT_INSN(),
1493 },
1494 .result = REJECT,
1495 .prog_type = BPF_PROG_TYPE_SK_SKB,
1496 .errstr = "invalid bpf_context access",
1497 },
1498 {
1499 "invalid access of skb->mark for SK_SKB",
1500 .insns = {
1501 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1502 offsetof(struct __sk_buff, mark)),
1503 BPF_EXIT_INSN(),
1504 },
1505 .result = REJECT,
1506 .prog_type = BPF_PROG_TYPE_SK_SKB,
1507 .errstr = "invalid bpf_context access",
1508 },
1509 {
1510 "check skb->mark is not writeable by SK_SKB",
1511 .insns = {
1512 BPF_MOV64_IMM(BPF_REG_0, 0),
1513 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1514 offsetof(struct __sk_buff, mark)),
1515 BPF_EXIT_INSN(),
1516 },
1517 .result = REJECT,
1518 .prog_type = BPF_PROG_TYPE_SK_SKB,
1519 .errstr = "invalid bpf_context access",
1520 },
1521 {
1522 "check skb->tc_index is writeable by SK_SKB",
1523 .insns = {
1524 BPF_MOV64_IMM(BPF_REG_0, 0),
1525 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1526 offsetof(struct __sk_buff, tc_index)),
1527 BPF_EXIT_INSN(),
1528 },
1529 .result = ACCEPT,
1530 .prog_type = BPF_PROG_TYPE_SK_SKB,
1531 },
1532 {
1533 "check skb->priority is writeable by SK_SKB",
1534 .insns = {
1535 BPF_MOV64_IMM(BPF_REG_0, 0),
1536 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1537 offsetof(struct __sk_buff, priority)),
1538 BPF_EXIT_INSN(),
1539 },
1540 .result = ACCEPT,
1541 .prog_type = BPF_PROG_TYPE_SK_SKB,
1542 },
1543 {
1544 "direct packet read for SK_SKB",
1545 .insns = {
1546 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1547 offsetof(struct __sk_buff, data)),
1548 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1549 offsetof(struct __sk_buff, data_end)),
1550 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1551 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1552 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1553 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1554 BPF_MOV64_IMM(BPF_REG_0, 0),
1555 BPF_EXIT_INSN(),
1556 },
1557 .result = ACCEPT,
1558 .prog_type = BPF_PROG_TYPE_SK_SKB,
1559 },
1560 {
1561 "direct packet write for SK_SKB",
1562 .insns = {
1563 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1564 offsetof(struct __sk_buff, data)),
1565 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1566 offsetof(struct __sk_buff, data_end)),
1567 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1568 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1569 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1570 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1571 BPF_MOV64_IMM(BPF_REG_0, 0),
1572 BPF_EXIT_INSN(),
1573 },
1574 .result = ACCEPT,
1575 .prog_type = BPF_PROG_TYPE_SK_SKB,
1576 },
1577 {
1578 "overlapping checks for direct packet access SK_SKB",
1579 .insns = {
1580 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1581 offsetof(struct __sk_buff, data)),
1582 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1583 offsetof(struct __sk_buff, data_end)),
1584 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1585 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1586 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1587 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1588 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1589 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1590 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1591 BPF_MOV64_IMM(BPF_REG_0, 0),
1592 BPF_EXIT_INSN(),
1593 },
1594 .result = ACCEPT,
1595 .prog_type = BPF_PROG_TYPE_SK_SKB,
1596 },
1597 {
1598 "check skb->mark is not writeable by sockets",
1599 .insns = {
1600 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1601 offsetof(struct __sk_buff, mark)),
1602 BPF_EXIT_INSN(),
1603 },
1604 .errstr = "invalid bpf_context access",
1605 .errstr_unpriv = "R1 leaks addr",
1606 .result = REJECT,
1607 },
1608 {
1609 "check skb->tc_index is not writeable by sockets",
1610 .insns = {
1611 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1612 offsetof(struct __sk_buff, tc_index)),
1613 BPF_EXIT_INSN(),
1614 },
1615 .errstr = "invalid bpf_context access",
1616 .errstr_unpriv = "R1 leaks addr",
1617 .result = REJECT,
1618 },
1619 {
1620 "check cb access: byte",
1621 .insns = {
1622 BPF_MOV64_IMM(BPF_REG_0, 0),
1623 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1624 offsetof(struct __sk_buff, cb[0])),
1625 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1626 offsetof(struct __sk_buff, cb[0]) + 1),
1627 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1628 offsetof(struct __sk_buff, cb[0]) + 2),
1629 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1630 offsetof(struct __sk_buff, cb[0]) + 3),
1631 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1632 offsetof(struct __sk_buff, cb[1])),
1633 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1634 offsetof(struct __sk_buff, cb[1]) + 1),
1635 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1636 offsetof(struct __sk_buff, cb[1]) + 2),
1637 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1638 offsetof(struct __sk_buff, cb[1]) + 3),
1639 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1640 offsetof(struct __sk_buff, cb[2])),
1641 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1642 offsetof(struct __sk_buff, cb[2]) + 1),
1643 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1644 offsetof(struct __sk_buff, cb[2]) + 2),
1645 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1646 offsetof(struct __sk_buff, cb[2]) + 3),
1647 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1648 offsetof(struct __sk_buff, cb[3])),
1649 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1650 offsetof(struct __sk_buff, cb[3]) + 1),
1651 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1652 offsetof(struct __sk_buff, cb[3]) + 2),
1653 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1654 offsetof(struct __sk_buff, cb[3]) + 3),
1655 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1656 offsetof(struct __sk_buff, cb[4])),
1657 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1658 offsetof(struct __sk_buff, cb[4]) + 1),
1659 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1660 offsetof(struct __sk_buff, cb[4]) + 2),
1661 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1662 offsetof(struct __sk_buff, cb[4]) + 3),
1663 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1664 offsetof(struct __sk_buff, cb[0])),
1665 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1666 offsetof(struct __sk_buff, cb[0]) + 1),
1667 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1668 offsetof(struct __sk_buff, cb[0]) + 2),
1669 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1670 offsetof(struct __sk_buff, cb[0]) + 3),
1671 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1672 offsetof(struct __sk_buff, cb[1])),
1673 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1674 offsetof(struct __sk_buff, cb[1]) + 1),
1675 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1676 offsetof(struct __sk_buff, cb[1]) + 2),
1677 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1678 offsetof(struct __sk_buff, cb[1]) + 3),
1679 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1680 offsetof(struct __sk_buff, cb[2])),
1681 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1682 offsetof(struct __sk_buff, cb[2]) + 1),
1683 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1684 offsetof(struct __sk_buff, cb[2]) + 2),
1685 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1686 offsetof(struct __sk_buff, cb[2]) + 3),
1687 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1688 offsetof(struct __sk_buff, cb[3])),
1689 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1690 offsetof(struct __sk_buff, cb[3]) + 1),
1691 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1692 offsetof(struct __sk_buff, cb[3]) + 2),
1693 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1694 offsetof(struct __sk_buff, cb[3]) + 3),
1695 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1696 offsetof(struct __sk_buff, cb[4])),
1697 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1698 offsetof(struct __sk_buff, cb[4]) + 1),
1699 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1700 offsetof(struct __sk_buff, cb[4]) + 2),
1701 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1702 offsetof(struct __sk_buff, cb[4]) + 3),
1703 BPF_EXIT_INSN(),
1704 },
1705 .result = ACCEPT,
1706 },
1707 {
1708 "__sk_buff->hash, offset 0, byte store not permitted",
1709 .insns = {
1710 BPF_MOV64_IMM(BPF_REG_0, 0),
1711 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1712 offsetof(struct __sk_buff, hash)),
1713 BPF_EXIT_INSN(),
1714 },
1715 .errstr = "invalid bpf_context access",
1716 .result = REJECT,
1717 },
1718 {
1719 "__sk_buff->tc_index, offset 3, byte store not permitted",
1720 .insns = {
1721 BPF_MOV64_IMM(BPF_REG_0, 0),
1722 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1723 offsetof(struct __sk_buff, tc_index) + 3),
1724 BPF_EXIT_INSN(),
1725 },
1726 .errstr = "invalid bpf_context access",
1727 .result = REJECT,
1728 },
1729 {
1730 "check skb->hash byte load permitted",
1731 .insns = {
1732 BPF_MOV64_IMM(BPF_REG_0, 0),
1733 #if __BYTE_ORDER == __LITTLE_ENDIAN
1734 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1735 offsetof(struct __sk_buff, hash)),
1736 #else
1737 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1738 offsetof(struct __sk_buff, hash) + 3),
1739 #endif
1740 BPF_EXIT_INSN(),
1741 },
1742 .result = ACCEPT,
1743 },
1744 {
1745 "check skb->hash byte load not permitted 1",
1746 .insns = {
1747 BPF_MOV64_IMM(BPF_REG_0, 0),
1748 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1749 offsetof(struct __sk_buff, hash) + 1),
1750 BPF_EXIT_INSN(),
1751 },
1752 .errstr = "invalid bpf_context access",
1753 .result = REJECT,
1754 },
1755 {
1756 "check skb->hash byte load not permitted 2",
1757 .insns = {
1758 BPF_MOV64_IMM(BPF_REG_0, 0),
1759 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1760 offsetof(struct __sk_buff, hash) + 2),
1761 BPF_EXIT_INSN(),
1762 },
1763 .errstr = "invalid bpf_context access",
1764 .result = REJECT,
1765 },
1766 {
1767 "check skb->hash byte load not permitted 3",
1768 .insns = {
1769 BPF_MOV64_IMM(BPF_REG_0, 0),
1770 #if __BYTE_ORDER == __LITTLE_ENDIAN
1771 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1772 offsetof(struct __sk_buff, hash) + 3),
1773 #else
1774 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1775 offsetof(struct __sk_buff, hash)),
1776 #endif
1777 BPF_EXIT_INSN(),
1778 },
1779 .errstr = "invalid bpf_context access",
1780 .result = REJECT,
1781 },
1782 {
1783 "check cb access: byte, wrong type",
1784 .insns = {
1785 BPF_MOV64_IMM(BPF_REG_0, 0),
1786 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1787 offsetof(struct __sk_buff, cb[0])),
1788 BPF_EXIT_INSN(),
1789 },
1790 .errstr = "invalid bpf_context access",
1791 .result = REJECT,
1792 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1793 },
1794 {
1795 "check cb access: half",
1796 .insns = {
1797 BPF_MOV64_IMM(BPF_REG_0, 0),
1798 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1799 offsetof(struct __sk_buff, cb[0])),
1800 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1801 offsetof(struct __sk_buff, cb[0]) + 2),
1802 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1803 offsetof(struct __sk_buff, cb[1])),
1804 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1805 offsetof(struct __sk_buff, cb[1]) + 2),
1806 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1807 offsetof(struct __sk_buff, cb[2])),
1808 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1809 offsetof(struct __sk_buff, cb[2]) + 2),
1810 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1811 offsetof(struct __sk_buff, cb[3])),
1812 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1813 offsetof(struct __sk_buff, cb[3]) + 2),
1814 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1815 offsetof(struct __sk_buff, cb[4])),
1816 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1817 offsetof(struct __sk_buff, cb[4]) + 2),
1818 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1819 offsetof(struct __sk_buff, cb[0])),
1820 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1821 offsetof(struct __sk_buff, cb[0]) + 2),
1822 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1823 offsetof(struct __sk_buff, cb[1])),
1824 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1825 offsetof(struct __sk_buff, cb[1]) + 2),
1826 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1827 offsetof(struct __sk_buff, cb[2])),
1828 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1829 offsetof(struct __sk_buff, cb[2]) + 2),
1830 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1831 offsetof(struct __sk_buff, cb[3])),
1832 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1833 offsetof(struct __sk_buff, cb[3]) + 2),
1834 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1835 offsetof(struct __sk_buff, cb[4])),
1836 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1837 offsetof(struct __sk_buff, cb[4]) + 2),
1838 BPF_EXIT_INSN(),
1839 },
1840 .result = ACCEPT,
1841 },
1842 {
1843 "check cb access: half, unaligned",
1844 .insns = {
1845 BPF_MOV64_IMM(BPF_REG_0, 0),
1846 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1847 offsetof(struct __sk_buff, cb[0]) + 1),
1848 BPF_EXIT_INSN(),
1849 },
1850 .errstr = "misaligned context access",
1851 .result = REJECT,
1852 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1853 },
1854 {
1855 "check __sk_buff->hash, offset 0, half store not permitted",
1856 .insns = {
1857 BPF_MOV64_IMM(BPF_REG_0, 0),
1858 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1859 offsetof(struct __sk_buff, hash)),
1860 BPF_EXIT_INSN(),
1861 },
1862 .errstr = "invalid bpf_context access",
1863 .result = REJECT,
1864 },
1865 {
1866 "check __sk_buff->tc_index, offset 2, half store not permitted",
1867 .insns = {
1868 BPF_MOV64_IMM(BPF_REG_0, 0),
1869 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1870 offsetof(struct __sk_buff, tc_index) + 2),
1871 BPF_EXIT_INSN(),
1872 },
1873 .errstr = "invalid bpf_context access",
1874 .result = REJECT,
1875 },
1876 {
1877 "check skb->hash half load permitted",
1878 .insns = {
1879 BPF_MOV64_IMM(BPF_REG_0, 0),
1880 #if __BYTE_ORDER == __LITTLE_ENDIAN
1881 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1882 offsetof(struct __sk_buff, hash)),
1883 #else
1884 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1885 offsetof(struct __sk_buff, hash) + 2),
1886 #endif
1887 BPF_EXIT_INSN(),
1888 },
1889 .result = ACCEPT,
1890 },
1891 {
1892 "check skb->hash half load not permitted",
1893 .insns = {
1894 BPF_MOV64_IMM(BPF_REG_0, 0),
1895 #if __BYTE_ORDER == __LITTLE_ENDIAN
1896 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1897 offsetof(struct __sk_buff, hash) + 2),
1898 #else
1899 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1900 offsetof(struct __sk_buff, hash)),
1901 #endif
1902 BPF_EXIT_INSN(),
1903 },
1904 .errstr = "invalid bpf_context access",
1905 .result = REJECT,
1906 },
1907 {
1908 "check cb access: half, wrong type",
1909 .insns = {
1910 BPF_MOV64_IMM(BPF_REG_0, 0),
1911 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1912 offsetof(struct __sk_buff, cb[0])),
1913 BPF_EXIT_INSN(),
1914 },
1915 .errstr = "invalid bpf_context access",
1916 .result = REJECT,
1917 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1918 },
1919 {
1920 "check cb access: word",
1921 .insns = {
1922 BPF_MOV64_IMM(BPF_REG_0, 0),
1923 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1924 offsetof(struct __sk_buff, cb[0])),
1925 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1926 offsetof(struct __sk_buff, cb[1])),
1927 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1928 offsetof(struct __sk_buff, cb[2])),
1929 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1930 offsetof(struct __sk_buff, cb[3])),
1931 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1932 offsetof(struct __sk_buff, cb[4])),
1933 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1934 offsetof(struct __sk_buff, cb[0])),
1935 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1936 offsetof(struct __sk_buff, cb[1])),
1937 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1938 offsetof(struct __sk_buff, cb[2])),
1939 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1940 offsetof(struct __sk_buff, cb[3])),
1941 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1942 offsetof(struct __sk_buff, cb[4])),
1943 BPF_EXIT_INSN(),
1944 },
1945 .result = ACCEPT,
1946 },
1947 {
1948 "check cb access: word, unaligned 1",
1949 .insns = {
1950 BPF_MOV64_IMM(BPF_REG_0, 0),
1951 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1952 offsetof(struct __sk_buff, cb[0]) + 2),
1953 BPF_EXIT_INSN(),
1954 },
1955 .errstr = "misaligned context access",
1956 .result = REJECT,
1957 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1958 },
1959 {
1960 "check cb access: word, unaligned 2",
1961 .insns = {
1962 BPF_MOV64_IMM(BPF_REG_0, 0),
1963 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1964 offsetof(struct __sk_buff, cb[4]) + 1),
1965 BPF_EXIT_INSN(),
1966 },
1967 .errstr = "misaligned context access",
1968 .result = REJECT,
1969 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1970 },
1971 {
1972 "check cb access: word, unaligned 3",
1973 .insns = {
1974 BPF_MOV64_IMM(BPF_REG_0, 0),
1975 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1976 offsetof(struct __sk_buff, cb[4]) + 2),
1977 BPF_EXIT_INSN(),
1978 },
1979 .errstr = "misaligned context access",
1980 .result = REJECT,
1981 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1982 },
1983 {
1984 "check cb access: word, unaligned 4",
1985 .insns = {
1986 BPF_MOV64_IMM(BPF_REG_0, 0),
1987 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1988 offsetof(struct __sk_buff, cb[4]) + 3),
1989 BPF_EXIT_INSN(),
1990 },
1991 .errstr = "misaligned context access",
1992 .result = REJECT,
1993 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1994 },
1995 {
1996 "check cb access: double",
1997 .insns = {
1998 BPF_MOV64_IMM(BPF_REG_0, 0),
1999 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2000 offsetof(struct __sk_buff, cb[0])),
2001 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2002 offsetof(struct __sk_buff, cb[2])),
2003 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2004 offsetof(struct __sk_buff, cb[0])),
2005 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2006 offsetof(struct __sk_buff, cb[2])),
2007 BPF_EXIT_INSN(),
2008 },
2009 .result = ACCEPT,
2010 },
2011 {
2012 "check cb access: double, unaligned 1",
2013 .insns = {
2014 BPF_MOV64_IMM(BPF_REG_0, 0),
2015 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2016 offsetof(struct __sk_buff, cb[1])),
2017 BPF_EXIT_INSN(),
2018 },
2019 .errstr = "misaligned context access",
2020 .result = REJECT,
2021 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2022 },
2023 {
2024 "check cb access: double, unaligned 2",
2025 .insns = {
2026 BPF_MOV64_IMM(BPF_REG_0, 0),
2027 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2028 offsetof(struct __sk_buff, cb[3])),
2029 BPF_EXIT_INSN(),
2030 },
2031 .errstr = "misaligned context access",
2032 .result = REJECT,
2033 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2034 },
2035 {
2036 "check cb access: double, oob 1",
2037 .insns = {
2038 BPF_MOV64_IMM(BPF_REG_0, 0),
2039 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2040 offsetof(struct __sk_buff, cb[4])),
2041 BPF_EXIT_INSN(),
2042 },
2043 .errstr = "invalid bpf_context access",
2044 .result = REJECT,
2045 },
2046 {
2047 "check cb access: double, oob 2",
2048 .insns = {
2049 BPF_MOV64_IMM(BPF_REG_0, 0),
2050 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2051 offsetof(struct __sk_buff, cb[4])),
2052 BPF_EXIT_INSN(),
2053 },
2054 .errstr = "invalid bpf_context access",
2055 .result = REJECT,
2056 },
2057 {
2058 "check __sk_buff->ifindex dw store not permitted",
2059 .insns = {
2060 BPF_MOV64_IMM(BPF_REG_0, 0),
2061 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2062 offsetof(struct __sk_buff, ifindex)),
2063 BPF_EXIT_INSN(),
2064 },
2065 .errstr = "invalid bpf_context access",
2066 .result = REJECT,
2067 },
2068 {
2069 "check __sk_buff->ifindex dw load not permitted",
2070 .insns = {
2071 BPF_MOV64_IMM(BPF_REG_0, 0),
2072 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2073 offsetof(struct __sk_buff, ifindex)),
2074 BPF_EXIT_INSN(),
2075 },
2076 .errstr = "invalid bpf_context access",
2077 .result = REJECT,
2078 },
2079 {
2080 "check cb access: double, wrong type",
2081 .insns = {
2082 BPF_MOV64_IMM(BPF_REG_0, 0),
2083 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2084 offsetof(struct __sk_buff, cb[0])),
2085 BPF_EXIT_INSN(),
2086 },
2087 .errstr = "invalid bpf_context access",
2088 .result = REJECT,
2089 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2090 },
2091 {
2092 "check out of range skb->cb access",
2093 .insns = {
2094 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2095 offsetof(struct __sk_buff, cb[0]) + 256),
2096 BPF_EXIT_INSN(),
2097 },
2098 .errstr = "invalid bpf_context access",
2099 .errstr_unpriv = "",
2100 .result = REJECT,
2101 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2102 },
2103 {
2104 "write skb fields from socket prog",
2105 .insns = {
2106 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2107 offsetof(struct __sk_buff, cb[4])),
2108 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2109 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2110 offsetof(struct __sk_buff, mark)),
2111 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2112 offsetof(struct __sk_buff, tc_index)),
2113 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2114 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2115 offsetof(struct __sk_buff, cb[0])),
2116 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2117 offsetof(struct __sk_buff, cb[2])),
2118 BPF_EXIT_INSN(),
2119 },
2120 .result = ACCEPT,
2121 .errstr_unpriv = "R1 leaks addr",
2122 .result_unpriv = REJECT,
2123 },
2124 {
2125 "write skb fields from tc_cls_act prog",
2126 .insns = {
2127 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2128 offsetof(struct __sk_buff, cb[0])),
2129 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2130 offsetof(struct __sk_buff, mark)),
2131 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2132 offsetof(struct __sk_buff, tc_index)),
2133 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2134 offsetof(struct __sk_buff, tc_index)),
2135 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2136 offsetof(struct __sk_buff, cb[3])),
2137 BPF_EXIT_INSN(),
2138 },
2139 .errstr_unpriv = "",
2140 .result_unpriv = REJECT,
2141 .result = ACCEPT,
2142 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2143 },
2144 {
2145 "PTR_TO_STACK store/load",
2146 .insns = {
2147 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2148 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2149 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2150 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2151 BPF_EXIT_INSN(),
2152 },
2153 .result = ACCEPT,
2154 .retval = 0xfaceb00c,
2155 },
2156 {
2157 "PTR_TO_STACK store/load - bad alignment on off",
2158 .insns = {
2159 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2161 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2162 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2163 BPF_EXIT_INSN(),
2164 },
2165 .result = REJECT,
2166 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2167 },
2168 {
2169 "PTR_TO_STACK store/load - bad alignment on reg",
2170 .insns = {
2171 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2172 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2173 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2174 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2175 BPF_EXIT_INSN(),
2176 },
2177 .result = REJECT,
2178 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2179 },
2180 {
2181 "PTR_TO_STACK store/load - out of bounds low",
2182 .insns = {
2183 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2184 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2185 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2186 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2187 BPF_EXIT_INSN(),
2188 },
2189 .result = REJECT,
2190 .errstr = "invalid stack off=-79992 size=8",
2191 },
2192 {
2193 "PTR_TO_STACK store/load - out of bounds high",
2194 .insns = {
2195 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2196 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2197 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2198 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2199 BPF_EXIT_INSN(),
2200 },
2201 .result = REJECT,
2202 .errstr = "invalid stack off=0 size=8",
2203 },
2204 {
2205 "unpriv: return pointer",
2206 .insns = {
2207 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2208 BPF_EXIT_INSN(),
2209 },
2210 .result = ACCEPT,
2211 .result_unpriv = REJECT,
2212 .errstr_unpriv = "R0 leaks addr",
2213 .retval = POINTER_VALUE,
2214 },
2215 {
2216 "unpriv: add const to pointer",
2217 .insns = {
2218 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2219 BPF_MOV64_IMM(BPF_REG_0, 0),
2220 BPF_EXIT_INSN(),
2221 },
2222 .result = ACCEPT,
2223 },
2224 {
2225 "unpriv: add pointer to pointer",
2226 .insns = {
2227 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2228 BPF_MOV64_IMM(BPF_REG_0, 0),
2229 BPF_EXIT_INSN(),
2230 },
2231 .result = REJECT,
2232 .errstr = "R1 pointer += pointer",
2233 },
2234 {
2235 "unpriv: neg pointer",
2236 .insns = {
2237 BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2238 BPF_MOV64_IMM(BPF_REG_0, 0),
2239 BPF_EXIT_INSN(),
2240 },
2241 .result = ACCEPT,
2242 .result_unpriv = REJECT,
2243 .errstr_unpriv = "R1 pointer arithmetic",
2244 },
2245 {
2246 "unpriv: cmp pointer with const",
2247 .insns = {
2248 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2249 BPF_MOV64_IMM(BPF_REG_0, 0),
2250 BPF_EXIT_INSN(),
2251 },
2252 .result = ACCEPT,
2253 .result_unpriv = REJECT,
2254 .errstr_unpriv = "R1 pointer comparison",
2255 },
2256 {
2257 "unpriv: cmp pointer with pointer",
2258 .insns = {
2259 BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2260 BPF_MOV64_IMM(BPF_REG_0, 0),
2261 BPF_EXIT_INSN(),
2262 },
2263 .result = ACCEPT,
2264 .result_unpriv = REJECT,
2265 .errstr_unpriv = "R10 pointer comparison",
2266 },
2267 {
2268 "unpriv: check that printk is disallowed",
2269 .insns = {
2270 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2271 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2272 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2273 BPF_MOV64_IMM(BPF_REG_2, 8),
2274 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2275 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2276 BPF_FUNC_trace_printk),
2277 BPF_MOV64_IMM(BPF_REG_0, 0),
2278 BPF_EXIT_INSN(),
2279 },
2280 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2281 .result_unpriv = REJECT,
2282 .result = ACCEPT,
2283 },
2284 {
2285 "unpriv: pass pointer to helper function",
2286 .insns = {
2287 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2288 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2289 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2290 BPF_LD_MAP_FD(BPF_REG_1, 0),
2291 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2292 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2293 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2294 BPF_FUNC_map_update_elem),
2295 BPF_MOV64_IMM(BPF_REG_0, 0),
2296 BPF_EXIT_INSN(),
2297 },
2298 .fixup_map1 = { 3 },
2299 .errstr_unpriv = "R4 leaks addr",
2300 .result_unpriv = REJECT,
2301 .result = ACCEPT,
2302 },
2303 {
2304 "unpriv: indirectly pass pointer on stack to helper function",
2305 .insns = {
2306 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2308 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2309 BPF_LD_MAP_FD(BPF_REG_1, 0),
2310 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2311 BPF_FUNC_map_lookup_elem),
2312 BPF_MOV64_IMM(BPF_REG_0, 0),
2313 BPF_EXIT_INSN(),
2314 },
2315 .fixup_map1 = { 3 },
2316 .errstr = "invalid indirect read from stack off -8+0 size 8",
2317 .result = REJECT,
2318 },
2319 {
2320 "unpriv: mangle pointer on stack 1",
2321 .insns = {
2322 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2323 BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2324 BPF_MOV64_IMM(BPF_REG_0, 0),
2325 BPF_EXIT_INSN(),
2326 },
2327 .errstr_unpriv = "attempt to corrupt spilled",
2328 .result_unpriv = REJECT,
2329 .result = ACCEPT,
2330 },
2331 {
2332 "unpriv: mangle pointer on stack 2",
2333 .insns = {
2334 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2335 BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2336 BPF_MOV64_IMM(BPF_REG_0, 0),
2337 BPF_EXIT_INSN(),
2338 },
2339 .errstr_unpriv = "attempt to corrupt spilled",
2340 .result_unpriv = REJECT,
2341 .result = ACCEPT,
2342 },
2343 {
2344 "unpriv: read pointer from stack in small chunks",
2345 .insns = {
2346 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2347 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2348 BPF_MOV64_IMM(BPF_REG_0, 0),
2349 BPF_EXIT_INSN(),
2350 },
2351 .errstr = "invalid size",
2352 .result = REJECT,
2353 },
2354 {
2355 "unpriv: write pointer into ctx",
2356 .insns = {
2357 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2358 BPF_MOV64_IMM(BPF_REG_0, 0),
2359 BPF_EXIT_INSN(),
2360 },
2361 .errstr_unpriv = "R1 leaks addr",
2362 .result_unpriv = REJECT,
2363 .errstr = "invalid bpf_context access",
2364 .result = REJECT,
2365 },
2366 {
2367 "unpriv: spill/fill of ctx",
2368 .insns = {
2369 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2370 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2371 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2372 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2373 BPF_MOV64_IMM(BPF_REG_0, 0),
2374 BPF_EXIT_INSN(),
2375 },
2376 .result = ACCEPT,
2377 },
2378 {
2379 "unpriv: spill/fill of ctx 2",
2380 .insns = {
2381 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2382 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2383 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2384 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2385 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2386 BPF_FUNC_get_hash_recalc),
2387 BPF_MOV64_IMM(BPF_REG_0, 0),
2388 BPF_EXIT_INSN(),
2389 },
2390 .result = ACCEPT,
2391 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2392 },
2393 {
2394 "unpriv: spill/fill of ctx 3",
2395 .insns = {
2396 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2397 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2398 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2399 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2400 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2401 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2402 BPF_FUNC_get_hash_recalc),
2403 BPF_EXIT_INSN(),
2404 },
2405 .result = REJECT,
2406 .errstr = "R1 type=fp expected=ctx",
2407 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2408 },
2409 {
2410 "unpriv: spill/fill of ctx 4",
2411 .insns = {
2412 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2413 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2414 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2415 BPF_MOV64_IMM(BPF_REG_0, 1),
2416 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2417 BPF_REG_0, -8, 0),
2418 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2419 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2420 BPF_FUNC_get_hash_recalc),
2421 BPF_EXIT_INSN(),
2422 },
2423 .result = REJECT,
2424 .errstr = "R1 type=inv expected=ctx",
2425 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2426 },
2427 {
2428 "unpriv: spill/fill of different pointers stx",
2429 .insns = {
2430 BPF_MOV64_IMM(BPF_REG_3, 42),
2431 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2432 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2433 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2434 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2435 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2436 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2437 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2438 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2439 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2440 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2441 offsetof(struct __sk_buff, mark)),
2442 BPF_MOV64_IMM(BPF_REG_0, 0),
2443 BPF_EXIT_INSN(),
2444 },
2445 .result = REJECT,
2446 .errstr = "same insn cannot be used with different pointers",
2447 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2448 },
2449 {
2450 "unpriv: spill/fill of different pointers ldx",
2451 .insns = {
2452 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2453 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2454 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2455 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2456 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2457 -(__s32)offsetof(struct bpf_perf_event_data,
2458 sample_period) - 8),
2459 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2460 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2461 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2462 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2463 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2464 offsetof(struct bpf_perf_event_data,
2465 sample_period)),
2466 BPF_MOV64_IMM(BPF_REG_0, 0),
2467 BPF_EXIT_INSN(),
2468 },
2469 .result = REJECT,
2470 .errstr = "same insn cannot be used with different pointers",
2471 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2472 },
2473 {
2474 "unpriv: write pointer into map elem value",
2475 .insns = {
2476 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2477 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2478 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2479 BPF_LD_MAP_FD(BPF_REG_1, 0),
2480 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2481 BPF_FUNC_map_lookup_elem),
2482 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2483 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2484 BPF_EXIT_INSN(),
2485 },
2486 .fixup_map1 = { 3 },
2487 .errstr_unpriv = "R0 leaks addr",
2488 .result_unpriv = REJECT,
2489 .result = ACCEPT,
2490 },
2491 {
2492 "unpriv: partial copy of pointer",
2493 .insns = {
2494 BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2495 BPF_MOV64_IMM(BPF_REG_0, 0),
2496 BPF_EXIT_INSN(),
2497 },
2498 .errstr_unpriv = "R10 partial copy",
2499 .result_unpriv = REJECT,
2500 .result = ACCEPT,
2501 },
2502 {
2503 "unpriv: pass pointer to tail_call",
2504 .insns = {
2505 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2506 BPF_LD_MAP_FD(BPF_REG_2, 0),
2507 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2508 BPF_FUNC_tail_call),
2509 BPF_MOV64_IMM(BPF_REG_0, 0),
2510 BPF_EXIT_INSN(),
2511 },
2512 .fixup_prog = { 1 },
2513 .errstr_unpriv = "R3 leaks addr into helper",
2514 .result_unpriv = REJECT,
2515 .result = ACCEPT,
2516 },
2517 {
2518 "unpriv: cmp map pointer with zero",
2519 .insns = {
2520 BPF_MOV64_IMM(BPF_REG_1, 0),
2521 BPF_LD_MAP_FD(BPF_REG_1, 0),
2522 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2523 BPF_MOV64_IMM(BPF_REG_0, 0),
2524 BPF_EXIT_INSN(),
2525 },
2526 .fixup_map1 = { 1 },
2527 .errstr_unpriv = "R1 pointer comparison",
2528 .result_unpriv = REJECT,
2529 .result = ACCEPT,
2530 },
2531 {
2532 "unpriv: write into frame pointer",
2533 .insns = {
2534 BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2535 BPF_MOV64_IMM(BPF_REG_0, 0),
2536 BPF_EXIT_INSN(),
2537 },
2538 .errstr = "frame pointer is read only",
2539 .result = REJECT,
2540 },
2541 {
2542 "unpriv: spill/fill frame pointer",
2543 .insns = {
2544 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2545 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2546 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2547 BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2548 BPF_MOV64_IMM(BPF_REG_0, 0),
2549 BPF_EXIT_INSN(),
2550 },
2551 .errstr = "frame pointer is read only",
2552 .result = REJECT,
2553 },
2554 {
2555 "unpriv: cmp of frame pointer",
2556 .insns = {
2557 BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2558 BPF_MOV64_IMM(BPF_REG_0, 0),
2559 BPF_EXIT_INSN(),
2560 },
2561 .errstr_unpriv = "R10 pointer comparison",
2562 .result_unpriv = REJECT,
2563 .result = ACCEPT,
2564 },
2565 {
2566 "unpriv: adding of fp",
2567 .insns = {
2568 BPF_MOV64_IMM(BPF_REG_0, 0),
2569 BPF_MOV64_IMM(BPF_REG_1, 0),
2570 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2571 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2572 BPF_EXIT_INSN(),
2573 },
2574 .result = ACCEPT,
2575 },
2576 {
2577 "unpriv: cmp of stack pointer",
2578 .insns = {
2579 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2580 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2581 BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2582 BPF_MOV64_IMM(BPF_REG_0, 0),
2583 BPF_EXIT_INSN(),
2584 },
2585 .errstr_unpriv = "R2 pointer comparison",
2586 .result_unpriv = REJECT,
2587 .result = ACCEPT,
2588 },
2589 {
2590 "runtime/jit: pass negative index to tail_call",
2591 .insns = {
2592 BPF_MOV64_IMM(BPF_REG_3, -1),
2593 BPF_LD_MAP_FD(BPF_REG_2, 0),
2594 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2595 BPF_FUNC_tail_call),
2596 BPF_MOV64_IMM(BPF_REG_0, 0),
2597 BPF_EXIT_INSN(),
2598 },
2599 .fixup_prog = { 1 },
2600 .result = ACCEPT,
2601 },
2602 {
2603 "runtime/jit: pass > 32bit index to tail_call",
2604 .insns = {
2605 BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2606 BPF_LD_MAP_FD(BPF_REG_2, 0),
2607 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2608 BPF_FUNC_tail_call),
2609 BPF_MOV64_IMM(BPF_REG_0, 0),
2610 BPF_EXIT_INSN(),
2611 },
2612 .fixup_prog = { 2 },
2613 .result = ACCEPT,
2614 },
2615 {
2616 "stack pointer arithmetic",
2617 .insns = {
2618 BPF_MOV64_IMM(BPF_REG_1, 4),
2619 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2620 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2621 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2622 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2623 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2624 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2625 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2626 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2627 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2628 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2629 BPF_MOV64_IMM(BPF_REG_0, 0),
2630 BPF_EXIT_INSN(),
2631 },
2632 .result = ACCEPT,
2633 },
2634 {
2635 "raw_stack: no skb_load_bytes",
2636 .insns = {
2637 BPF_MOV64_IMM(BPF_REG_2, 4),
2638 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2639 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2640 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2641 BPF_MOV64_IMM(BPF_REG_4, 8),
2642 /* Call to skb_load_bytes() omitted. */
2643 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2644 BPF_EXIT_INSN(),
2645 },
2646 .result = REJECT,
2647 .errstr = "invalid read from stack off -8+0 size 8",
2648 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2649 },
2650 {
2651 "raw_stack: skb_load_bytes, negative len",
2652 .insns = {
2653 BPF_MOV64_IMM(BPF_REG_2, 4),
2654 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2655 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2656 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2657 BPF_MOV64_IMM(BPF_REG_4, -8),
2658 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2659 BPF_FUNC_skb_load_bytes),
2660 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2661 BPF_EXIT_INSN(),
2662 },
2663 .result = REJECT,
2664 .errstr = "R4 min value is negative",
2665 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2666 },
2667 {
2668 "raw_stack: skb_load_bytes, negative len 2",
2669 .insns = {
2670 BPF_MOV64_IMM(BPF_REG_2, 4),
2671 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2672 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2673 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2674 BPF_MOV64_IMM(BPF_REG_4, ~0),
2675 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2676 BPF_FUNC_skb_load_bytes),
2677 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2678 BPF_EXIT_INSN(),
2679 },
2680 .result = REJECT,
2681 .errstr = "R4 min value is negative",
2682 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2683 },
2684 {
2685 "raw_stack: skb_load_bytes, zero len",
2686 .insns = {
2687 BPF_MOV64_IMM(BPF_REG_2, 4),
2688 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2689 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2690 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2691 BPF_MOV64_IMM(BPF_REG_4, 0),
2692 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2693 BPF_FUNC_skb_load_bytes),
2694 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2695 BPF_EXIT_INSN(),
2696 },
2697 .result = REJECT,
2698 .errstr = "invalid stack type R3",
2699 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2700 },
2701 {
2702 "raw_stack: skb_load_bytes, no init",
2703 .insns = {
2704 BPF_MOV64_IMM(BPF_REG_2, 4),
2705 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2706 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2707 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2708 BPF_MOV64_IMM(BPF_REG_4, 8),
2709 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2710 BPF_FUNC_skb_load_bytes),
2711 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2712 BPF_EXIT_INSN(),
2713 },
2714 .result = ACCEPT,
2715 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2716 },
2717 {
2718 "raw_stack: skb_load_bytes, init",
2719 .insns = {
2720 BPF_MOV64_IMM(BPF_REG_2, 4),
2721 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2722 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2723 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2724 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2725 BPF_MOV64_IMM(BPF_REG_4, 8),
2726 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2727 BPF_FUNC_skb_load_bytes),
2728 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2729 BPF_EXIT_INSN(),
2730 },
2731 .result = ACCEPT,
2732 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2733 },
2734 {
2735 "raw_stack: skb_load_bytes, spilled regs around bounds",
2736 .insns = {
2737 BPF_MOV64_IMM(BPF_REG_2, 4),
2738 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2739 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2740 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2741 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2742 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2743 BPF_MOV64_IMM(BPF_REG_4, 8),
2744 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2745 BPF_FUNC_skb_load_bytes),
2746 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2747 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2748 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2749 offsetof(struct __sk_buff, mark)),
2750 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2751 offsetof(struct __sk_buff, priority)),
2752 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2753 BPF_EXIT_INSN(),
2754 },
2755 .result = ACCEPT,
2756 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2757 },
2758 {
2759 "raw_stack: skb_load_bytes, spilled regs corruption",
2760 .insns = {
2761 BPF_MOV64_IMM(BPF_REG_2, 4),
2762 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2763 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2764 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2765 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2766 BPF_MOV64_IMM(BPF_REG_4, 8),
2767 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2768 BPF_FUNC_skb_load_bytes),
2769 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2770 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2771 offsetof(struct __sk_buff, mark)),
2772 BPF_EXIT_INSN(),
2773 },
2774 .result = REJECT,
2775 .errstr = "R0 invalid mem access 'inv'",
2776 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2777 },
2778 {
2779 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2780 .insns = {
2781 BPF_MOV64_IMM(BPF_REG_2, 4),
2782 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2783 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2784 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2785 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2786 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2787 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2788 BPF_MOV64_IMM(BPF_REG_4, 8),
2789 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2790 BPF_FUNC_skb_load_bytes),
2791 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2792 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2793 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2794 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2795 offsetof(struct __sk_buff, mark)),
2796 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2797 offsetof(struct __sk_buff, priority)),
2798 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2799 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2800 offsetof(struct __sk_buff, pkt_type)),
2801 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2802 BPF_EXIT_INSN(),
2803 },
2804 .result = REJECT,
