]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - tools/testing/selftests/bpf/test_verifier.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
bpf: add prog tag test case to bpf selftests
[mirror_ubuntu-artful-kernel.git] / tools / testing / selftests / bpf / test_verifier.c
CommitLineData
3c731eba
AS		 1/*
2 * Testsuite for eBPF verifier
3 *
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
9 */
5aa5bd14 10
3c731eba
AS		 11#include <stdio.h>
12#include <unistd.h>
3c731eba 13#include <errno.h>
3c731eba 14#include <string.h>
614cd3bd 15#include <stddef.h>
bf508877 16#include <stdbool.h>
5aa5bd14
DB		 17#include <sched.h>
18
bf508877 19#include <sys/resource.h>
3c731eba 20
5aa5bd14
DB		 21#include <linux/unistd.h>
22#include <linux/filter.h>
23#include <linux/bpf_perf_event.h>
24#include <linux/bpf.h>
25
26#include "../../../include/linux/filter.h"
27
28#include "bpf_sys.h"
29
30#ifndef ARRAY_SIZE
31# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
32#endif
3c731eba 33
5aa5bd14
DB		 34#define MAX_INSNS 512
35#define MAX_FIXUPS 8
bf508877 36
3c731eba
AS		 37struct bpf_test {
38 const char *descr;
39 struct bpf_insn insns[MAX_INSNS];
5aa5bd14
DB		 40 int fixup_map1[MAX_FIXUPS];
41 int fixup_map2[MAX_FIXUPS];
42 int fixup_prog[MAX_FIXUPS];
3c731eba 43 const char *errstr;
bf508877 44 const char *errstr_unpriv;
3c731eba 45 enum {
bf508877 46 UNDEF,
3c731eba
AS		 47 ACCEPT,
48 REJECT
bf508877 49 } result, result_unpriv;
d691f9e8 50 enum bpf_prog_type prog_type;
3c731eba
AS		 51};
52
48461135
JB		 53/* Note we want this to be 64 bit aligned so that the end of our array is
54 * actually the end of the structure.
55 */
56#define MAX_ENTRIES 11
5aa5bd14 57
48461135 58struct test_val {
5aa5bd14 59 unsigned int index;
48461135
JB		 60 int foo[MAX_ENTRIES];
61};
62
3c731eba
AS		 63static struct bpf_test tests[] = {
64 {
65 "add+sub+mul",
66 .insns = {
67 BPF_MOV64_IMM(BPF_REG_1, 1),
68 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
69 BPF_MOV64_IMM(BPF_REG_2, 3),
70 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
71 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
72 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
73 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
74 BPF_EXIT_INSN(),
75 },
76 .result = ACCEPT,
77 },
78 {
79 "unreachable",
80 .insns = {
81 BPF_EXIT_INSN(),
82 BPF_EXIT_INSN(),
83 },
84 .errstr = "unreachable",
85 .result = REJECT,
86 },
87 {
88 "unreachable2",
89 .insns = {
90 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
91 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
92 BPF_EXIT_INSN(),
93 },
94 .errstr = "unreachable",
95 .result = REJECT,
96 },
97 {
98 "out of range jump",
99 .insns = {
100 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
101 BPF_EXIT_INSN(),
102 },
103 .errstr = "jump out of range",
104 .result = REJECT,
105 },
106 {
107 "out of range jump2",
108 .insns = {
109 BPF_JMP_IMM(BPF_JA, 0, 0, -2),
110 BPF_EXIT_INSN(),
111 },
112 .errstr = "jump out of range",
113 .result = REJECT,
114 },
115 {
116 "test1 ld_imm64",
117 .insns = {
118 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
119 BPF_LD_IMM64(BPF_REG_0, 0),
120 BPF_LD_IMM64(BPF_REG_0, 0),
121 BPF_LD_IMM64(BPF_REG_0, 1),
122 BPF_LD_IMM64(BPF_REG_0, 1),
123 BPF_MOV64_IMM(BPF_REG_0, 2),
124 BPF_EXIT_INSN(),
125 },
126 .errstr = "invalid BPF_LD_IMM insn",
bf508877 127 .errstr_unpriv = "R1 pointer comparison",
3c731eba
AS		 128 .result = REJECT,
129 },
130 {
131 "test2 ld_imm64",
132 .insns = {
133 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
134 BPF_LD_IMM64(BPF_REG_0, 0),
135 BPF_LD_IMM64(BPF_REG_0, 0),
136 BPF_LD_IMM64(BPF_REG_0, 1),
137 BPF_LD_IMM64(BPF_REG_0, 1),
138 BPF_EXIT_INSN(),
139 },
140 .errstr = "invalid BPF_LD_IMM insn",
bf508877 141 .errstr_unpriv = "R1 pointer comparison",
3c731eba
AS		 142 .result = REJECT,
143 },
144 {
145 "test3 ld_imm64",
146 .insns = {
147 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
148 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
149 BPF_LD_IMM64(BPF_REG_0, 0),
150 BPF_LD_IMM64(BPF_REG_0, 0),
151 BPF_LD_IMM64(BPF_REG_0, 1),
152 BPF_LD_IMM64(BPF_REG_0, 1),
153 BPF_EXIT_INSN(),
154 },
155 .errstr = "invalid bpf_ld_imm64 insn",
156 .result = REJECT,
157 },
158 {
159 "test4 ld_imm64",
160 .insns = {
161 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
162 BPF_EXIT_INSN(),
163 },
164 .errstr = "invalid bpf_ld_imm64 insn",
165 .result = REJECT,
166 },
167 {
168 "test5 ld_imm64",
169 .insns = {
170 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
171 },
172 .errstr = "invalid bpf_ld_imm64 insn",
173 .result = REJECT,
174 },
175 {
176 "no bpf_exit",
177 .insns = {
178 BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
179 },
180 .errstr = "jump out of range",
181 .result = REJECT,
182 },
183 {
184 "loop (back-edge)",
185 .insns = {
186 BPF_JMP_IMM(BPF_JA, 0, 0, -1),
187 BPF_EXIT_INSN(),
188 },
189 .errstr = "back-edge",
190 .result = REJECT,
191 },
192 {
193 "loop2 (back-edge)",
194 .insns = {
195 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
