tools/testing/selftests/bpf/verifier/helper_packet_access.c

   1 {
   2         "helper access to packet: test1, valid packet_ptr range",
   3         .insns = {
   4         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
   5         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
   6                     offsetof(struct xdp_md, data_end)),
   7         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   8         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   9         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
  10         BPF_LD_MAP_FD(BPF_REG_1, 0),
  11         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
  12         BPF_MOV64_IMM(BPF_REG_4, 0),
  13         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
  14         BPF_MOV64_IMM(BPF_REG_0, 0),
  15         BPF_EXIT_INSN(),
  16         },
  17         .fixup_map_hash_8b = { 5 },
  18         .result_unpriv = ACCEPT,
  19         .result = ACCEPT,
  20         .prog_type = BPF_PROG_TYPE_XDP,
  21 },
  22 {
  23         "helper access to packet: test2, unchecked packet_ptr",
  24         .insns = {
  25         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
  26         BPF_LD_MAP_FD(BPF_REG_1, 0),
  27         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  28         BPF_MOV64_IMM(BPF_REG_0, 0),
  29         BPF_EXIT_INSN(),
  30         },
  31         .fixup_map_hash_8b = { 1 },
  32         .result = REJECT,
  33         .errstr = "invalid access to packet",
  34         .prog_type = BPF_PROG_TYPE_XDP,
  35 },
  36 {
  37         "helper access to packet: test3, variable add",
  38         .insns = {
  39         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
  40         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
  41                         offsetof(struct xdp_md, data_end)),
  42         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
  43         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
  44         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
  45         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
  46         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
  47         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
  48         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
  49         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
  50         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
  51         BPF_LD_MAP_FD(BPF_REG_1, 0),
  52         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
  53         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  54         BPF_MOV64_IMM(BPF_REG_0, 0),
  55         BPF_EXIT_INSN(),
  56         },
  57         .fixup_map_hash_8b = { 11 },
  58         .result = ACCEPT,
  59         .prog_type = BPF_PROG_TYPE_XDP,
  60 },
  61 {
  62         "helper access to packet: test4, packet_ptr with bad range",
  63         .insns = {
  64         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
  65         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
  66                     offsetof(struct xdp_md, data_end)),
  67         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
  68         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
  69         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
  70         BPF_MOV64_IMM(BPF_REG_0, 0),
  71         BPF_EXIT_INSN(),
  72         BPF_LD_MAP_FD(BPF_REG_1, 0),
  73         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  74         BPF_MOV64_IMM(BPF_REG_0, 0),
  75         BPF_EXIT_INSN(),
  76         },
  77         .fixup_map_hash_8b = { 7 },
  78         .result = REJECT,
  79         .errstr = "invalid access to packet",
  80         .prog_type = BPF_PROG_TYPE_XDP,
  81 },
  82 {
  83         "helper access to packet: test5, packet_ptr with too short range",
  84         .insns = {
  85         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
  86         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
  87                     offsetof(struct xdp_md, data_end)),
  88         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
  89         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
  90         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
  91         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
  92         BPF_LD_MAP_FD(BPF_REG_1, 0),
  93         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  94         BPF_MOV64_IMM(BPF_REG_0, 0),
  95         BPF_EXIT_INSN(),
  96         },
  97         .fixup_map_hash_8b = { 6 },
  98         .result = REJECT,
  99         .errstr = "invalid access to packet",
 100         .prog_type = BPF_PROG_TYPE_XDP,
 101 },
 102 {
 103         "helper access to packet: test6, cls valid packet_ptr range",
 104         .insns = {
 105         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
 106                     offsetof(struct __sk_buff, data)),
 107         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
 108                     offsetof(struct __sk_buff, data_end)),
 109         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
 110         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
 111         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
 112         BPF_LD_MAP_FD(BPF_REG_1, 0),
 113         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 114         BPF_MOV64_IMM(BPF_REG_4, 0),
 115         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
 116         BPF_MOV64_IMM(BPF_REG_0, 0),
 117         BPF_EXIT_INSN(),
 118         },
 119         .fixup_map_hash_8b = { 5 },
 120         .result = ACCEPT,
 121         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 122 },
 123 {
 124         "helper access to packet: test7, cls unchecked packet_ptr",
 125         .insns = {
 126         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
 127                     offsetof(struct __sk_buff, data)),
 128         BPF_LD_MAP_FD(BPF_REG_1, 0),
 129         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 130         BPF_MOV64_IMM(BPF_REG_0, 0),
 131         BPF_EXIT_INSN(),
 132         },
 133         .fixup_map_hash_8b = { 1 },
 134         .result = REJECT,
 135         .errstr = "invalid access to packet",
 136         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 137 },
 138 {
 139         "helper access to packet: test8, cls variable add",
 140         .insns = {
 141         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
 142                         offsetof(struct __sk_buff, data)),
 143         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
 144                         offsetof(struct __sk_buff, data_end)),
 145         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
 146         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
 147         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
 148         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
 149         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
 150         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
 151         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
 152         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
 153         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
 154         BPF_LD_MAP_FD(BPF_REG_1, 0),