2805 .errstr = "R3 invalid mem access 'inv'",
2806 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2807 },
2808 {
2809 "raw_stack: skb_load_bytes, spilled regs + data",
2810 .insns = {
2811 BPF_MOV64_IMM(BPF_REG_2, 4),
2812 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2814 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2815 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2816 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2817 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2818 BPF_MOV64_IMM(BPF_REG_4, 8),
2819 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2820 BPF_FUNC_skb_load_bytes),
2821 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2822 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2823 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2824 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2825 offsetof(struct __sk_buff, mark)),
2826 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2827 offsetof(struct __sk_buff, priority)),
2828 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2829 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2830 BPF_EXIT_INSN(),
2831 },
2832 .result = ACCEPT,
2833 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2834 },
2835 {
2836 "raw_stack: skb_load_bytes, invalid access 1",
2837 .insns = {
2838 BPF_MOV64_IMM(BPF_REG_2, 4),
2839 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2840 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2841 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2842 BPF_MOV64_IMM(BPF_REG_4, 8),
2843 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2844 BPF_FUNC_skb_load_bytes),
2845 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2846 BPF_EXIT_INSN(),
2847 },
2848 .result = REJECT,
2849 .errstr = "invalid stack type R3 off=-513 access_size=8",
2850 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2851 },
2852 {
2853 "raw_stack: skb_load_bytes, invalid access 2",
2854 .insns = {
2855 BPF_MOV64_IMM(BPF_REG_2, 4),
2856 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2857 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2858 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2859 BPF_MOV64_IMM(BPF_REG_4, 8),
2860 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2861 BPF_FUNC_skb_load_bytes),
2862 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2863 BPF_EXIT_INSN(),
2864 },
2865 .result = REJECT,
2866 .errstr = "invalid stack type R3 off=-1 access_size=8",
2867 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2868 },
2869 {
2870 "raw_stack: skb_load_bytes, invalid access 3",
2871 .insns = {
2872 BPF_MOV64_IMM(BPF_REG_2, 4),
2873 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2874 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2875 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2876 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2877 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2878 BPF_FUNC_skb_load_bytes),
2879 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2880 BPF_EXIT_INSN(),
2881 },
2882 .result = REJECT,
2883 .errstr = "R4 min value is negative",
2884 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2885 },
2886 {
2887 "raw_stack: skb_load_bytes, invalid access 4",
2888 .insns = {
2889 BPF_MOV64_IMM(BPF_REG_2, 4),
2890 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2891 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2892 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2893 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2894 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2895 BPF_FUNC_skb_load_bytes),
2896 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2897 BPF_EXIT_INSN(),
2898 },
2899 .result = REJECT,
2900 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2901 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2902 },
2903 {
2904 "raw_stack: skb_load_bytes, invalid access 5",
2905 .insns = {
2906 BPF_MOV64_IMM(BPF_REG_2, 4),
2907 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2908 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2909 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2910 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2911 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2912 BPF_FUNC_skb_load_bytes),
2913 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2914 BPF_EXIT_INSN(),
2915 },
2916 .result = REJECT,
2917 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2918 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2919 },
2920 {
2921 "raw_stack: skb_load_bytes, invalid access 6",
2922 .insns = {
2923 BPF_MOV64_IMM(BPF_REG_2, 4),
2924 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2925 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2926 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2927 BPF_MOV64_IMM(BPF_REG_4, 0),
2928 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2929 BPF_FUNC_skb_load_bytes),
2930 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2931 BPF_EXIT_INSN(),
2932 },
2933 .result = REJECT,
2934 .errstr = "invalid stack type R3 off=-512 access_size=0",
2935 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2936 },
2937 {
2938 "raw_stack: skb_load_bytes, large access",
2939 .insns = {
2940 BPF_MOV64_IMM(BPF_REG_2, 4),
2941 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2942 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2943 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2944 BPF_MOV64_IMM(BPF_REG_4, 512),
2945 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2946 BPF_FUNC_skb_load_bytes),
2947 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2948 BPF_EXIT_INSN(),
2949 },
2950 .result = ACCEPT,
2951 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2952 },
2953 {
2954 "context stores via ST",
2955 .insns = {
2956 BPF_MOV64_IMM(BPF_REG_0, 0),
2957 BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
2958 BPF_EXIT_INSN(),
2959 },
2960 .errstr = "BPF_ST stores into R1 context is not allowed",
2961 .result = REJECT,
2962 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2963 },
2964 {
2965 "context stores via XADD",
2966 .insns = {
2967 BPF_MOV64_IMM(BPF_REG_0, 0),
2968 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
2969 BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
2970 BPF_EXIT_INSN(),
2971 },
2972 .errstr = "BPF_XADD stores into R1 context is not allowed",
2973 .result = REJECT,
2974 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2975 },
2976 {
2977 "direct packet access: test1",
2978 .insns = {
2979 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2980 offsetof(struct __sk_buff, data)),
2981 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2982 offsetof(struct __sk_buff, data_end)),
2983 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2984 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2985 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2986 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2987 BPF_MOV64_IMM(BPF_REG_0, 0),
2988 BPF_EXIT_INSN(),
2989 },
2990 .result = ACCEPT,
2991 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2992 },
2993 {
2994 "direct packet access: test2",
2995 .insns = {
2996 BPF_MOV64_IMM(BPF_REG_0, 1),
2997 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2998 offsetof(struct __sk_buff, data_end)),
2999 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3000 offsetof(struct __sk_buff, data)),
3001 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3002 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3003 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3004 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3005 BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3006 BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3007 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3008 offsetof(struct __sk_buff, data)),
3009 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3010 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3011 offsetof(struct __sk_buff, len)),
3012 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3013 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3014 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3015 BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3016 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3017 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3018 offsetof(struct __sk_buff, data_end)),
3019 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3020 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3021 BPF_MOV64_IMM(BPF_REG_0, 0),
3022 BPF_EXIT_INSN(),
3023 },
3024 .result = ACCEPT,
3025 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3026 },
3027 {
3028 "direct packet access: test3",
3029 .insns = {
3030 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3031 offsetof(struct __sk_buff, data)),
3032 BPF_MOV64_IMM(BPF_REG_0, 0),
3033 BPF_EXIT_INSN(),
3034 },
3035 .errstr = "invalid bpf_context access off=76",
3036 .result = REJECT,
3037 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3038 },
3039 {
3040 "direct packet access: test4 (write)",
3041 .insns = {
3042 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3043 offsetof(struct __sk_buff, data)),
3044 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3045 offsetof(struct __sk_buff, data_end)),
3046 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3047 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3048 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3049 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3050 BPF_MOV64_IMM(BPF_REG_0, 0),
3051 BPF_EXIT_INSN(),
3052 },
3053 .result = ACCEPT,
3054 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3055 },
3056 {
3057 "direct packet access: test5 (pkt_end >= reg, good access)",
3058 .insns = {
3059 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3060 offsetof(struct __sk_buff, data)),
3061 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3062 offsetof(struct __sk_buff, data_end)),
3063 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3064 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3065 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3066 BPF_MOV64_IMM(BPF_REG_0, 1),
3067 BPF_EXIT_INSN(),
3068 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3069 BPF_MOV64_IMM(BPF_REG_0, 0),
3070 BPF_EXIT_INSN(),
3071 },
3072 .result = ACCEPT,
3073 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3074 },
3075 {
3076 "direct packet access: test6 (pkt_end >= reg, bad access)",
3077 .insns = {
3078 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3079 offsetof(struct __sk_buff, data)),
3080 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3081 offsetof(struct __sk_buff, data_end)),
3082 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3083 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3084 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3085 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3086 BPF_MOV64_IMM(BPF_REG_0, 1),
3087 BPF_EXIT_INSN(),
3088 BPF_MOV64_IMM(BPF_REG_0, 0),
3089 BPF_EXIT_INSN(),
3090 },
3091 .errstr = "invalid access to packet",
3092 .result = REJECT,
3093 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3094 },
3095 {
3096 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3097 .insns = {
3098 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3099 offsetof(struct __sk_buff, data)),
3100 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3101 offsetof(struct __sk_buff, data_end)),
3102 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3104 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3105 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3106 BPF_MOV64_IMM(BPF_REG_0, 1),
3107 BPF_EXIT_INSN(),
3108 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3109 BPF_MOV64_IMM(BPF_REG_0, 0),
3110 BPF_EXIT_INSN(),
3111 },
3112 .errstr = "invalid access to packet",
3113 .result = REJECT,
3114 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3115 },
3116 {
3117 "direct packet access: test8 (double test, variant 1)",
3118 .insns = {
3119 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3120 offsetof(struct __sk_buff, data)),
3121 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3122 offsetof(struct __sk_buff, data_end)),
3123 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3124 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3125 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3126 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3127 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3128 BPF_MOV64_IMM(BPF_REG_0, 1),
3129 BPF_EXIT_INSN(),
3130 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3131 BPF_MOV64_IMM(BPF_REG_0, 0),
3132 BPF_EXIT_INSN(),
3133 },
3134 .result = ACCEPT,
3135 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3136 },
3137 {
3138 "direct packet access: test9 (double test, variant 2)",
3139 .insns = {
3140 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3141 offsetof(struct __sk_buff, data)),
3142 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3143 offsetof(struct __sk_buff, data_end)),
3144 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3145 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3146 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3147 BPF_MOV64_IMM(BPF_REG_0, 1),
3148 BPF_EXIT_INSN(),
3149 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3150 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3151 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3152 BPF_MOV64_IMM(BPF_REG_0, 0),
3153 BPF_EXIT_INSN(),
3154 },
3155 .result = ACCEPT,
3156 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3157 },
3158 {
3159 "direct packet access: test10 (write invalid)",
3160 .insns = {
3161 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3162 offsetof(struct __sk_buff, data)),
3163 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3164 offsetof(struct __sk_buff, data_end)),
3165 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3166 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3167 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3168 BPF_MOV64_IMM(BPF_REG_0, 0),
3169 BPF_EXIT_INSN(),
3170 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3171 BPF_MOV64_IMM(BPF_REG_0, 0),
3172 BPF_EXIT_INSN(),
3173 },
3174 .errstr = "invalid access to packet",
3175 .result = REJECT,
3176 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3177 },
3178 {
3179 "direct packet access: test11 (shift, good access)",
3180 .insns = {
3181 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3182 offsetof(struct __sk_buff, data)),
3183 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3184 offsetof(struct __sk_buff, data_end)),
3185 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3186 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3187 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3188 BPF_MOV64_IMM(BPF_REG_3, 144),
3189 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3190 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3191 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3192 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3193 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3194 BPF_MOV64_IMM(BPF_REG_0, 1),
3195 BPF_EXIT_INSN(),
3196 BPF_MOV64_IMM(BPF_REG_0, 0),
3197 BPF_EXIT_INSN(),
3198 },
3199 .result = ACCEPT,
3200 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3201 .retval = 1,
3202 },
3203 {
3204 "direct packet access: test12 (and, good access)",
3205 .insns = {
3206 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3207 offsetof(struct __sk_buff, data)),
3208 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3209 offsetof(struct __sk_buff, data_end)),
3210 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3211 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3212 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3213 BPF_MOV64_IMM(BPF_REG_3, 144),
3214 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3215 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3216 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3217 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3218 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3219 BPF_MOV64_IMM(BPF_REG_0, 1),
3220 BPF_EXIT_INSN(),
3221 BPF_MOV64_IMM(BPF_REG_0, 0),
3222 BPF_EXIT_INSN(),
3223 },
3224 .result = ACCEPT,
3225 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3226 .retval = 1,
3227 },
3228 {
3229 "direct packet access: test13 (branches, good access)",
3230 .insns = {
3231 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3232 offsetof(struct __sk_buff, data)),
3233 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3234 offsetof(struct __sk_buff, data_end)),
3235 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3236 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3237 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3238 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3239 offsetof(struct __sk_buff, mark)),
3240 BPF_MOV64_IMM(BPF_REG_4, 1),
3241 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3242 BPF_MOV64_IMM(BPF_REG_3, 14),
3243 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3244 BPF_MOV64_IMM(BPF_REG_3, 24),
3245 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3247 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3248 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3249 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3250 BPF_MOV64_IMM(BPF_REG_0, 1),
3251 BPF_EXIT_INSN(),
3252 BPF_MOV64_IMM(BPF_REG_0, 0),
3253 BPF_EXIT_INSN(),
3254 },
3255 .result = ACCEPT,
3256 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3257 .retval = 1,
3258 },
3259 {
3260 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3261 .insns = {
3262 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3263 offsetof(struct __sk_buff, data)),
3264 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3265 offsetof(struct __sk_buff, data_end)),
3266 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3267 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3268 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3269 BPF_MOV64_IMM(BPF_REG_5, 12),
3270 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3271 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3272 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3273 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3274 BPF_MOV64_IMM(BPF_REG_0, 1),
3275 BPF_EXIT_INSN(),
3276 BPF_MOV64_IMM(BPF_REG_0, 0),
3277 BPF_EXIT_INSN(),
3278 },
3279 .result = ACCEPT,
3280 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3281 .retval = 1,
3282 },
3283 {
3284 "direct packet access: test15 (spill with xadd)",
3285 .insns = {
3286 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3287 offsetof(struct __sk_buff, data)),
3288 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3289 offsetof(struct __sk_buff, data_end)),
3290 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3291 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3292 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3293 BPF_MOV64_IMM(BPF_REG_5, 4096),
3294 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3296 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3297 BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3298 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3299 BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3300 BPF_MOV64_IMM(BPF_REG_0, 0),
3301 BPF_EXIT_INSN(),
3302 },
3303 .errstr = "R2 invalid mem access 'inv'",
3304 .result = REJECT,
3305 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3306 },
3307 {
3308 "direct packet access: test16 (arith on data_end)",
3309 .insns = {
3310 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3311 offsetof(struct __sk_buff, data)),
3312 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3313 offsetof(struct __sk_buff, data_end)),
3314 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3315 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3316 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3317 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3318 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3319 BPF_MOV64_IMM(BPF_REG_0, 0),
3320 BPF_EXIT_INSN(),
3321 },
3322 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3323 .result = REJECT,
3324 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3325 },
3326 {
3327 "direct packet access: test17 (pruning, alignment)",
3328 .insns = {
3329 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3330 offsetof(struct __sk_buff, data)),
3331 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3332 offsetof(struct __sk_buff, data_end)),
3333 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3334 offsetof(struct __sk_buff, mark)),
3335 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3336 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3337 BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3338 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3339 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3340 BPF_MOV64_IMM(BPF_REG_0, 0),
3341 BPF_EXIT_INSN(),
3342 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3343 BPF_JMP_A(-6),
3344 },
3345 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3346 .result = REJECT,
3347 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3348 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3349 },
3350 {
3351 "direct packet access: test18 (imm += pkt_ptr, 1)",
3352 .insns = {
3353 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3354 offsetof(struct __sk_buff, data)),
3355 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3356 offsetof(struct __sk_buff, data_end)),
3357 BPF_MOV64_IMM(BPF_REG_0, 8),
3358 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3359 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3360 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3361 BPF_MOV64_IMM(BPF_REG_0, 0),
3362 BPF_EXIT_INSN(),
3363 },
3364 .result = ACCEPT,
3365 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3366 },
3367 {
3368 "direct packet access: test19 (imm += pkt_ptr, 2)",
3369 .insns = {
3370 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3371 offsetof(struct __sk_buff, data)),
3372 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3373 offsetof(struct __sk_buff, data_end)),
3374 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3375 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3376 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3377 BPF_MOV64_IMM(BPF_REG_4, 4),
3378 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3379 BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3380 BPF_MOV64_IMM(BPF_REG_0, 0),
3381 BPF_EXIT_INSN(),
3382 },
3383 .result = ACCEPT,
3384 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3385 },
3386 {
3387 "direct packet access: test20 (x += pkt_ptr, 1)",
3388 .insns = {
3389 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3390 offsetof(struct __sk_buff, data)),
3391 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3392 offsetof(struct __sk_buff, data_end)),
3393 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3394 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3395 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3396 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3397 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3398 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3399 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3401 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3402 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3403 BPF_MOV64_IMM(BPF_REG_0, 0),
3404 BPF_EXIT_INSN(),
3405 },
3406 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3407 .result = ACCEPT,
3408 },
3409 {
3410 "direct packet access: test21 (x += pkt_ptr, 2)",
3411 .insns = {
3412 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3413 offsetof(struct __sk_buff, data)),
3414 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3415 offsetof(struct __sk_buff, data_end)),
3416 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3417 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3418 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3419 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3420 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3421 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3422 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3423 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3424 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3425 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3426 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3427 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3428 BPF_MOV64_IMM(BPF_REG_0, 0),
3429 BPF_EXIT_INSN(),
3430 },
3431 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3432 .result = ACCEPT,
3433 },
3434 {
3435 "direct packet access: test22 (x += pkt_ptr, 3)",
3436 .insns = {
3437 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3438 offsetof(struct __sk_buff, data)),
3439 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3440 offsetof(struct __sk_buff, data_end)),
3441 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3442 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3443 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3444 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3445 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3446 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3447 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3448 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3449 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3450 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3451 BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3452 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3453 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3454 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3455 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3456 BPF_MOV64_IMM(BPF_REG_2, 1),
3457 BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3458 BPF_MOV64_IMM(BPF_REG_0, 0),
3459 BPF_EXIT_INSN(),
3460 },
3461 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3462 .result = ACCEPT,
3463 },
3464 {
3465 "direct packet access: test23 (x += pkt_ptr, 4)",
3466 .insns = {
3467 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3468 offsetof(struct __sk_buff, data)),
3469 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3470 offsetof(struct __sk_buff, data_end)),
3471 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3472 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3473 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3474 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3475 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3476 BPF_MOV64_IMM(BPF_REG_0, 31),
3477 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3478 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3479 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3480 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3481 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3482 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3483 BPF_MOV64_IMM(BPF_REG_0, 0),
3484 BPF_EXIT_INSN(),
3485 },
3486 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3487 .result = REJECT,
3488 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3489 },
3490 {
3491 "direct packet access: test24 (x += pkt_ptr, 5)",
3492 .insns = {
3493 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3494 offsetof(struct __sk_buff, data)),
3495 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3496 offsetof(struct __sk_buff, data_end)),
3497 BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3498 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3499 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3500 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3501 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3502 BPF_MOV64_IMM(BPF_REG_0, 64),
3503 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3504 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3505 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3506 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3507 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3508 BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3509 BPF_MOV64_IMM(BPF_REG_0, 0),
3510 BPF_EXIT_INSN(),
3511 },
3512 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3513 .result = ACCEPT,
3514 },
3515 {
3516 "direct packet access: test25 (marking on <, good access)",
3517 .insns = {
3518 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3519 offsetof(struct __sk_buff, data)),
3520 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3521 offsetof(struct __sk_buff, data_end)),
3522 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3523 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3524 BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3525 BPF_MOV64_IMM(BPF_REG_0, 0),
3526 BPF_EXIT_INSN(),
3527 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3528 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3529 },
3530 .result = ACCEPT,
3531 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3532 },
3533 {
3534 "direct packet access: test26 (marking on <, bad access)",
3535 .insns = {
3536 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3537 offsetof(struct __sk_buff, data)),
3538 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3539 offsetof(struct __sk_buff, data_end)),
3540 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3541 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3542 BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3543 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3544 BPF_MOV64_IMM(BPF_REG_0, 0),
3545 BPF_EXIT_INSN(),
3546 BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3547 },
3548 .result = REJECT,
3549 .errstr = "invalid access to packet",
3550 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3551 },
3552 {
3553 "direct packet access: test27 (marking on <=, good access)",
3554 .insns = {
3555 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3556 offsetof(struct __sk_buff, data)),
3557 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3558 offsetof(struct __sk_buff, data_end)),
3559 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3560 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3561 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3562 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3563 BPF_MOV64_IMM(BPF_REG_0, 1),
3564 BPF_EXIT_INSN(),
3565 },
3566 .result = ACCEPT,
3567 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3568 .retval = 1,
3569 },
3570 {
3571 "direct packet access: test28 (marking on <=, bad access)",
3572 .insns = {
3573 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3574 offsetof(struct __sk_buff, data)),
3575 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3576 offsetof(struct __sk_buff, data_end)),
3577 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3578 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3579 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3580 BPF_MOV64_IMM(BPF_REG_0, 1),
3581 BPF_EXIT_INSN(),
3582 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3583 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3584 },
3585 .result = REJECT,
3586 .errstr = "invalid access to packet",
3587 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3588 },
3589 {
3590 "helper access to packet: test1, valid packet_ptr range",
3591 .insns = {
3592 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3593 offsetof(struct xdp_md, data)),
3594 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3595 offsetof(struct xdp_md, data_end)),
3596 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3597 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3598 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3599 BPF_LD_MAP_FD(BPF_REG_1, 0),
3600 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3601 BPF_MOV64_IMM(BPF_REG_4, 0),
3602 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3603 BPF_FUNC_map_update_elem),
3604 BPF_MOV64_IMM(BPF_REG_0, 0),
3605 BPF_EXIT_INSN(),
3606 },
3607 .fixup_map1 = { 5 },
3608 .result_unpriv = ACCEPT,
3609 .result = ACCEPT,
3610 .prog_type = BPF_PROG_TYPE_XDP,
3611 },
3612 {
3613 "helper access to packet: test2, unchecked packet_ptr",
3614 .insns = {
3615 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3616 offsetof(struct xdp_md, data)),
3617 BPF_LD_MAP_FD(BPF_REG_1, 0),
3618 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3619 BPF_FUNC_map_lookup_elem),
3620 BPF_MOV64_IMM(BPF_REG_0, 0),
3621 BPF_EXIT_INSN(),
3622 },
3623 .fixup_map1 = { 1 },
3624 .result = REJECT,
3625 .errstr = "invalid access to packet",
3626 .prog_type = BPF_PROG_TYPE_XDP,
3627 },
3628 {
3629 "helper access to packet: test3, variable add",
3630 .insns = {
3631 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3632 offsetof(struct xdp_md, data)),
3633 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3634 offsetof(struct xdp_md, data_end)),
3635 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3636 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3637 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3638 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3639 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3640 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3641 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3642 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3643 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3644 BPF_LD_MAP_FD(BPF_REG_1, 0),
3645 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3646 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3647 BPF_FUNC_map_lookup_elem),
3648 BPF_MOV64_IMM(BPF_REG_0, 0),
3649 BPF_EXIT_INSN(),
3650 },
3651 .fixup_map1 = { 11 },
3652 .result = ACCEPT,
3653 .prog_type = BPF_PROG_TYPE_XDP,
3654 },
3655 {
3656 "helper access to packet: test4, packet_ptr with bad range",
3657 .insns = {
3658 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3659 offsetof(struct xdp_md, data)),
3660 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3661 offsetof(struct xdp_md, data_end)),
3662 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3663 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3664 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3665 BPF_MOV64_IMM(BPF_REG_0, 0),
3666 BPF_EXIT_INSN(),
3667 BPF_LD_MAP_FD(BPF_REG_1, 0),
3668 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3669 BPF_FUNC_map_lookup_elem),
3670 BPF_MOV64_IMM(BPF_REG_0, 0),
3671 BPF_EXIT_INSN(),
3672 },
3673 .fixup_map1 = { 7 },
3674 .result = REJECT,
3675 .errstr = "invalid access to packet",
3676 .prog_type = BPF_PROG_TYPE_XDP,
3677 },
3678 {
3679 "helper access to packet: test5, packet_ptr with too short range",
3680 .insns = {
3681 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3682 offsetof(struct xdp_md, data)),
3683 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3684 offsetof(struct xdp_md, data_end)),
3685 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3686 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3687 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3688 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3689 BPF_LD_MAP_FD(BPF_REG_1, 0),
3690 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3691 BPF_FUNC_map_lookup_elem),
3692 BPF_MOV64_IMM(BPF_REG_0, 0),
3693 BPF_EXIT_INSN(),
3694 },
3695 .fixup_map1 = { 6 },
3696 .result = REJECT,
3697 .errstr = "invalid access to packet",
3698 .prog_type = BPF_PROG_TYPE_XDP,
3699 },
3700 {
3701 "helper access to packet: test6, cls valid packet_ptr range",
3702 .insns = {
3703 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3704 offsetof(struct __sk_buff, data)),
3705 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3706 offsetof(struct __sk_buff, data_end)),
3707 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3708 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3709 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3710 BPF_LD_MAP_FD(BPF_REG_1, 0),
3711 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3712 BPF_MOV64_IMM(BPF_REG_4, 0),
3713 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3714 BPF_FUNC_map_update_elem),
3715 BPF_MOV64_IMM(BPF_REG_0, 0),
3716 BPF_EXIT_INSN(),
3717 },
3718 .fixup_map1 = { 5 },
3719 .result = ACCEPT,
3720 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3721 },
3722 {
3723 "helper access to packet: test7, cls unchecked packet_ptr",
3724 .insns = {
3725 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3726 offsetof(struct __sk_buff, data)),
3727 BPF_LD_MAP_FD(BPF_REG_1, 0),
3728 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3729 BPF_FUNC_map_lookup_elem),
3730 BPF_MOV64_IMM(BPF_REG_0, 0),
3731 BPF_EXIT_INSN(),
3732 },
3733 .fixup_map1 = { 1 },
3734 .result = REJECT,
3735 .errstr = "invalid access to packet",
3736 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3737 },
3738 {
3739 "helper access to packet: test8, cls variable add",
3740 .insns = {
3741 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3742 offsetof(struct __sk_buff, data)),
3743 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3744 offsetof(struct __sk_buff, data_end)),
3745 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3746 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3747 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3748 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3749 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3750 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3751 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3752 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3753 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3754 BPF_LD_MAP_FD(BPF_REG_1, 0),
3755 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3756 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3757 BPF_FUNC_map_lookup_elem),
3758 BPF_MOV64_IMM(BPF_REG_0, 0),
3759 BPF_EXIT_INSN(),
3760 },
3761 .fixup_map1 = { 11 },
3762 .result = ACCEPT,
3763 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3764 },
3765 {
3766 "helper access to packet: test9, cls packet_ptr with bad range",
3767 .insns = {
3768 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3769 offsetof(struct __sk_buff, data)),
3770 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3771 offsetof(struct __sk_buff, data_end)),
3772 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3773 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3774 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3775 BPF_MOV64_IMM(BPF_REG_0, 0),
3776 BPF_EXIT_INSN(),
3777 BPF_LD_MAP_FD(BPF_REG_1, 0),
3778 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3779 BPF_FUNC_map_lookup_elem),
3780 BPF_MOV64_IMM(BPF_REG_0, 0),
3781 BPF_EXIT_INSN(),
3782 },
3783 .fixup_map1 = { 7 },
3784 .result = REJECT,
3785 .errstr = "invalid access to packet",
3786 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3787 },
3788 {
3789 "helper access to packet: test10, cls packet_ptr with too short range",
3790 .insns = {
3791 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3792 offsetof(struct __sk_buff, data)),
3793 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3794 offsetof(struct __sk_buff, data_end)),
3795 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3796 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3797 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3798 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3799 BPF_LD_MAP_FD(BPF_REG_1, 0),
3800 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3801 BPF_FUNC_map_lookup_elem),
3802 BPF_MOV64_IMM(BPF_REG_0, 0),
3803 BPF_EXIT_INSN(),
3804 },
3805 .fixup_map1 = { 6 },
3806 .result = REJECT,
3807 .errstr = "invalid access to packet",
3808 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3809 },
3810 {
3811 "helper access to packet: test11, cls unsuitable helper 1",
3812 .insns = {
3813 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3814 offsetof(struct __sk_buff, data)),
3815 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3816 offsetof(struct __sk_buff, data_end)),
3817 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3818 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3819 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
3820 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
3821 BPF_MOV64_IMM(BPF_REG_2, 0),
3822 BPF_MOV64_IMM(BPF_REG_4, 42),
3823 BPF_MOV64_IMM(BPF_REG_5, 0),
3824 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3825 BPF_FUNC_skb_store_bytes),
3826 BPF_MOV64_IMM(BPF_REG_0, 0),
3827 BPF_EXIT_INSN(),
3828 },
3829 .result = REJECT,
3830 .errstr = "helper access to the packet",
3831 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3832 },
3833 {
3834 "helper access to packet: test12, cls unsuitable helper 2",
3835 .insns = {
3836 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3837 offsetof(struct __sk_buff, data)),
3838 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3839 offsetof(struct __sk_buff, data_end)),
3840 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3841 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
3842 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
3843 BPF_MOV64_IMM(BPF_REG_2, 0),
3844 BPF_MOV64_IMM(BPF_REG_4, 4),
3845 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3846 BPF_FUNC_skb_load_bytes),
3847 BPF_MOV64_IMM(BPF_REG_0, 0),
3848 BPF_EXIT_INSN(),
3849 },
3850 .result = REJECT,
3851 .errstr = "helper access to the packet",
3852 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3853 },
3854 {
3855 "helper access to packet: test13, cls helper ok",
3856 .insns = {
3857 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3858 offsetof(struct __sk_buff, data)),
3859 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3860 offsetof(struct __sk_buff, data_end)),
3861 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3862 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3863 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3864 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3865 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3866 BPF_MOV64_IMM(BPF_REG_2, 4),
3867 BPF_MOV64_IMM(BPF_REG_3, 0),
3868 BPF_MOV64_IMM(BPF_REG_4, 0),
3869 BPF_MOV64_IMM(BPF_REG_5, 0),
3870 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3871 BPF_FUNC_csum_diff),
3872 BPF_MOV64_IMM(BPF_REG_0, 0),
3873 BPF_EXIT_INSN(),
3874 },
3875 .result = ACCEPT,
3876 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3877 },
3878 {
3879 "helper access to packet: test14, cls helper ok sub",
3880 .insns = {
3881 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3882 offsetof(struct __sk_buff, data)),
3883 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3884 offsetof(struct __sk_buff, data_end)),
3885 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3886 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3887 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3888 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3889 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
3890 BPF_MOV64_IMM(BPF_REG_2, 4),
3891 BPF_MOV64_IMM(BPF_REG_3, 0),
3892 BPF_MOV64_IMM(BPF_REG_4, 0),
3893 BPF_MOV64_IMM(BPF_REG_5, 0),
3894 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3895 BPF_FUNC_csum_diff),
3896 BPF_MOV64_IMM(BPF_REG_0, 0),
3897 BPF_EXIT_INSN(),
3898 },
3899 .result = ACCEPT,
3900 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3901 },
3902 {
3903 "helper access to packet: test15, cls helper fail sub",
3904 .insns = {
3905 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3906 offsetof(struct __sk_buff, data)),
3907 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3908 offsetof(struct __sk_buff, data_end)),
3909 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3910 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3911 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3912 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3913 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
3914 BPF_MOV64_IMM(BPF_REG_2, 4),
3915 BPF_MOV64_IMM(BPF_REG_3, 0),
3916 BPF_MOV64_IMM(BPF_REG_4, 0),
3917 BPF_MOV64_IMM(BPF_REG_5, 0),
3918 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3919 BPF_FUNC_csum_diff),
3920 BPF_MOV64_IMM(BPF_REG_0, 0),
3921 BPF_EXIT_INSN(),
3922 },
3923 .result = REJECT,
3924 .errstr = "invalid access to packet",
3925 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3926 },
3927 {
3928 "helper access to packet: test16, cls helper fail range 1",
3929 .insns = {
3930 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3931 offsetof(struct __sk_buff, data)),
3932 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3933 offsetof(struct __sk_buff, data_end)),
3934 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3935 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3936 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3937 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3938 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3939 BPF_MOV64_IMM(BPF_REG_2, 8),
3940 BPF_MOV64_IMM(BPF_REG_3, 0),
3941 BPF_MOV64_IMM(BPF_REG_4, 0),
3942 BPF_MOV64_IMM(BPF_REG_5, 0),
3943 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3944 BPF_FUNC_csum_diff),