196 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
197 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
198 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
199 BPF_EXIT_INSN(),
200 },
201 .errstr = "back-edge",
202 .result = REJECT,
203 },
204 {
205 "conditional loop",
206 .insns = {
207 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
208 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
209 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
210 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
211 BPF_EXIT_INSN(),
212 },
213 .errstr = "back-edge",
214 .result = REJECT,
215 },
216 {
217 "read uninitialized register",
218 .insns = {
219 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
220 BPF_EXIT_INSN(),
221 },
222 .errstr = "R2 !read_ok",
223 .result = REJECT,
224 },
225 {
226 "read invalid register",
227 .insns = {
228 BPF_MOV64_REG(BPF_REG_0, -1),
229 BPF_EXIT_INSN(),
230 },
231 .errstr = "R15 is invalid",
232 .result = REJECT,
233 },
234 {
235 "program doesn't init R0 before exit",
236 .insns = {
237 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
238 BPF_EXIT_INSN(),
239 },
240 .errstr = "R0 !read_ok",
241 .result = REJECT,
242 },
32bf08a6
AS		 243 {
244 "program doesn't init R0 before exit in all branches",
245 .insns = {
246 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
247 BPF_MOV64_IMM(BPF_REG_0, 1),
248 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
249 BPF_EXIT_INSN(),
250 },
251 .errstr = "R0 !read_ok",
bf508877 252 .errstr_unpriv = "R1 pointer comparison",
32bf08a6
AS		 253 .result = REJECT,
254 },
3c731eba
AS		 255 {
256 "stack out of bounds",
257 .insns = {
258 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
259 BPF_EXIT_INSN(),
260 },
261 .errstr = "invalid stack",
262 .result = REJECT,
263 },
264 {
265 "invalid call insn1",
266 .insns = {
267 BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
268 BPF_EXIT_INSN(),
269 },
270 .errstr = "BPF_CALL uses reserved",
271 .result = REJECT,
272 },
273 {
274 "invalid call insn2",
275 .insns = {
276 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
277 BPF_EXIT_INSN(),
278 },
279 .errstr = "BPF_CALL uses reserved",
280 .result = REJECT,
281 },
282 {
283 "invalid function call",
284 .insns = {
285 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
286 BPF_EXIT_INSN(),
287 },
e00c7b21 288 .errstr = "invalid func unknown#1234567",
3c731eba
AS		 289 .result = REJECT,
290 },
291 {
292 "uninitialized stack1",
293 .insns = {
294 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
296 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 297 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
298 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 299 BPF_EXIT_INSN(),
300 },
5aa5bd14 301 .fixup_map1 = { 2 },
3c731eba
AS		 302 .errstr = "invalid indirect read from stack",
303 .result = REJECT,
304 },
305 {
306 "uninitialized stack2",
307 .insns = {
308 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
309 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
310 BPF_EXIT_INSN(),
311 },
312 .errstr = "invalid read from stack",
313 .result = REJECT,
314 },
7d95b0ab
DB		 315 {
316 "invalid argument register",
317 .insns = {
5aa5bd14
DB		 318 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
319 BPF_FUNC_get_cgroup_classid),
320 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
321 BPF_FUNC_get_cgroup_classid),
7d95b0ab
DB		 322 BPF_EXIT_INSN(),
323 },
324 .errstr = "R1 !read_ok",
325 .result = REJECT,
326 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
327 },
328 {
329 "non-invalid argument register",
330 .insns = {
331 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
5aa5bd14
DB		 332 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
333 BPF_FUNC_get_cgroup_classid),
7d95b0ab 334 BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
5aa5bd14
DB		 335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
336 BPF_FUNC_get_cgroup_classid),
7d95b0ab
DB		 337 BPF_EXIT_INSN(),
338 },
339 .result = ACCEPT,
340 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
341 },
3c731eba
AS		 342 {
343 "check valid spill/fill",
344 .insns = {
345 /* spill R1(ctx) into stack */
346 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3c731eba
AS		 347 /* fill it back into R2 */
348 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3c731eba 349 /* should be able to access R0 = *(R2 + 8) */
f91fe17e
DB		 350 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
351 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3c731eba
AS		 352 BPF_EXIT_INSN(),
353 },
bf508877 354 .errstr_unpriv = "R0 leaks addr",
3c731eba 355 .result = ACCEPT,
bf508877 356 .result_unpriv = REJECT,
3c731eba 357 },
3f2050e2
DB		 358 {
359 "check valid spill/fill, skb mark",
360 .insns = {
361 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
362 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
363 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
364 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
365 offsetof(struct __sk_buff, mark)),
366 BPF_EXIT_INSN(),
