tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c

   1 {
   2         "bounds checks mixing signed and unsigned, positive bounds",
   3         .insns = {
   4         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
   5         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
   6         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
   7         BPF_LD_MAP_FD(BPF_REG_1, 0),
   8         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
   9         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
  10         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
  11         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
  12         BPF_MOV64_IMM(BPF_REG_2, 2),
  13         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
  14         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
  15         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
  16         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
  17         BPF_MOV64_IMM(BPF_REG_0, 0),
  18         BPF_EXIT_INSN(),
  19         },
  20         .fixup_map_hash_8b = { 3 },
  21         .errstr = "unbounded min value",
  22         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
  23         .result = REJECT,
  24 },
  25 {
  26         "bounds checks mixing signed and unsigned",
  27         .insns = {
  28         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  29         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  30         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  31         BPF_LD_MAP_FD(BPF_REG_1, 0),
  32         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  33         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
  34         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
  35         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
  36         BPF_MOV64_IMM(BPF_REG_2, -1),
  37         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
  38         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
  39         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
  40         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
  41         BPF_MOV64_IMM(BPF_REG_0, 0),
  42         BPF_EXIT_INSN(),
  43         },
  44         .fixup_map_hash_8b = { 3 },
  45         .errstr = "unbounded min value",
  46         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
  47         .result = REJECT,
  48 },
  49 {
  50         "bounds checks mixing signed and unsigned, variant 2",
  51         .insns = {
  52         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  53         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  54         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  55         BPF_LD_MAP_FD(BPF_REG_1, 0),
  56         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  57         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
  58         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
  59         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
  60         BPF_MOV64_IMM(BPF_REG_2, -1),
  61         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
  62         BPF_MOV64_IMM(BPF_REG_8, 0),
  63         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
  64         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
  65         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
  66         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
  67         BPF_MOV64_IMM(BPF_REG_0, 0),
  68         BPF_EXIT_INSN(),
  69         },
  70         .fixup_map_hash_8b = { 3 },
  71         .errstr = "unbounded min value",
  72         .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
  73         .result = REJECT,
  74 },
  75 {
  76         "bounds checks mixing signed and unsigned, variant 3",
  77         .insns = {
  78         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  79         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  80         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  81         BPF_LD_MAP_FD(BPF_REG_1, 0),
  82         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  83         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
  84         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
  85         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
  86         BPF_MOV64_IMM(BPF_REG_2, -1),
  87         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
  88         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
  89         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
  90         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
  91         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
  92         BPF_MOV64_IMM(BPF_REG_0, 0),
  93         BPF_EXIT_INSN(),
  94         },
  95         .fixup_map_hash_8b = { 3 },
  96         .errstr = "unbounded min value",
  97         .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
  98         .result = REJECT,
  99 },
 100 {
 101         "bounds checks mixing signed and unsigned, variant 4",
 102         .insns = {
 103         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 104         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 105         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 106         BPF_LD_MAP_FD(BPF_REG_1, 0),
 107         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 108         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
 109         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 110         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 111         BPF_MOV64_IMM(BPF_REG_2, 1),
 112         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
 113         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 114         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 115         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 116         BPF_MOV64_IMM(BPF_REG_0, 0),
 117         BPF_EXIT_INSN(),
 118         },
 119         .fixup_map_hash_8b = { 3 },
 120         .result = ACCEPT,
 121 },
 122 {
 123         "bounds checks mixing signed and unsigned, variant 5",
 124         .insns = {
 125         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 126         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 127         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 128         BPF_LD_MAP_FD(BPF_REG_1, 0),
 129         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 130         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 131         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 132         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 133         BPF_MOV64_IMM(BPF_REG_2, -1),