3945 BPF_MOV64_IMM(BPF_REG_0, 0),
3946 BPF_EXIT_INSN(),
3947 },
3948 .result = REJECT,
3949 .errstr = "invalid access to packet",
3950 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3951 },
3952 {
3953 "helper access to packet: test17, cls helper fail range 2",
3954 .insns = {
3955 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3956 offsetof(struct __sk_buff, data)),
3957 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3958 offsetof(struct __sk_buff, data_end)),
3959 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3960 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3961 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3962 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3963 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3964 BPF_MOV64_IMM(BPF_REG_2, -9),
3965 BPF_MOV64_IMM(BPF_REG_3, 0),
3966 BPF_MOV64_IMM(BPF_REG_4, 0),
3967 BPF_MOV64_IMM(BPF_REG_5, 0),
3968 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3969 BPF_FUNC_csum_diff),
3970 BPF_MOV64_IMM(BPF_REG_0, 0),
3971 BPF_EXIT_INSN(),
3972 },
3973 .result = REJECT,
3974 .errstr = "R2 min value is negative",
3975 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3976 },
3977 {
3978 "helper access to packet: test18, cls helper fail range 3",
3979 .insns = {
3980 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3981 offsetof(struct __sk_buff, data)),
3982 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3983 offsetof(struct __sk_buff, data_end)),
3984 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3985 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3986 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3987 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3988 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3989 BPF_MOV64_IMM(BPF_REG_2, ~0),
3990 BPF_MOV64_IMM(BPF_REG_3, 0),
3991 BPF_MOV64_IMM(BPF_REG_4, 0),
3992 BPF_MOV64_IMM(BPF_REG_5, 0),
3993 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3994 BPF_FUNC_csum_diff),
3995 BPF_MOV64_IMM(BPF_REG_0, 0),
3996 BPF_EXIT_INSN(),
3997 },
3998 .result = REJECT,
3999 .errstr = "R2 min value is negative",
4000 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4001 },
4002 {
4003 "helper access to packet: test19, cls helper range zero",
4004 .insns = {
4005 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4006 offsetof(struct __sk_buff, data)),
4007 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4008 offsetof(struct __sk_buff, data_end)),
4009 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4010 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4012 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4013 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4014 BPF_MOV64_IMM(BPF_REG_2, 0),
4015 BPF_MOV64_IMM(BPF_REG_3, 0),
4016 BPF_MOV64_IMM(BPF_REG_4, 0),
4017 BPF_MOV64_IMM(BPF_REG_5, 0),
4018 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4019 BPF_FUNC_csum_diff),
4020 BPF_MOV64_IMM(BPF_REG_0, 0),
4021 BPF_EXIT_INSN(),
4022 },
4023 .result = ACCEPT,
4024 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4025 },
4026 {
4027 "helper access to packet: test20, pkt end as input",
4028 .insns = {
4029 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4030 offsetof(struct __sk_buff, data)),
4031 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4032 offsetof(struct __sk_buff, data_end)),
4033 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4034 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4035 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4036 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4037 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4038 BPF_MOV64_IMM(BPF_REG_2, 4),
4039 BPF_MOV64_IMM(BPF_REG_3, 0),
4040 BPF_MOV64_IMM(BPF_REG_4, 0),
4041 BPF_MOV64_IMM(BPF_REG_5, 0),
4042 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4043 BPF_FUNC_csum_diff),
4044 BPF_MOV64_IMM(BPF_REG_0, 0),
4045 BPF_EXIT_INSN(),
4046 },
4047 .result = REJECT,
4048 .errstr = "R1 type=pkt_end expected=fp",
4049 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4050 },
4051 {
4052 "helper access to packet: test21, wrong reg",
4053 .insns = {
4054 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4055 offsetof(struct __sk_buff, data)),
4056 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4057 offsetof(struct __sk_buff, data_end)),
4058 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4059 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4060 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4061 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4062 BPF_MOV64_IMM(BPF_REG_2, 4),
4063 BPF_MOV64_IMM(BPF_REG_3, 0),
4064 BPF_MOV64_IMM(BPF_REG_4, 0),
4065 BPF_MOV64_IMM(BPF_REG_5, 0),
4066 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4067 BPF_FUNC_csum_diff),
4068 BPF_MOV64_IMM(BPF_REG_0, 0),
4069 BPF_EXIT_INSN(),
4070 },
4071 .result = REJECT,
4072 .errstr = "invalid access to packet",
4073 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4074 },
4075 {
4076 "valid map access into an array with a constant",
4077 .insns = {
4078 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4079 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4080 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4081 BPF_LD_MAP_FD(BPF_REG_1, 0),
4082 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4083 BPF_FUNC_map_lookup_elem),
4084 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4085 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4086 offsetof(struct test_val, foo)),
4087 BPF_EXIT_INSN(),
4088 },
4089 .fixup_map2 = { 3 },
4090 .errstr_unpriv = "R0 leaks addr",
4091 .result_unpriv = REJECT,
4092 .result = ACCEPT,
4093 },
4094 {
4095 "valid map access into an array with a register",
4096 .insns = {
4097 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4098 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4099 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4100 BPF_LD_MAP_FD(BPF_REG_1, 0),
4101 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4102 BPF_FUNC_map_lookup_elem),
4103 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4104 BPF_MOV64_IMM(BPF_REG_1, 4),
4105 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4106 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4107 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4108 offsetof(struct test_val, foo)),
4109 BPF_EXIT_INSN(),
4110 },
4111 .fixup_map2 = { 3 },
4112 .errstr_unpriv = "R0 leaks addr",
4113 .result_unpriv = REJECT,
4114 .result = ACCEPT,
4115 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4116 },
4117 {
4118 "valid map access into an array with a variable",
4119 .insns = {
4120 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4121 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4122 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4123 BPF_LD_MAP_FD(BPF_REG_1, 0),
4124 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4125 BPF_FUNC_map_lookup_elem),
4126 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4127 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4128 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4129 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4130 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4131 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4132 offsetof(struct test_val, foo)),
4133 BPF_EXIT_INSN(),
4134 },
4135 .fixup_map2 = { 3 },
4136 .errstr_unpriv = "R0 leaks addr",
4137 .result_unpriv = REJECT,
4138 .result = ACCEPT,
4139 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4140 },
4141 {
4142 "valid map access into an array with a signed variable",
4143 .insns = {
4144 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4145 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4146 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4147 BPF_LD_MAP_FD(BPF_REG_1, 0),
4148 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4149 BPF_FUNC_map_lookup_elem),
4150 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4151 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4152 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4153 BPF_MOV32_IMM(BPF_REG_1, 0),
4154 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4155 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4156 BPF_MOV32_IMM(BPF_REG_1, 0),
4157 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4158 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4159 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4160 offsetof(struct test_val, foo)),
4161 BPF_EXIT_INSN(),
4162 },
4163 .fixup_map2 = { 3 },
4164 .errstr_unpriv = "R0 leaks addr",
4165 .result_unpriv = REJECT,
4166 .result = ACCEPT,
4167 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4168 },
4169 {
4170 "invalid map access into an array with a constant",
4171 .insns = {
4172 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4173 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4174 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4175 BPF_LD_MAP_FD(BPF_REG_1, 0),
4176 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4177 BPF_FUNC_map_lookup_elem),
4178 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4179 BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4180 offsetof(struct test_val, foo)),
4181 BPF_EXIT_INSN(),
4182 },
4183 .fixup_map2 = { 3 },
4184 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4185 .result = REJECT,
4186 },
4187 {
4188 "invalid map access into an array with a register",
4189 .insns = {
4190 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4191 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4192 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4193 BPF_LD_MAP_FD(BPF_REG_1, 0),
4194 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4195 BPF_FUNC_map_lookup_elem),
4196 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4197 BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4198 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4199 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4200 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4201 offsetof(struct test_val, foo)),
4202 BPF_EXIT_INSN(),
4203 },
4204 .fixup_map2 = { 3 },
4205 .errstr = "R0 min value is outside of the array range",
4206 .result = REJECT,
4207 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4208 },
4209 {
4210 "invalid map access into an array with a variable",
4211 .insns = {
4212 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4213 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4215 BPF_LD_MAP_FD(BPF_REG_1, 0),
4216 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4217 BPF_FUNC_map_lookup_elem),
4218 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4219 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4220 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4221 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4222 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4223 offsetof(struct test_val, foo)),
4224 BPF_EXIT_INSN(),
4225 },
4226 .fixup_map2 = { 3 },
4227 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4228 .result = REJECT,
4229 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4230 },
4231 {
4232 "invalid map access into an array with no floor check",
4233 .insns = {
4234 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4235 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4236 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4237 BPF_LD_MAP_FD(BPF_REG_1, 0),
4238 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4239 BPF_FUNC_map_lookup_elem),
4240 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4241 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4242 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4243 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4244 BPF_MOV32_IMM(BPF_REG_1, 0),
4245 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4246 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4247 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4248 offsetof(struct test_val, foo)),
4249 BPF_EXIT_INSN(),
4250 },
4251 .fixup_map2 = { 3 },
4252 .errstr_unpriv = "R0 leaks addr",
4253 .errstr = "R0 unbounded memory access",
4254 .result_unpriv = REJECT,
4255 .result = REJECT,
4256 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4257 },
4258 {
4259 "invalid map access into an array with a invalid max check",
4260 .insns = {
4261 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4262 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4263 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4264 BPF_LD_MAP_FD(BPF_REG_1, 0),
4265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4266 BPF_FUNC_map_lookup_elem),
4267 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4268 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4269 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4270 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4271 BPF_MOV32_IMM(BPF_REG_1, 0),
4272 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4273 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4274 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4275 offsetof(struct test_val, foo)),
4276 BPF_EXIT_INSN(),
4277 },
4278 .fixup_map2 = { 3 },
4279 .errstr_unpriv = "R0 leaks addr",
4280 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4281 .result_unpriv = REJECT,
4282 .result = REJECT,
4283 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4284 },
4285 {
4286 "invalid map access into an array with a invalid max check",
4287 .insns = {
4288 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4289 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4290 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4291 BPF_LD_MAP_FD(BPF_REG_1, 0),
4292 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4293 BPF_FUNC_map_lookup_elem),
4294 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4295 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4296 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4297 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4298 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4299 BPF_LD_MAP_FD(BPF_REG_1, 0),
4300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4301 BPF_FUNC_map_lookup_elem),
4302 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4303 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4304 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4305 offsetof(struct test_val, foo)),
4306 BPF_EXIT_INSN(),
4307 },
4308 .fixup_map2 = { 3, 11 },
4309 .errstr = "R0 pointer += pointer",
4310 .result = REJECT,
4311 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4312 },
4313 {
4314 "multiple registers share map_lookup_elem result",
4315 .insns = {
4316 BPF_MOV64_IMM(BPF_REG_1, 10),
4317 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4318 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4319 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4320 BPF_LD_MAP_FD(BPF_REG_1, 0),
4321 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4322 BPF_FUNC_map_lookup_elem),
4323 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4324 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4325 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4326 BPF_EXIT_INSN(),
4327 },
4328 .fixup_map1 = { 4 },
4329 .result = ACCEPT,
4330 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4331 },
4332 {
4333 "alu ops on ptr_to_map_value_or_null, 1",
4334 .insns = {
4335 BPF_MOV64_IMM(BPF_REG_1, 10),
4336 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4337 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4338 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4339 BPF_LD_MAP_FD(BPF_REG_1, 0),
4340 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4341 BPF_FUNC_map_lookup_elem),
4342 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4343 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4344 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4345 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4346 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4347 BPF_EXIT_INSN(),
4348 },
4349 .fixup_map1 = { 4 },
4350 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4351 .result = REJECT,
4352 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4353 },
4354 {
4355 "alu ops on ptr_to_map_value_or_null, 2",
4356 .insns = {
4357 BPF_MOV64_IMM(BPF_REG_1, 10),
4358 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4359 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4360 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4361 BPF_LD_MAP_FD(BPF_REG_1, 0),
4362 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4363 BPF_FUNC_map_lookup_elem),
4364 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4365 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4366 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4367 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4368 BPF_EXIT_INSN(),
4369 },
4370 .fixup_map1 = { 4 },
4371 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4372 .result = REJECT,
4373 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4374 },
4375 {
4376 "alu ops on ptr_to_map_value_or_null, 3",
4377 .insns = {
4378 BPF_MOV64_IMM(BPF_REG_1, 10),
4379 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4380 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4381 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4382 BPF_LD_MAP_FD(BPF_REG_1, 0),
4383 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4384 BPF_FUNC_map_lookup_elem),
4385 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4386 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4387 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4388 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4389 BPF_EXIT_INSN(),
4390 },
4391 .fixup_map1 = { 4 },
4392 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4393 .result = REJECT,
4394 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4395 },
4396 {
4397 "invalid memory access with multiple map_lookup_elem calls",
4398 .insns = {
4399 BPF_MOV64_IMM(BPF_REG_1, 10),
4400 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4401 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4402 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4403 BPF_LD_MAP_FD(BPF_REG_1, 0),
4404 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4405 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4406 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4407 BPF_FUNC_map_lookup_elem),
4408 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4409 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4410 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4411 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4412 BPF_FUNC_map_lookup_elem),
4413 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4414 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4415 BPF_EXIT_INSN(),
4416 },
4417 .fixup_map1 = { 4 },
4418 .result = REJECT,
4419 .errstr = "R4 !read_ok",
4420 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4421 },
4422 {
4423 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4424 .insns = {
4425 BPF_MOV64_IMM(BPF_REG_1, 10),
4426 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4427 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4428 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4429 BPF_LD_MAP_FD(BPF_REG_1, 0),
4430 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4431 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4432 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4433 BPF_FUNC_map_lookup_elem),
4434 BPF_MOV64_IMM(BPF_REG_2, 10),
4435 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4436 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4437 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4438 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4439 BPF_FUNC_map_lookup_elem),
4440 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4441 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4442 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4443 BPF_EXIT_INSN(),
4444 },
4445 .fixup_map1 = { 4 },
4446 .result = ACCEPT,
4447 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4448 },
4449 {
4450 "invalid map access from else condition",
4451 .insns = {
4452 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4453 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4454 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4455 BPF_LD_MAP_FD(BPF_REG_1, 0),
4456 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4457 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4458 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4459 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4460 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4461 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4462 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4463 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4464 BPF_EXIT_INSN(),
4465 },
4466 .fixup_map2 = { 3 },
4467 .errstr = "R0 unbounded memory access",
4468 .result = REJECT,
4469 .errstr_unpriv = "R0 leaks addr",
4470 .result_unpriv = REJECT,
4471 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4472 },
4473 {
4474 "constant register |= constant should keep constant type",
4475 .insns = {
4476 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4477 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4478 BPF_MOV64_IMM(BPF_REG_2, 34),
4479 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4480 BPF_MOV64_IMM(BPF_REG_3, 0),
4481 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4482 BPF_EXIT_INSN(),
4483 },
4484 .result = ACCEPT,
4485 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4486 },
4487 {
4488 "constant register |= constant should not bypass stack boundary checks",
4489 .insns = {
4490 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4492 BPF_MOV64_IMM(BPF_REG_2, 34),
4493 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4494 BPF_MOV64_IMM(BPF_REG_3, 0),
4495 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4496 BPF_EXIT_INSN(),
4497 },
4498 .errstr = "invalid stack type R1 off=-48 access_size=58",
4499 .result = REJECT,
4500 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4501 },
4502 {
4503 "constant register |= constant register should keep constant type",
4504 .insns = {
4505 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4506 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4507 BPF_MOV64_IMM(BPF_REG_2, 34),
4508 BPF_MOV64_IMM(BPF_REG_4, 13),
4509 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4510 BPF_MOV64_IMM(BPF_REG_3, 0),
4511 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4512 BPF_EXIT_INSN(),
4513 },
4514 .result = ACCEPT,
4515 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4516 },
4517 {
4518 "constant register |= constant register should not bypass stack boundary checks",
4519 .insns = {
4520 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4521 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4522 BPF_MOV64_IMM(BPF_REG_2, 34),
4523 BPF_MOV64_IMM(BPF_REG_4, 24),
4524 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4525 BPF_MOV64_IMM(BPF_REG_3, 0),
4526 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4527 BPF_EXIT_INSN(),
4528 },
4529 .errstr = "invalid stack type R1 off=-48 access_size=58",
4530 .result = REJECT,
4531 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4532 },
4533 {
4534 "invalid direct packet write for LWT_IN",
4535 .insns = {
4536 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4537 offsetof(struct __sk_buff, data)),
4538 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4539 offsetof(struct __sk_buff, data_end)),
4540 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4541 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4542 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4543 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4544 BPF_MOV64_IMM(BPF_REG_0, 0),
4545 BPF_EXIT_INSN(),
4546 },
4547 .errstr = "cannot write into packet",
4548 .result = REJECT,
4549 .prog_type = BPF_PROG_TYPE_LWT_IN,
4550 },
4551 {
4552 "invalid direct packet write for LWT_OUT",
4553 .insns = {
4554 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4555 offsetof(struct __sk_buff, data)),
4556 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4557 offsetof(struct __sk_buff, data_end)),
4558 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4560 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4561 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4562 BPF_MOV64_IMM(BPF_REG_0, 0),
4563 BPF_EXIT_INSN(),
4564 },
4565 .errstr = "cannot write into packet",
4566 .result = REJECT,
4567 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4568 },
4569 {
4570 "direct packet write for LWT_XMIT",
4571 .insns = {
4572 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4573 offsetof(struct __sk_buff, data)),
4574 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4575 offsetof(struct __sk_buff, data_end)),
4576 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4577 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4578 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4579 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4580 BPF_MOV64_IMM(BPF_REG_0, 0),
4581 BPF_EXIT_INSN(),
4582 },
4583 .result = ACCEPT,
4584 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4585 },
4586 {
4587 "direct packet read for LWT_IN",
4588 .insns = {
4589 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4590 offsetof(struct __sk_buff, data)),
4591 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4592 offsetof(struct __sk_buff, data_end)),
4593 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4594 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4595 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4596 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4597 BPF_MOV64_IMM(BPF_REG_0, 0),
4598 BPF_EXIT_INSN(),
4599 },
4600 .result = ACCEPT,
4601 .prog_type = BPF_PROG_TYPE_LWT_IN,
4602 },
4603 {
4604 "direct packet read for LWT_OUT",
4605 .insns = {
4606 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4607 offsetof(struct __sk_buff, data)),
4608 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4609 offsetof(struct __sk_buff, data_end)),
4610 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4611 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4612 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4613 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4614 BPF_MOV64_IMM(BPF_REG_0, 0),
4615 BPF_EXIT_INSN(),
4616 },
4617 .result = ACCEPT,
4618 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4619 },
4620 {
4621 "direct packet read for LWT_XMIT",
4622 .insns = {
4623 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4624 offsetof(struct __sk_buff, data)),
4625 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4626 offsetof(struct __sk_buff, data_end)),
4627 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4628 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4629 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4630 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4631 BPF_MOV64_IMM(BPF_REG_0, 0),
4632 BPF_EXIT_INSN(),
4633 },
4634 .result = ACCEPT,
4635 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4636 },
4637 {
4638 "overlapping checks for direct packet access",
4639 .insns = {
4640 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4641 offsetof(struct __sk_buff, data)),
4642 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4643 offsetof(struct __sk_buff, data_end)),
4644 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4645 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4646 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
4647 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4648 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
4649 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
4650 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
4651 BPF_MOV64_IMM(BPF_REG_0, 0),
4652 BPF_EXIT_INSN(),
4653 },
4654 .result = ACCEPT,
4655 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4656 },
4657 {
4658 "invalid access of tc_classid for LWT_IN",
4659 .insns = {
4660 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4661 offsetof(struct __sk_buff, tc_classid)),
4662 BPF_EXIT_INSN(),
4663 },
4664 .result = REJECT,
4665 .errstr = "invalid bpf_context access",
4666 },
4667 {
4668 "invalid access of tc_classid for LWT_OUT",
4669 .insns = {
4670 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4671 offsetof(struct __sk_buff, tc_classid)),
4672 BPF_EXIT_INSN(),
4673 },
4674 .result = REJECT,
4675 .errstr = "invalid bpf_context access",
4676 },
4677 {
4678 "invalid access of tc_classid for LWT_XMIT",
4679 .insns = {
4680 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4681 offsetof(struct __sk_buff, tc_classid)),
4682 BPF_EXIT_INSN(),
4683 },
4684 .result = REJECT,
4685 .errstr = "invalid bpf_context access",
4686 },
4687 {
4688 "leak pointer into ctx 1",
4689 .insns = {
4690 BPF_MOV64_IMM(BPF_REG_0, 0),
4691 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4692 offsetof(struct __sk_buff, cb[0])),
4693 BPF_LD_MAP_FD(BPF_REG_2, 0),
4694 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
4695 offsetof(struct __sk_buff, cb[0])),
4696 BPF_EXIT_INSN(),
4697 },
4698 .fixup_map1 = { 2 },
4699 .errstr_unpriv = "R2 leaks addr into mem",
4700 .result_unpriv = REJECT,
4701 .result = REJECT,
4702 .errstr = "BPF_XADD stores into R1 context is not allowed",
4703 },
4704 {
4705 "leak pointer into ctx 2",
4706 .insns = {
4707 BPF_MOV64_IMM(BPF_REG_0, 0),
4708 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4709 offsetof(struct __sk_buff, cb[0])),
4710 BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
4711 offsetof(struct __sk_buff, cb[0])),
4712 BPF_EXIT_INSN(),
4713 },
4714 .errstr_unpriv = "R10 leaks addr into mem",
4715 .result_unpriv = REJECT,
4716 .result = REJECT,
4717 .errstr = "BPF_XADD stores into R1 context is not allowed",
4718 },
4719 {
4720 "leak pointer into ctx 3",
4721 .insns = {
4722 BPF_MOV64_IMM(BPF_REG_0, 0),
4723 BPF_LD_MAP_FD(BPF_REG_2, 0),
4724 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
4725 offsetof(struct __sk_buff, cb[0])),
4726 BPF_EXIT_INSN(),
4727 },
4728 .fixup_map1 = { 1 },
4729 .errstr_unpriv = "R2 leaks addr into ctx",
4730 .result_unpriv = REJECT,
4731 .result = ACCEPT,
4732 },
4733 {
4734 "leak pointer into map val",
4735 .insns = {
4736 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
4737 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4738 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4739 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4740 BPF_LD_MAP_FD(BPF_REG_1, 0),
4741 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4742 BPF_FUNC_map_lookup_elem),
4743 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4744 BPF_MOV64_IMM(BPF_REG_3, 0),
4745 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
4746 BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
4747 BPF_MOV64_IMM(BPF_REG_0, 0),
4748 BPF_EXIT_INSN(),
4749 },
4750 .fixup_map1 = { 4 },
4751 .errstr_unpriv = "R6 leaks addr into mem",
4752 .result_unpriv = REJECT,
4753 .result = ACCEPT,
4754 },
4755 {
4756 "helper access to map: full range",
4757 .insns = {
4758 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4759 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4760 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4761 BPF_LD_MAP_FD(BPF_REG_1, 0),
4762 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4763 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4764 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4765 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4766 BPF_MOV64_IMM(BPF_REG_3, 0),
4767 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4768 BPF_EXIT_INSN(),
4769 },
4770 .fixup_map2 = { 3 },
4771 .result = ACCEPT,
4772 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4773 },
4774 {
4775 "helper access to map: partial range",
4776 .insns = {
4777 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4778 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4779 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4780 BPF_LD_MAP_FD(BPF_REG_1, 0),
4781 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4782 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4783 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4784 BPF_MOV64_IMM(BPF_REG_2, 8),
4785 BPF_MOV64_IMM(BPF_REG_3, 0),
4786 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4787 BPF_EXIT_INSN(),
4788 },
4789 .fixup_map2 = { 3 },
4790 .result = ACCEPT,
4791 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4792 },
4793 {
4794 "helper access to map: empty range",
4795 .insns = {
4796 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4797 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4798 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4799 BPF_LD_MAP_FD(BPF_REG_1, 0),
4800 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4801 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4802 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4803 BPF_MOV64_IMM(BPF_REG_2, 0),
4804 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
4805 BPF_EXIT_INSN(),
4806 },
4807 .fixup_map2 = { 3 },
4808 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
4809 .result = REJECT,
4810 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4811 },
4812 {
4813 "helper access to map: out-of-bound range",
4814 .insns = {
4815 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4816 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4817 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4818 BPF_LD_MAP_FD(BPF_REG_1, 0),
4819 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4820 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4821 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4822 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
4823 BPF_MOV64_IMM(BPF_REG_3, 0),
4824 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4825 BPF_EXIT_INSN(),
4826 },
4827 .fixup_map2 = { 3 },
4828 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
4829 .result = REJECT,
4830 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4831 },
4832 {
4833 "helper access to map: negative range",
4834 .insns = {
4835 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4836 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4837 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4838 BPF_LD_MAP_FD(BPF_REG_1, 0),
4839 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4840 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4841 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4842 BPF_MOV64_IMM(BPF_REG_2, -8),
4843 BPF_MOV64_IMM(BPF_REG_3, 0),
4844 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4845 BPF_EXIT_INSN(),
4846 },
4847 .fixup_map2 = { 3 },
4848 .errstr = "R2 min value is negative",
4849 .result = REJECT,
4850 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4851 },
4852 {
4853 "helper access to adjusted map (via const imm): full range",
4854 .insns = {
4855 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4856 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4857 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4858 BPF_LD_MAP_FD(BPF_REG_1, 0),
4859 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4860 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4861 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4862 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4863 offsetof(struct test_val, foo)),
4864 BPF_MOV64_IMM(BPF_REG_2,
4865 sizeof(struct test_val) -
4866 offsetof(struct test_val, foo)),
4867 BPF_MOV64_IMM(BPF_REG_3, 0),
4868 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4869 BPF_EXIT_INSN(),
4870 },
4871 .fixup_map2 = { 3 },
4872 .result = ACCEPT,
4873 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4874 },
4875 {
4876 "helper access to adjusted map (via const imm): partial range",
4877 .insns = {
4878 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4879 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4880 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4881 BPF_LD_MAP_FD(BPF_REG_1, 0),
4882 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4883 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4884 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4885 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4886 offsetof(struct test_val, foo)),
4887 BPF_MOV64_IMM(BPF_REG_2, 8),
4888 BPF_MOV64_IMM(BPF_REG_3, 0),
4889 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4890 BPF_EXIT_INSN(),
4891 },
4892 .fixup_map2 = { 3 },
4893 .result = ACCEPT,
4894 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4895 },
4896 {
4897 "helper access to adjusted map (via const imm): empty range",
4898 .insns = {
4899 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4900 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4901 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4902 BPF_LD_MAP_FD(BPF_REG_1, 0),
4903 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4904 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4905 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4906 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4907 offsetof(struct test_val, foo)),
4908 BPF_MOV64_IMM(BPF_REG_2, 0),
4909 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
4910 BPF_EXIT_INSN(),
4911 },
4912 .fixup_map2 = { 3 },
4913 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
4914 .result = REJECT,
4915 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4916 },
4917 {
4918 "helper access to adjusted map (via const imm): out-of-bound range",
4919 .insns = {
4920 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4921 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4922 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4923 BPF_LD_MAP_FD(BPF_REG_1, 0),
4924 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4925 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4926 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4927 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4928 offsetof(struct test_val, foo)),
4929 BPF_MOV64_IMM(BPF_REG_2,
4930 sizeof(struct test_val) -
4931 offsetof(struct test_val, foo) + 8),
4932 BPF_MOV64_IMM(BPF_REG_3, 0),
4933 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4934 BPF_EXIT_INSN(),
4935 },
4936 .fixup_map2 = { 3 },
4937 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4938 .result = REJECT,
4939 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4940 },
4941 {
4942 "helper access to adjusted map (via const imm): negative range (> adjustment)",
4943 .insns = {
4944 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4945 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4946 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4947 BPF_LD_MAP_FD(BPF_REG_1, 0),
4948 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4949 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4950 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4951 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4952 offsetof(struct test_val, foo)),
4953 BPF_MOV64_IMM(BPF_REG_2, -8),
4954 BPF_MOV64_IMM(BPF_REG_3, 0),
4955 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4956 BPF_EXIT_INSN(),
4957 },
4958 .fixup_map2 = { 3 },
4959 .errstr = "R2 min value is negative",
4960 .result = REJECT,
4961 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4962 },
4963 {
4964 "helper access to adjusted map (via const imm): negative range (< adjustment)",
4965 .insns = {
4966 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4967 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4968 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4969 BPF_LD_MAP_FD(BPF_REG_1, 0),
4970 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4971 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4972 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4973 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4974 offsetof(struct test_val, foo)),
4975 BPF_MOV64_IMM(BPF_REG_2, -1),
4976 BPF_MOV64_IMM(BPF_REG_3, 0),
4977 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4978 BPF_EXIT_INSN(),
4979 },
4980 .fixup_map2 = { 3 },
4981 .errstr = "R2 min value is negative",
4982 .result = REJECT,
4983 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4984 },
4985 {
4986 "helper access to adjusted map (via const reg): full range",
4987 .insns = {
4988 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4989 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4990 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4991 BPF_LD_MAP_FD(BPF_REG_1, 0),
4992 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4993 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4994 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4995 BPF_MOV64_IMM(BPF_REG_3,
4996 offsetof(struct test_val, foo)),
4997 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4998 BPF_MOV64_IMM(BPF_REG_2,
4999 sizeof(struct test_val) -
5000 offsetof(struct test_val, foo)),
5001 BPF_MOV64_IMM(BPF_REG_3, 0),
5002 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5003 BPF_EXIT_INSN(),
5004 },
5005 .fixup_map2 = { 3 },
5006 .result = ACCEPT,
5007 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5008 },
5009 {
5010 "helper access to adjusted map (via const reg): partial range",
5011 .insns = {
5012 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5014 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5015 BPF_LD_MAP_FD(BPF_REG_1, 0),
5016 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5017 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5018 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5019 BPF_MOV64_IMM(BPF_REG_3,
5020 offsetof(struct test_val, foo)),
5021 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5022 BPF_MOV64_IMM(BPF_REG_2, 8),
5023 BPF_MOV64_IMM(BPF_REG_3, 0),
5024 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5025 BPF_EXIT_INSN(),
5026 },
5027 .fixup_map2 = { 3 },
5028 .result = ACCEPT,
5029 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5030 },
5031 {
5032 "helper access to adjusted map (via const reg): empty range",
5033 .insns = {
5034 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5035 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5036 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5037 BPF_LD_MAP_FD(BPF_REG_1, 0),
5038 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5039 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5040 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5041 BPF_MOV64_IMM(BPF_REG_3, 0),
5042 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5043 BPF_MOV64_IMM(BPF_REG_2, 0),
5044 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5045 BPF_EXIT_INSN(),
5046 },
5047 .fixup_map2 = { 3 },
5048 .errstr = "R1 min value is outside of the array range",
5049 .result = REJECT,
5050 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5051 },
5052 {
5053 "helper access to adjusted map (via const reg): out-of-bound range",
5054 .insns = {
5055 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5056 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5057 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5058 BPF_LD_MAP_FD(BPF_REG_1, 0),
5059 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5060 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5061 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5062 BPF_MOV64_IMM(BPF_REG_3,
5063 offsetof(struct test_val, foo)),
5064 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5065 BPF_MOV64_IMM(BPF_REG_2,
5066 sizeof(struct test_val) -
5067 offsetof(struct test_val, foo) + 8),
5068 BPF_MOV64_IMM(BPF_REG_3, 0),
5069 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5070 BPF_EXIT_INSN(),
5071 },
5072 .fixup_map2 = { 3 },
5073 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5074 .result = REJECT,
5075 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5076 },
5077 {
5078 "helper access to adjusted map (via const reg): negative range (> adjustment)",
5079 .insns = {
5080 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5081 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5082 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5083 BPF_LD_MAP_FD(BPF_REG_1, 0),
5084 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5085 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5086 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5087 BPF_MOV64_IMM(BPF_REG_3,
5088 offsetof(struct test_val, foo)),
5089 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5090 BPF_MOV64_IMM(BPF_REG_2, -8),
5091 BPF_MOV64_IMM(BPF_REG_3, 0),
5092 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5093 BPF_EXIT_INSN(),
5094 },
5095 .fixup_map2 = { 3 },
5096 .errstr = "R2 min value is negative",
5097 .result = REJECT,
5098 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5099 },
5100 {
5101 "helper access to adjusted map (via const reg): negative range (< adjustment)",
5102 .insns = {
5103 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5104 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5105 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5106 BPF_LD_MAP_FD(BPF_REG_1, 0),