367 },
368 .result = ACCEPT,
369 .result_unpriv = ACCEPT,
370 },
3c731eba
AS		 371 {
372 "check corrupted spill/fill",
373 .insns = {
374 /* spill R1(ctx) into stack */
375 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3c731eba
AS		 376 /* mess up with R1 pointer on stack */
377 BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
3c731eba
AS		 378 /* fill back into R0 should fail */
379 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3c731eba
AS		 380 BPF_EXIT_INSN(),
381 },
bf508877 382 .errstr_unpriv = "attempt to corrupt spilled",
3c731eba
AS		 383 .errstr = "corrupted spill",
384 .result = REJECT,
385 },
386 {
387 "invalid src register in STX",
388 .insns = {
389 BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
390 BPF_EXIT_INSN(),
391 },
392 .errstr = "R15 is invalid",
393 .result = REJECT,
394 },
395 {
396 "invalid dst register in STX",
397 .insns = {
398 BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
399 BPF_EXIT_INSN(),
400 },
401 .errstr = "R14 is invalid",
402 .result = REJECT,
403 },
404 {
405 "invalid dst register in ST",
406 .insns = {
407 BPF_ST_MEM(BPF_B, 14, -1, -1),
408 BPF_EXIT_INSN(),
409 },
410 .errstr = "R14 is invalid",
411 .result = REJECT,
412 },
413 {
414 "invalid src register in LDX",
415 .insns = {
416 BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
417 BPF_EXIT_INSN(),
418 },
419 .errstr = "R12 is invalid",
420 .result = REJECT,
421 },
422 {
423 "invalid dst register in LDX",
424 .insns = {
425 BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
426 BPF_EXIT_INSN(),
427 },
428 .errstr = "R11 is invalid",
429 .result = REJECT,
430 },
431 {
432 "junk insn",
433 .insns = {
434 BPF_RAW_INSN(0, 0, 0, 0, 0),
435 BPF_EXIT_INSN(),
436 },
437 .errstr = "invalid BPF_LD_IMM",
438 .result = REJECT,
439 },
440 {
441 "junk insn2",
442 .insns = {
443 BPF_RAW_INSN(1, 0, 0, 0, 0),
444 BPF_EXIT_INSN(),
445 },
446 .errstr = "BPF_LDX uses reserved fields",
447 .result = REJECT,
448 },
449 {
450 "junk insn3",
451 .insns = {
452 BPF_RAW_INSN(-1, 0, 0, 0, 0),
453 BPF_EXIT_INSN(),
454 },
455 .errstr = "invalid BPF_ALU opcode f0",
456 .result = REJECT,
457 },
458 {
459 "junk insn4",
460 .insns = {
461 BPF_RAW_INSN(-1, -1, -1, -1, -1),
462 BPF_EXIT_INSN(),
463 },
464 .errstr = "invalid BPF_ALU opcode f0",
465 .result = REJECT,
466 },
467 {
468 "junk insn5",
469 .insns = {
470 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
471 BPF_EXIT_INSN(),
472 },
473 .errstr = "BPF_ALU uses reserved fields",
474 .result = REJECT,
475 },
476 {
477 "misaligned read from stack",
478 .insns = {
479 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
480 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
481 BPF_EXIT_INSN(),
482 },
483 .errstr = "misaligned access",
484 .result = REJECT,
485 },
486 {
487 "invalid map_fd for function call",
488 .insns = {
489 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
490 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
492 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 493 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
494 BPF_FUNC_map_delete_elem),
3c731eba
AS		 495 BPF_EXIT_INSN(),
496 },
497 .errstr = "fd 0 is not pointing to valid bpf_map",
498 .result = REJECT,
499 },
500 {
501 "don't check return value before access",
502 .insns = {
503 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
504 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
505 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
506 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 507 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
508 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 509 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
510 BPF_EXIT_INSN(),
511 },
5aa5bd14 512 .fixup_map1 = { 3 },
3c731eba
AS		 513 .errstr = "R0 invalid mem access 'map_value_or_null'",
514 .result = REJECT,
515 },
516 {
517 "access memory with incorrect alignment",
518 .insns = {
519 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
520 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
521 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
522 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 523 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
524 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 525 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
526 BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
527 BPF_EXIT_INSN(),
528 },
5aa5bd14 529 .fixup_map1 = { 3 },
3c731eba
AS		 530 .errstr = "misaligned access",
531 .result = REJECT,
532 },
533 {
534 "sometimes access memory with incorrect alignment",
535 .insns = {
536 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
537 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
538 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
539 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 540 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
541 BPF_FUNC_map_lookup_elem),
3c731eba
AS		 542 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
543 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