 134         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
 135         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
 136         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
 137         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
 138         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 139         BPF_MOV64_IMM(BPF_REG_0, 0),
 140         BPF_EXIT_INSN(),
 141         },
 142         .fixup_map_hash_8b = { 3 },
 143         .errstr = "unbounded min value",
 144         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 145         .result = REJECT,
 146 },
 147 {
 148         "bounds checks mixing signed and unsigned, variant 6",
 149         .insns = {
 150         BPF_MOV64_IMM(BPF_REG_2, 0),
 151         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
 152         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
 153         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 154         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
 155         BPF_MOV64_IMM(BPF_REG_6, -1),
 156         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
 157         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
 158         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
 159         BPF_MOV64_IMM(BPF_REG_5, 0),
 160         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
 161         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
 162         BPF_MOV64_IMM(BPF_REG_0, 0),
 163         BPF_EXIT_INSN(),
 164         },
 165         .errstr = "R4 min value is negative, either use unsigned",
 166         .result = REJECT,
 167 },
 168 {
 169         "bounds checks mixing signed and unsigned, variant 7",
 170         .insns = {
 171         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 172         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 173         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 174         BPF_LD_MAP_FD(BPF_REG_1, 0),
 175         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 176         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
 177         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 178         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 179         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
 180         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
 181         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 182         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 183         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 184         BPF_MOV64_IMM(BPF_REG_0, 0),
 185         BPF_EXIT_INSN(),
 186         },
 187         .fixup_map_hash_8b = { 3 },
 188         .result = ACCEPT,
 189 },
 190 {
 191         "bounds checks mixing signed and unsigned, variant 8",
 192         .insns = {
 193         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 194         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 195         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 196         BPF_LD_MAP_FD(BPF_REG_1, 0),
 197         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 198         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 199         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 200         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 201         BPF_MOV64_IMM(BPF_REG_2, -1),
 202         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
 203         BPF_MOV64_IMM(BPF_REG_0, 0),
 204         BPF_EXIT_INSN(),
 205         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 206         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 207         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 208         BPF_MOV64_IMM(BPF_REG_0, 0),
 209         BPF_EXIT_INSN(),
 210         },
 211         .fixup_map_hash_8b = { 3 },
 212         .errstr = "unbounded min value",
 213         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 214         .result = REJECT,
 215 },
 216 {
 217         "bounds checks mixing signed and unsigned, variant 9",
 218         .insns = {
 219         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 220         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 221         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 222         BPF_LD_MAP_FD(BPF_REG_1, 0),
 223         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 224         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
 225         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 226         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 227         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
 228         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
 229         BPF_MOV64_IMM(BPF_REG_0, 0),
 230         BPF_EXIT_INSN(),
 231         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 232         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 233         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 234         BPF_MOV64_IMM(BPF_REG_0, 0),
 235         BPF_EXIT_INSN(),
 236         },
 237         .fixup_map_hash_8b = { 3 },
 238         .result = ACCEPT,
 239 },
 240 {
 241         "bounds checks mixing signed and unsigned, variant 10",
 242         .insns = {
 243         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 244         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 245         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 246         BPF_LD_MAP_FD(BPF_REG_1, 0),
 247         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 248         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 249         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 250         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 251         BPF_MOV64_IMM(BPF_REG_2, 0),
 252         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
 253         BPF_MOV64_IMM(BPF_REG_0, 0),
 254         BPF_EXIT_INSN(),
 255         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 256         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 257         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 258         BPF_MOV64_IMM(BPF_REG_0, 0),
 259         BPF_EXIT_INSN(),
 260         },
 261         .fixup_map_hash_8b = { 3 },
 262         .errstr = "unbounded min value",
 263         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 264         .result = REJECT,
 265 },
 266 {
 267         "bounds checks mixing signed and unsigned, variant 11",
 268         .insns = {
 269         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 270         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 271         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 272         BPF_LD_MAP_FD(BPF_REG_1, 0),