5107 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5108 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5109 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5110 BPF_MOV64_IMM(BPF_REG_3,
5111 offsetof(struct test_val, foo)),
5112 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5113 BPF_MOV64_IMM(BPF_REG_2, -1),
5114 BPF_MOV64_IMM(BPF_REG_3, 0),
5115 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5116 BPF_EXIT_INSN(),
5117 },
5118 .fixup_map2 = { 3 },
5119 .errstr = "R2 min value is negative",
5120 .result = REJECT,
5121 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5122 },
5123 {
5124 "helper access to adjusted map (via variable): full range",
5125 .insns = {
5126 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5127 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5128 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5129 BPF_LD_MAP_FD(BPF_REG_1, 0),
5130 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5131 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5132 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5133 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5134 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5135 offsetof(struct test_val, foo), 4),
5136 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5137 BPF_MOV64_IMM(BPF_REG_2,
5138 sizeof(struct test_val) -
5139 offsetof(struct test_val, foo)),
5140 BPF_MOV64_IMM(BPF_REG_3, 0),
5141 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5142 BPF_EXIT_INSN(),
5143 },
5144 .fixup_map2 = { 3 },
5145 .result = ACCEPT,
5146 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5147 },
5148 {
5149 "helper access to adjusted map (via variable): partial range",
5150 .insns = {
5151 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5153 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5154 BPF_LD_MAP_FD(BPF_REG_1, 0),
5155 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5156 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5157 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5158 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5159 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5160 offsetof(struct test_val, foo), 4),
5161 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5162 BPF_MOV64_IMM(BPF_REG_2, 8),
5163 BPF_MOV64_IMM(BPF_REG_3, 0),
5164 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5165 BPF_EXIT_INSN(),
5166 },
5167 .fixup_map2 = { 3 },
5168 .result = ACCEPT,
5169 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5170 },
5171 {
5172 "helper access to adjusted map (via variable): empty range",
5173 .insns = {
5174 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5175 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5176 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5177 BPF_LD_MAP_FD(BPF_REG_1, 0),
5178 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5179 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5180 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5181 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5182 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5183 offsetof(struct test_val, foo), 3),
5184 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5185 BPF_MOV64_IMM(BPF_REG_2, 0),
5186 BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5187 BPF_EXIT_INSN(),
5188 },
5189 .fixup_map2 = { 3 },
5190 .errstr = "R1 min value is outside of the array range",
5191 .result = REJECT,
5192 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5193 },
5194 {
5195 "helper access to adjusted map (via variable): no max check",
5196 .insns = {
5197 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5198 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5199 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5200 BPF_LD_MAP_FD(BPF_REG_1, 0),
5201 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5202 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5203 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5204 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5205 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5206 BPF_MOV64_IMM(BPF_REG_2, 1),
5207 BPF_MOV64_IMM(BPF_REG_3, 0),
5208 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5209 BPF_EXIT_INSN(),
5210 },
5211 .fixup_map2 = { 3 },
5212 .errstr = "R1 unbounded memory access",
5213 .result = REJECT,
5214 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5215 },
5216 {
5217 "helper access to adjusted map (via variable): wrong max check",
5218 .insns = {
5219 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5220 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5221 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5222 BPF_LD_MAP_FD(BPF_REG_1, 0),
5223 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5224 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5225 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5226 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5227 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5228 offsetof(struct test_val, foo), 4),
5229 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5230 BPF_MOV64_IMM(BPF_REG_2,
5231 sizeof(struct test_val) -
5232 offsetof(struct test_val, foo) + 1),
5233 BPF_MOV64_IMM(BPF_REG_3, 0),
5234 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5235 BPF_EXIT_INSN(),
5236 },
5237 .fixup_map2 = { 3 },
5238 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
5239 .result = REJECT,
5240 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5241 },
5242 {
5243 "helper access to map: bounds check using <, good access",
5244 .insns = {
5245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5247 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5248 BPF_LD_MAP_FD(BPF_REG_1, 0),
5249 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5250 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5251 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5252 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5253 BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
5254 BPF_MOV64_IMM(BPF_REG_0, 0),
5255 BPF_EXIT_INSN(),
5256 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5257 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5258 BPF_MOV64_IMM(BPF_REG_0, 0),
5259 BPF_EXIT_INSN(),
5260 },
5261 .fixup_map2 = { 3 },
5262 .result = ACCEPT,
5263 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5264 },
5265 {
5266 "helper access to map: bounds check using <, bad access",
5267 .insns = {
5268 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5269 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5270 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5271 BPF_LD_MAP_FD(BPF_REG_1, 0),
5272 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5273 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5274 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5275 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5276 BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
5277 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5278 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5279 BPF_MOV64_IMM(BPF_REG_0, 0),
5280 BPF_EXIT_INSN(),
5281 BPF_MOV64_IMM(BPF_REG_0, 0),
5282 BPF_EXIT_INSN(),
5283 },
5284 .fixup_map2 = { 3 },
5285 .result = REJECT,
5286 .errstr = "R1 unbounded memory access",
5287 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5288 },
5289 {
5290 "helper access to map: bounds check using <=, good access",
5291 .insns = {
5292 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5293 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5294 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5295 BPF_LD_MAP_FD(BPF_REG_1, 0),
5296 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5297 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5298 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5299 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5300 BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
5301 BPF_MOV64_IMM(BPF_REG_0, 0),
5302 BPF_EXIT_INSN(),
5303 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5304 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5305 BPF_MOV64_IMM(BPF_REG_0, 0),
5306 BPF_EXIT_INSN(),
5307 },
5308 .fixup_map2 = { 3 },
5309 .result = ACCEPT,
5310 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5311 },
5312 {
5313 "helper access to map: bounds check using <=, bad access",
5314 .insns = {
5315 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5316 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5317 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5318 BPF_LD_MAP_FD(BPF_REG_1, 0),
5319 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5320 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5321 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5322 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5323 BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5324 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5325 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5326 BPF_MOV64_IMM(BPF_REG_0, 0),
5327 BPF_EXIT_INSN(),
5328 BPF_MOV64_IMM(BPF_REG_0, 0),
5329 BPF_EXIT_INSN(),
5330 },
5331 .fixup_map2 = { 3 },
5332 .result = REJECT,
5333 .errstr = "R1 unbounded memory access",
5334 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5335 },
5336 {
5337 "helper access to map: bounds check using s<, good access",
5338 .insns = {
5339 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5340 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5341 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5342 BPF_LD_MAP_FD(BPF_REG_1, 0),
5343 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5344 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5345 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5346 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5347 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5348 BPF_MOV64_IMM(BPF_REG_0, 0),
5349 BPF_EXIT_INSN(),
5350 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5351 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5352 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5353 BPF_MOV64_IMM(BPF_REG_0, 0),
5354 BPF_EXIT_INSN(),
5355 },
5356 .fixup_map2 = { 3 },
5357 .result = ACCEPT,
5358 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5359 },
5360 {
5361 "helper access to map: bounds check using s<, good access 2",
5362 .insns = {
5363 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5364 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5365 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5366 BPF_LD_MAP_FD(BPF_REG_1, 0),
5367 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5368 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5369 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5370 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5371 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5372 BPF_MOV64_IMM(BPF_REG_0, 0),
5373 BPF_EXIT_INSN(),
5374 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5375 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5376 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5377 BPF_MOV64_IMM(BPF_REG_0, 0),
5378 BPF_EXIT_INSN(),
5379 },
5380 .fixup_map2 = { 3 },
5381 .result = ACCEPT,
5382 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5383 },
5384 {
5385 "helper access to map: bounds check using s<, bad access",
5386 .insns = {
5387 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5388 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5389 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5390 BPF_LD_MAP_FD(BPF_REG_1, 0),
5391 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5392 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5393 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5394 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5395 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5396 BPF_MOV64_IMM(BPF_REG_0, 0),
5397 BPF_EXIT_INSN(),
5398 BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5399 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5400 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5401 BPF_MOV64_IMM(BPF_REG_0, 0),
5402 BPF_EXIT_INSN(),
5403 },
5404 .fixup_map2 = { 3 },
5405 .result = REJECT,
5406 .errstr = "R1 min value is negative",
5407 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5408 },
5409 {
5410 "helper access to map: bounds check using s<=, good access",
5411 .insns = {
5412 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5413 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5414 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5415 BPF_LD_MAP_FD(BPF_REG_1, 0),
5416 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5417 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5418 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5419 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5420 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5421 BPF_MOV64_IMM(BPF_REG_0, 0),
5422 BPF_EXIT_INSN(),
5423 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5424 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5425 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5426 BPF_MOV64_IMM(BPF_REG_0, 0),
5427 BPF_EXIT_INSN(),
5428 },
5429 .fixup_map2 = { 3 },
5430 .result = ACCEPT,
5431 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5432 },
5433 {
5434 "helper access to map: bounds check using s<=, good access 2",
5435 .insns = {
5436 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5437 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5438 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5439 BPF_LD_MAP_FD(BPF_REG_1, 0),
5440 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5441 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5442 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5443 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5444 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5445 BPF_MOV64_IMM(BPF_REG_0, 0),
5446 BPF_EXIT_INSN(),
5447 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5448 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5449 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5450 BPF_MOV64_IMM(BPF_REG_0, 0),
5451 BPF_EXIT_INSN(),
5452 },
5453 .fixup_map2 = { 3 },
5454 .result = ACCEPT,
5455 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5456 },
5457 {
5458 "helper access to map: bounds check using s<=, bad access",
5459 .insns = {
5460 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5461 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5462 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5463 BPF_LD_MAP_FD(BPF_REG_1, 0),
5464 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5465 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5466 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5467 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5468 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5469 BPF_MOV64_IMM(BPF_REG_0, 0),
5470 BPF_EXIT_INSN(),
5471 BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5472 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5473 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5474 BPF_MOV64_IMM(BPF_REG_0, 0),
5475 BPF_EXIT_INSN(),
5476 },
5477 .fixup_map2 = { 3 },
5478 .result = REJECT,
5479 .errstr = "R1 min value is negative",
5480 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5481 },
5482 {
5483 "map element value is preserved across register spilling",
5484 .insns = {
5485 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5486 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5487 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5488 BPF_LD_MAP_FD(BPF_REG_1, 0),
5489 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5490 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5491 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5492 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5493 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5494 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5495 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5496 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5497 BPF_EXIT_INSN(),
5498 },
5499 .fixup_map2 = { 3 },
5500 .errstr_unpriv = "R0 leaks addr",
5501 .result = ACCEPT,
5502 .result_unpriv = REJECT,
5503 },
5504 {
5505 "map element value or null is marked on register spilling",
5506 .insns = {
5507 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5508 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5509 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5510 BPF_LD_MAP_FD(BPF_REG_1, 0),
5511 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5512 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5513 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
5514 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5515 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5516 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5517 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5518 BPF_EXIT_INSN(),
5519 },
5520 .fixup_map2 = { 3 },
5521 .errstr_unpriv = "R0 leaks addr",
5522 .result = ACCEPT,
5523 .result_unpriv = REJECT,
5524 },
5525 {
5526 "map element value store of cleared call register",
5527 .insns = {
5528 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5529 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5530 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5531 BPF_LD_MAP_FD(BPF_REG_1, 0),
5532 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5533 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5534 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
5535 BPF_EXIT_INSN(),
5536 },
5537 .fixup_map2 = { 3 },
5538 .errstr_unpriv = "R1 !read_ok",
5539 .errstr = "R1 !read_ok",
5540 .result = REJECT,
5541 .result_unpriv = REJECT,
5542 },
5543 {
5544 "map element value with unaligned store",
5545 .insns = {
5546 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5547 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5548 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5549 BPF_LD_MAP_FD(BPF_REG_1, 0),
5550 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5551 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
5552 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5553 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5554 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
5555 BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
5556 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5557 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
5558 BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
5559 BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
5560 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
5561 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
5562 BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
5563 BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
5564 BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
5565 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
5566 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
5567 BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
5568 BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
5569 BPF_EXIT_INSN(),
5570 },
5571 .fixup_map2 = { 3 },
5572 .errstr_unpriv = "R0 leaks addr",
5573 .result = ACCEPT,
5574 .result_unpriv = REJECT,
5575 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5576 },
5577 {
5578 "map element value with unaligned load",
5579 .insns = {
5580 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5581 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5582 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5583 BPF_LD_MAP_FD(BPF_REG_1, 0),
5584 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5585 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5586 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5587 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
5588 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5589 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5590 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
5591 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5592 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
5593 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
5594 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
5595 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5596 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
5597 BPF_EXIT_INSN(),
5598 },
5599 .fixup_map2 = { 3 },
5600 .errstr_unpriv = "R0 leaks addr",
5601 .result = ACCEPT,
5602 .result_unpriv = REJECT,
5603 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5604 },
5605 {
5606 "map element value illegal alu op, 1",
5607 .insns = {
5608 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5609 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5610 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5611 BPF_LD_MAP_FD(BPF_REG_1, 0),
5612 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5613 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5614 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
5615 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5616 BPF_EXIT_INSN(),
5617 },
5618 .fixup_map2 = { 3 },
5619 .errstr = "R0 bitwise operator &= on pointer",
5620 .result = REJECT,
5621 },
5622 {
5623 "map element value illegal alu op, 2",
5624 .insns = {
5625 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5626 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5627 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5628 BPF_LD_MAP_FD(BPF_REG_1, 0),
5629 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5630 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5631 BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
5632 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5633 BPF_EXIT_INSN(),
5634 },
5635 .fixup_map2 = { 3 },
5636 .errstr = "R0 32-bit pointer arithmetic prohibited",
5637 .result = REJECT,
5638 },
5639 {
5640 "map element value illegal alu op, 3",
5641 .insns = {
5642 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5643 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5644 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5645 BPF_LD_MAP_FD(BPF_REG_1, 0),
5646 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5647 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5648 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
5649 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5650 BPF_EXIT_INSN(),
5651 },
5652 .fixup_map2 = { 3 },
5653 .errstr = "R0 pointer arithmetic with /= operator",
5654 .result = REJECT,
5655 },
5656 {
5657 "map element value illegal alu op, 4",
5658 .insns = {
5659 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5660 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5661 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5662 BPF_LD_MAP_FD(BPF_REG_1, 0),
5663 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5664 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5665 BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
5666 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5667 BPF_EXIT_INSN(),
5668 },
5669 .fixup_map2 = { 3 },
5670 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5671 .errstr = "invalid mem access 'inv'",
5672 .result = REJECT,
5673 .result_unpriv = REJECT,
5674 },
5675 {
5676 "map element value illegal alu op, 5",
5677 .insns = {
5678 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5679 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5680 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5681 BPF_LD_MAP_FD(BPF_REG_1, 0),
5682 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5683 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5684 BPF_MOV64_IMM(BPF_REG_3, 4096),
5685 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5686 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5687 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5688 BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
5689 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
5690 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5691 BPF_EXIT_INSN(),
5692 },
5693 .fixup_map2 = { 3 },
5694 .errstr = "R0 invalid mem access 'inv'",
5695 .result = REJECT,
5696 },
5697 {
5698 "map element value is preserved across register spilling",
5699 .insns = {
5700 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5701 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5702 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5703 BPF_LD_MAP_FD(BPF_REG_1, 0),
5704 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5705 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5706 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
5707 offsetof(struct test_val, foo)),
5708 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5709 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5710 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5711 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5712 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5713 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5714 BPF_EXIT_INSN(),
5715 },
5716 .fixup_map2 = { 3 },
5717 .errstr_unpriv = "R0 leaks addr",
5718 .result = ACCEPT,
5719 .result_unpriv = REJECT,
5720 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5721 },
5722 {
5723 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
5724 .insns = {
5725 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5727 BPF_MOV64_IMM(BPF_REG_0, 0),
5728 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5729 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5730 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5731 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5732 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5733 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5734 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5735 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5736 BPF_MOV64_IMM(BPF_REG_2, 16),
5737 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5738 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5739 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5740 BPF_MOV64_IMM(BPF_REG_4, 0),
5741 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5742 BPF_MOV64_IMM(BPF_REG_3, 0),
5743 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5744 BPF_MOV64_IMM(BPF_REG_0, 0),
5745 BPF_EXIT_INSN(),
5746 },
5747 .result = ACCEPT,
5748 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5749 },
5750 {
5751 "helper access to variable memory: stack, bitwise AND, zero included",
5752 .insns = {
5753 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5755 BPF_MOV64_IMM(BPF_REG_2, 16),
5756 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5757 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5758 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5759 BPF_MOV64_IMM(BPF_REG_3, 0),
5760 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5761 BPF_EXIT_INSN(),
5762 },
5763 .errstr = "invalid indirect read from stack off -64+0 size 64",
5764 .result = REJECT,
5765 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5766 },
5767 {
5768 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
5769 .insns = {
5770 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5771 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5772 BPF_MOV64_IMM(BPF_REG_2, 16),
5773 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5774 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5775 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
5776 BPF_MOV64_IMM(BPF_REG_4, 0),
5777 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5778 BPF_MOV64_IMM(BPF_REG_3, 0),
5779 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5780 BPF_MOV64_IMM(BPF_REG_0, 0),
5781 BPF_EXIT_INSN(),
5782 },
5783 .errstr = "invalid stack type R1 off=-64 access_size=65",
5784 .result = REJECT,
5785 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5786 },
5787 {
5788 "helper access to variable memory: stack, JMP, correct bounds",
5789 .insns = {
5790 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5792 BPF_MOV64_IMM(BPF_REG_0, 0),
5793 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5794 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5795 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5796 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5797 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5798 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5799 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5800 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5801 BPF_MOV64_IMM(BPF_REG_2, 16),
5802 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5803 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5804 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
5805 BPF_MOV64_IMM(BPF_REG_4, 0),
5806 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5807 BPF_MOV64_IMM(BPF_REG_3, 0),
5808 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5809 BPF_MOV64_IMM(BPF_REG_0, 0),
5810 BPF_EXIT_INSN(),
5811 },
5812 .result = ACCEPT,
5813 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5814 },
5815 {
5816 "helper access to variable memory: stack, JMP (signed), correct bounds",
5817 .insns = {
5818 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5819 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5820 BPF_MOV64_IMM(BPF_REG_0, 0),
5821 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5822 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5823 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5824 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5825 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5826 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5827 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5828 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5829 BPF_MOV64_IMM(BPF_REG_2, 16),
5830 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5831 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5832 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
5833 BPF_MOV64_IMM(BPF_REG_4, 0),
5834 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5835 BPF_MOV64_IMM(BPF_REG_3, 0),
5836 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5837 BPF_MOV64_IMM(BPF_REG_0, 0),
5838 BPF_EXIT_INSN(),
5839 },
5840 .result = ACCEPT,
5841 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5842 },
5843 {
5844 "helper access to variable memory: stack, JMP, bounds + offset",
5845 .insns = {
5846 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5847 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5848 BPF_MOV64_IMM(BPF_REG_2, 16),
5849 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5850 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5851 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
5852 BPF_MOV64_IMM(BPF_REG_4, 0),
5853 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
5854 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5855 BPF_MOV64_IMM(BPF_REG_3, 0),
5856 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5857 BPF_MOV64_IMM(BPF_REG_0, 0),
5858 BPF_EXIT_INSN(),
5859 },
5860 .errstr = "invalid stack type R1 off=-64 access_size=65",
5861 .result = REJECT,
5862 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5863 },
5864 {
5865 "helper access to variable memory: stack, JMP, wrong max",
5866 .insns = {
5867 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5868 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5869 BPF_MOV64_IMM(BPF_REG_2, 16),
5870 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5871 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5872 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
5873 BPF_MOV64_IMM(BPF_REG_4, 0),
5874 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5875 BPF_MOV64_IMM(BPF_REG_3, 0),
5876 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5877 BPF_MOV64_IMM(BPF_REG_0, 0),
5878 BPF_EXIT_INSN(),
5879 },
5880 .errstr = "invalid stack type R1 off=-64 access_size=65",
5881 .result = REJECT,
5882 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5883 },
5884 {
5885 "helper access to variable memory: stack, JMP, no max check",
5886 .insns = {
5887 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5888 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5889 BPF_MOV64_IMM(BPF_REG_2, 16),
5890 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5891 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5892 BPF_MOV64_IMM(BPF_REG_4, 0),
5893 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5894 BPF_MOV64_IMM(BPF_REG_3, 0),
5895 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5896 BPF_MOV64_IMM(BPF_REG_0, 0),
5897 BPF_EXIT_INSN(),
5898 },
5899 /* because max wasn't checked, signed min is negative */
5900 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
5901 .result = REJECT,
5902 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5903 },
5904 {
5905 "helper access to variable memory: stack, JMP, no min check",
5906 .insns = {
5907 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5908 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5909 BPF_MOV64_IMM(BPF_REG_2, 16),
5910 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5911 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5912 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
5913 BPF_MOV64_IMM(BPF_REG_3, 0),
5914 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5915 BPF_MOV64_IMM(BPF_REG_0, 0),
5916 BPF_EXIT_INSN(),
5917 },
5918 .errstr = "invalid indirect read from stack off -64+0 size 64",
5919 .result = REJECT,
5920 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5921 },
5922 {
5923 "helper access to variable memory: stack, JMP (signed), no min check",
5924 .insns = {
5925 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5926 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5927 BPF_MOV64_IMM(BPF_REG_2, 16),
5928 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5929 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5930 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
5931 BPF_MOV64_IMM(BPF_REG_3, 0),
5932 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5933 BPF_MOV64_IMM(BPF_REG_0, 0),
5934 BPF_EXIT_INSN(),
5935 },
5936 .errstr = "R2 min value is negative",
5937 .result = REJECT,
5938 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5939 },
5940 {
5941 "helper access to variable memory: map, JMP, correct bounds",
5942 .insns = {
5943 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5944 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5945 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5946 BPF_LD_MAP_FD(BPF_REG_1, 0),
5947 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5948 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5949 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5950 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5951 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5952 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5953 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5954 sizeof(struct test_val), 4),
5955 BPF_MOV64_IMM(BPF_REG_4, 0),
5956 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5957 BPF_MOV64_IMM(BPF_REG_3, 0),
5958 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5959 BPF_MOV64_IMM(BPF_REG_0, 0),
5960 BPF_EXIT_INSN(),
5961 },
5962 .fixup_map2 = { 3 },
5963 .result = ACCEPT,
5964 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5965 },
5966 {
5967 "helper access to variable memory: map, JMP, wrong max",
5968 .insns = {
5969 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5970 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5971 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5972 BPF_LD_MAP_FD(BPF_REG_1, 0),
5973 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5974 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5975 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5976 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5977 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5978 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5979 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5980 sizeof(struct test_val) + 1, 4),
5981 BPF_MOV64_IMM(BPF_REG_4, 0),
5982 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5983 BPF_MOV64_IMM(BPF_REG_3, 0),
5984 BPF_EMIT_CALL(BPF_FUNC_probe_read),
5985 BPF_MOV64_IMM(BPF_REG_0, 0),
5986 BPF_EXIT_INSN(),
5987 },
5988 .fixup_map2 = { 3 },
5989 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
5990 .result = REJECT,
5991 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5992 },
5993 {
5994 "helper access to variable memory: map adjusted, JMP, correct bounds",
5995 .insns = {
5996 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5998 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5999 BPF_LD_MAP_FD(BPF_REG_1, 0),
6000 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6001 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6002 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6003 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6004 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6005 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6006 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6007 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6008 sizeof(struct test_val) - 20, 4),
6009 BPF_MOV64_IMM(BPF_REG_4, 0),
6010 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6011 BPF_MOV64_IMM(BPF_REG_3, 0),
6012 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6013 BPF_MOV64_IMM(BPF_REG_0, 0),
6014 BPF_EXIT_INSN(),
6015 },
6016 .fixup_map2 = { 3 },
6017 .result = ACCEPT,
6018 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6019 },
6020 {
6021 "helper access to variable memory: map adjusted, JMP, wrong max",
6022 .insns = {
6023 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6024 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6025 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6026 BPF_LD_MAP_FD(BPF_REG_1, 0),
6027 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6028 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6029 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6030 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6031 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6032 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6033 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6034 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6035 sizeof(struct test_val) - 19, 4),
6036 BPF_MOV64_IMM(BPF_REG_4, 0),
6037 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6038 BPF_MOV64_IMM(BPF_REG_3, 0),
6039 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6040 BPF_MOV64_IMM(BPF_REG_0, 0),
6041 BPF_EXIT_INSN(),
6042 },
6043 .fixup_map2 = { 3 },
6044 .errstr = "R1 min value is outside of the array range",
6045 .result = REJECT,
6046 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6047 },
6048 {
6049 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6050 .insns = {
6051 BPF_MOV64_IMM(BPF_REG_1, 0),
6052 BPF_MOV64_IMM(BPF_REG_2, 0),
6053 BPF_MOV64_IMM(BPF_REG_3, 0),
6054 BPF_MOV64_IMM(BPF_REG_4, 0),
6055 BPF_MOV64_IMM(BPF_REG_5, 0),
6056 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6057 BPF_EXIT_INSN(),
6058 },
6059 .result = ACCEPT,
6060 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6061 },
6062 {
6063 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6064 .insns = {
6065 BPF_MOV64_IMM(BPF_REG_1, 0),
6066 BPF_MOV64_IMM(BPF_REG_2, 1),
6067 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6068 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6069 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6070 BPF_MOV64_IMM(BPF_REG_3, 0),
6071 BPF_MOV64_IMM(BPF_REG_4, 0),
6072 BPF_MOV64_IMM(BPF_REG_5, 0),
6073 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6074 BPF_EXIT_INSN(),
6075 },
6076 .errstr = "R1 type=inv expected=fp",
6077 .result = REJECT,
6078 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6079 },
6080 {
6081 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6082 .insns = {
6083 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6084 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6085 BPF_MOV64_IMM(BPF_REG_2, 0),
6086 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6087 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
6088 BPF_MOV64_IMM(BPF_REG_3, 0),
6089 BPF_MOV64_IMM(BPF_REG_4, 0),
6090 BPF_MOV64_IMM(BPF_REG_5, 0),
6091 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6092 BPF_EXIT_INSN(),
6093 },
6094 .result = ACCEPT,
6095 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6096 },
6097 {
6098 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6099 .insns = {
6100 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6101 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6102 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6103 BPF_LD_MAP_FD(BPF_REG_1, 0),
6104 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6105 BPF_FUNC_map_lookup_elem),
6106 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6107 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6108 BPF_MOV64_IMM(BPF_REG_2, 0),
6109 BPF_MOV64_IMM(BPF_REG_3, 0),
6110 BPF_MOV64_IMM(BPF_REG_4, 0),
6111 BPF_MOV64_IMM(BPF_REG_5, 0),
6112 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6113 BPF_EXIT_INSN(),
6114 },
6115 .fixup_map1 = { 3 },
6116 .result = ACCEPT,
6117 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6118 },
6119 {
6120 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6121 .insns = {
6122 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6123 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6124 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6125 BPF_LD_MAP_FD(BPF_REG_1, 0),
6126 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6127 BPF_FUNC_map_lookup_elem),
6128 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6129 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6130 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
6131 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6132 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6133 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6134 BPF_MOV64_IMM(BPF_REG_3, 0),
6135 BPF_MOV64_IMM(BPF_REG_4, 0),
6136 BPF_MOV64_IMM(BPF_REG_5, 0),
6137 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6138 BPF_EXIT_INSN(),
6139 },
6140 .fixup_map1 = { 3 },
6141 .result = ACCEPT,
6142 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6143 },
6144 {
6145 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6146 .insns = {
6147 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6148 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6149 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6150 BPF_LD_MAP_FD(BPF_REG_1, 0),
6151 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6152 BPF_FUNC_map_lookup_elem),
6153 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6154 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6155 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6156 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6157 BPF_MOV64_IMM(BPF_REG_3, 0),
6158 BPF_MOV64_IMM(BPF_REG_4, 0),
6159 BPF_MOV64_IMM(BPF_REG_5, 0),
6160 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6161 BPF_EXIT_INSN(),
6162 },
6163 .fixup_map1 = { 3 },
6164 .result = ACCEPT,
6165 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6166 },
6167 {
6168 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
6169 .insns = {
6170 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6171 offsetof(struct __sk_buff, data)),
6172 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6173 offsetof(struct __sk_buff, data_end)),
6174 BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
6175 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6176 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
6177 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
6178 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
6179 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6180 BPF_MOV64_IMM(BPF_REG_3, 0),
6181 BPF_MOV64_IMM(BPF_REG_4, 0),
6182 BPF_MOV64_IMM(BPF_REG_5, 0),
6183 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6184 BPF_EXIT_INSN(),
6185 },
6186 .result = ACCEPT,
6187 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6188 .retval = 0 /* csum_diff of 64-byte packet */,
6189 },
6190 {
6191 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6192 .insns = {
6193 BPF_MOV64_IMM(BPF_REG_1, 0),
6194 BPF_MOV64_IMM(BPF_REG_2, 0),
6195 BPF_MOV64_IMM(BPF_REG_3, 0),
6196 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6197 BPF_EXIT_INSN(),
6198 },
6199 .errstr = "R1 type=inv expected=fp",
6200 .result = REJECT,
6201 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6202 },
6203 {
6204 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6205 .insns = {
6206 BPF_MOV64_IMM(BPF_REG_1, 0),
6207 BPF_MOV64_IMM(BPF_REG_2, 1),
6208 BPF_MOV64_IMM(BPF_REG_3, 0),
6209 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6210 BPF_EXIT_INSN(),
6211 },
6212 .errstr = "R1 type=inv expected=fp",
6213 .result = REJECT,
6214 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6215 },
6216 {
6217 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6218 .insns = {
6219 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6220 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6221 BPF_MOV64_IMM(BPF_REG_2, 0),
6222 BPF_MOV64_IMM(BPF_REG_3, 0),