544 BPF_EXIT_INSN(),
545 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
546 BPF_EXIT_INSN(),
547 },
5aa5bd14 548 .fixup_map1 = { 3 },
3c731eba 549 .errstr = "R0 invalid mem access",
bf508877 550 .errstr_unpriv = "R0 leaks addr",
3c731eba
AS		 551 .result = REJECT,
552 },
fd10c2ef
AS		 553 {
554 "jump test 1",
555 .insns = {
556 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
557 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
558 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
559 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
560 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
561 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
562 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
563 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
564 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
565 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
566 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
567 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
568 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
569 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
570 BPF_MOV64_IMM(BPF_REG_0, 0),
571 BPF_EXIT_INSN(),
572 },
bf508877
AS		 573 .errstr_unpriv = "R1 pointer comparison",
574 .result_unpriv = REJECT,
fd10c2ef
AS		 575 .result = ACCEPT,
576 },
577 {
578 "jump test 2",
579 .insns = {
580 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
581 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
582 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
583 BPF_JMP_IMM(BPF_JA, 0, 0, 14),
584 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
585 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
586 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
587 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
588 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
589 BPF_JMP_IMM(BPF_JA, 0, 0, 8),
590 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
591 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
592 BPF_JMP_IMM(BPF_JA, 0, 0, 5),
593 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
594 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
595 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
596 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
597 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
598 BPF_MOV64_IMM(BPF_REG_0, 0),
599 BPF_EXIT_INSN(),
600 },
bf508877
AS		 601 .errstr_unpriv = "R1 pointer comparison",
602 .result_unpriv = REJECT,
fd10c2ef
AS		 603 .result = ACCEPT,
604 },
605 {
606 "jump test 3",
607 .insns = {
608 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
609 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
610 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
611 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
612 BPF_JMP_IMM(BPF_JA, 0, 0, 19),
613 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
614 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
615 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
616 BPF_JMP_IMM(BPF_JA, 0, 0, 15),
617 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
618 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
619 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
620 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
621 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
622 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
623 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
624 BPF_JMP_IMM(BPF_JA, 0, 0, 7),
625 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
626 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
627 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
628 BPF_JMP_IMM(BPF_JA, 0, 0, 3),
629 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
630 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
631 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
632 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 633 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
634 BPF_FUNC_map_delete_elem),
fd10c2ef
AS		 635 BPF_EXIT_INSN(),
636 },
5aa5bd14 637 .fixup_map1 = { 24 },
bf508877
AS		 638 .errstr_unpriv = "R1 pointer comparison",
639 .result_unpriv = REJECT,
fd10c2ef
AS		 640 .result = ACCEPT,
641 },
642 {
643 "jump test 4",
644 .insns = {
645 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
646 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
647 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
648 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
649 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
650 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
651 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
652 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
653 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
654 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
655 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
656 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
657 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
658 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