 155         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
 156         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 157         BPF_MOV64_IMM(BPF_REG_0, 0),
 158         BPF_EXIT_INSN(),
 159         },
 160         .fixup_map_hash_8b = { 11 },
 161         .result = ACCEPT,
 162         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 163 },
 164 {
 165         "helper access to packet: test9, cls packet_ptr with bad range",
 166         .insns = {
 167         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
 168                     offsetof(struct __sk_buff, data)),
 169         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
 170                     offsetof(struct __sk_buff, data_end)),
 171         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
 172         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
 173         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
 174         BPF_MOV64_IMM(BPF_REG_0, 0),
 175         BPF_EXIT_INSN(),
 176         BPF_LD_MAP_FD(BPF_REG_1, 0),
 177         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 178         BPF_MOV64_IMM(BPF_REG_0, 0),
 179         BPF_EXIT_INSN(),
 180         },
 181         .fixup_map_hash_8b = { 7 },
 182         .result = REJECT,
 183         .errstr = "invalid access to packet",
 184         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 185 },
 186 {
 187         "helper access to packet: test10, cls packet_ptr with too short range",
 188         .insns = {
 189         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
 190                     offsetof(struct __sk_buff, data)),
 191         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
 192                     offsetof(struct __sk_buff, data_end)),
 193         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
 194         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
 195         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
 196         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
 197         BPF_LD_MAP_FD(BPF_REG_1, 0),
 198         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 199         BPF_MOV64_IMM(BPF_REG_0, 0),
 200         BPF_EXIT_INSN(),
 201         },
 202         .fixup_map_hash_8b = { 6 },
 203         .result = REJECT,
 204         .errstr = "invalid access to packet",
 205         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 206 },
 207 {
 208         "helper access to packet: test11, cls unsuitable helper 1",
 209         .insns = {
 210         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 211                     offsetof(struct __sk_buff, data)),
 212         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 213                     offsetof(struct __sk_buff, data_end)),
 214         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 215         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
 216         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
 217         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
 218         BPF_MOV64_IMM(BPF_REG_2, 0),
 219         BPF_MOV64_IMM(BPF_REG_4, 42),
 220         BPF_MOV64_IMM(BPF_REG_5, 0),
 221         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes),
 222         BPF_MOV64_IMM(BPF_REG_0, 0),
 223         BPF_EXIT_INSN(),
 224         },
 225         .result = REJECT,
 226         .errstr = "helper access to the packet",
 227         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 228 },
 229 {
 230         "helper access to packet: test12, cls unsuitable helper 2",
 231         .insns = {
 232         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 233                     offsetof(struct __sk_buff, data)),
 234         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 235                     offsetof(struct __sk_buff, data_end)),
 236         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
 237         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
 238         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
 239         BPF_MOV64_IMM(BPF_REG_2, 0),
 240         BPF_MOV64_IMM(BPF_REG_4, 4),
 241         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
 242         BPF_MOV64_IMM(BPF_REG_0, 0),
 243         BPF_EXIT_INSN(),
 244         },
 245         .result = REJECT,
 246         .errstr = "helper access to the packet",
 247         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 248 },
 249 {
 250         "helper access to packet: test13, cls helper ok",
 251         .insns = {
 252         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 253                     offsetof(struct __sk_buff, data)),
 254         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 255                     offsetof(struct __sk_buff, data_end)),
 256         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 257         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 258         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 259         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 260         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 261         BPF_MOV64_IMM(BPF_REG_2, 4),
 262         BPF_MOV64_IMM(BPF_REG_3, 0),
 263         BPF_MOV64_IMM(BPF_REG_4, 0),
 264         BPF_MOV64_IMM(BPF_REG_5, 0),
 265         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 266         BPF_MOV64_IMM(BPF_REG_0, 0),
 267         BPF_EXIT_INSN(),
 268         },
 269         .result = ACCEPT,
 270         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 271 },
 272 {
 273         "helper access to packet: test14, cls helper ok sub",
 274         .insns = {
 275         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 276                     offsetof(struct __sk_buff, data)),
 277         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 278                     offsetof(struct __sk_buff, data_end)),
 279         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 280         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 281         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 282         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 283         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
 284         BPF_MOV64_IMM(BPF_REG_2, 4),
 285         BPF_MOV64_IMM(BPF_REG_3, 0),
 286         BPF_MOV64_IMM(BPF_REG_4, 0),
 287         BPF_MOV64_IMM(BPF_REG_5, 0),
 288         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 289         BPF_MOV64_IMM(BPF_REG_0, 0),
 290         BPF_EXIT_INSN(),
 291         },
 292         .result = ACCEPT,
 293         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 294 },
 295 {
 296         "helper access to packet: test15, cls helper fail sub",
 297         .insns = {
 298         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 299                     offsetof(struct __sk_buff, data)),
 300         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 301                     offsetof(struct __sk_buff, data_end)),
 302         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 303         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 304         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 305         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 306         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