6223 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6224 BPF_EXIT_INSN(),
6225 },
6226 .result = ACCEPT,
6227 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6228 },
6229 {
6230 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6231 .insns = {
6232 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6233 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6234 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6235 BPF_LD_MAP_FD(BPF_REG_1, 0),
6236 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6237 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6238 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6239 BPF_MOV64_IMM(BPF_REG_2, 0),
6240 BPF_MOV64_IMM(BPF_REG_3, 0),
6241 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6242 BPF_EXIT_INSN(),
6243 },
6244 .fixup_map1 = { 3 },
6245 .result = ACCEPT,
6246 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6247 },
6248 {
6249 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6250 .insns = {
6251 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6252 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6254 BPF_LD_MAP_FD(BPF_REG_1, 0),
6255 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6256 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6257 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6258 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6259 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6261 BPF_MOV64_IMM(BPF_REG_3, 0),
6262 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6263 BPF_EXIT_INSN(),
6264 },
6265 .fixup_map1 = { 3 },
6266 .result = ACCEPT,
6267 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6268 },
6269 {
6270 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6271 .insns = {
6272 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6273 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6274 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6275 BPF_LD_MAP_FD(BPF_REG_1, 0),
6276 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6277 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6278 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6279 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6280 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
6281 BPF_MOV64_IMM(BPF_REG_3, 0),
6282 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6283 BPF_EXIT_INSN(),
6284 },
6285 .fixup_map1 = { 3 },
6286 .result = ACCEPT,
6287 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6288 },
6289 {
6290 "helper access to variable memory: 8 bytes leak",
6291 .insns = {
6292 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6293 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6294 BPF_MOV64_IMM(BPF_REG_0, 0),
6295 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6296 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6297 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6298 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6299 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6300 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6301 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6302 BPF_MOV64_IMM(BPF_REG_2, 1),
6303 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6304 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6305 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
6306 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
6307 BPF_MOV64_IMM(BPF_REG_3, 0),
6308 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6309 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6310 BPF_EXIT_INSN(),
6311 },
6312 .errstr = "invalid indirect read from stack off -64+32 size 64",
6313 .result = REJECT,
6314 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6315 },
6316 {
6317 "helper access to variable memory: 8 bytes no leak (init memory)",
6318 .insns = {
6319 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6320 BPF_MOV64_IMM(BPF_REG_0, 0),
6321 BPF_MOV64_IMM(BPF_REG_0, 0),
6322 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6323 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6324 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6325 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6326 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6327 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6328 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6329 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6330 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6331 BPF_MOV64_IMM(BPF_REG_2, 0),
6332 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
6333 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
6334 BPF_MOV64_IMM(BPF_REG_3, 0),
6335 BPF_EMIT_CALL(BPF_FUNC_probe_read),
6336 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6337 BPF_EXIT_INSN(),
6338 },
6339 .result = ACCEPT,
6340 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6341 },
6342 {
6343 "invalid and of negative number",
6344 .insns = {
6345 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6346 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6347 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6348 BPF_LD_MAP_FD(BPF_REG_1, 0),
6349 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6350 BPF_FUNC_map_lookup_elem),
6351 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6352 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6353 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
6354 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
6355 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6356 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
6357 offsetof(struct test_val, foo)),
6358 BPF_EXIT_INSN(),
6359 },
6360 .fixup_map2 = { 3 },
6361 .errstr = "R0 max value is outside of the array range",
6362 .result = REJECT,
6363 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6364 },
6365 {
6366 "invalid range check",
6367 .insns = {
6368 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6369 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6370 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6371 BPF_LD_MAP_FD(BPF_REG_1, 0),
6372 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6373 BPF_FUNC_map_lookup_elem),
6374 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
6375 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6376 BPF_MOV64_IMM(BPF_REG_9, 1),
6377 BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
6378 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
6379 BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
6380 BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
6381 BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
6382 BPF_MOV32_IMM(BPF_REG_3, 1),
6383 BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
6384 BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
6385 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
6386 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
6387 BPF_MOV64_REG(BPF_REG_0, 0),
6388 BPF_EXIT_INSN(),
6389 },
6390 .fixup_map2 = { 3 },
6391 .errstr = "R0 max value is outside of the array range",
6392 .result = REJECT,
6393 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6394 },
6395 {
6396 "map in map access",
6397 .insns = {
6398 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6399 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6401 BPF_LD_MAP_FD(BPF_REG_1, 0),
6402 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6403 BPF_FUNC_map_lookup_elem),
6404 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6405 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6406 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6407 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6408 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6409 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6410 BPF_FUNC_map_lookup_elem),
6411 BPF_MOV64_REG(BPF_REG_0, 0),
6412 BPF_EXIT_INSN(),
6413 },
6414 .fixup_map_in_map = { 3 },
6415 .result = ACCEPT,
6416 },
6417 {
6418 "invalid inner map pointer",
6419 .insns = {
6420 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6421 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6422 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6423 BPF_LD_MAP_FD(BPF_REG_1, 0),
6424 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6425 BPF_FUNC_map_lookup_elem),
6426 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6427 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6428 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6429 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6430 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6431 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
6432 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6433 BPF_FUNC_map_lookup_elem),
6434 BPF_MOV64_REG(BPF_REG_0, 0),
6435 BPF_EXIT_INSN(),
6436 },
6437 .fixup_map_in_map = { 3 },
6438 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
6439 .result = REJECT,
6440 },
6441 {
6442 "forgot null checking on the inner map pointer",
6443 .insns = {
6444 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6445 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6446 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6447 BPF_LD_MAP_FD(BPF_REG_1, 0),
6448 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6449 BPF_FUNC_map_lookup_elem),
6450 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6451 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6452 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6453 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6454 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6455 BPF_FUNC_map_lookup_elem),
6456 BPF_MOV64_REG(BPF_REG_0, 0),
6457 BPF_EXIT_INSN(),
6458 },
6459 .fixup_map_in_map = { 3 },
6460 .errstr = "R1 type=map_value_or_null expected=map_ptr",
6461 .result = REJECT,
6462 },
6463 {
6464 "ld_abs: check calling conv, r1",
6465 .insns = {
6466 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6467 BPF_MOV64_IMM(BPF_REG_1, 0),
6468 BPF_LD_ABS(BPF_W, -0x200000),
6469 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6470 BPF_EXIT_INSN(),
6471 },
6472 .errstr = "R1 !read_ok",
6473 .result = REJECT,
6474 },
6475 {
6476 "ld_abs: check calling conv, r2",
6477 .insns = {
6478 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6479 BPF_MOV64_IMM(BPF_REG_2, 0),
6480 BPF_LD_ABS(BPF_W, -0x200000),
6481 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6482 BPF_EXIT_INSN(),
6483 },
6484 .errstr = "R2 !read_ok",
6485 .result = REJECT,
6486 },
6487 {
6488 "ld_abs: check calling conv, r3",
6489 .insns = {
6490 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6491 BPF_MOV64_IMM(BPF_REG_3, 0),
6492 BPF_LD_ABS(BPF_W, -0x200000),
6493 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6494 BPF_EXIT_INSN(),
6495 },
6496 .errstr = "R3 !read_ok",
6497 .result = REJECT,
6498 },
6499 {
6500 "ld_abs: check calling conv, r4",
6501 .insns = {
6502 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6503 BPF_MOV64_IMM(BPF_REG_4, 0),
6504 BPF_LD_ABS(BPF_W, -0x200000),
6505 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6506 BPF_EXIT_INSN(),
6507 },
6508 .errstr = "R4 !read_ok",
6509 .result = REJECT,
6510 },
6511 {
6512 "ld_abs: check calling conv, r5",
6513 .insns = {
6514 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6515 BPF_MOV64_IMM(BPF_REG_5, 0),
6516 BPF_LD_ABS(BPF_W, -0x200000),
6517 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6518 BPF_EXIT_INSN(),
6519 },
6520 .errstr = "R5 !read_ok",
6521 .result = REJECT,
6522 },
6523 {
6524 "ld_abs: check calling conv, r7",
6525 .insns = {
6526 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6527 BPF_MOV64_IMM(BPF_REG_7, 0),
6528 BPF_LD_ABS(BPF_W, -0x200000),
6529 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6530 BPF_EXIT_INSN(),
6531 },
6532 .result = ACCEPT,
6533 },
6534 {
6535 "ld_abs: tests on r6 and skb data reload helper",
6536 .insns = {
6537 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6538 BPF_LD_ABS(BPF_B, 0),
6539 BPF_LD_ABS(BPF_H, 0),
6540 BPF_LD_ABS(BPF_W, 0),
6541 BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
6542 BPF_MOV64_IMM(BPF_REG_6, 0),
6543 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
6544 BPF_MOV64_IMM(BPF_REG_2, 1),
6545 BPF_MOV64_IMM(BPF_REG_3, 2),
6546 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6547 BPF_FUNC_skb_vlan_push),
6548 BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
6549 BPF_LD_ABS(BPF_B, 0),
6550 BPF_LD_ABS(BPF_H, 0),
6551 BPF_LD_ABS(BPF_W, 0),
6552 BPF_MOV64_IMM(BPF_REG_0, 42),
6553 BPF_EXIT_INSN(),
6554 },
6555 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6556 .result = ACCEPT,
6557 .retval = 42 /* ultimate return value */,
6558 },
6559 {
6560 "ld_ind: check calling conv, r1",
6561 .insns = {
6562 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6563 BPF_MOV64_IMM(BPF_REG_1, 1),
6564 BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
6565 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6566 BPF_EXIT_INSN(),
6567 },
6568 .errstr = "R1 !read_ok",
6569 .result = REJECT,
6570 },
6571 {
6572 "ld_ind: check calling conv, r2",
6573 .insns = {
6574 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6575 BPF_MOV64_IMM(BPF_REG_2, 1),
6576 BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
6577 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6578 BPF_EXIT_INSN(),
6579 },
6580 .errstr = "R2 !read_ok",
6581 .result = REJECT,
6582 },
6583 {
6584 "ld_ind: check calling conv, r3",
6585 .insns = {
6586 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6587 BPF_MOV64_IMM(BPF_REG_3, 1),
6588 BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
6589 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6590 BPF_EXIT_INSN(),
6591 },
6592 .errstr = "R3 !read_ok",
6593 .result = REJECT,
6594 },
6595 {
6596 "ld_ind: check calling conv, r4",
6597 .insns = {
6598 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6599 BPF_MOV64_IMM(BPF_REG_4, 1),
6600 BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
6601 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6602 BPF_EXIT_INSN(),
6603 },
6604 .errstr = "R4 !read_ok",
6605 .result = REJECT,
6606 },
6607 {
6608 "ld_ind: check calling conv, r5",
6609 .insns = {
6610 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6611 BPF_MOV64_IMM(BPF_REG_5, 1),
6612 BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
6613 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6614 BPF_EXIT_INSN(),
6615 },
6616 .errstr = "R5 !read_ok",
6617 .result = REJECT,
6618 },
6619 {
6620 "ld_ind: check calling conv, r7",
6621 .insns = {
6622 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6623 BPF_MOV64_IMM(BPF_REG_7, 1),
6624 BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
6625 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6626 BPF_EXIT_INSN(),
6627 },
6628 .result = ACCEPT,
6629 .retval = 1,
6630 },
6631 {
6632 "check bpf_perf_event_data->sample_period byte load permitted",
6633 .insns = {
6634 BPF_MOV64_IMM(BPF_REG_0, 0),
6635 #if __BYTE_ORDER == __LITTLE_ENDIAN
6636 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6637 offsetof(struct bpf_perf_event_data, sample_period)),
6638 #else
6639 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6640 offsetof(struct bpf_perf_event_data, sample_period) + 7),
6641 #endif
6642 BPF_EXIT_INSN(),
6643 },
6644 .result = ACCEPT,
6645 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6646 },
6647 {
6648 "check bpf_perf_event_data->sample_period half load permitted",
6649 .insns = {
6650 BPF_MOV64_IMM(BPF_REG_0, 0),
6651 #if __BYTE_ORDER == __LITTLE_ENDIAN
6652 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6653 offsetof(struct bpf_perf_event_data, sample_period)),
6654 #else
6655 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6656 offsetof(struct bpf_perf_event_data, sample_period) + 6),
6657 #endif
6658 BPF_EXIT_INSN(),
6659 },
6660 .result = ACCEPT,
6661 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6662 },
6663 {
6664 "check bpf_perf_event_data->sample_period word load permitted",
6665 .insns = {
6666 BPF_MOV64_IMM(BPF_REG_0, 0),
6667 #if __BYTE_ORDER == __LITTLE_ENDIAN
6668 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6669 offsetof(struct bpf_perf_event_data, sample_period)),
6670 #else
6671 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6672 offsetof(struct bpf_perf_event_data, sample_period) + 4),
6673 #endif
6674 BPF_EXIT_INSN(),
6675 },
6676 .result = ACCEPT,
6677 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6678 },
6679 {
6680 "check bpf_perf_event_data->sample_period dword load permitted",
6681 .insns = {
6682 BPF_MOV64_IMM(BPF_REG_0, 0),
6683 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
6684 offsetof(struct bpf_perf_event_data, sample_period)),
6685 BPF_EXIT_INSN(),
6686 },
6687 .result = ACCEPT,
6688 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6689 },
6690 {
6691 "check skb->data half load not permitted",
6692 .insns = {
6693 BPF_MOV64_IMM(BPF_REG_0, 0),
6694 #if __BYTE_ORDER == __LITTLE_ENDIAN
6695 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6696 offsetof(struct __sk_buff, data)),
6697 #else
6698 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6699 offsetof(struct __sk_buff, data) + 2),
6700 #endif
6701 BPF_EXIT_INSN(),
6702 },
6703 .result = REJECT,
6704 .errstr = "invalid bpf_context access",
6705 },
6706 {
6707 "check skb->tc_classid half load not permitted for lwt prog",
6708 .insns = {
6709 BPF_MOV64_IMM(BPF_REG_0, 0),
6710 #if __BYTE_ORDER == __LITTLE_ENDIAN
6711 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6712 offsetof(struct __sk_buff, tc_classid)),
6713 #else
6714 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6715 offsetof(struct __sk_buff, tc_classid) + 2),
6716 #endif
6717 BPF_EXIT_INSN(),
6718 },
6719 .result = REJECT,
6720 .errstr = "invalid bpf_context access",
6721 .prog_type = BPF_PROG_TYPE_LWT_IN,
6722 },
6723 {
6724 "bounds checks mixing signed and unsigned, positive bounds",
6725 .insns = {
6726 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6727 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6728 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6729 BPF_LD_MAP_FD(BPF_REG_1, 0),
6730 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6731 BPF_FUNC_map_lookup_elem),
6732 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6733 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6734 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6735 BPF_MOV64_IMM(BPF_REG_2, 2),
6736 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
6737 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
6738 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6739 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6740 BPF_MOV64_IMM(BPF_REG_0, 0),
6741 BPF_EXIT_INSN(),
6742 },
6743 .fixup_map1 = { 3 },
6744 .errstr = "unbounded min value",
6745 .result = REJECT,
6746 },
6747 {
6748 "bounds checks mixing signed and unsigned",
6749 .insns = {
6750 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6751 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6752 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6753 BPF_LD_MAP_FD(BPF_REG_1, 0),
6754 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6755 BPF_FUNC_map_lookup_elem),
6756 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6757 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6758 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6759 BPF_MOV64_IMM(BPF_REG_2, -1),
6760 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6761 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6762 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6763 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6764 BPF_MOV64_IMM(BPF_REG_0, 0),
6765 BPF_EXIT_INSN(),
6766 },
6767 .fixup_map1 = { 3 },
6768 .errstr = "unbounded min value",
6769 .result = REJECT,
6770 },
6771 {
6772 "bounds checks mixing signed and unsigned, variant 2",
6773 .insns = {
6774 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6775 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6776 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6777 BPF_LD_MAP_FD(BPF_REG_1, 0),
6778 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6779 BPF_FUNC_map_lookup_elem),
6780 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6781 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6782 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6783 BPF_MOV64_IMM(BPF_REG_2, -1),
6784 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6785 BPF_MOV64_IMM(BPF_REG_8, 0),
6786 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
6787 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6788 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6789 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6790 BPF_MOV64_IMM(BPF_REG_0, 0),
6791 BPF_EXIT_INSN(),
6792 },
6793 .fixup_map1 = { 3 },
6794 .errstr = "unbounded min value",
6795 .result = REJECT,
6796 },
6797 {
6798 "bounds checks mixing signed and unsigned, variant 3",
6799 .insns = {
6800 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6801 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6802 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6803 BPF_LD_MAP_FD(BPF_REG_1, 0),
6804 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6805 BPF_FUNC_map_lookup_elem),
6806 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6807 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6808 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6809 BPF_MOV64_IMM(BPF_REG_2, -1),
6810 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
6811 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
6812 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6813 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6814 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6815 BPF_MOV64_IMM(BPF_REG_0, 0),
6816 BPF_EXIT_INSN(),
6817 },
6818 .fixup_map1 = { 3 },
6819 .errstr = "unbounded min value",
6820 .result = REJECT,
6821 },
6822 {
6823 "bounds checks mixing signed and unsigned, variant 4",
6824 .insns = {
6825 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6826 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6827 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6828 BPF_LD_MAP_FD(BPF_REG_1, 0),
6829 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6830 BPF_FUNC_map_lookup_elem),
6831 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6832 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6833 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6834 BPF_MOV64_IMM(BPF_REG_2, 1),
6835 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
6836 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6837 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6838 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6839 BPF_MOV64_IMM(BPF_REG_0, 0),
6840 BPF_EXIT_INSN(),
6841 },
6842 .fixup_map1 = { 3 },
6843 .result = ACCEPT,
6844 },
6845 {
6846 "bounds checks mixing signed and unsigned, variant 5",
6847 .insns = {
6848 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6849 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6850 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6851 BPF_LD_MAP_FD(BPF_REG_1, 0),
6852 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6853 BPF_FUNC_map_lookup_elem),
6854 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6855 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6856 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6857 BPF_MOV64_IMM(BPF_REG_2, -1),
6858 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6859 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
6860 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
6861 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6862 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6863 BPF_MOV64_IMM(BPF_REG_0, 0),
6864 BPF_EXIT_INSN(),
6865 },
6866 .fixup_map1 = { 3 },
6867 .errstr = "unbounded min value",
6868 .result = REJECT,
6869 },
6870 {
6871 "bounds checks mixing signed and unsigned, variant 6",
6872 .insns = {
6873 BPF_MOV64_IMM(BPF_REG_2, 0),
6874 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
6875 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
6876 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6877 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
6878 BPF_MOV64_IMM(BPF_REG_6, -1),
6879 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
6880 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
6881 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
6882 BPF_MOV64_IMM(BPF_REG_5, 0),
6883 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
6884 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6885 BPF_FUNC_skb_load_bytes),
6886 BPF_MOV64_IMM(BPF_REG_0, 0),
6887 BPF_EXIT_INSN(),
6888 },
6889 .errstr = "R4 min value is negative, either use unsigned",
6890 .result = REJECT,
6891 },
6892 {
6893 "bounds checks mixing signed and unsigned, variant 7",
6894 .insns = {
6895 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6896 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6897 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6898 BPF_LD_MAP_FD(BPF_REG_1, 0),
6899 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6900 BPF_FUNC_map_lookup_elem),
6901 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6902 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6903 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6904 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
6905 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6906 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6907 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6908 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6909 BPF_MOV64_IMM(BPF_REG_0, 0),
6910 BPF_EXIT_INSN(),
6911 },
6912 .fixup_map1 = { 3 },
6913 .result = ACCEPT,
6914 },
6915 {
6916 "bounds checks mixing signed and unsigned, variant 8",
6917 .insns = {
6918 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6919 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6920 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6921 BPF_LD_MAP_FD(BPF_REG_1, 0),
6922 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6923 BPF_FUNC_map_lookup_elem),
6924 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6925 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6926 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6927 BPF_MOV64_IMM(BPF_REG_2, -1),
6928 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6929 BPF_MOV64_IMM(BPF_REG_0, 0),
6930 BPF_EXIT_INSN(),
6931 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6932 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6933 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6934 BPF_MOV64_IMM(BPF_REG_0, 0),
6935 BPF_EXIT_INSN(),
6936 },
6937 .fixup_map1 = { 3 },
6938 .errstr = "unbounded min value",
6939 .result = REJECT,
6940 },
6941 {
6942 "bounds checks mixing signed and unsigned, variant 9",
6943 .insns = {
6944 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6945 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6946 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6947 BPF_LD_MAP_FD(BPF_REG_1, 0),
6948 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6949 BPF_FUNC_map_lookup_elem),
6950 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6951 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6952 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6953 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
6954 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6955 BPF_MOV64_IMM(BPF_REG_0, 0),
6956 BPF_EXIT_INSN(),
6957 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6958 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6959 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6960 BPF_MOV64_IMM(BPF_REG_0, 0),
6961 BPF_EXIT_INSN(),
6962 },
6963 .fixup_map1 = { 3 },
6964 .result = ACCEPT,
6965 },
6966 {
6967 "bounds checks mixing signed and unsigned, variant 10",
6968 .insns = {
6969 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6970 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6971 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6972 BPF_LD_MAP_FD(BPF_REG_1, 0),
6973 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6974 BPF_FUNC_map_lookup_elem),
6975 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6976 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6977 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6978 BPF_MOV64_IMM(BPF_REG_2, 0),
6979 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6980 BPF_MOV64_IMM(BPF_REG_0, 0),
6981 BPF_EXIT_INSN(),
6982 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6983 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6984 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6985 BPF_MOV64_IMM(BPF_REG_0, 0),
6986 BPF_EXIT_INSN(),
6987 },
6988 .fixup_map1 = { 3 },
6989 .errstr = "unbounded min value",
6990 .result = REJECT,
6991 },
6992 {
6993 "bounds checks mixing signed and unsigned, variant 11",
6994 .insns = {
6995 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6996 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6998 BPF_LD_MAP_FD(BPF_REG_1, 0),
6999 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7000 BPF_FUNC_map_lookup_elem),
7001 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7002 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7003 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7004 BPF_MOV64_IMM(BPF_REG_2, -1),
7005 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7006 /* Dead branch. */
7007 BPF_MOV64_IMM(BPF_REG_0, 0),
7008 BPF_EXIT_INSN(),
7009 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7010 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7011 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7012 BPF_MOV64_IMM(BPF_REG_0, 0),
7013 BPF_EXIT_INSN(),
7014 },
7015 .fixup_map1 = { 3 },
7016 .errstr = "unbounded min value",
7017 .result = REJECT,
7018 },
7019 {
7020 "bounds checks mixing signed and unsigned, variant 12",
7021 .insns = {
7022 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7023 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7024 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7025 BPF_LD_MAP_FD(BPF_REG_1, 0),
7026 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7027 BPF_FUNC_map_lookup_elem),
7028 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7029 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7030 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7031 BPF_MOV64_IMM(BPF_REG_2, -6),
7032 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7033 BPF_MOV64_IMM(BPF_REG_0, 0),
7034 BPF_EXIT_INSN(),
7035 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7036 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7037 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7038 BPF_MOV64_IMM(BPF_REG_0, 0),
7039 BPF_EXIT_INSN(),
7040 },
7041 .fixup_map1 = { 3 },
7042 .errstr = "unbounded min value",
7043 .result = REJECT,
7044 },
7045 {
7046 "bounds checks mixing signed and unsigned, variant 13",
7047 .insns = {
7048 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7049 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7050 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7051 BPF_LD_MAP_FD(BPF_REG_1, 0),
7052 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7053 BPF_FUNC_map_lookup_elem),
7054 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7055 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7056 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7057 BPF_MOV64_IMM(BPF_REG_2, 2),
7058 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7059 BPF_MOV64_IMM(BPF_REG_7, 1),
7060 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
7061 BPF_MOV64_IMM(BPF_REG_0, 0),
7062 BPF_EXIT_INSN(),
7063 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
7064 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
7065 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
7066 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7067 BPF_MOV64_IMM(BPF_REG_0, 0),
7068 BPF_EXIT_INSN(),
7069 },
7070 .fixup_map1 = { 3 },
7071 .errstr = "unbounded min value",
7072 .result = REJECT,
7073 },
7074 {
7075 "bounds checks mixing signed and unsigned, variant 14",
7076 .insns = {
7077 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
7078 offsetof(struct __sk_buff, mark)),
7079 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7080 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7081 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7082 BPF_LD_MAP_FD(BPF_REG_1, 0),
7083 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7084 BPF_FUNC_map_lookup_elem),
7085 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7086 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7087 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7088 BPF_MOV64_IMM(BPF_REG_2, -1),
7089 BPF_MOV64_IMM(BPF_REG_8, 2),
7090 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
7091 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
7092 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7093 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7094 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7095 BPF_MOV64_IMM(BPF_REG_0, 0),
7096 BPF_EXIT_INSN(),
7097 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
7098 BPF_JMP_IMM(BPF_JA, 0, 0, -7),
7099 },
7100 .fixup_map1 = { 4 },
7101 .errstr = "R0 invalid mem access 'inv'",
7102 .result = REJECT,
7103 },
7104 {
7105 "bounds checks mixing signed and unsigned, variant 15",
7106 .insns = {
7107 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7108 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7109 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7110 BPF_LD_MAP_FD(BPF_REG_1, 0),
7111 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7112 BPF_FUNC_map_lookup_elem),
7113 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7114 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7115 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7116 BPF_MOV64_IMM(BPF_REG_2, -6),
7117 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7118 BPF_MOV64_IMM(BPF_REG_0, 0),
7119 BPF_EXIT_INSN(),
7120 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7121 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
7122 BPF_MOV64_IMM(BPF_REG_0, 0),
7123 BPF_EXIT_INSN(),
7124 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7125 BPF_MOV64_IMM(BPF_REG_0, 0),
7126 BPF_EXIT_INSN(),
7127 },
7128 .fixup_map1 = { 3 },
7129 .errstr = "unbounded min value",
7130 .result = REJECT,
7131 .result_unpriv = REJECT,
7132 },
7133 {
7134 "subtraction bounds (map value) variant 1",
7135 .insns = {
7136 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7137 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7138 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7139 BPF_LD_MAP_FD(BPF_REG_1, 0),
7140 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7141 BPF_FUNC_map_lookup_elem),
7142 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7143 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7144 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
7145 BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7146 BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
7147 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7148 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
7149 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7150 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7151 BPF_EXIT_INSN(),
7152 BPF_MOV64_IMM(BPF_REG_0, 0),
7153 BPF_EXIT_INSN(),
7154 },
7155 .fixup_map1 = { 3 },
7156 .errstr = "R0 max value is outside of the array range",
7157 .result = REJECT,
7158 },
7159 {
7160 "subtraction bounds (map value) variant 2",
7161 .insns = {
7162 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7163 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7164 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7165 BPF_LD_MAP_FD(BPF_REG_1, 0),
7166 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7167 BPF_FUNC_map_lookup_elem),
7168 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7169 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7170 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
7171 BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7172 BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
7173 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7174 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7175 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7176 BPF_EXIT_INSN(),
7177 BPF_MOV64_IMM(BPF_REG_0, 0),
7178 BPF_EXIT_INSN(),
7179 },
7180 .fixup_map1 = { 3 },
7181 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
7182 .result = REJECT,
7183 },
7184 {
7185 "bounds check based on zero-extended MOV",
7186 .insns = {
7187 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7188 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7189 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7190 BPF_LD_MAP_FD(BPF_REG_1, 0),
7191 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7192 BPF_FUNC_map_lookup_elem),
7193 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7194 /* r2 = 0x0000'0000'ffff'ffff */
7195 BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
7196 /* r2 = 0 */
7197 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7198 /* no-op */
7199 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7200 /* access at offset 0 */
7201 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7202 /* exit */
7203 BPF_MOV64_IMM(BPF_REG_0, 0),
7204 BPF_EXIT_INSN(),
7205 },
7206 .fixup_map1 = { 3 },
7207 .result = ACCEPT
7208 },
7209 {
7210 "bounds check based on sign-extended MOV. test1",
7211 .insns = {
7212 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7213 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7215 BPF_LD_MAP_FD(BPF_REG_1, 0),
7216 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7217 BPF_FUNC_map_lookup_elem),
7218 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7219 /* r2 = 0xffff'ffff'ffff'ffff */
7220 BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7221 /* r2 = 0xffff'ffff */
7222 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7223 /* r0 = <oob pointer> */
7224 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7225 /* access to OOB pointer */
7226 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7227 /* exit */
7228 BPF_MOV64_IMM(BPF_REG_0, 0),
7229 BPF_EXIT_INSN(),
7230 },
7231 .fixup_map1 = { 3 },
7232 .errstr = "map_value pointer and 4294967295",
7233 .result = REJECT
7234 },
7235 {
7236 "bounds check based on sign-extended MOV. test2",
7237 .insns = {
7238 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7239 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7240 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7241 BPF_LD_MAP_FD(BPF_REG_1, 0),
7242 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7243 BPF_FUNC_map_lookup_elem),
7244 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7245 /* r2 = 0xffff'ffff'ffff'ffff */
7246 BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7247 /* r2 = 0xfff'ffff */
7248 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
7249 /* r0 = <oob pointer> */
7250 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7251 /* access to OOB pointer */
7252 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7253 /* exit */
7254 BPF_MOV64_IMM(BPF_REG_0, 0),
7255 BPF_EXIT_INSN(),
7256 },
7257 .fixup_map1 = { 3 },
7258 .errstr = "R0 min value is outside of the array range",
7259 .result = REJECT
7260 },
7261 {
7262 "bounds check based on reg_off + var_off + insn_off. test1",
7263 .insns = {
7264 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7265 offsetof(struct __sk_buff, mark)),
7266 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7267 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7268 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7269 BPF_LD_MAP_FD(BPF_REG_1, 0),
7270 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7271 BPF_FUNC_map_lookup_elem),
7272 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7273 BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7274 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
7275 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7276 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7277 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7278 BPF_MOV64_IMM(BPF_REG_0, 0),
7279 BPF_EXIT_INSN(),
7280 },
7281 .fixup_map1 = { 4 },
7282 .errstr = "value_size=8 off=1073741825",
7283 .result = REJECT,
7284 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7285 },
7286 {
7287 "bounds check based on reg_off + var_off + insn_off. test2",
7288 .insns = {
7289 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7290 offsetof(struct __sk_buff, mark)),
7291 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7292 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7293 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7294 BPF_LD_MAP_FD(BPF_REG_1, 0),
7295 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7296 BPF_FUNC_map_lookup_elem),
7297 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7298 BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7299 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
7300 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7301 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7302 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7303 BPF_MOV64_IMM(BPF_REG_0, 0),
7304 BPF_EXIT_INSN(),
7305 },
7306 .fixup_map1 = { 4 },
7307 .errstr = "value 1073741823",
7308 .result = REJECT,
7309 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7310 },
7311 {
7312 "bounds check after truncation of non-boundary-crossing range",
7313 .insns = {
7314 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7315 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7316 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7317 BPF_LD_MAP_FD(BPF_REG_1, 0),
7318 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7319 BPF_FUNC_map_lookup_elem),
7320 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7321 /* r1 = [0x00, 0xff] */
7322 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7323 BPF_MOV64_IMM(BPF_REG_2, 1),
7324 /* r2 = 0x10'0000'0000 */
7325 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
7326 /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
7327 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
7328 /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
7329 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7330 /* r1 = [0x00, 0xff] */
7331 BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
7332 /* r1 = 0 */
7333 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7334 /* no-op */
7335 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7336 /* access at offset 0 */
7337 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7338 /* exit */
7339 BPF_MOV64_IMM(BPF_REG_0, 0),
7340 BPF_EXIT_INSN(),
7341 },
7342 .fixup_map1 = { 3 },
7343 .result = ACCEPT
7344 },
7345 {
7346 "bounds check after truncation of boundary-crossing range (1)",
7347 .insns = {
7348 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7349 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7351 BPF_LD_MAP_FD(BPF_REG_1, 0),
7352 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7353 BPF_FUNC_map_lookup_elem),
7354 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7355 /* r1 = [0x00, 0xff] */
7356 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7357 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7358 /* r1 = [0xffff'ff80, 0x1'0000'007f] */
7359 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7360 /* r1 = [0xffff'ff80, 0xffff'ffff] or
7361 * [0x0000'0000, 0x0000'007f]
7362 */
7363 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
7364 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7365 /* r1 = [0x00, 0xff] or
7366 * [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
7367 */
7368 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7369 /* r1 = 0 or
7370 * [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
7371 */
7372 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7373 /* no-op or OOB pointer computation */
7374 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7375 /* potentially OOB access */
7376 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7377 /* exit */
7378 BPF_MOV64_IMM(BPF_REG_0, 0),
7379 BPF_EXIT_INSN(),
7380 },
7381 .fixup_map1 = { 3 },
7382 /* not actually fully unbounded, but the bound is very high */
7383 .errstr = "R0 unbounded memory access",
7384 .result = REJECT
7385 },
7386 {
7387 "bounds check after truncation of boundary-crossing range (2)",
7388 .insns = {
7389 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7390 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7391 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7392 BPF_LD_MAP_FD(BPF_REG_1, 0),
7393 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7394 BPF_FUNC_map_lookup_elem),
7395 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7396 /* r1 = [0x00, 0xff] */
7397 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7399 /* r1 = [0xffff'ff80, 0x1'0000'007f] */
7400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7401 /* r1 = [0xffff'ff80, 0xffff'ffff] or
7402 * [0x0000'0000, 0x0000'007f]
7403 * difference to previous test: truncation via MOV32
7404 * instead of ALU32.