659 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
660 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
661 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
662 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
663 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
664 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
665 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
666 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
667 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
668 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
669 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
670 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
671 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
672 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
673 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
674 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
675 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
676 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
677 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
678 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
679 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
680 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
681 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
682 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
683 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
684 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
685 BPF_MOV64_IMM(BPF_REG_0, 0),
686 BPF_EXIT_INSN(),
687 },
bf508877
AS		 688 .errstr_unpriv = "R1 pointer comparison",
689 .result_unpriv = REJECT,
fd10c2ef
AS		 690 .result = ACCEPT,
691 },
342ded40
AS		 692 {
693 "jump test 5",
694 .insns = {
695 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
696 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
697 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
698 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
699 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
700 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
701 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
702 BPF_MOV64_IMM(BPF_REG_0, 0),
703 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
704 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
705 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
706 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
707 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
708 BPF_MOV64_IMM(BPF_REG_0, 0),
709 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
710 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
711 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
712 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
713 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
714 BPF_MOV64_IMM(BPF_REG_0, 0),
715 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
716 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
717 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
718 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
719 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
720 BPF_MOV64_IMM(BPF_REG_0, 0),
721 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
722 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
723 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
724 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
725 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
726 BPF_MOV64_IMM(BPF_REG_0, 0),
727 BPF_EXIT_INSN(),
728 },
bf508877
AS		 729 .errstr_unpriv = "R1 pointer comparison",
730 .result_unpriv = REJECT,
342ded40
AS		 731 .result = ACCEPT,
732 },
614cd3bd
AS		 733 {
734 "access skb fields ok",
735 .insns = {
736 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
737 offsetof(struct __sk_buff, len)),
738 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
739 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
740 offsetof(struct __sk_buff, mark)),
741 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
742 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
743 offsetof(struct __sk_buff, pkt_type)),
744 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
745 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
746 offsetof(struct __sk_buff, queue_mapping)),
747 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
c2497395
AS		 748 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
749 offsetof(struct __sk_buff, protocol)),
750 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
751 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
752 offsetof(struct __sk_buff, vlan_present)),
753 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
754 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
755 offsetof(struct __sk_buff, vlan_tci)),
756 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
614cd3bd
AS		 757 BPF_EXIT_INSN(),
758 },
759 .result = ACCEPT,
760 },
761 {
762 "access skb fields bad1",
763 .insns = {
764 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
765 BPF_EXIT_INSN(),
766 },