 273         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 274         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 275         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 276         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 277         BPF_MOV64_IMM(BPF_REG_2, -1),
 278         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
 279         /* Dead branch. */
 280         BPF_MOV64_IMM(BPF_REG_0, 0),
 281         BPF_EXIT_INSN(),
 282         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 283         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 284         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 285         BPF_MOV64_IMM(BPF_REG_0, 0),
 286         BPF_EXIT_INSN(),
 287         },
 288         .fixup_map_hash_8b = { 3 },
 289         .errstr = "unbounded min value",
 290         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 291         .result = REJECT,
 292 },
 293 {
 294         "bounds checks mixing signed and unsigned, variant 12",
 295         .insns = {
 296         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 297         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 298         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 299         BPF_LD_MAP_FD(BPF_REG_1, 0),
 300         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 301         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 302         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 303         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 304         BPF_MOV64_IMM(BPF_REG_2, -6),
 305         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
 306         BPF_MOV64_IMM(BPF_REG_0, 0),
 307         BPF_EXIT_INSN(),
 308         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 309         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 310         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 311         BPF_MOV64_IMM(BPF_REG_0, 0),
 312         BPF_EXIT_INSN(),
 313         },
 314         .fixup_map_hash_8b = { 3 },
 315         .errstr = "unbounded min value",
 316         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 317         .result = REJECT,
 318 },
 319 {
 320         "bounds checks mixing signed and unsigned, variant 13",
 321         .insns = {
 322         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 323         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 324         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 325         BPF_LD_MAP_FD(BPF_REG_1, 0),
 326         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 327         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
 328         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 329         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 330         BPF_MOV64_IMM(BPF_REG_2, 2),
 331         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
 332         BPF_MOV64_IMM(BPF_REG_7, 1),
 333         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
 334         BPF_MOV64_IMM(BPF_REG_0, 0),
 335         BPF_EXIT_INSN(),
 336         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
 337         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
 338         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
 339         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 340         BPF_MOV64_IMM(BPF_REG_0, 0),
 341         BPF_EXIT_INSN(),
 342         },
 343         .fixup_map_hash_8b = { 3 },
 344         .errstr = "unbounded min value",
 345         .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds",
 346         .result = REJECT,
 347 },
 348 {
 349         "bounds checks mixing signed and unsigned, variant 14",
 350         .insns = {
 351         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
 352                     offsetof(struct __sk_buff, mark)),
 353         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 354         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 355         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 356         BPF_LD_MAP_FD(BPF_REG_1, 0),
 357         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 358         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
 359         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 360         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 361         BPF_MOV64_IMM(BPF_REG_2, -1),
 362         BPF_MOV64_IMM(BPF_REG_8, 2),
 363         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
 364         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
 365         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
 366         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 367         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 368         BPF_MOV64_IMM(BPF_REG_0, 0),
 369         BPF_EXIT_INSN(),
 370         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
 371         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
 372         },
 373         .fixup_map_hash_8b = { 4 },
 374         .errstr = "unbounded min value",
 375         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 376         .result = REJECT,
 377 },
 378 {
 379         "bounds checks mixing signed and unsigned, variant 15",
 380         .insns = {
 381         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 382         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 383         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 384         BPF_LD_MAP_FD(BPF_REG_1, 0),
 385         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 386         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
 387         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
 388         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
 389         BPF_MOV64_IMM(BPF_REG_2, -6),
 390         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
 391         BPF_MOV64_IMM(BPF_REG_0, 0),
 392         BPF_EXIT_INSN(),
 393         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
 394         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
 395         BPF_MOV64_IMM(BPF_REG_0, 0),
 396         BPF_EXIT_INSN(),
 397         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
 398         BPF_MOV64_IMM(BPF_REG_0, 0),
 399         BPF_EXIT_INSN(),
 400         },
 401         .fixup_map_hash_8b = { 3 },
 402         .errstr = "unbounded min value",
 403         .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
 404         .result = REJECT,
 405         .result_unpriv = REJECT,
 406 },