7405 */
7406 BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
7407 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7408 /* r1 = [0x00, 0xff] or
7409 * [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
7410 */
7411 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7412 /* r1 = 0 or
7413 * [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
7414 */
7415 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7416 /* no-op or OOB pointer computation */
7417 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7418 /* potentially OOB access */
7419 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7420 /* exit */
7421 BPF_MOV64_IMM(BPF_REG_0, 0),
7422 BPF_EXIT_INSN(),
7423 },
7424 .fixup_map1 = { 3 },
7425 /* not actually fully unbounded, but the bound is very high */
7426 .errstr = "R0 unbounded memory access",
7427 .result = REJECT
7428 },
7429 {
7430 "bounds check after wrapping 32-bit addition",
7431 .insns = {
7432 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7433 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7434 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7435 BPF_LD_MAP_FD(BPF_REG_1, 0),
7436 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7437 BPF_FUNC_map_lookup_elem),
7438 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7439 /* r1 = 0x7fff'ffff */
7440 BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
7441 /* r1 = 0xffff'fffe */
7442 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7443 /* r1 = 0 */
7444 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
7445 /* no-op */
7446 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7447 /* access at offset 0 */
7448 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7449 /* exit */
7450 BPF_MOV64_IMM(BPF_REG_0, 0),
7451 BPF_EXIT_INSN(),
7452 },
7453 .fixup_map1 = { 3 },
7454 .result = ACCEPT
7455 },
7456 {
7457 "bounds check after shift with oversized count operand",
7458 .insns = {
7459 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7460 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7461 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7462 BPF_LD_MAP_FD(BPF_REG_1, 0),
7463 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7464 BPF_FUNC_map_lookup_elem),
7465 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7466 BPF_MOV64_IMM(BPF_REG_2, 32),
7467 BPF_MOV64_IMM(BPF_REG_1, 1),
7468 /* r1 = (u32)1 << (u32)32 = ? */
7469 BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
7470 /* r1 = [0x0000, 0xffff] */
7471 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
7472 /* computes unknown pointer, potentially OOB */
7473 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7474 /* potentially OOB access */
7475 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7476 /* exit */
7477 BPF_MOV64_IMM(BPF_REG_0, 0),
7478 BPF_EXIT_INSN(),
7479 },
7480 .fixup_map1 = { 3 },
7481 .errstr = "R0 max value is outside of the array range",
7482 .result = REJECT
7483 },
7484 {
7485 "bounds check after right shift of maybe-negative number",
7486 .insns = {
7487 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7488 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7489 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7490 BPF_LD_MAP_FD(BPF_REG_1, 0),
7491 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7492 BPF_FUNC_map_lookup_elem),
7493 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7494 /* r1 = [0x00, 0xff] */
7495 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7496 /* r1 = [-0x01, 0xfe] */
7497 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
7498 /* r1 = 0 or 0xff'ffff'ffff'ffff */
7499 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7500 /* r1 = 0 or 0xffff'ffff'ffff */
7501 BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7502 /* computes unknown pointer, potentially OOB */
7503 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7504 /* potentially OOB access */
7505 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7506 /* exit */
7507 BPF_MOV64_IMM(BPF_REG_0, 0),
7508 BPF_EXIT_INSN(),
7509 },
7510 .fixup_map1 = { 3 },
7511 .errstr = "R0 unbounded memory access",
7512 .result = REJECT
7513 },
7514 {
7515 "bounds check map access with off+size signed 32bit overflow. test1",
7516 .insns = {
7517 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7518 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7519 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7520 BPF_LD_MAP_FD(BPF_REG_1, 0),
7521 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7522 BPF_FUNC_map_lookup_elem),
7523 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7524 BPF_EXIT_INSN(),
7525 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
7526 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7527 BPF_JMP_A(0),
7528 BPF_EXIT_INSN(),
7529 },
7530 .fixup_map1 = { 3 },
7531 .errstr = "map_value pointer and 2147483646",
7532 .result = REJECT
7533 },
7534 {
7535 "bounds check map access with off+size signed 32bit overflow. test2",
7536 .insns = {
7537 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7538 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7539 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7540 BPF_LD_MAP_FD(BPF_REG_1, 0),
7541 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7542 BPF_FUNC_map_lookup_elem),
7543 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7544 BPF_EXIT_INSN(),
7545 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7546 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7547 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7548 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7549 BPF_JMP_A(0),
7550 BPF_EXIT_INSN(),
7551 },
7552 .fixup_map1 = { 3 },
7553 .errstr = "pointer offset 1073741822",
7554 .result = REJECT
7555 },
7556 {
7557 "bounds check map access with off+size signed 32bit overflow. test3",
7558 .insns = {
7559 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7560 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7561 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7562 BPF_LD_MAP_FD(BPF_REG_1, 0),
7563 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7564 BPF_FUNC_map_lookup_elem),
7565 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7566 BPF_EXIT_INSN(),
7567 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7568 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7569 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7570 BPF_JMP_A(0),
7571 BPF_EXIT_INSN(),
7572 },
7573 .fixup_map1 = { 3 },
7574 .errstr = "pointer offset -1073741822",
7575 .result = REJECT
7576 },
7577 {
7578 "bounds check map access with off+size signed 32bit overflow. test4",
7579 .insns = {
7580 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7581 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7582 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7583 BPF_LD_MAP_FD(BPF_REG_1, 0),
7584 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7585 BPF_FUNC_map_lookup_elem),
7586 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7587 BPF_EXIT_INSN(),
7588 BPF_MOV64_IMM(BPF_REG_1, 1000000),
7589 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
7590 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7591 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7592 BPF_JMP_A(0),
7593 BPF_EXIT_INSN(),
7594 },
7595 .fixup_map1 = { 3 },
7596 .errstr = "map_value pointer and 1000000000000",
7597 .result = REJECT
7598 },
7599 {
7600 "pointer/scalar confusion in state equality check (way 1)",
7601 .insns = {
7602 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7603 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7604 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7605 BPF_LD_MAP_FD(BPF_REG_1, 0),
7606 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7607 BPF_FUNC_map_lookup_elem),
7608 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7609 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7610 BPF_JMP_A(1),
7611 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7612 BPF_JMP_A(0),
7613 BPF_EXIT_INSN(),
7614 },
7615 .fixup_map1 = { 3 },
7616 .result = ACCEPT,
7617 .retval = POINTER_VALUE,
7618 .result_unpriv = REJECT,
7619 .errstr_unpriv = "R0 leaks addr as return value"
7620 },
7621 {
7622 "pointer/scalar confusion in state equality check (way 2)",
7623 .insns = {
7624 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7625 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7626 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7627 BPF_LD_MAP_FD(BPF_REG_1, 0),
7628 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7629 BPF_FUNC_map_lookup_elem),
7630 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
7631 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7632 BPF_JMP_A(1),
7633 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7634 BPF_EXIT_INSN(),
7635 },
7636 .fixup_map1 = { 3 },
7637 .result = ACCEPT,
7638 .retval = POINTER_VALUE,
7639 .result_unpriv = REJECT,
7640 .errstr_unpriv = "R0 leaks addr as return value"
7641 },
7642 {
7643 "variable-offset ctx access",
7644 .insns = {
7645 /* Get an unknown value */
7646 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7647 /* Make it small and 4-byte aligned */
7648 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7649 /* add it to skb. We now have either &skb->len or
7650 * &skb->pkt_type, but we don't know which
7651 */
7652 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
7653 /* dereference it */
7654 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7655 BPF_EXIT_INSN(),
7656 },
7657 .errstr = "variable ctx access var_off=(0x0; 0x4)",
7658 .result = REJECT,
7659 .prog_type = BPF_PROG_TYPE_LWT_IN,
7660 },
7661 {
7662 "variable-offset stack access",
7663 .insns = {
7664 /* Fill the top 8 bytes of the stack */
7665 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7666 /* Get an unknown value */
7667 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7668 /* Make it small and 4-byte aligned */
7669 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7670 BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7671 /* add it to fp. We now have either fp-4 or fp-8, but
7672 * we don't know which
7673 */
7674 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7675 /* dereference it */
7676 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
7677 BPF_EXIT_INSN(),
7678 },
7679 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
7680 .result = REJECT,
7681 .prog_type = BPF_PROG_TYPE_LWT_IN,
7682 },
7683 {
7684 "indirect variable-offset stack access",
7685 .insns = {
7686 /* Fill the top 8 bytes of the stack */
7687 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7688 /* Get an unknown value */
7689 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7690 /* Make it small and 4-byte aligned */
7691 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7692 BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7693 /* add it to fp. We now have either fp-4 or fp-8, but
7694 * we don't know which
7695 */
7696 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7697 /* dereference it indirectly */
7698 BPF_LD_MAP_FD(BPF_REG_1, 0),
7699 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7700 BPF_FUNC_map_lookup_elem),
7701 BPF_MOV64_IMM(BPF_REG_0, 0),
7702 BPF_EXIT_INSN(),
7703 },
7704 .fixup_map1 = { 5 },
7705 .errstr = "variable stack read R2",
7706 .result = REJECT,
7707 .prog_type = BPF_PROG_TYPE_LWT_IN,
7708 },
7709 {
7710 "direct stack access with 32-bit wraparound. test1",
7711 .insns = {
7712 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7713 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7714 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7715 BPF_MOV32_IMM(BPF_REG_0, 0),
7716 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7717 BPF_EXIT_INSN()
7718 },
7719 .errstr = "fp pointer and 2147483647",
7720 .result = REJECT
7721 },
7722 {
7723 "direct stack access with 32-bit wraparound. test2",
7724 .insns = {
7725 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7727 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7728 BPF_MOV32_IMM(BPF_REG_0, 0),
7729 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7730 BPF_EXIT_INSN()
7731 },
7732 .errstr = "fp pointer and 1073741823",
7733 .result = REJECT
7734 },
7735 {
7736 "direct stack access with 32-bit wraparound. test3",
7737 .insns = {
7738 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7739 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7740 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7741 BPF_MOV32_IMM(BPF_REG_0, 0),
7742 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7743 BPF_EXIT_INSN()
7744 },
7745 .errstr = "fp pointer offset 1073741822",
7746 .result = REJECT
7747 },
7748 {
7749 "liveness pruning and write screening",
7750 .insns = {
7751 /* Get an unknown value */
7752 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7753 /* branch conditions teach us nothing about R2 */
7754 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7755 BPF_MOV64_IMM(BPF_REG_0, 0),
7756 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7757 BPF_MOV64_IMM(BPF_REG_0, 0),
7758 BPF_EXIT_INSN(),
7759 },
7760 .errstr = "R0 !read_ok",
7761 .result = REJECT,
7762 .prog_type = BPF_PROG_TYPE_LWT_IN,
7763 },
7764 {
7765 "varlen_map_value_access pruning",
7766 .insns = {
7767 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7768 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7769 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7770 BPF_LD_MAP_FD(BPF_REG_1, 0),
7771 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7772 BPF_FUNC_map_lookup_elem),
7773 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7774 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
7775 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
7776 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
7777 BPF_MOV32_IMM(BPF_REG_1, 0),
7778 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
7779 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7780 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
7781 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7782 offsetof(struct test_val, foo)),
7783 BPF_EXIT_INSN(),
7784 },
7785 .fixup_map2 = { 3 },
7786 .errstr_unpriv = "R0 leaks addr",
7787 .errstr = "R0 unbounded memory access",
7788 .result_unpriv = REJECT,
7789 .result = REJECT,
7790 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7791 },
7792 {
7793 "invalid 64-bit BPF_END",
7794 .insns = {
7795 BPF_MOV32_IMM(BPF_REG_0, 0),
7796 {
7797 .code = BPF_ALU64 | BPF_END | BPF_TO_LE,
7798 .dst_reg = BPF_REG_0,
7799 .src_reg = 0,
7800 .off = 0,
7801 .imm = 32,
7802 },
7803 BPF_EXIT_INSN(),
7804 },
7805 .errstr = "unknown opcode d7",
7806 .result = REJECT,
7807 },
7808 {
7809 "XDP, using ifindex from netdev",
7810 .insns = {
7811 BPF_MOV64_IMM(BPF_REG_0, 0),
7812 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7813 offsetof(struct xdp_md, ingress_ifindex)),
7814 BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
7815 BPF_MOV64_IMM(BPF_REG_0, 1),
7816 BPF_EXIT_INSN(),
7817 },
7818 .result = ACCEPT,
7819 .prog_type = BPF_PROG_TYPE_XDP,
7820 .retval = 1,
7821 },
7822 {
7823 "meta access, test1",
7824 .insns = {
7825 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7826 offsetof(struct xdp_md, data_meta)),
7827 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7828 offsetof(struct xdp_md, data)),
7829 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7830 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7831 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
7832 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7833 BPF_MOV64_IMM(BPF_REG_0, 0),
7834 BPF_EXIT_INSN(),
7835 },
7836 .result = ACCEPT,
7837 .prog_type = BPF_PROG_TYPE_XDP,
7838 },
7839 {
7840 "meta access, test2",
7841 .insns = {
7842 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7843 offsetof(struct xdp_md, data_meta)),
7844 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7845 offsetof(struct xdp_md, data)),
7846 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7847 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
7848 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7849 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
7850 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
7851 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7852 BPF_MOV64_IMM(BPF_REG_0, 0),
7853 BPF_EXIT_INSN(),
7854 },
7855 .result = REJECT,
7856 .errstr = "invalid access to packet, off=-8",
7857 .prog_type = BPF_PROG_TYPE_XDP,
7858 },
7859 {
7860 "meta access, test3",
7861 .insns = {
7862 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7863 offsetof(struct xdp_md, data_meta)),
7864 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7865 offsetof(struct xdp_md, data_end)),
7866 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7867 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7868 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
7869 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7870 BPF_MOV64_IMM(BPF_REG_0, 0),
7871 BPF_EXIT_INSN(),
7872 },
7873 .result = REJECT,
7874 .errstr = "invalid access to packet",
7875 .prog_type = BPF_PROG_TYPE_XDP,
7876 },
7877 {
7878 "meta access, test4",
7879 .insns = {
7880 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7881 offsetof(struct xdp_md, data_meta)),
7882 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7883 offsetof(struct xdp_md, data_end)),
7884 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
7885 offsetof(struct xdp_md, data)),
7886 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7887 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7888 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
7889 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7890 BPF_MOV64_IMM(BPF_REG_0, 0),
7891 BPF_EXIT_INSN(),
7892 },
7893 .result = REJECT,
7894 .errstr = "invalid access to packet",
7895 .prog_type = BPF_PROG_TYPE_XDP,
7896 },
7897 {
7898 "meta access, test5",
7899 .insns = {
7900 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7901 offsetof(struct xdp_md, data_meta)),
7902 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
7903 offsetof(struct xdp_md, data)),
7904 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7905 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7906 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
7907 BPF_MOV64_IMM(BPF_REG_2, -8),
7908 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7909 BPF_FUNC_xdp_adjust_meta),
7910 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
7911 BPF_MOV64_IMM(BPF_REG_0, 0),
7912 BPF_EXIT_INSN(),
7913 },
7914 .result = REJECT,
7915 .errstr = "R3 !read_ok",
7916 .prog_type = BPF_PROG_TYPE_XDP,
7917 },
7918 {
7919 "meta access, test6",
7920 .insns = {
7921 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7922 offsetof(struct xdp_md, data_meta)),
7923 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7924 offsetof(struct xdp_md, data)),
7925 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7926 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7927 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7928 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
7929 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
7930 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7931 BPF_MOV64_IMM(BPF_REG_0, 0),
7932 BPF_EXIT_INSN(),
7933 },
7934 .result = REJECT,
7935 .errstr = "invalid access to packet",
7936 .prog_type = BPF_PROG_TYPE_XDP,
7937 },
7938 {
7939 "meta access, test7",
7940 .insns = {
7941 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7942 offsetof(struct xdp_md, data_meta)),
7943 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7944 offsetof(struct xdp_md, data)),
7945 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7946 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7947 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7948 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
7949 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
7950 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7951 BPF_MOV64_IMM(BPF_REG_0, 0),
7952 BPF_EXIT_INSN(),
7953 },
7954 .result = ACCEPT,
7955 .prog_type = BPF_PROG_TYPE_XDP,
7956 },
7957 {
7958 "meta access, test8",
7959 .insns = {
7960 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7961 offsetof(struct xdp_md, data_meta)),
7962 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7963 offsetof(struct xdp_md, data)),
7964 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7965 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
7966 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
7967 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7968 BPF_MOV64_IMM(BPF_REG_0, 0),
7969 BPF_EXIT_INSN(),
7970 },
7971 .result = ACCEPT,
7972 .prog_type = BPF_PROG_TYPE_XDP,
7973 },
7974 {
7975 "meta access, test9",
7976 .insns = {
7977 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7978 offsetof(struct xdp_md, data_meta)),
7979 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7980 offsetof(struct xdp_md, data)),
7981 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7982 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
7983 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
7984 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
7985 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7986 BPF_MOV64_IMM(BPF_REG_0, 0),
7987 BPF_EXIT_INSN(),
7988 },
7989 .result = REJECT,
7990 .errstr = "invalid access to packet",
7991 .prog_type = BPF_PROG_TYPE_XDP,
7992 },
7993 {
7994 "meta access, test10",
7995 .insns = {
7996 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7997 offsetof(struct xdp_md, data_meta)),
7998 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7999 offsetof(struct xdp_md, data)),
8000 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8001 offsetof(struct xdp_md, data_end)),
8002 BPF_MOV64_IMM(BPF_REG_5, 42),
8003 BPF_MOV64_IMM(BPF_REG_6, 24),
8004 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8005 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8006 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8007 BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8008 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
8009 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8010 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8012 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
8013 BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
8014 BPF_MOV64_IMM(BPF_REG_0, 0),
8015 BPF_EXIT_INSN(),
8016 },
8017 .result = REJECT,
8018 .errstr = "invalid access to packet",
8019 .prog_type = BPF_PROG_TYPE_XDP,
8020 },
8021 {
8022 "meta access, test11",
8023 .insns = {
8024 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8025 offsetof(struct xdp_md, data_meta)),
8026 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8027 offsetof(struct xdp_md, data)),
8028 BPF_MOV64_IMM(BPF_REG_5, 42),
8029 BPF_MOV64_IMM(BPF_REG_6, 24),
8030 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8031 BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8032 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8033 BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8034 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
8035 BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8036 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8037 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8038 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
8039 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
8040 BPF_MOV64_IMM(BPF_REG_0, 0),
8041 BPF_EXIT_INSN(),
8042 },
8043 .result = ACCEPT,
8044 .prog_type = BPF_PROG_TYPE_XDP,
8045 },
8046 {
8047 "meta access, test12",
8048 .insns = {
8049 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8050 offsetof(struct xdp_md, data_meta)),
8051 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8052 offsetof(struct xdp_md, data)),
8053 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8054 offsetof(struct xdp_md, data_end)),
8055 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8056 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8057 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
8058 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8059 BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8060 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8061 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
8062 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8063 BPF_MOV64_IMM(BPF_REG_0, 0),
8064 BPF_EXIT_INSN(),
8065 },
8066 .result = ACCEPT,
8067 .prog_type = BPF_PROG_TYPE_XDP,
8068 },
8069 {
8070 "arithmetic ops make PTR_TO_CTX unusable",
8071 .insns = {
8072 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
8073 offsetof(struct __sk_buff, data) -
8074 offsetof(struct __sk_buff, mark)),
8075 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8076 offsetof(struct __sk_buff, mark)),
8077 BPF_EXIT_INSN(),
8078 },
8079 .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
8080 .result = REJECT,
8081 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8082 },
8083 {
8084 "pkt_end - pkt_start is allowed",
8085 .insns = {
8086 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8087 offsetof(struct __sk_buff, data_end)),
8088 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8089 offsetof(struct __sk_buff, data)),
8090 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
8091 BPF_EXIT_INSN(),
8092 },
8093 .result = ACCEPT,
8094 .retval = TEST_DATA_LEN,
8095 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8096 },
8097 {
8098 "XDP pkt read, pkt_end mangling, bad access 1",
8099 .insns = {
8100 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8101 offsetof(struct xdp_md, data)),
8102 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8103 offsetof(struct xdp_md, data_end)),
8104 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8105 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8106 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
8107 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8108 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8109 BPF_MOV64_IMM(BPF_REG_0, 0),
8110 BPF_EXIT_INSN(),
8111 },
8112 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8113 .result = REJECT,
8114 .prog_type = BPF_PROG_TYPE_XDP,
8115 },
8116 {
8117 "XDP pkt read, pkt_end mangling, bad access 2",
8118 .insns = {
8119 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8120 offsetof(struct xdp_md, data)),
8121 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8122 offsetof(struct xdp_md, data_end)),
8123 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8124 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8125 BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
8126 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8127 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8128 BPF_MOV64_IMM(BPF_REG_0, 0),
8129 BPF_EXIT_INSN(),
8130 },
8131 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8132 .result = REJECT,
8133 .prog_type = BPF_PROG_TYPE_XDP,
8134 },
8135 {
8136 "XDP pkt read, pkt_data' > pkt_end, good access",
8137 .insns = {
8138 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8139 offsetof(struct xdp_md, data)),
8140 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8141 offsetof(struct xdp_md, data_end)),
8142 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8143 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8144 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8145 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8146 BPF_MOV64_IMM(BPF_REG_0, 0),
8147 BPF_EXIT_INSN(),
8148 },
8149 .result = ACCEPT,
8150 .prog_type = BPF_PROG_TYPE_XDP,
8151 },
8152 {
8153 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
8154 .insns = {
8155 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8156 offsetof(struct xdp_md, data)),
8157 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8158 offsetof(struct xdp_md, data_end)),
8159 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8161 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8162 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8163 BPF_MOV64_IMM(BPF_REG_0, 0),
8164 BPF_EXIT_INSN(),
8165 },
8166 .errstr = "R1 offset is outside of the packet",
8167 .result = REJECT,
8168 .prog_type = BPF_PROG_TYPE_XDP,
8169 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8170 },
8171 {
8172 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
8173 .insns = {
8174 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8175 offsetof(struct xdp_md, data)),
8176 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8177 offsetof(struct xdp_md, data_end)),
8178 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8179 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8180 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8181 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8182 BPF_MOV64_IMM(BPF_REG_0, 0),
8183 BPF_EXIT_INSN(),
8184 },
8185 .errstr = "R1 offset is outside of the packet",
8186 .result = REJECT,
8187 .prog_type = BPF_PROG_TYPE_XDP,
8188 },
8189 {
8190 "XDP pkt read, pkt_end > pkt_data', good access",
8191 .insns = {
8192 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8193 offsetof(struct xdp_md, data)),
8194 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8195 offsetof(struct xdp_md, data_end)),
8196 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8197 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8198 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8199 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8200 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8201 BPF_MOV64_IMM(BPF_REG_0, 0),
8202 BPF_EXIT_INSN(),
8203 },
8204 .result = ACCEPT,
8205 .prog_type = BPF_PROG_TYPE_XDP,
8206 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8207 },
8208 {
8209 "XDP pkt read, pkt_end > pkt_data', bad access 1",
8210 .insns = {
8211 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8212 offsetof(struct xdp_md, data)),
8213 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8214 offsetof(struct xdp_md, data_end)),
8215 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8216 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8217 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8218 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8219 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8220 BPF_MOV64_IMM(BPF_REG_0, 0),
8221 BPF_EXIT_INSN(),
8222 },
8223 .errstr = "R1 offset is outside of the packet",
8224 .result = REJECT,
8225 .prog_type = BPF_PROG_TYPE_XDP,
8226 },
8227 {
8228 "XDP pkt read, pkt_end > pkt_data', bad access 2",
8229 .insns = {
8230 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8231 offsetof(struct xdp_md, data)),
8232 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8233 offsetof(struct xdp_md, data_end)),
8234 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8235 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8236 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8237 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8238 BPF_MOV64_IMM(BPF_REG_0, 0),
8239 BPF_EXIT_INSN(),
8240 },
8241 .errstr = "R1 offset is outside of the packet",
8242 .result = REJECT,
8243 .prog_type = BPF_PROG_TYPE_XDP,
8244 },
8245 {
8246 "XDP pkt read, pkt_data' < pkt_end, good access",
8247 .insns = {
8248 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8249 offsetof(struct xdp_md, data)),
8250 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8251 offsetof(struct xdp_md, data_end)),
8252 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8254 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8255 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8256 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8257 BPF_MOV64_IMM(BPF_REG_0, 0),
8258 BPF_EXIT_INSN(),
8259 },
8260 .result = ACCEPT,
8261 .prog_type = BPF_PROG_TYPE_XDP,
8262 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8263 },
8264 {
8265 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
8266 .insns = {
8267 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8268 offsetof(struct xdp_md, data)),
8269 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8270 offsetof(struct xdp_md, data_end)),
8271 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8272 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8273 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8274 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8275 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8276 BPF_MOV64_IMM(BPF_REG_0, 0),
8277 BPF_EXIT_INSN(),
8278 },
8279 .errstr = "R1 offset is outside of the packet",
8280 .result = REJECT,
8281 .prog_type = BPF_PROG_TYPE_XDP,
8282 },
8283 {
8284 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
8285 .insns = {
8286 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8287 offsetof(struct xdp_md, data)),
8288 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8289 offsetof(struct xdp_md, data_end)),
8290 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8291 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8292 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8293 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8294 BPF_MOV64_IMM(BPF_REG_0, 0),
8295 BPF_EXIT_INSN(),
8296 },
8297 .errstr = "R1 offset is outside of the packet",
8298 .result = REJECT,
8299 .prog_type = BPF_PROG_TYPE_XDP,
8300 },
8301 {
8302 "XDP pkt read, pkt_end < pkt_data', good access",
8303 .insns = {
8304 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8305 offsetof(struct xdp_md, data)),
8306 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8307 offsetof(struct xdp_md, data_end)),
8308 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8309 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8310 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8311 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8312 BPF_MOV64_IMM(BPF_REG_0, 0),
8313 BPF_EXIT_INSN(),
8314 },
8315 .result = ACCEPT,
8316 .prog_type = BPF_PROG_TYPE_XDP,
8317 },
8318 {
8319 "XDP pkt read, pkt_end < pkt_data', bad access 1",
8320 .insns = {
8321 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8322 offsetof(struct xdp_md, data)),
8323 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8324 offsetof(struct xdp_md, data_end)),
8325 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8326 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8327 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8328 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8329 BPF_MOV64_IMM(BPF_REG_0, 0),
8330 BPF_EXIT_INSN(),
8331 },
8332 .errstr = "R1 offset is outside of the packet",
8333 .result = REJECT,
8334 .prog_type = BPF_PROG_TYPE_XDP,
8335 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8336 },
8337 {
8338 "XDP pkt read, pkt_end < pkt_data', bad access 2",
8339 .insns = {
8340 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8341 offsetof(struct xdp_md, data)),
8342 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8343 offsetof(struct xdp_md, data_end)),
8344 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8345 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8346 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
8347 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8348 BPF_MOV64_IMM(BPF_REG_0, 0),
8349 BPF_EXIT_INSN(),
8350 },
8351 .errstr = "R1 offset is outside of the packet",
8352 .result = REJECT,
8353 .prog_type = BPF_PROG_TYPE_XDP,
8354 },
8355 {
8356 "XDP pkt read, pkt_data' >= pkt_end, good access",
8357 .insns = {
8358 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8359 offsetof(struct xdp_md, data)),
8360 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8361 offsetof(struct xdp_md, data_end)),
8362 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8363 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8364 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8365 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8366 BPF_MOV64_IMM(BPF_REG_0, 0),
8367 BPF_EXIT_INSN(),
8368 },
8369 .result = ACCEPT,
8370 .prog_type = BPF_PROG_TYPE_XDP,
8371 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8372 },
8373 {
8374 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
8375 .insns = {
8376 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8377 offsetof(struct xdp_md, data)),
8378 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8379 offsetof(struct xdp_md, data_end)),
8380 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8381 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8382 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8383 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8384 BPF_MOV64_IMM(BPF_REG_0, 0),
8385 BPF_EXIT_INSN(),
8386 },
8387 .errstr = "R1 offset is outside of the packet",
8388 .result = REJECT,
8389 .prog_type = BPF_PROG_TYPE_XDP,
8390 },
8391 {
8392 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
8393 .insns = {
8394 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8395 offsetof(struct xdp_md, data)),
8396 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8397 offsetof(struct xdp_md, data_end)),
8398 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8399 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8400 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
8401 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8402 BPF_MOV64_IMM(BPF_REG_0, 0),
8403 BPF_EXIT_INSN(),
8404 },
8405 .errstr = "R1 offset is outside of the packet",
8406 .result = REJECT,
8407 .prog_type = BPF_PROG_TYPE_XDP,
8408 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8409 },
8410 {
8411 "XDP pkt read, pkt_end >= pkt_data', good access",
8412 .insns = {
8413 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8414 offsetof(struct xdp_md, data)),
8415 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8416 offsetof(struct xdp_md, data_end)),
8417 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8418 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8419 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8420 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8421 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8422 BPF_MOV64_IMM(BPF_REG_0, 0),
8423 BPF_EXIT_INSN(),
8424 },
8425 .result = ACCEPT,
8426 .prog_type = BPF_PROG_TYPE_XDP,
8427 },
8428 {
8429 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
8430 .insns = {
8431 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8432 offsetof(struct xdp_md, data)),
8433 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8434 offsetof(struct xdp_md, data_end)),
8435 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8436 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8437 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8438 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8439 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8440 BPF_MOV64_IMM(BPF_REG_0, 0),
8441 BPF_EXIT_INSN(),
8442 },
8443 .errstr = "R1 offset is outside of the packet",
8444 .result = REJECT,
8445 .prog_type = BPF_PROG_TYPE_XDP,
8446 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8447 },
8448 {
8449 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
8450 .insns = {
8451 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8452 offsetof(struct xdp_md, data)),
8453 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8454 offsetof(struct xdp_md, data_end)),
8455 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8456 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8457 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8458 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8459 BPF_MOV64_IMM(BPF_REG_0, 0),
8460 BPF_EXIT_INSN(),
8461 },
8462 .errstr = "R1 offset is outside of the packet",
8463 .result = REJECT,
8464 .prog_type = BPF_PROG_TYPE_XDP,
8465 },
8466 {
8467 "XDP pkt read, pkt_data' <= pkt_end, good access",
8468 .insns = {
8469 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8470 offsetof(struct xdp_md, data)),
8471 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8472 offsetof(struct xdp_md, data_end)),
8473 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8474 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8475 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8476 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8477 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8478 BPF_MOV64_IMM(BPF_REG_0, 0),
8479 BPF_EXIT_INSN(),
8480 },
8481 .result = ACCEPT,
8482 .prog_type = BPF_PROG_TYPE_XDP,
8483 },
8484 {
8485 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
8486 .insns = {
8487 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8488 offsetof(struct xdp_md, data)),
8489 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8490 offsetof(struct xdp_md, data_end)),
8491 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8492 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8493 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8494 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8495 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8496 BPF_MOV64_IMM(BPF_REG_0, 0),
8497 BPF_EXIT_INSN(),
8498 },
8499 .errstr = "R1 offset is outside of the packet",
8500 .result = REJECT,
8501 .prog_type = BPF_PROG_TYPE_XDP,
8502 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8503 },
8504 {
8505 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
8506 .insns = {
8507 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8508 offsetof(struct xdp_md, data)),
8509 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8510 offsetof(struct xdp_md, data_end)),
8511 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8512 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8513 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8514 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8515 BPF_MOV64_IMM(BPF_REG_0, 0),
8516 BPF_EXIT_INSN(),
8517 },
8518 .errstr = "R1 offset is outside of the packet",
8519 .result = REJECT,
8520 .prog_type = BPF_PROG_TYPE_XDP,
8521 },
8522 {
8523 "XDP pkt read, pkt_end <= pkt_data', good access",
8524 .insns = {
8525 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8526 offsetof(struct xdp_md, data)),
8527 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8528 offsetof(struct xdp_md, data_end)),
8529 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8530 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8531 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8532 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8533 BPF_MOV64_IMM(BPF_REG_0, 0),
8534 BPF_EXIT_INSN(),
8535 },
8536 .result = ACCEPT,
8537 .prog_type = BPF_PROG_TYPE_XDP,
8538 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8539 },
8540 {
8541 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
8542 .insns = {
8543 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8544 offsetof(struct xdp_md, data)),
8545 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8546 offsetof(struct xdp_md, data_end)),
8547 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8548 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8549 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8550 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8551 BPF_MOV64_IMM(BPF_REG_0, 0),
8552 BPF_EXIT_INSN(),
8553 },
8554 .errstr = "R1 offset is outside of the packet",
8555 .result = REJECT,
8556 .prog_type = BPF_PROG_TYPE_XDP,
8557 },
8558 {
8559 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
8560 .insns = {
8561 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8562 offsetof(struct xdp_md, data)),
8563 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8564 offsetof(struct xdp_md, data_end)),
8565 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8566 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8567 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
8568 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8569 BPF_MOV64_IMM(BPF_REG_0, 0),
8570 BPF_EXIT_INSN(),
8571 },
8572 .errstr = "R1 offset is outside of the packet",
8573 .result = REJECT,
8574 .prog_type = BPF_PROG_TYPE_XDP,
8575 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8576 },
8577 {
8578 "XDP pkt read, pkt_meta' > pkt_data, good access",
8579 .insns = {
8580 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8581 offsetof(struct xdp_md, data_meta)),
8582 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8583 offsetof(struct xdp_md, data)),
8584 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8585 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8586 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8587 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8588 BPF_MOV64_IMM(BPF_REG_0, 0),
8589 BPF_EXIT_INSN(),
8590 },
8591 .result = ACCEPT,
8592 .prog_type = BPF_PROG_TYPE_XDP,
8593 },
8594 {
8595 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
8596 .insns = {
8597 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8598 offsetof(struct xdp_md, data_meta)),
8599 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8600 offsetof(struct xdp_md, data)),
8601 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8602 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8603 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8604 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8605 BPF_MOV64_IMM(BPF_REG_0, 0),
8606 BPF_EXIT_INSN(),
8607 },
8608 .errstr = "R1 offset is outside of the packet",
8609 .result = REJECT,
8610 .prog_type = BPF_PROG_TYPE_XDP,
8611 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8612 },
8613 {
8614 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
8615 .insns = {
8616 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8617 offsetof(struct xdp_md, data_meta)),
8618 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8619 offsetof(struct xdp_md, data)),
8620 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8621 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8622 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8623 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8624 BPF_MOV64_IMM(BPF_REG_0, 0),
8625 BPF_EXIT_INSN(),
8626 },
8627 .errstr = "R1 offset is outside of the packet",
8628 .result = REJECT,
8629 .prog_type = BPF_PROG_TYPE_XDP,
8630 },
8631 {
8632 "XDP pkt read, pkt_data > pkt_meta', good access",
8633 .insns = {
8634 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8635 offsetof(struct xdp_md, data_meta)),
8636 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8637 offsetof(struct xdp_md, data)),
8638 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8639 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8640 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8641 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8642 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8643 BPF_MOV64_IMM(BPF_REG_0, 0),
8644 BPF_EXIT_INSN(),
8645 },
8646 .result = ACCEPT,
8647 .prog_type = BPF_PROG_TYPE_XDP,
8648 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8649 },
8650 {
8651 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
8652 .insns = {
8653 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8654 offsetof(struct xdp_md, data_meta)),
8655 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8656 offsetof(struct xdp_md, data)),
8657 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8658 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8659 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8660 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8661 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8662 BPF_MOV64_IMM(BPF_REG_0, 0),
8663 BPF_EXIT_INSN(),
8664 },
8665 .errstr = "R1 offset is outside of the packet",
8666 .result = REJECT,
8667 .prog_type = BPF_PROG_TYPE_XDP,
8668 },
8669 {
8670 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
8671 .insns = {
8672 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8673 offsetof(struct xdp_md, data_meta)),
8674 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8675 offsetof(struct xdp_md, data)),
8676 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8677 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8678 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8679 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8680 BPF_MOV64_IMM(BPF_REG_0, 0),
8681 BPF_EXIT_INSN(),
8682 },
8683 .errstr = "R1 offset is outside of the packet",
8684 .result = REJECT,
8685 .prog_type = BPF_PROG_TYPE_XDP,
8686 },
8687 {
8688 "XDP pkt read, pkt_meta' < pkt_data, good access",
8689 .insns = {
8690 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8691 offsetof(struct xdp_md, data_meta)),
8692 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8693 offsetof(struct xdp_md, data)),
8694 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8695 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8696 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8697 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8698 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8699 BPF_MOV64_IMM(BPF_REG_0, 0),
8700 BPF_EXIT_INSN(),
8701 },
8702 .result = ACCEPT,
8703 .prog_type = BPF_PROG_TYPE_XDP,
8704 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8705 },
8706 {
8707 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
8708 .insns = {
8709 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8710 offsetof(struct xdp_md, data_meta)),
8711 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8712 offsetof(struct xdp_md, data)),
8713 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8714 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8715 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8716 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8717 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8718 BPF_MOV64_IMM(BPF_REG_0, 0),
8719 BPF_EXIT_INSN(),
8720 },
8721 .errstr = "R1 offset is outside of the packet",
8722 .result = REJECT,
8723 .prog_type = BPF_PROG_TYPE_XDP,
8724 },
8725 {
8726 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
8727 .insns = {
8728 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8729 offsetof(struct xdp_md, data_meta)),
8730 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8731 offsetof(struct xdp_md, data)),