767 .errstr = "invalid bpf_context access",
768 .result = REJECT,
769 },
770 {
771 "access skb fields bad2",
772 .insns = {
773 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
774 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
775 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
776 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
777 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 778 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
779 BPF_FUNC_map_lookup_elem),
614cd3bd
AS		 780 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
781 BPF_EXIT_INSN(),
782 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
783 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
784 offsetof(struct __sk_buff, pkt_type)),
785 BPF_EXIT_INSN(),
786 },
5aa5bd14 787 .fixup_map1 = { 4 },
614cd3bd 788 .errstr = "different pointers",
bf508877 789 .errstr_unpriv = "R1 pointer comparison",
614cd3bd
AS		 790 .result = REJECT,
791 },
792 {
793 "access skb fields bad3",
794 .insns = {
795 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
796 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
797 offsetof(struct __sk_buff, pkt_type)),
798 BPF_EXIT_INSN(),
799 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
800 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
801 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
802 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 803 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
804 BPF_FUNC_map_lookup_elem),
614cd3bd
AS		 805 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
806 BPF_EXIT_INSN(),
807 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
808 BPF_JMP_IMM(BPF_JA, 0, 0, -12),
809 },
5aa5bd14 810 .fixup_map1 = { 6 },
614cd3bd 811 .errstr = "different pointers",
bf508877 812 .errstr_unpriv = "R1 pointer comparison",
614cd3bd
AS		 813 .result = REJECT,
814 },
725f9dcd
AS		 815 {
816 "access skb fields bad4",
817 .insns = {
818 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
819 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
820 offsetof(struct __sk_buff, len)),
821 BPF_MOV64_IMM(BPF_REG_0, 0),
822 BPF_EXIT_INSN(),
823 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
824 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
825 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
826 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 827 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
828 BPF_FUNC_map_lookup_elem),
725f9dcd
AS		 829 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
830 BPF_EXIT_INSN(),
831 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
832 BPF_JMP_IMM(BPF_JA, 0, 0, -13),
833 },
5aa5bd14 834 .fixup_map1 = { 7 },
725f9dcd 835 .errstr = "different pointers",
bf508877 836 .errstr_unpriv = "R1 pointer comparison",
725f9dcd
AS		 837 .result = REJECT,
838 },
d691f9e8
AS		 839 {
840 "check skb->mark is not writeable by sockets",
841 .insns = {
842 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
843 offsetof(struct __sk_buff, mark)),
844 BPF_EXIT_INSN(),
845 },
846 .errstr = "invalid bpf_context access",
bf508877 847 .errstr_unpriv = "R1 leaks addr",
d691f9e8
AS		 848 .result = REJECT,
849 },
850 {
851 "check skb->tc_index is not writeable by sockets",
852 .insns = {
853 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
854 offsetof(struct __sk_buff, tc_index)),
855 BPF_EXIT_INSN(),
856 },
857 .errstr = "invalid bpf_context access",
bf508877 858 .errstr_unpriv = "R1 leaks addr",
d691f9e8
AS		 859 .result = REJECT,
860 },
861 {
62c7989b 862 "check cb access: byte",
d691f9e8 863 .insns = {
62c7989b
DB		 864 BPF_MOV64_IMM(BPF_REG_0, 0),
865 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
866 offsetof(struct __sk_buff, cb[0])),
867 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
868 offsetof(struct __sk_buff, cb[0]) + 1),
869 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
870 offsetof(struct __sk_buff, cb[0]) + 2),
871 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
872 offsetof(struct __sk_buff, cb[0]) + 3),
873 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
874 offsetof(struct __sk_buff, cb[1])),
875 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
876 offsetof(struct __sk_buff, cb[1]) + 1),
877 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
878 offsetof(struct __sk_buff, cb[1]) + 2),
879 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
880 offsetof(struct __sk_buff, cb[1]) + 3),
881 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
882 offsetof(struct __sk_buff, cb[2])),
883 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
884 offsetof(struct __sk_buff, cb[2]) + 1),
885 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
886 offsetof(struct __sk_buff, cb[2]) + 2),
887 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
888 offsetof(struct __sk_buff, cb[2]) + 3),
889 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
890 offsetof(struct __sk_buff, cb[3])),
891 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
892 offsetof(struct __sk_buff, cb[3]) + 1),