 307         BPF_MOV64_IMM(BPF_REG_2, 4),
 308         BPF_MOV64_IMM(BPF_REG_3, 0),
 309         BPF_MOV64_IMM(BPF_REG_4, 0),
 310         BPF_MOV64_IMM(BPF_REG_5, 0),
 311         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 312         BPF_MOV64_IMM(BPF_REG_0, 0),
 313         BPF_EXIT_INSN(),
 314         },
 315         .result = REJECT,
 316         .errstr = "invalid access to packet",
 317         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 318 },
 319 {
 320         "helper access to packet: test16, cls helper fail range 1",
 321         .insns = {
 322         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 323                     offsetof(struct __sk_buff, data)),
 324         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 325                     offsetof(struct __sk_buff, data_end)),
 326         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 327         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 328         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 329         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 330         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 331         BPF_MOV64_IMM(BPF_REG_2, 8),
 332         BPF_MOV64_IMM(BPF_REG_3, 0),
 333         BPF_MOV64_IMM(BPF_REG_4, 0),
 334         BPF_MOV64_IMM(BPF_REG_5, 0),
 335         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 336         BPF_MOV64_IMM(BPF_REG_0, 0),
 337         BPF_EXIT_INSN(),
 338         },
 339         .result = REJECT,
 340         .errstr = "invalid access to packet",
 341         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 342 },
 343 {
 344         "helper access to packet: test17, cls helper fail range 2",
 345         .insns = {
 346         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 347                     offsetof(struct __sk_buff, data)),
 348         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 349                     offsetof(struct __sk_buff, data_end)),
 350         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 351         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 352         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 353         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 354         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 355         BPF_MOV64_IMM(BPF_REG_2, -9),
 356         BPF_MOV64_IMM(BPF_REG_3, 0),
 357         BPF_MOV64_IMM(BPF_REG_4, 0),
 358         BPF_MOV64_IMM(BPF_REG_5, 0),
 359         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 360         BPF_MOV64_IMM(BPF_REG_0, 0),
 361         BPF_EXIT_INSN(),
 362         },
 363         .result = REJECT,
 364         .errstr = "R2 min value is negative",
 365         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 366 },
 367 {
 368         "helper access to packet: test18, cls helper fail range 3",
 369         .insns = {
 370         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 371                     offsetof(struct __sk_buff, data)),
 372         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 373                     offsetof(struct __sk_buff, data_end)),
 374         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 375         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 376         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 377         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 378         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 379         BPF_MOV64_IMM(BPF_REG_2, ~0),
 380         BPF_MOV64_IMM(BPF_REG_3, 0),
 381         BPF_MOV64_IMM(BPF_REG_4, 0),
 382         BPF_MOV64_IMM(BPF_REG_5, 0),
 383         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 384         BPF_MOV64_IMM(BPF_REG_0, 0),
 385         BPF_EXIT_INSN(),
 386         },
 387         .result = REJECT,
 388         .errstr = "R2 min value is negative",
 389         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 390 },
 391 {
 392         "helper access to packet: test19, cls helper range zero",
 393         .insns = {
 394         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 395                     offsetof(struct __sk_buff, data)),
 396         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 397                     offsetof(struct __sk_buff, data_end)),
 398         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 399         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 400         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 401         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 402         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 403         BPF_MOV64_IMM(BPF_REG_2, 0),
 404         BPF_MOV64_IMM(BPF_REG_3, 0),
 405         BPF_MOV64_IMM(BPF_REG_4, 0),
 406         BPF_MOV64_IMM(BPF_REG_5, 0),
 407         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 408         BPF_MOV64_IMM(BPF_REG_0, 0),
 409         BPF_EXIT_INSN(),
 410         },
 411         .result = ACCEPT,
 412         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 413 },
 414 {
 415         "helper access to packet: test20, pkt end as input",
 416         .insns = {
 417         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 418                     offsetof(struct __sk_buff, data)),
 419         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 420                     offsetof(struct __sk_buff, data_end)),
 421         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 422         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 423         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 424         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 425         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
 426         BPF_MOV64_IMM(BPF_REG_2, 4),
 427         BPF_MOV64_IMM(BPF_REG_3, 0),
 428         BPF_MOV64_IMM(BPF_REG_4, 0),
 429         BPF_MOV64_IMM(BPF_REG_5, 0),
 430         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 431         BPF_MOV64_IMM(BPF_REG_0, 0),
 432         BPF_EXIT_INSN(),
 433         },
 434         .result = REJECT,
 435         .errstr = "R1 type=pkt_end expected=fp",
 436         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 437 },
 438 {
 439         "helper access to packet: test21, wrong reg",
 440         .insns = {
 441         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
 442                     offsetof(struct __sk_buff, data)),
 443         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 444                     offsetof(struct __sk_buff, data_end)),
 445         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
 446         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 447         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
 448         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
 449         BPF_MOV64_IMM(BPF_REG_2, 4),
 450         BPF_MOV64_IMM(BPF_REG_3, 0),
 451         BPF_MOV64_IMM(BPF_REG_4, 0),
 452         BPF_MOV64_IMM(BPF_REG_5, 0),
 453         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
 454         BPF_MOV64_IMM(BPF_REG_0, 0),
 455         BPF_EXIT_INSN(),
 456         },
 457         .result = REJECT,
 458         .errstr = "invalid access to packet",
 459         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 460 },