8732 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8733 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8734 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8735 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8736 BPF_MOV64_IMM(BPF_REG_0, 0),
8737 BPF_EXIT_INSN(),
8738 },
8739 .errstr = "R1 offset is outside of the packet",
8740 .result = REJECT,
8741 .prog_type = BPF_PROG_TYPE_XDP,
8742 },
8743 {
8744 "XDP pkt read, pkt_data < pkt_meta', good access",
8745 .insns = {
8746 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8747 offsetof(struct xdp_md, data_meta)),
8748 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8749 offsetof(struct xdp_md, data)),
8750 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8751 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8752 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8753 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8754 BPF_MOV64_IMM(BPF_REG_0, 0),
8755 BPF_EXIT_INSN(),
8756 },
8757 .result = ACCEPT,
8758 .prog_type = BPF_PROG_TYPE_XDP,
8759 },
8760 {
8761 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
8762 .insns = {
8763 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8764 offsetof(struct xdp_md, data_meta)),
8765 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8766 offsetof(struct xdp_md, data)),
8767 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8768 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8769 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8770 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8771 BPF_MOV64_IMM(BPF_REG_0, 0),
8772 BPF_EXIT_INSN(),
8773 },
8774 .errstr = "R1 offset is outside of the packet",
8775 .result = REJECT,
8776 .prog_type = BPF_PROG_TYPE_XDP,
8777 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8778 },
8779 {
8780 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
8781 .insns = {
8782 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8783 offsetof(struct xdp_md, data_meta)),
8784 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8785 offsetof(struct xdp_md, data)),
8786 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8787 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8788 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
8789 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8790 BPF_MOV64_IMM(BPF_REG_0, 0),
8791 BPF_EXIT_INSN(),
8792 },
8793 .errstr = "R1 offset is outside of the packet",
8794 .result = REJECT,
8795 .prog_type = BPF_PROG_TYPE_XDP,
8796 },
8797 {
8798 "XDP pkt read, pkt_meta' >= pkt_data, good access",
8799 .insns = {
8800 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8801 offsetof(struct xdp_md, data_meta)),
8802 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8803 offsetof(struct xdp_md, data)),
8804 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8805 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8806 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8807 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8808 BPF_MOV64_IMM(BPF_REG_0, 0),
8809 BPF_EXIT_INSN(),
8810 },
8811 .result = ACCEPT,
8812 .prog_type = BPF_PROG_TYPE_XDP,
8813 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8814 },
8815 {
8816 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
8817 .insns = {
8818 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8819 offsetof(struct xdp_md, data_meta)),
8820 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8821 offsetof(struct xdp_md, data)),
8822 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8823 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8824 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8825 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8826 BPF_MOV64_IMM(BPF_REG_0, 0),
8827 BPF_EXIT_INSN(),
8828 },
8829 .errstr = "R1 offset is outside of the packet",
8830 .result = REJECT,
8831 .prog_type = BPF_PROG_TYPE_XDP,
8832 },
8833 {
8834 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
8835 .insns = {
8836 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8837 offsetof(struct xdp_md, data_meta)),
8838 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8839 offsetof(struct xdp_md, data)),
8840 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8841 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8842 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
8843 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8844 BPF_MOV64_IMM(BPF_REG_0, 0),
8845 BPF_EXIT_INSN(),
8846 },
8847 .errstr = "R1 offset is outside of the packet",
8848 .result = REJECT,
8849 .prog_type = BPF_PROG_TYPE_XDP,
8850 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8851 },
8852 {
8853 "XDP pkt read, pkt_data >= pkt_meta', good access",
8854 .insns = {
8855 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8856 offsetof(struct xdp_md, data_meta)),
8857 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8858 offsetof(struct xdp_md, data)),
8859 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8860 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8861 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8862 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8863 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8864 BPF_MOV64_IMM(BPF_REG_0, 0),
8865 BPF_EXIT_INSN(),
8866 },
8867 .result = ACCEPT,
8868 .prog_type = BPF_PROG_TYPE_XDP,
8869 },
8870 {
8871 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
8872 .insns = {
8873 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8874 offsetof(struct xdp_md, data_meta)),
8875 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8876 offsetof(struct xdp_md, data)),
8877 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8878 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8879 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8880 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8881 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8882 BPF_MOV64_IMM(BPF_REG_0, 0),
8883 BPF_EXIT_INSN(),
8884 },
8885 .errstr = "R1 offset is outside of the packet",
8886 .result = REJECT,
8887 .prog_type = BPF_PROG_TYPE_XDP,
8888 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8889 },
8890 {
8891 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
8892 .insns = {
8893 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8894 offsetof(struct xdp_md, data_meta)),
8895 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8896 offsetof(struct xdp_md, data)),
8897 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8898 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8899 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8900 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8901 BPF_MOV64_IMM(BPF_REG_0, 0),
8902 BPF_EXIT_INSN(),
8903 },
8904 .errstr = "R1 offset is outside of the packet",
8905 .result = REJECT,
8906 .prog_type = BPF_PROG_TYPE_XDP,
8907 },
8908 {
8909 "XDP pkt read, pkt_meta' <= pkt_data, good access",
8910 .insns = {
8911 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8912 offsetof(struct xdp_md, data_meta)),
8913 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8914 offsetof(struct xdp_md, data)),
8915 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8916 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8917 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8918 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8919 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8920 BPF_MOV64_IMM(BPF_REG_0, 0),
8921 BPF_EXIT_INSN(),
8922 },
8923 .result = ACCEPT,
8924 .prog_type = BPF_PROG_TYPE_XDP,
8925 },
8926 {
8927 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
8928 .insns = {
8929 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8930 offsetof(struct xdp_md, data_meta)),
8931 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8932 offsetof(struct xdp_md, data)),
8933 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8934 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8935 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8936 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8937 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8938 BPF_MOV64_IMM(BPF_REG_0, 0),
8939 BPF_EXIT_INSN(),
8940 },
8941 .errstr = "R1 offset is outside of the packet",
8942 .result = REJECT,
8943 .prog_type = BPF_PROG_TYPE_XDP,
8944 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8945 },
8946 {
8947 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
8948 .insns = {
8949 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8950 offsetof(struct xdp_md, data_meta)),
8951 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8952 offsetof(struct xdp_md, data)),
8953 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8954 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8955 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8956 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8957 BPF_MOV64_IMM(BPF_REG_0, 0),
8958 BPF_EXIT_INSN(),
8959 },
8960 .errstr = "R1 offset is outside of the packet",
8961 .result = REJECT,
8962 .prog_type = BPF_PROG_TYPE_XDP,
8963 },
8964 {
8965 "XDP pkt read, pkt_data <= pkt_meta', good access",
8966 .insns = {
8967 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8968 offsetof(struct xdp_md, data_meta)),
8969 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8970 offsetof(struct xdp_md, data)),
8971 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8972 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8973 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8974 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8975 BPF_MOV64_IMM(BPF_REG_0, 0),
8976 BPF_EXIT_INSN(),
8977 },
8978 .result = ACCEPT,
8979 .prog_type = BPF_PROG_TYPE_XDP,
8980 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8981 },
8982 {
8983 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
8984 .insns = {
8985 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8986 offsetof(struct xdp_md, data_meta)),
8987 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8988 offsetof(struct xdp_md, data)),
8989 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8990 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8991 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8992 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8993 BPF_MOV64_IMM(BPF_REG_0, 0),
8994 BPF_EXIT_INSN(),
8995 },
8996 .errstr = "R1 offset is outside of the packet",
8997 .result = REJECT,
8998 .prog_type = BPF_PROG_TYPE_XDP,
8999 },
9000 {
9001 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
9002 .insns = {
9003 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9004 offsetof(struct xdp_md, data_meta)),
9005 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9006 offsetof(struct xdp_md, data)),
9007 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9008 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9009 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9010 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9011 BPF_MOV64_IMM(BPF_REG_0, 0),
9012 BPF_EXIT_INSN(),
9013 },
9014 .errstr = "R1 offset is outside of the packet",
9015 .result = REJECT,
9016 .prog_type = BPF_PROG_TYPE_XDP,
9017 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9018 },
9019 {
9020 "check deducing bounds from const, 1",
9021 .insns = {
9022 BPF_MOV64_IMM(BPF_REG_0, 1),
9023 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
9024 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9025 BPF_EXIT_INSN(),
9026 },
9027 .result = REJECT,
9028 .errstr = "R0 tried to subtract pointer from scalar",
9029 },
9030 {
9031 "check deducing bounds from const, 2",
9032 .insns = {
9033 BPF_MOV64_IMM(BPF_REG_0, 1),
9034 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9035 BPF_EXIT_INSN(),
9036 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
9037 BPF_EXIT_INSN(),
9038 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9039 BPF_EXIT_INSN(),
9040 },
9041 .result = ACCEPT,
9042 .retval = 1,
9043 },
9044 {
9045 "check deducing bounds from const, 3",
9046 .insns = {
9047 BPF_MOV64_IMM(BPF_REG_0, 0),
9048 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9049 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9050 BPF_EXIT_INSN(),
9051 },
9052 .result = REJECT,
9053 .errstr = "R0 tried to subtract pointer from scalar",
9054 },
9055 {
9056 "check deducing bounds from const, 4",
9057 .insns = {
9058 BPF_MOV64_IMM(BPF_REG_0, 0),
9059 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
9060 BPF_EXIT_INSN(),
9061 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9062 BPF_EXIT_INSN(),
9063 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9064 BPF_EXIT_INSN(),
9065 },
9066 .result = ACCEPT,
9067 },
9068 {
9069 "check deducing bounds from const, 5",
9070 .insns = {
9071 BPF_MOV64_IMM(BPF_REG_0, 0),
9072 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9073 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9074 BPF_EXIT_INSN(),
9075 },
9076 .result = REJECT,
9077 .errstr = "R0 tried to subtract pointer from scalar",
9078 },
9079 {
9080 "check deducing bounds from const, 6",
9081 .insns = {
9082 BPF_MOV64_IMM(BPF_REG_0, 0),
9083 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9084 BPF_EXIT_INSN(),
9085 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9086 BPF_EXIT_INSN(),
9087 },
9088 .result = REJECT,
9089 .errstr = "R0 tried to subtract pointer from scalar",
9090 },
9091 {
9092 "check deducing bounds from const, 7",
9093 .insns = {
9094 BPF_MOV64_IMM(BPF_REG_0, ~0),
9095 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9096 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9097 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9098 offsetof(struct __sk_buff, mark)),
9099 BPF_EXIT_INSN(),
9100 },
9101 .result = REJECT,
9102 .errstr = "dereference of modified ctx ptr",
9103 },
9104 {
9105 "check deducing bounds from const, 8",
9106 .insns = {
9107 BPF_MOV64_IMM(BPF_REG_0, ~0),
9108 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9109 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
9110 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9111 offsetof(struct __sk_buff, mark)),
9112 BPF_EXIT_INSN(),
9113 },
9114 .result = REJECT,
9115 .errstr = "dereference of modified ctx ptr",
9116 },
9117 {
9118 "check deducing bounds from const, 9",
9119 .insns = {
9120 BPF_MOV64_IMM(BPF_REG_0, 0),
9121 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9122 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9123 BPF_EXIT_INSN(),
9124 },
9125 .result = REJECT,
9126 .errstr = "R0 tried to subtract pointer from scalar",
9127 },
9128 {
9129 "check deducing bounds from const, 10",
9130 .insns = {
9131 BPF_MOV64_IMM(BPF_REG_0, 0),
9132 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9133 /* Marks reg as unknown. */
9134 BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
9135 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9136 BPF_EXIT_INSN(),
9137 },
9138 .result = REJECT,
9139 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
9140 },
9141 {
9142 "bpf_exit with invalid return code. test1",
9143 .insns = {
9144 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9145 BPF_EXIT_INSN(),
9146 },
9147 .errstr = "R0 has value (0x0; 0xffffffff)",
9148 .result = REJECT,
9149 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9150 },
9151 {
9152 "bpf_exit with invalid return code. test2",
9153 .insns = {
9154 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9155 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
9156 BPF_EXIT_INSN(),
9157 },
9158 .result = ACCEPT,
9159 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9160 },
9161 {
9162 "bpf_exit with invalid return code. test3",
9163 .insns = {
9164 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9165 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
9166 BPF_EXIT_INSN(),
9167 },
9168 .errstr = "R0 has value (0x0; 0x3)",
9169 .result = REJECT,
9170 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9171 },
9172 {
9173 "bpf_exit with invalid return code. test4",
9174 .insns = {
9175 BPF_MOV64_IMM(BPF_REG_0, 1),
9176 BPF_EXIT_INSN(),
9177 },
9178 .result = ACCEPT,
9179 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9180 },
9181 {
9182 "bpf_exit with invalid return code. test5",
9183 .insns = {
9184 BPF_MOV64_IMM(BPF_REG_0, 2),
9185 BPF_EXIT_INSN(),
9186 },
9187 .errstr = "R0 has value (0x2; 0x0)",
9188 .result = REJECT,
9189 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9190 },
9191 {
9192 "bpf_exit with invalid return code. test6",
9193 .insns = {
9194 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9195 BPF_EXIT_INSN(),
9196 },
9197 .errstr = "R0 is not a known value (ctx)",
9198 .result = REJECT,
9199 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9200 },
9201 {
9202 "bpf_exit with invalid return code. test7",
9203 .insns = {
9204 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9205 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
9206 BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
9207 BPF_EXIT_INSN(),
9208 },
9209 .errstr = "R0 has unknown scalar value",
9210 .result = REJECT,
9211 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9212 },
9213 {
9214 "calls: basic sanity",
9215 .insns = {
9216 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9217 BPF_MOV64_IMM(BPF_REG_0, 1),
9218 BPF_EXIT_INSN(),
9219 BPF_MOV64_IMM(BPF_REG_0, 2),
9220 BPF_EXIT_INSN(),
9221 },
9222 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9223 .result = ACCEPT,
9224 },
9225 {
9226 "calls: not on unpriviledged",
9227 .insns = {
9228 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9229 BPF_MOV64_IMM(BPF_REG_0, 1),
9230 BPF_EXIT_INSN(),
9231 BPF_MOV64_IMM(BPF_REG_0, 2),
9232 BPF_EXIT_INSN(),
9233 },
9234 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
9235 .result_unpriv = REJECT,
9236 .result = ACCEPT,
9237 .retval = 1,
9238 },
9239 {
9240 "calls: div by 0 in subprog",
9241 .insns = {
9242 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9243 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9244 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9245 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9246 offsetof(struct __sk_buff, data_end)),
9247 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9248 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9249 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9250 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9251 BPF_MOV64_IMM(BPF_REG_0, 1),
9252 BPF_EXIT_INSN(),
9253 BPF_MOV32_IMM(BPF_REG_2, 0),
9254 BPF_MOV32_IMM(BPF_REG_3, 1),
9255 BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
9256 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9257 offsetof(struct __sk_buff, data)),
9258 BPF_EXIT_INSN(),
9259 },
9260 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9261 .result = ACCEPT,
9262 .retval = 1,
9263 },
9264 {
9265 "calls: multiple ret types in subprog 1",
9266 .insns = {
9267 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9268 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9269 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9270 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9271 offsetof(struct __sk_buff, data_end)),
9272 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9273 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9274 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9275 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9276 BPF_MOV64_IMM(BPF_REG_0, 1),
9277 BPF_EXIT_INSN(),
9278 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9279 offsetof(struct __sk_buff, data)),
9280 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9281 BPF_MOV32_IMM(BPF_REG_0, 42),
9282 BPF_EXIT_INSN(),
9283 },
9284 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9285 .result = REJECT,
9286 .errstr = "R0 invalid mem access 'inv'",
9287 },
9288 {
9289 "calls: multiple ret types in subprog 2",
9290 .insns = {
9291 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9292 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9293 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9294 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9295 offsetof(struct __sk_buff, data_end)),
9296 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9298 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9299 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9300 BPF_MOV64_IMM(BPF_REG_0, 1),
9301 BPF_EXIT_INSN(),
9302 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9303 offsetof(struct __sk_buff, data)),
9304 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9305 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
9306 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9308 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9309 BPF_LD_MAP_FD(BPF_REG_1, 0),
9310 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9311 BPF_FUNC_map_lookup_elem),
9312 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9313 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
9314 offsetof(struct __sk_buff, data)),
9315 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
9316 BPF_EXIT_INSN(),
9317 },
9318 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9319 .fixup_map1 = { 16 },
9320 .result = REJECT,
9321 .errstr = "R0 min value is outside of the array range",
9322 },
9323 {
9324 "calls: overlapping caller/callee",
9325 .insns = {
9326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
9327 BPF_MOV64_IMM(BPF_REG_0, 1),
9328 BPF_EXIT_INSN(),
9329 },
9330 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9331 .errstr = "last insn is not an exit or jmp",
9332 .result = REJECT,
9333 },
9334 {
9335 "calls: wrong recursive calls",
9336 .insns = {
9337 BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9338 BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9339 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9340 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9341 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9342 BPF_MOV64_IMM(BPF_REG_0, 1),
9343 BPF_EXIT_INSN(),
9344 },
9345 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9346 .errstr = "jump out of range",
9347 .result = REJECT,
9348 },
9349 {
9350 "calls: wrong src reg",
9351 .insns = {
9352 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
9353 BPF_MOV64_IMM(BPF_REG_0, 1),
9354 BPF_EXIT_INSN(),
9355 },
9356 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9357 .errstr = "BPF_CALL uses reserved fields",
9358 .result = REJECT,
9359 },
9360 {
9361 "calls: wrong off value",
9362 .insns = {
9363 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
9364 BPF_MOV64_IMM(BPF_REG_0, 1),
9365 BPF_EXIT_INSN(),
9366 BPF_MOV64_IMM(BPF_REG_0, 2),
9367 BPF_EXIT_INSN(),
9368 },
9369 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9370 .errstr = "BPF_CALL uses reserved fields",
9371 .result = REJECT,
9372 },
9373 {
9374 "calls: jump back loop",
9375 .insns = {
9376 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
9377 BPF_MOV64_IMM(BPF_REG_0, 1),
9378 BPF_EXIT_INSN(),
9379 },
9380 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9381 .errstr = "back-edge from insn 0 to 0",
9382 .result = REJECT,
9383 },
9384 {
9385 "calls: conditional call",
9386 .insns = {
9387 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9388 offsetof(struct __sk_buff, mark)),
9389 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9390 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9391 BPF_MOV64_IMM(BPF_REG_0, 1),
9392 BPF_EXIT_INSN(),
9393 BPF_MOV64_IMM(BPF_REG_0, 2),
9394 BPF_EXIT_INSN(),
9395 },
9396 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9397 .errstr = "jump out of range",
9398 .result = REJECT,
9399 },
9400 {
9401 "calls: conditional call 2",
9402 .insns = {
9403 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9404 offsetof(struct __sk_buff, mark)),
9405 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9406 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9407 BPF_MOV64_IMM(BPF_REG_0, 1),
9408 BPF_EXIT_INSN(),
9409 BPF_MOV64_IMM(BPF_REG_0, 2),
9410 BPF_EXIT_INSN(),
9411 BPF_MOV64_IMM(BPF_REG_0, 3),
9412 BPF_EXIT_INSN(),
9413 },
9414 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9415 .result = ACCEPT,
9416 },
9417 {
9418 "calls: conditional call 3",
9419 .insns = {
9420 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9421 offsetof(struct __sk_buff, mark)),
9422 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9423 BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9424 BPF_MOV64_IMM(BPF_REG_0, 1),
9425 BPF_EXIT_INSN(),
9426 BPF_MOV64_IMM(BPF_REG_0, 1),
9427 BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9428 BPF_MOV64_IMM(BPF_REG_0, 3),
9429 BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9430 },
9431 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9432 .errstr = "back-edge from insn",
9433 .result = REJECT,
9434 },
9435 {
9436 "calls: conditional call 4",
9437 .insns = {
9438 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9439 offsetof(struct __sk_buff, mark)),
9440 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9441 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9442 BPF_MOV64_IMM(BPF_REG_0, 1),
9443 BPF_EXIT_INSN(),
9444 BPF_MOV64_IMM(BPF_REG_0, 1),
9445 BPF_JMP_IMM(BPF_JA, 0, 0, -5),
9446 BPF_MOV64_IMM(BPF_REG_0, 3),
9447 BPF_EXIT_INSN(),
9448 },
9449 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9450 .result = ACCEPT,
9451 },
9452 {
9453 "calls: conditional call 5",
9454 .insns = {
9455 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9456 offsetof(struct __sk_buff, mark)),
9457 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9458 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9459 BPF_MOV64_IMM(BPF_REG_0, 1),
9460 BPF_EXIT_INSN(),
9461 BPF_MOV64_IMM(BPF_REG_0, 1),
9462 BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9463 BPF_MOV64_IMM(BPF_REG_0, 3),
9464 BPF_EXIT_INSN(),
9465 },
9466 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9467 .errstr = "back-edge from insn",
9468 .result = REJECT,
9469 },
9470 {
9471 "calls: conditional call 6",
9472 .insns = {
9473 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9474 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
9475 BPF_EXIT_INSN(),
9476 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9477 offsetof(struct __sk_buff, mark)),
9478 BPF_EXIT_INSN(),
9479 },
9480 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9481 .errstr = "back-edge from insn",
9482 .result = REJECT,
9483 },
9484 {
9485 "calls: using r0 returned by callee",
9486 .insns = {
9487 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9488 BPF_EXIT_INSN(),
9489 BPF_MOV64_IMM(BPF_REG_0, 2),
9490 BPF_EXIT_INSN(),
9491 },
9492 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9493 .result = ACCEPT,
9494 },
9495 {
9496 "calls: using uninit r0 from callee",
9497 .insns = {
9498 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9499 BPF_EXIT_INSN(),
9500 BPF_EXIT_INSN(),
9501 },
9502 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9503 .errstr = "!read_ok",
9504 .result = REJECT,
9505 },
9506 {
9507 "calls: callee is using r1",
9508 .insns = {
9509 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9510 BPF_EXIT_INSN(),
9511 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9512 offsetof(struct __sk_buff, len)),
9513 BPF_EXIT_INSN(),
9514 },
9515 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
9516 .result = ACCEPT,
9517 .retval = TEST_DATA_LEN,
9518 },
9519 {
9520 "calls: callee using args1",
9521 .insns = {
9522 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9523 BPF_EXIT_INSN(),
9524 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9525 BPF_EXIT_INSN(),
9526 },
9527 .errstr_unpriv = "allowed for root only",
9528 .result_unpriv = REJECT,
9529 .result = ACCEPT,
9530 .retval = POINTER_VALUE,
9531 },
9532 {
9533 "calls: callee using wrong args2",
9534 .insns = {
9535 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9536 BPF_EXIT_INSN(),
9537 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9538 BPF_EXIT_INSN(),
9539 },
9540 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9541 .errstr = "R2 !read_ok",
9542 .result = REJECT,
9543 },
9544 {
9545 "calls: callee using two args",
9546 .insns = {
9547 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9548 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
9549 offsetof(struct __sk_buff, len)),
9550 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
9551 offsetof(struct __sk_buff, len)),
9552 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9553 BPF_EXIT_INSN(),
9554 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9555 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
9556 BPF_EXIT_INSN(),
9557 },
9558 .errstr_unpriv = "allowed for root only",
9559 .result_unpriv = REJECT,
9560 .result = ACCEPT,
9561 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
9562 },
9563 {
9564 "calls: callee changing pkt pointers",
9565 .insns = {
9566 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
9567 offsetof(struct xdp_md, data)),
9568 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
9569 offsetof(struct xdp_md, data_end)),
9570 BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
9571 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
9572 BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
9573 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9574 /* clear_all_pkt_pointers() has to walk all frames
9575 * to make sure that pkt pointers in the caller
9576 * are cleared when callee is calling a helper that
9577 * adjusts packet size
9578 */
9579 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
9580 BPF_MOV32_IMM(BPF_REG_0, 0),
9581 BPF_EXIT_INSN(),
9582 BPF_MOV64_IMM(BPF_REG_2, 0),
9583 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9584 BPF_FUNC_xdp_adjust_head),
9585 BPF_EXIT_INSN(),
9586 },
9587 .result = REJECT,
9588 .errstr = "R6 invalid mem access 'inv'",
9589 .prog_type = BPF_PROG_TYPE_XDP,
9590 },
9591 {
9592 "calls: two calls with args",
9593 .insns = {
9594 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9595 BPF_EXIT_INSN(),
9596 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9597 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9598 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9599 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9600 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9601 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9602 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9603 BPF_EXIT_INSN(),
9604 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9605 offsetof(struct __sk_buff, len)),
9606 BPF_EXIT_INSN(),
9607 },
9608 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9609 .result = ACCEPT,
9610 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
9611 },
9612 {
9613 "calls: calls with stack arith",
9614 .insns = {
9615 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9616 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9617 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9618 BPF_EXIT_INSN(),
9619 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9620 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9621 BPF_EXIT_INSN(),
9622 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9623 BPF_MOV64_IMM(BPF_REG_0, 42),
9624 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
9625 BPF_EXIT_INSN(),
9626 },
9627 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9628 .result = ACCEPT,
9629 .retval = 42,
9630 },
9631 {
9632 "calls: calls with misaligned stack access",
9633 .insns = {
9634 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9635 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
9636 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9637 BPF_EXIT_INSN(),
9638 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
9639 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9640 BPF_EXIT_INSN(),
9641 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
9642 BPF_MOV64_IMM(BPF_REG_0, 42),
9643 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
9644 BPF_EXIT_INSN(),
9645 },
9646 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9647 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
9648 .errstr = "misaligned stack access",
9649 .result = REJECT,
9650 },
9651 {
9652 "calls: calls control flow, jump test",
9653 .insns = {
9654 BPF_MOV64_IMM(BPF_REG_0, 42),
9655 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
9656 BPF_MOV64_IMM(BPF_REG_0, 43),
9657 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9658 BPF_JMP_IMM(BPF_JA, 0, 0, -3),
9659 BPF_EXIT_INSN(),
9660 },
9661 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9662 .result = ACCEPT,
9663 .retval = 43,
9664 },
9665 {
9666 "calls: calls control flow, jump test 2",
9667 .insns = {
9668 BPF_MOV64_IMM(BPF_REG_0, 42),
9669 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
9670 BPF_MOV64_IMM(BPF_REG_0, 43),
9671 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9672 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
9673 BPF_EXIT_INSN(),
9674 },
9675 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9676 .errstr = "jump out of range from insn 1 to 4",
9677 .result = REJECT,
9678 },
9679 {
9680 "calls: two calls with bad jump",
9681 .insns = {
9682 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9683 BPF_EXIT_INSN(),
9684 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9685 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9686 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9687 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9688 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9689 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9690 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9691 BPF_EXIT_INSN(),
9692 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9693 offsetof(struct __sk_buff, len)),
9694 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
9695 BPF_EXIT_INSN(),
9696 },
9697 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9698 .errstr = "jump out of range from insn 11 to 9",
9699 .result = REJECT,
9700 },
9701 {
9702 "calls: recursive call. test1",
9703 .insns = {
9704 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9705 BPF_EXIT_INSN(),
9706 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
9707 BPF_EXIT_INSN(),
9708 },
9709 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9710 .errstr = "back-edge",
9711 .result = REJECT,
9712 },
9713 {
9714 "calls: recursive call. test2",
9715 .insns = {
9716 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9717 BPF_EXIT_INSN(),
9718 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
9719 BPF_EXIT_INSN(),
9720 },
9721 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9722 .errstr = "back-edge",
9723 .result = REJECT,
9724 },
9725 {
9726 "calls: unreachable code",
9727 .insns = {
9728 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9729 BPF_EXIT_INSN(),
9730 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9731 BPF_EXIT_INSN(),
9732 BPF_MOV64_IMM(BPF_REG_0, 0),
9733 BPF_EXIT_INSN(),
9734 BPF_MOV64_IMM(BPF_REG_0, 0),
9735 BPF_EXIT_INSN(),
9736 },
9737 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9738 .errstr = "unreachable insn 6",
9739 .result = REJECT,
9740 },
9741 {
9742 "calls: invalid call",
9743 .insns = {
9744 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9745 BPF_EXIT_INSN(),
9746 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
9747 BPF_EXIT_INSN(),
9748 },
9749 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9750 .errstr = "invalid destination",
9751 .result = REJECT,
9752 },
9753 {
9754 "calls: invalid call 2",
9755 .insns = {
9756 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9757 BPF_EXIT_INSN(),
9758 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
9759 BPF_EXIT_INSN(),
9760 },
9761 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9762 .errstr = "invalid destination",
9763 .result = REJECT,
9764 },
9765 {
9766 "calls: jumping across function bodies. test1",
9767 .insns = {
9768 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9769 BPF_MOV64_IMM(BPF_REG_0, 0),
9770 BPF_EXIT_INSN(),
9771 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
9772 BPF_EXIT_INSN(),
9773 },
9774 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9775 .errstr = "jump out of range",
9776 .result = REJECT,
9777 },
9778 {
9779 "calls: jumping across function bodies. test2",
9780 .insns = {
9781 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
9782 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9783 BPF_MOV64_IMM(BPF_REG_0, 0),
9784 BPF_EXIT_INSN(),
9785 BPF_EXIT_INSN(),
9786 },
9787 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9788 .errstr = "jump out of range",
9789 .result = REJECT,
9790 },
9791 {
9792 "calls: call without exit",
9793 .insns = {
9794 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9795 BPF_EXIT_INSN(),
9796 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9797 BPF_EXIT_INSN(),
9798 BPF_MOV64_IMM(BPF_REG_0, 0),
9799 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
9800 },
9801 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9802 .errstr = "not an exit",
9803 .result = REJECT,
9804 },
9805 {
9806 "calls: call into middle of ld_imm64",
9807 .insns = {
9808 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9809 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9810 BPF_MOV64_IMM(BPF_REG_0, 0),
9811 BPF_EXIT_INSN(),
9812 BPF_LD_IMM64(BPF_REG_0, 0),
9813 BPF_EXIT_INSN(),
9814 },
9815 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9816 .errstr = "last insn",
9817 .result = REJECT,
9818 },
9819 {
9820 "calls: call into middle of other call",
9821 .insns = {
9822 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9823 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9824 BPF_MOV64_IMM(BPF_REG_0, 0),
9825 BPF_EXIT_INSN(),
9826 BPF_MOV64_IMM(BPF_REG_0, 0),
9827 BPF_MOV64_IMM(BPF_REG_0, 0),
9828 BPF_EXIT_INSN(),
9829 },
9830 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9831 .errstr = "last insn",
9832 .result = REJECT,
9833 },
9834 {
9835 "calls: ld_abs with changing ctx data in callee",
9836 .insns = {
9837 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9838 BPF_LD_ABS(BPF_B, 0),
9839 BPF_LD_ABS(BPF_H, 0),
9840 BPF_LD_ABS(BPF_W, 0),
9841 BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
9842 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
9843 BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
9844 BPF_LD_ABS(BPF_B, 0),
9845 BPF_LD_ABS(BPF_H, 0),
9846 BPF_LD_ABS(BPF_W, 0),
9847 BPF_EXIT_INSN(),
9848 BPF_MOV64_IMM(BPF_REG_2, 1),
9849 BPF_MOV64_IMM(BPF_REG_3, 2),
9850 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9851 BPF_FUNC_skb_vlan_push),
9852 BPF_EXIT_INSN(),
9853 },
9854 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9855 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
9856 .result = REJECT,
9857 },
9858 {
9859 "calls: two calls with bad fallthrough",
9860 .insns = {
9861 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9862 BPF_EXIT_INSN(),
9863 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9864 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9865 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9866 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9867 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9868 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9869 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9870 BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
9871 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9872 offsetof(struct __sk_buff, len)),
9873 BPF_EXIT_INSN(),
9874 },
9875 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9876 .errstr = "not an exit",
9877 .result = REJECT,
9878 },
9879 {
9880 "calls: two calls with stack read",
9881 .insns = {
9882 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9883 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9884 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
9885 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9886 BPF_EXIT_INSN(),
9887 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9888 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9889 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9890 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9891 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9892 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9893 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9894 BPF_EXIT_INSN(),
9895 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9896 BPF_EXIT_INSN(),
9897 },
9898 .prog_type = BPF_PROG_TYPE_XDP,
9899 .result = ACCEPT,
9900 },
9901 {
9902 "calls: two calls with stack write",
9903 .insns = {
9904 /* main prog */
9905 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9906 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9907 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
9908 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9909 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
9910 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9911 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
9912 BPF_EXIT_INSN(),
9913
9914 /* subprog 1 */
9915 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9916 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
9917 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
9918 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
9919 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9920 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9921 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
9922 BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
9923 /* write into stack frame of main prog */
9924 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
9925 BPF_EXIT_INSN(),
9926
9927 /* subprog 2 */
9928 /* read from stack frame of main prog */
9929 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9930 BPF_EXIT_INSN(),
9931 },
9932 .prog_type = BPF_PROG_TYPE_XDP,
9933 .result = ACCEPT,
9934 },
9935 {
9936 "calls: stack overflow using two frames (pre-call access)",
9937 .insns = {
9938 /* prog 1 */
9939 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
9940 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
9941 BPF_EXIT_INSN(),
9942
9943 /* prog 2 */
9944 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
9945 BPF_MOV64_IMM(BPF_REG_0, 0),
9946 BPF_EXIT_INSN(),
9947 },
9948 .prog_type = BPF_PROG_TYPE_XDP,
9949 .errstr = "combined stack size",
9950 .result = REJECT,
9951 },
9952 {
9953 "calls: stack overflow using two frames (post-call access)",
9954 .insns = {
9955 /* prog 1 */
9956 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
9957 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
9958 BPF_EXIT_INSN(),
9959
9960 /* prog 2 */
9961 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
9962 BPF_MOV64_IMM(BPF_REG_0, 0),
9963 BPF_EXIT_INSN(),
9964 },
9965 .prog_type = BPF_PROG_TYPE_XDP,
9966 .errstr = "combined stack size",
9967 .result = REJECT,
9968 },
9969 {
9970 "calls: stack depth check using three frames. test1",
9971 .insns = {
9972 /* main */
9973 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
9974 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
9975 BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
9976 BPF_MOV64_IMM(BPF_REG_0, 0),
9977 BPF_EXIT_INSN(),
9978 /* A */
9979 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
9980 BPF_EXIT_INSN(),
9981 /* B */
9982 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
9983 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
9984 BPF_EXIT_INSN(),
9985 },
9986 .prog_type = BPF_PROG_TYPE_XDP,
9987 /* stack_main=32, stack_A=256, stack_B=64
9988 * and max(main+A, main+A+B) < 512
9989 */
9990 .result = ACCEPT,
9991 },
9992 {
9993 "calls: stack depth check using three frames. test2",
9994 .insns = {
9995 /* main */
9996 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
9997 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
9998 BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
9999 BPF_MOV64_IMM(BPF_REG_0, 0),
10000 BPF_EXIT_INSN(),
10001 /* A */
10002 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10003 BPF_EXIT_INSN(),
10004 /* B */
10005 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10006 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10007 BPF_EXIT_INSN(),
10008 },
10009 .prog_type = BPF_PROG_TYPE_XDP,
10010 /* stack_main=32, stack_A=64, stack_B=256
10011 * and max(main+A, main+A+B) < 512
10012 */
10013 .result = ACCEPT,
10014 },
10015 {
10016 "calls: stack depth check using three frames. test3",
10017 .insns = {
10018 /* main */
10019 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10020 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10021 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10022 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
10023 BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
10024 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10025 BPF_MOV64_IMM(BPF_REG_0, 0),
10026 BPF_EXIT_INSN(),
10027 /* A */
10028 BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
10029 BPF_EXIT_INSN(),
10030 BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
10031 BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10032 /* B */
10033 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
10034 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
10035 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10036 BPF_EXIT_INSN(),
10037 },
10038 .prog_type = BPF_PROG_TYPE_XDP,
10039 /* stack_main=64, stack_A=224, stack_B=256
10040 * and max(main+A, main+A+B) > 512
10041 */
10042 .errstr = "combined stack",
10043 .result = REJECT,
10044 },
10045 {
10046 "calls: stack depth check using three frames. test4",
10047 /* void main(void) {
10048 * func1(0);
10049 * func1(1);
10050 * func2(1);
10051 * }
10052 * void func1(int alloc_or_recurse) {
10053 * if (alloc_or_recurse) {
10054 * frame_pointer[-300] = 1;
10055 * } else {
10056 * func2(alloc_or_recurse);
10057 * }
10058 * }
10059 * void func2(int alloc_or_recurse) {
10060 * if (alloc_or_recurse) {
10061 * frame_pointer[-300] = 1;
10062 * }
10063 * }
10064 */
10065 .insns = {
10066 /* main */
10067 BPF_MOV64_IMM(BPF_REG_1, 0),
10068 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10069 BPF_MOV64_IMM(BPF_REG_1, 1),
10070 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10071 BPF_MOV64_IMM(BPF_REG_1, 1),
10072 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
10073 BPF_MOV64_IMM(BPF_REG_0, 0),
10074 BPF_EXIT_INSN(),
10075 /* A */
10076 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
10077 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10078 BPF_EXIT_INSN(),
10079 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10080 BPF_EXIT_INSN(),
10081 /* B */
10082 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10083 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10084 BPF_EXIT_INSN(),
10085 },
10086 .prog_type = BPF_PROG_TYPE_XDP,
10087 .result = REJECT,
10088 .errstr = "combined stack",
10089 },
10090 {
10091 "calls: stack depth check using three frames. test5",
10092 .insns = {
10093 /* main */
10094 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
10095 BPF_EXIT_INSN(),
10096 /* A */
10097 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10098 BPF_EXIT_INSN(),
10099 /* B */
10100 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
10101 BPF_EXIT_INSN(),
10102 /* C */
10103 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
10104 BPF_EXIT_INSN(),
10105 /* D */
10106 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
10107 BPF_EXIT_INSN(),
10108 /* E */
10109 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
10110 BPF_EXIT_INSN(),
10111 /* F */
10112 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
10113 BPF_EXIT_INSN(),
10114 /* G */
10115 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
10116 BPF_EXIT_INSN(),
10117 /* H */
10118 BPF_MOV64_IMM(BPF_REG_0, 0),
10119 BPF_EXIT_INSN(),
10120 },
10121 .prog_type = BPF_PROG_TYPE_XDP,
10122 .errstr = "call stack",
10123 .result = REJECT,
10124 },
10125 {
10126 "calls: spill into caller stack frame",
10127 .insns = {
10128 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10129 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10130 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10131 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10132 BPF_EXIT_INSN(),
10133 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
10134 BPF_MOV64_IMM(BPF_REG_0, 0),
10135 BPF_EXIT_INSN(),
10136 },
10137 .prog_type = BPF_PROG_TYPE_XDP,
10138 .errstr = "cannot spill",
10139 .result = REJECT,
10140 },
10141 {
10142 "calls: write into caller stack frame",
10143 .insns = {
10144 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10145 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10146 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10147 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10148 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10149 BPF_EXIT_INSN(),
10150 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
10151 BPF_MOV64_IMM(BPF_REG_0, 0),
10152 BPF_EXIT_INSN(),
10153 },
10154 .prog_type = BPF_PROG_TYPE_XDP,
10155 .result = ACCEPT,
10156 .retval = 42,
10157 },
10158 {
10159 "calls: write into callee stack frame",
10160 .insns = {
10161 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10162 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
10163 BPF_EXIT_INSN(),
10164 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
10165 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
10166 BPF_EXIT_INSN(),
10167 },
10168 .prog_type = BPF_PROG_TYPE_XDP,
10169 .errstr = "cannot return stack pointer",
10170 .result = REJECT,
10171 },
10172 {
10173 "calls: two calls with stack write and void return",
10174 .insns = {
10175 /* main prog */
10176 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10177 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10178 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10179 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10180 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10181 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10182 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10183 BPF_EXIT_INSN(),
10184
10185 /* subprog 1 */
10186 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10187 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10188 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10189 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10190 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10191 BPF_EXIT_INSN(),
10192
10193 /* subprog 2 */
10194 /* write into stack frame of main prog */
10195 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
10196 BPF_EXIT_INSN(), /* void return */
10197 },
10198 .prog_type = BPF_PROG_TYPE_XDP,
10199 .result = ACCEPT,
10200 },
10201 {
10202 "calls: ambiguous return value",
10203 .insns = {
10204 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10205 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10206 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10207 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10208 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10209 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10210 BPF_EXIT_INSN(),
10211 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10212 BPF_MOV64_IMM(BPF_REG_0, 0),
10213 BPF_EXIT_INSN(),
10214 },
10215 .errstr_unpriv = "allowed for root only",
10216 .result_unpriv = REJECT,
10217 .errstr = "R0 !read_ok",
10218 .result = REJECT,
10219 },
10220 {
10221 "calls: two calls that return map_value",
10222 .insns = {
10223 /* main prog */
10224 /* pass fp-16, fp-8 into a function */
10225 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10226 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10227 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10228 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10229 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10230
10231 /* fetch map_value_ptr from the stack of this function */
10232 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
10233 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10234 /* write into map value */
10235 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10236 /* fetch secound map_value_ptr from the stack */
10237 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10238 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10239 /* write into map value */
10240 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10241 BPF_MOV64_IMM(BPF_REG_0, 0),
10242 BPF_EXIT_INSN(),
10243
10244 /* subprog 1 */
10245 /* call 3rd function twice */
10246 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10247 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10248 /* first time with fp-8 */
10249 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10250 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10251 /* second time with fp-16 */
10252 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10253 BPF_EXIT_INSN(),
10254
10255 /* subprog 2 */
10256 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10257 /* lookup from map */
10258 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10259 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10261 BPF_LD_MAP_FD(BPF_REG_1, 0),
10262 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10263 BPF_FUNC_map_lookup_elem),
10264 /* write map_value_ptr into stack frame of main prog */
10265 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10266 BPF_MOV64_IMM(BPF_REG_0, 0),
10267 BPF_EXIT_INSN(), /* return 0 */
10268 },
10269 .prog_type = BPF_PROG_TYPE_XDP,
10270 .fixup_map1 = { 23 },
10271 .result = ACCEPT,
10272 },
10273 {
10274 "calls: two calls that return map_value with bool condition",
10275 .insns = {
10276 /* main prog */
10277 /* pass fp-16, fp-8 into a function */
10278 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10280 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10282 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10283 BPF_MOV64_IMM(BPF_REG_0, 0),
10284 BPF_EXIT_INSN(),
10285
10286 /* subprog 1 */
10287 /* call 3rd function twice */
10288 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10289 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10290 /* first time with fp-8 */
10291 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
10292 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10293 /* fetch map_value_ptr from the stack of this function */
10294 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10295 /* write into map value */
10296 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10297 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10298 /* second time with fp-16 */
10299 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10300 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10301 /* fetch secound map_value_ptr from the stack */
10302 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
10303 /* write into map value */
10304 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10305 BPF_EXIT_INSN(),
10306
10307 /* subprog 2 */
10308 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10309 /* lookup from map */
10310 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10311 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10312 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10313 BPF_LD_MAP_FD(BPF_REG_1, 0),
10314 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10315 BPF_FUNC_map_lookup_elem),
10316 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10317 BPF_MOV64_IMM(BPF_REG_0, 0),
10318 BPF_EXIT_INSN(), /* return 0 */
10319 /* write map_value_ptr into stack frame of main prog */
10320 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10321 BPF_MOV64_IMM(BPF_REG_0, 1),
10322 BPF_EXIT_INSN(), /* return 1 */
10323 },
10324 .prog_type = BPF_PROG_TYPE_XDP,
10325 .fixup_map1 = { 23 },
10326 .result = ACCEPT,
10327 },
10328 {
10329 "calls: two calls that return map_value with incorrect bool check",
10330 .insns = {
10331 /* main prog */
10332 /* pass fp-16, fp-8 into a function */
10333 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10334 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10335 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10336 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10337 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10338 BPF_MOV64_IMM(BPF_REG_0, 0),
10339 BPF_EXIT_INSN(),
10340
10341 /* subprog 1 */
10342 /* call 3rd function twice */
10343 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10344 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10345 /* first time with fp-8 */
10346 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
10347 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10348 /* fetch map_value_ptr from the stack of this function */
10349 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10350 /* write into map value */
10351 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10352 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10353 /* second time with fp-16 */
10354 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10355 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10356 /* fetch secound map_value_ptr from the stack */
10357 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
10358 /* write into map value */
10359 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10360 BPF_EXIT_INSN(),
10361
10362 /* subprog 2 */
10363 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10364 /* lookup from map */
10365 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10366 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10367 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10368 BPF_LD_MAP_FD(BPF_REG_1, 0),
10369 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10370 BPF_FUNC_map_lookup_elem),
10371 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10372 BPF_MOV64_IMM(BPF_REG_0, 0),
10373 BPF_EXIT_INSN(), /* return 0 */
10374 /* write map_value_ptr into stack frame of main prog */
10375 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10376 BPF_MOV64_IMM(BPF_REG_0, 1),
10377 BPF_EXIT_INSN(), /* return 1 */
10378 },
10379 .prog_type = BPF_PROG_TYPE_XDP,
10380 .fixup_map1 = { 23 },
10381 .result = REJECT,
10382 .errstr = "invalid read from stack off -16+0 size 8",
10383 },
10384 {
10385 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
10386 .insns = {
10387 /* main prog */
10388 /* pass fp-16, fp-8 into a function */
10389 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10390 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10391 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10392 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10393 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10394 BPF_MOV64_IMM(BPF_REG_0, 0),
10395 BPF_EXIT_INSN(),
10396
10397 /* subprog 1 */
10398 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10399 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10400 /* 1st lookup from map */
10401 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10402 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10403 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10404 BPF_LD_MAP_FD(BPF_REG_1, 0),
10405 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10406 BPF_FUNC_map_lookup_elem),
10407 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10408 BPF_MOV64_IMM(BPF_REG_8, 0),
10409 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10410 /* write map_value_ptr into stack frame of main prog at fp-8 */
10411 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10412 BPF_MOV64_IMM(BPF_REG_8, 1),
10413
10414 /* 2nd lookup from map */
10415 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
10416 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10417 BPF_LD_MAP_FD(BPF_REG_1, 0),
10418 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
10419 BPF_FUNC_map_lookup_elem),
10420 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10421 BPF_MOV64_IMM(BPF_REG_9, 0),
10422 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10423 /* write map_value_ptr into stack frame of main prog at fp-16 */
10424 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10425 BPF_MOV64_IMM(BPF_REG_9, 1),
10426
10427 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10428 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
10429 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10430 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10431 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10432 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), /* 34 */
10433 BPF_EXIT_INSN(),
10434
10435 /* subprog 2 */
10436 /* if arg2 == 1 do *arg1 = 0 */
10437 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10438 /* fetch map_value_ptr from the stack of this function */
10439 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10440 /* write into map value */
10441 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10442
10443 /* if arg4 == 1 do *arg3 = 0 */
10444 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10445 /* fetch map_value_ptr from the stack of this function */
10446 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10447 /* write into map value */
10448 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
10449 BPF_EXIT_INSN(),
10450 },
10451 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10452 .fixup_map1 = { 12, 22 },
10453 .result = REJECT,
10454 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
10455 },
10456 {
10457 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
10458 .insns = {
10459 /* main prog */
10460 /* pass fp-16, fp-8 into a function */
10461 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10462 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10463 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10464 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10465 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10466 BPF_MOV64_IMM(BPF_REG_0, 0),
10467 BPF_EXIT_INSN(),
10468
10469 /* subprog 1 */
10470 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10471 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10472 /* 1st lookup from map */
10473 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10474 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10475 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10476 BPF_LD_MAP_FD(BPF_REG_1, 0),
10477 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10478 BPF_FUNC_map_lookup_elem),
10479 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10480 BPF_MOV64_IMM(BPF_REG_8, 0),
10481 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10482 /* write map_value_ptr into stack frame of main prog at fp-8 */
10483 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10484 BPF_MOV64_IMM(BPF_REG_8, 1),
10485
10486 /* 2nd lookup from map */
10487 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
10488 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10489 BPF_LD_MAP_FD(BPF_REG_1, 0),
10490 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
10491 BPF_FUNC_map_lookup_elem),
10492 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10493 BPF_MOV64_IMM(BPF_REG_9, 0),
10494 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10495 /* write map_value_ptr into stack frame of main prog at fp-16 */
10496 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10497 BPF_MOV64_IMM(BPF_REG_9, 1),
10498
10499 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10500 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
10501 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10502 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10503 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10504 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), /* 34 */
10505 BPF_EXIT_INSN(),
10506
10507 /* subprog 2 */
10508 /* if arg2 == 1 do *arg1 = 0 */
10509 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10510 /* fetch map_value_ptr from the stack of this function */
10511 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10512 /* write into map value */
10513 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10514
10515 /* if arg4 == 1 do *arg3 = 0 */
10516 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10517 /* fetch map_value_ptr from the stack of this function */
10518 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10519 /* write into map value */
10520 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10521 BPF_EXIT_INSN(),
10522 },
10523 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10524 .fixup_map1 = { 12, 22 },
10525 .result = ACCEPT,
10526 },
10527 {
10528 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
10529 .insns = {
10530 /* main prog */
10531 /* pass fp-16, fp-8 into a function */
10532 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10533 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10534 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10535 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10536 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
10537 BPF_MOV64_IMM(BPF_REG_0, 0),
10538 BPF_EXIT_INSN(),
10539
10540 /* subprog 1 */
10541 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10542 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10543 /* 1st lookup from map */
10544 BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
10545 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10546 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
10547 BPF_LD_MAP_FD(BPF_REG_1, 0),
10548 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10549 BPF_FUNC_map_lookup_elem),
10550 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10551 BPF_MOV64_IMM(BPF_REG_8, 0),
10552 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10553 /* write map_value_ptr into stack frame of main prog at fp-8 */
10554 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10555 BPF_MOV64_IMM(BPF_REG_8, 1),
10556
10557 /* 2nd lookup from map */
10558 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
10560 BPF_LD_MAP_FD(BPF_REG_1, 0),
10561 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10562 BPF_FUNC_map_lookup_elem),
10563 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10564 BPF_MOV64_IMM(BPF_REG_9, 0), // 26
10565 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10566 /* write map_value_ptr into stack frame of main prog at fp-16 */
10567 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10568 BPF_MOV64_IMM(BPF_REG_9, 1),
10569
10570 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10571 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
10572 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10573 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10574 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10575 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
10576 BPF_JMP_IMM(BPF_JA, 0, 0, -30),
10577
10578 /* subprog 2 */
10579 /* if arg2 == 1 do *arg1 = 0 */
10580 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10581 /* fetch map_value_ptr from the stack of this function */
10582 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10583 /* write into map value */
10584 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10585
10586 /* if arg4 == 1 do *arg3 = 0 */
10587 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10588 /* fetch map_value_ptr from the stack of this function */
10589 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10590 /* write into map value */
10591 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
10592 BPF_JMP_IMM(BPF_JA, 0, 0, -8),
10593 },
10594 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10595 .fixup_map1 = { 12, 22 },
10596 .result = REJECT,
10597 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
10598 },
10599 {
10600 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
10601 .insns = {
10602 /* main prog */
10603 /* pass fp-16, fp-8 into a function */
10604 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10605 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10606 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10607 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10608 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10609 BPF_MOV64_IMM(BPF_REG_0, 0),
10610 BPF_EXIT_INSN(),
10611
10612 /* subprog 1 */
10613 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10614 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10615 /* 1st lookup from map */
10616 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10617 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10618 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10619 BPF_LD_MAP_FD(BPF_REG_1, 0),
10620 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10621 BPF_FUNC_map_lookup_elem),
10622 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10623 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10624 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10625 BPF_MOV64_IMM(BPF_REG_8, 0),
10626 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10627 BPF_MOV64_IMM(BPF_REG_8, 1),
10628
10629 /* 2nd lookup from map */
10630 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10631 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10632 BPF_LD_MAP_FD(BPF_REG_1, 0),
10633 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10634 BPF_FUNC_map_lookup_elem),
10635 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10636 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10637 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10638 BPF_MOV64_IMM(BPF_REG_9, 0),
10639 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10640 BPF_MOV64_IMM(BPF_REG_9, 1),
10641
10642 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10643 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10644 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10645 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10646 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10647 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10648 BPF_EXIT_INSN(),
10649
10650 /* subprog 2 */
10651 /* if arg2 == 1 do *arg1 = 0 */
10652 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10653 /* fetch map_value_ptr from the stack of this function */
10654 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10655 /* write into map value */
10656 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10657
10658 /* if arg4 == 1 do *arg3 = 0 */
10659 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10660 /* fetch map_value_ptr from the stack of this function */
10661 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10662 /* write into map value */
10663 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10664 BPF_EXIT_INSN(),
10665 },
10666 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10667 .fixup_map1 = { 12, 22 },
10668 .result = ACCEPT,
10669 },
10670 {
10671 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
10672 .insns = {
10673 /* main prog */
10674 /* pass fp-16, fp-8 into a function */
10675 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10676 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10677 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10678 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10679 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10680 BPF_MOV64_IMM(BPF_REG_0, 0),
10681 BPF_EXIT_INSN(),
10682
10683 /* subprog 1 */
10684 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10685 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10686 /* 1st lookup from map */
10687 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10688 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10689 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10690 BPF_LD_MAP_FD(BPF_REG_1, 0),
10691 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10692 BPF_FUNC_map_lookup_elem),
10693 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10694 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10695 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10696 BPF_MOV64_IMM(BPF_REG_8, 0),
10697 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10698 BPF_MOV64_IMM(BPF_REG_8, 1),
10699
10700 /* 2nd lookup from map */
10701 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10702 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10703 BPF_LD_MAP_FD(BPF_REG_1, 0),
10704 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10705 BPF_FUNC_map_lookup_elem),
10706 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10707 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10708 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10709 BPF_MOV64_IMM(BPF_REG_9, 0),
10710 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10711 BPF_MOV64_IMM(BPF_REG_9, 1),
10712
10713 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10714 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10715 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10716 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10717 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10718 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10719 BPF_EXIT_INSN(),
10720
10721 /* subprog 2 */
10722 /* if arg2 == 1 do *arg1 = 0 */
10723 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10724 /* fetch map_value_ptr from the stack of this function */
10725 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10726 /* write into map value */
10727 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10728
10729 /* if arg4 == 0 do *arg3 = 0 */
10730 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
10731 /* fetch map_value_ptr from the stack of this function */
10732 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10733 /* write into map value */
10734 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10735 BPF_EXIT_INSN(),
10736 },
10737 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10738 .fixup_map1 = { 12, 22 },
10739 .result = REJECT,
10740 .errstr = "R0 invalid mem access 'inv'",
10741 },
10742 {
10743 "calls: pkt_ptr spill into caller stack",
10744 .insns = {
10745 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10746 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10747 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10748 BPF_EXIT_INSN(),
10749
10750 /* subprog 1 */
10751 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10752 offsetof(struct __sk_buff, data)),
10753 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10754 offsetof(struct __sk_buff, data_end)),
10755 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10756 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10757 /* spill unchecked pkt_ptr into stack of caller */
10758 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10759 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10760 /* now the pkt range is verified, read pkt_ptr from stack */
10761 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10762 /* write 4 bytes into packet */
10763 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10764 BPF_EXIT_INSN(),
10765 },
10766 .result = ACCEPT,
10767 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10768 .retval = POINTER_VALUE,
10769 },
10770 {
10771 "calls: pkt_ptr spill into caller stack 2",
10772 .insns = {
10773 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10774 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10775 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10776 /* Marking is still kept, but not in all cases safe. */
10777 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10778 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10779 BPF_EXIT_INSN(),
10780
10781 /* subprog 1 */
10782 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10783 offsetof(struct __sk_buff, data)),
10784 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10785 offsetof(struct __sk_buff, data_end)),
10786 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10787 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10788 /* spill unchecked pkt_ptr into stack of caller */
10789 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10790 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10791 /* now the pkt range is verified, read pkt_ptr from stack */
10792 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10793 /* write 4 bytes into packet */
10794 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10795 BPF_EXIT_INSN(),
10796 },
10797 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10798 .errstr = "invalid access to packet",
10799 .result = REJECT,
10800 },
10801 {
10802 "calls: pkt_ptr spill into caller stack 3",
10803 .insns = {
10804 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10805 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10806 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10807 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
10808 /* Marking is still kept and safe here. */
10809 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10810 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10811 BPF_EXIT_INSN(),
10812
10813 /* subprog 1 */
10814 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10815 offsetof(struct __sk_buff, data)),
10816 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10817 offsetof(struct __sk_buff, data_end)),
10818 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10819 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10820 /* spill unchecked pkt_ptr into stack of caller */
10821 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10822 BPF_MOV64_IMM(BPF_REG_5, 0),
10823 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
10824 BPF_MOV64_IMM(BPF_REG_5, 1),
10825 /* now the pkt range is verified, read pkt_ptr from stack */
10826 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10827 /* write 4 bytes into packet */
10828 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10829 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10830 BPF_EXIT_INSN(),
10831 },
10832 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10833 .result = ACCEPT,
10834 .retval = 1,
10835 },
10836 {
10837 "calls: pkt_ptr spill into caller stack 4",
10838 .insns = {
10839 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10840 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10841 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10842 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
10843 /* Check marking propagated. */
10844 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10845 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10846 BPF_EXIT_INSN(),
10847
10848 /* subprog 1 */
10849 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10850 offsetof(struct __sk_buff, data)),
10851 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10852 offsetof(struct __sk_buff, data_end)),
10853 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10854 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10855 /* spill unchecked pkt_ptr into stack of caller */
10856 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10857 BPF_MOV64_IMM(BPF_REG_5, 0),
10858 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10859 BPF_MOV64_IMM(BPF_REG_5, 1),
10860 /* don't read back pkt_ptr from stack here */
10861 /* write 4 bytes into packet */
10862 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10863 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10864 BPF_EXIT_INSN(),
10865 },
10866 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10867 .result = ACCEPT,
10868 .retval = 1,
10869 },
10870 {
10871 "calls: pkt_ptr spill into caller stack 5",
10872 .insns = {
10873 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10874 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10875 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
10876 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10877 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10878 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
10879 BPF_EXIT_INSN(),
10880
10881 /* subprog 1 */
10882 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10883 offsetof(struct __sk_buff, data)),
10884 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10885 offsetof(struct __sk_buff, data_end)),
10886 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10887 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10888 BPF_MOV64_IMM(BPF_REG_5, 0),
10889 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
10890 /* spill checked pkt_ptr into stack of caller */
10891 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10892 BPF_MOV64_IMM(BPF_REG_5, 1),
10893 /* don't read back pkt_ptr from stack here */
10894 /* write 4 bytes into packet */
10895 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10896 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10897 BPF_EXIT_INSN(),
10898 },
10899 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10900 .errstr = "same insn cannot be used with different",
10901 .result = REJECT,
10902 },
10903 {
10904 "calls: pkt_ptr spill into caller stack 6",
10905 .insns = {
10906 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10907 offsetof(struct __sk_buff, data_end)),
10908 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10909 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10910 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10911 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10912 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10913 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
10914 BPF_EXIT_INSN(),
10915
10916 /* subprog 1 */
10917 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10918 offsetof(struct __sk_buff, data)),
10919 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10920 offsetof(struct __sk_buff, data_end)),
10921 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10922 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10923 BPF_MOV64_IMM(BPF_REG_5, 0),
10924 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
10925 /* spill checked pkt_ptr into stack of caller */
10926 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10927 BPF_MOV64_IMM(BPF_REG_5, 1),
10928 /* don't read back pkt_ptr from stack here */
10929 /* write 4 bytes into packet */
10930 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10931 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10932 BPF_EXIT_INSN(),
10933 },
10934 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10935 .errstr = "R4 invalid mem access",
10936 .result = REJECT,
10937 },
10938 {
10939 "calls: pkt_ptr spill into caller stack 7",
10940 .insns = {
10941 BPF_MOV64_IMM(BPF_REG_2, 0),
10942 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10943 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10944 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10945 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10946 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10947 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
10948 BPF_EXIT_INSN(),
10949
10950 /* subprog 1 */
10951 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10952 offsetof(struct __sk_buff, data)),
10953 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10954 offsetof(struct __sk_buff, data_end)),
10955 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10956 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10957 BPF_MOV64_IMM(BPF_REG_5, 0),
10958 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
10959 /* spill checked pkt_ptr into stack of caller */
10960 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10961 BPF_MOV64_IMM(BPF_REG_5, 1),
10962 /* don't read back pkt_ptr from stack here */
10963 /* write 4 bytes into packet */
10964 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10965 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10966 BPF_EXIT_INSN(),
10967 },
10968 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10969 .errstr = "R4 invalid mem access",
10970 .result = REJECT,
10971 },
10972 {
10973 "calls: pkt_ptr spill into caller stack 8",
10974 .insns = {
10975 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10976 offsetof(struct __sk_buff, data)),
10977 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10978 offsetof(struct __sk_buff, data_end)),
10979 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10980 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10981 BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
10982 BPF_EXIT_INSN(),
10983 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10984 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10985 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10986 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10987 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10988 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
10989 BPF_EXIT_INSN(),
10990
10991 /* subprog 1 */
10992 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10993 offsetof(struct __sk_buff, data)),
10994 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10995 offsetof(struct __sk_buff, data_end)),
10996 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10998 BPF_MOV64_IMM(BPF_REG_5, 0),
10999 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11000 /* spill checked pkt_ptr into stack of caller */
11001 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11002 BPF_MOV64_IMM(BPF_REG_5, 1),
11003 /* don't read back pkt_ptr from stack here */
11004 /* write 4 bytes into packet */
11005 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11006 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11007 BPF_EXIT_INSN(),
11008 },
11009 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11010 .result = ACCEPT,
11011 },
11012 {
11013 "calls: pkt_ptr spill into caller stack 9",
11014 .insns = {
11015 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11016 offsetof(struct __sk_buff, data)),
11017 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11018 offsetof(struct __sk_buff, data_end)),
11019 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11020 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11021 BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11022 BPF_EXIT_INSN(),
11023 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11024 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11025 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11026 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11027 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11028 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11029 BPF_EXIT_INSN(),
11030
11031 /* subprog 1 */
11032 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11033 offsetof(struct __sk_buff, data)),
11034 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11035 offsetof(struct __sk_buff, data_end)),
11036 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11037 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11038 BPF_MOV64_IMM(BPF_REG_5, 0),
11039 /* spill unchecked pkt_ptr into stack of caller */
11040 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11041 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11042 BPF_MOV64_IMM(BPF_REG_5, 1),
11043 /* don't read back pkt_ptr from stack here */
11044 /* write 4 bytes into packet */
11045 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11046 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11047 BPF_EXIT_INSN(),
11048 },
11049 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11050 .errstr = "invalid access to packet",
11051 .result = REJECT,
11052 },
11053 {
11054 "calls: caller stack init to zero or map_value_or_null",
11055 .insns = {
11056 BPF_MOV64_IMM(BPF_REG_0, 0),
11057 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11058 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11059 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11060 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11061 /* fetch map_value_or_null or const_zero from stack */
11062 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11063 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11064 /* store into map_value */
11065 BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
11066 BPF_EXIT_INSN(),
11067
11068 /* subprog 1 */
11069 /* if (ctx == 0) return; */
11070 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
11071 /* else bpf_map_lookup() and *(fp - 8) = r0 */
11072 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
11073 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11074 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11075 BPF_LD_MAP_FD(BPF_REG_1, 0),
11076 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11077 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11078 BPF_FUNC_map_lookup_elem),
11079 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11080 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11081 BPF_EXIT_INSN(),
11082 },
11083 .fixup_map1 = { 13 },
11084 .result = ACCEPT,
11085 .prog_type = BPF_PROG_TYPE_XDP,
11086 },
11087 {
11088 "calls: stack init to zero and pruning",
11089 .insns = {
11090 /* first make allocated_stack 16 byte */
11091 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
11092 /* now fork the execution such that the false branch
11093 * of JGT insn will be verified second and it skisp zero
11094 * init of fp-8 stack slot. If stack liveness marking
11095 * is missing live_read marks from call map_lookup
11096 * processing then pruning will incorrectly assume
11097 * that fp-8 stack slot was unused in the fall-through
11098 * branch and will accept the program incorrectly
11099 */
11100 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
11101 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11102 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
11103 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11104 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11105 BPF_LD_MAP_FD(BPF_REG_1, 0),
11106 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11107 BPF_FUNC_map_lookup_elem),
11108 BPF_EXIT_INSN(),
11109 },
11110 .fixup_map2 = { 6 },
11111 .errstr = "invalid indirect read from stack off -8+0 size 8",
11112 .result = REJECT,
11113 .prog_type = BPF_PROG_TYPE_XDP,
11114 },
11115 {
11116 "search pruning: all branches should be verified (nop operation)",
11117 .insns = {
11118 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11119 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11120 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11121 BPF_LD_MAP_FD(BPF_REG_1, 0),
11122 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11123 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
11124 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11125 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11126 BPF_MOV64_IMM(BPF_REG_4, 0),
11127 BPF_JMP_A(1),
11128 BPF_MOV64_IMM(BPF_REG_4, 1),
11129 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11130 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11131 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11132 BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
11133 BPF_MOV64_IMM(BPF_REG_6, 0),
11134 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
11135 BPF_EXIT_INSN(),
11136 },
11137 .fixup_map1 = { 3 },
11138 .errstr = "R6 invalid mem access 'inv'",
11139 .result = REJECT,
11140 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11141 },
11142 {
11143 "search pruning: all branches should be verified (invalid stack access)",
11144 .insns = {
11145 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11146 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11147 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11148 BPF_LD_MAP_FD(BPF_REG_1, 0),
11149 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11150 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
11151 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11152 BPF_MOV64_IMM(BPF_REG_4, 0),
11153 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11154 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11155 BPF_JMP_A(1),
11156 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
11157 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11158 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11159 BPF_EXIT_INSN(),
11160 },
11161 .fixup_map1 = { 3 },
11162 .errstr = "invalid read from stack off -16+0 size 8",
11163 .result = REJECT,
11164 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11165 },
11166 };
11167
11168 static int probe_filter_length(const struct bpf_insn *fp)
11169 {
11170 int len;
11171
11172 for (len = MAX_INSNS - 1; len > 0; --len)
11173 if (fp[len].code != 0 || fp[len].imm != 0)
11174 break;
11175 return len + 1;
11176 }
11177
11178 static int create_map(uint32_t size_value, uint32_t max_elem)
11179 {
11180 int fd;
11181
11182 fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
11183 size_value, max_elem, BPF_F_NO_PREALLOC);
11184 if (fd < 0)
11185 printf("Failed to create hash map '%s'!\n", strerror(errno));
11186
11187 return fd;
11188 }
11189
11190 static int create_prog_array(void)
11191 {
11192 int fd;
11193
11194 fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
11195 sizeof(int), 4, 0);
11196 if (fd < 0)
11197 printf("Failed to create prog array '%s'!\n", strerror(errno));
11198
11199 return fd;
11200 }
11201
11202 static int create_map_in_map(void)
11203 {
11204 int inner_map_fd, outer_map_fd;
11205
11206 inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
11207 sizeof(int), 1, 0);
11208 if (inner_map_fd < 0) {
11209 printf("Failed to create array '%s'!\n", strerror(errno));
11210 return inner_map_fd;
11211 }
11212
11213 outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
11214 sizeof(int), inner_map_fd, 1, 0);
11215 if (outer_map_fd < 0)
11216 printf("Failed to create array of maps '%s'!\n",
11217 strerror(errno));
11218
11219 close(inner_map_fd);
11220
11221 return outer_map_fd;
11222 }
11223
11224 static char bpf_vlog[32768];
11225
11226 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
11227 int *map_fds)
11228 {
11229 int *fixup_map1 = test->fixup_map1;
11230 int *fixup_map2 = test->fixup_map2;
11231 int *fixup_prog = test->fixup_prog;
11232 int *fixup_map_in_map = test->fixup_map_in_map;
11233
11234 /* Allocating HTs with 1 elem is fine here, since we only test
11235 * for verifier and not do a runtime lookup, so the only thing
11236 * that really matters is value size in this case.
11237 */
11238 if (*fixup_map1) {
11239 map_fds[0] = create_map(sizeof(long long), 1);
11240 do {
11241 prog[*fixup_map1].imm = map_fds[0];
11242 fixup_map1++;
11243 } while (*fixup_map1);
11244 }
11245
11246 if (*fixup_map2) {
11247 map_fds[1] = create_map(sizeof(struct test_val), 1);
11248 do {
11249 prog[*fixup_map2].imm = map_fds[1];
11250 fixup_map2++;
11251 } while (*fixup_map2);
11252 }
11253
11254 if (*fixup_prog) {
11255 map_fds[2] = create_prog_array();
11256 do {
11257 prog[*fixup_prog].imm = map_fds[2];
11258 fixup_prog++;
11259 } while (*fixup_prog);
11260 }
11261
11262 if (*fixup_map_in_map) {
11263 map_fds[3] = create_map_in_map();
11264 do {
11265 prog[*fixup_map_in_map].imm = map_fds[3];
11266 fixup_map_in_map++;
11267 } while (*fixup_map_in_map);
11268 }
11269 }
11270
11271 static void do_test_single(struct bpf_test *test, bool unpriv,
11272 int *passes, int *errors)
11273 {
11274 int fd_prog, expected_ret, reject_from_alignment;
11275 struct bpf_insn *prog = test->insns;
11276 int prog_len = probe_filter_length(prog);
11277 char data_in[TEST_DATA_LEN] = {};
11278 int prog_type = test->prog_type;
11279 int map_fds[MAX_NR_MAPS];
11280 const char *expected_err;
11281 uint32_t retval;
11282 int i, err;
11283
11284 for (i = 0; i < MAX_NR_MAPS; i++)
11285 map_fds[i] = -1;
11286
11287 do_test_fixup(test, prog, map_fds);
11288
11289 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
11290 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
11291 "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
11292
11293 expected_ret = unpriv && test->result_unpriv != UNDEF ?
11294 test->result_unpriv : test->result;
11295 expected_err = unpriv && test->errstr_unpriv ?
11296 test->errstr_unpriv : test->errstr;
11297
11298 reject_from_alignment = fd_prog < 0 &&
11299 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
11300 strstr(bpf_vlog, "Unknown alignment.");
11301 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
11302 if (reject_from_alignment) {
11303 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
11304 strerror(errno));
11305 goto fail_log;
11306 }
11307 #endif
11308 if (expected_ret == ACCEPT) {
11309 if (fd_prog < 0 && !reject_from_alignment) {
11310 printf("FAIL\nFailed to load prog '%s'!\n",
11311 strerror(errno));
11312 goto fail_log;
11313 }
11314 } else {
11315 if (fd_prog >= 0) {
11316 printf("FAIL\nUnexpected success to load!\n");
11317 goto fail_log;
11318 }
11319 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
11320 printf("FAIL\nUnexpected error message!\n");
11321 goto fail_log;
11322 }
11323 }
11324
11325 if (fd_prog >= 0) {
11326 err = bpf_prog_test_run(fd_prog, 1, data_in, sizeof(data_in),
11327 NULL, NULL, &retval, NULL);
11328 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
11329 printf("Unexpected bpf_prog_test_run error\n");
11330 goto fail_log;
11331 }
11332 if (!err && retval != test->retval &&
11333 test->retval != POINTER_VALUE) {
11334 printf("FAIL retval %d != %d\n", retval, test->retval);
11335 goto fail_log;
11336 }
11337 }
11338 (*passes)++;
11339 printf("OK%s\n", reject_from_alignment ?
11340 " (NOTE: reject due to unknown alignment)" : "");
11341 close_fds:
11342 close(fd_prog);
11343 for (i = 0; i < MAX_NR_MAPS; i++)
11344 close(map_fds[i]);
11345 sched_yield();
11346 return;
11347 fail_log:
11348 (*errors)++;
11349 printf("%s", bpf_vlog);
11350 goto close_fds;
11351 }
11352
11353 static bool is_admin(void)
11354 {
11355 cap_t caps;
11356 cap_flag_value_t sysadmin = CAP_CLEAR;
11357 const cap_value_t cap_val = CAP_SYS_ADMIN;
11358
11359 #ifdef CAP_IS_SUPPORTED
11360 if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
11361 perror("cap_get_flag");
11362 return false;
11363 }
11364 #endif
11365 caps = cap_get_proc();
11366 if (!caps) {
11367 perror("cap_get_proc");
11368 return false;
11369 }
11370 if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
11371 perror("cap_get_flag");
11372 if (cap_free(caps))
11373 perror("cap_free");
11374 return (sysadmin == CAP_SET);
11375 }
11376
11377 static int set_admin(bool admin)
11378 {
11379 cap_t caps;
11380 const cap_value_t cap_val = CAP_SYS_ADMIN;
11381 int ret = -1;
11382
11383 caps = cap_get_proc();
11384 if (!caps) {
11385 perror("cap_get_proc");
11386 return -1;
11387 }
11388 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
11389 admin ? CAP_SET : CAP_CLEAR)) {
11390 perror("cap_set_flag");
11391 goto out;
11392 }
11393 if (cap_set_proc(caps)) {
11394 perror("cap_set_proc");
11395 goto out;
11396 }
11397 ret = 0;
11398 out:
11399 if (cap_free(caps))
11400 perror("cap_free");
11401 return ret;
11402 }
11403
11404 static int do_test(bool unpriv, unsigned int from, unsigned int to)
11405 {
11406 int i, passes = 0, errors = 0;
11407
11408 for (i = from; i < to; i++) {
11409 struct bpf_test *test = &tests[i];
11410
11411 /* Program types that are not supported by non-root we
11412 * skip right away.
11413 */
11414 if (!test->prog_type) {
11415 if (!unpriv)
11416 set_admin(false);
11417 printf("#%d/u %s ", i, test->descr);
11418 do_test_single(test, true, &passes, &errors);
11419 if (!unpriv)
11420 set_admin(true);
11421 }
11422
11423 if (!unpriv) {
11424 printf("#%d/p %s ", i, test->descr);
11425 do_test_single(test, false, &passes, &errors);
11426 }
11427 }
11428
11429 printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
11430 return errors ? EXIT_FAILURE : EXIT_SUCCESS;
11431 }
11432
11433 int main(int argc, char **argv)
11434 {
11435 struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
11436 struct rlimit rlim = { 1 << 20, 1 << 20 };
11437 unsigned int from = 0, to = ARRAY_SIZE(tests);
11438 bool unpriv = !is_admin();
11439
11440 if (argc == 3) {
11441 unsigned int l = atoi(argv[argc - 2]);
11442 unsigned int u = atoi(argv[argc - 1]);
11443
11444 if (l < to && u < to) {
11445 from = l;
11446 to = u + 1;
11447 }
11448 } else if (argc == 2) {
11449 unsigned int t = atoi(argv[argc - 1]);
11450
11451 if (t < to) {
11452 from = t;
11453 to = t + 1;
11454 }
11455 }
11456
11457 setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
11458 return do_test(unpriv, from, to);
11459 }
CRIS linux kernel tree