893 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
894 offsetof(struct __sk_buff, cb[3]) + 2),
895 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
896 offsetof(struct __sk_buff, cb[3]) + 3),
897 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
898 offsetof(struct __sk_buff, cb[4])),
899 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
900 offsetof(struct __sk_buff, cb[4]) + 1),
901 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
902 offsetof(struct __sk_buff, cb[4]) + 2),
903 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
904 offsetof(struct __sk_buff, cb[4]) + 3),
905 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
906 offsetof(struct __sk_buff, cb[0])),
907 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
908 offsetof(struct __sk_buff, cb[0]) + 1),
909 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
910 offsetof(struct __sk_buff, cb[0]) + 2),
911 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
912 offsetof(struct __sk_buff, cb[0]) + 3),
913 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
914 offsetof(struct __sk_buff, cb[1])),
915 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
916 offsetof(struct __sk_buff, cb[1]) + 1),
917 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
918 offsetof(struct __sk_buff, cb[1]) + 2),
919 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
920 offsetof(struct __sk_buff, cb[1]) + 3),
921 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
922 offsetof(struct __sk_buff, cb[2])),
923 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
924 offsetof(struct __sk_buff, cb[2]) + 1),
925 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
926 offsetof(struct __sk_buff, cb[2]) + 2),
927 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
928 offsetof(struct __sk_buff, cb[2]) + 3),
929 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
930 offsetof(struct __sk_buff, cb[3])),
931 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
932 offsetof(struct __sk_buff, cb[3]) + 1),
933 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
934 offsetof(struct __sk_buff, cb[3]) + 2),
935 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
936 offsetof(struct __sk_buff, cb[3]) + 3),
937 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
938 offsetof(struct __sk_buff, cb[4])),
939 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
940 offsetof(struct __sk_buff, cb[4]) + 1),
941 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
942 offsetof(struct __sk_buff, cb[4]) + 2),
943 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
944 offsetof(struct __sk_buff, cb[4]) + 3),
945 BPF_EXIT_INSN(),
946 },
947 .result = ACCEPT,
948 },
949 {
950 "check cb access: byte, oob 1",
951 .insns = {
952 BPF_MOV64_IMM(BPF_REG_0, 0),
953 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
954 offsetof(struct __sk_buff, cb[4]) + 4),
955 BPF_EXIT_INSN(),
956 },
957 .errstr = "invalid bpf_context access",
958 .result = REJECT,
959 },
960 {
961 "check cb access: byte, oob 2",
962 .insns = {
963 BPF_MOV64_IMM(BPF_REG_0, 0),
964 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
965 offsetof(struct __sk_buff, cb[0]) - 1),
966 BPF_EXIT_INSN(),
967 },
968 .errstr = "invalid bpf_context access",
969 .result = REJECT,
970 },
971 {
972 "check cb access: byte, oob 3",
973 .insns = {
974 BPF_MOV64_IMM(BPF_REG_0, 0),
975 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
976 offsetof(struct __sk_buff, cb[4]) + 4),
977 BPF_EXIT_INSN(),
978 },
979 .errstr = "invalid bpf_context access",
980 .result = REJECT,
981 },
982 {
983 "check cb access: byte, oob 4",
984 .insns = {
985 BPF_MOV64_IMM(BPF_REG_0, 0),
986 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
987 offsetof(struct __sk_buff, cb[0]) - 1),
988 BPF_EXIT_INSN(),
989 },
990 .errstr = "invalid bpf_context access",
991 .result = REJECT,
992 },
993 {
994 "check cb access: byte, wrong type",
995 .insns = {
996 BPF_MOV64_IMM(BPF_REG_0, 0),
997 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
998 offsetof(struct __sk_buff, cb[0])),
999 BPF_EXIT_INSN(),
1000 },
1001 .errstr = "invalid bpf_context access",
1002 .result = REJECT,
1003 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1004 },
1005 {
1006 "check cb access: half",
1007 .insns = {
1008 BPF_MOV64_IMM(BPF_REG_0, 0),
1009 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1010 offsetof(struct __sk_buff, cb[0])),
1011 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1012 offsetof(struct __sk_buff, cb[0]) + 2),
1013 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1014 offsetof(struct __sk_buff, cb[1])),
1015 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1016 offsetof(struct __sk_buff, cb[1]) + 2),
1017 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1018 offsetof(struct __sk_buff, cb[2])),
1019 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1020 offsetof(struct __sk_buff, cb[2]) + 2),
1021 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1022 offsetof(struct __sk_buff, cb[3])),
1023 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1024 offsetof(struct __sk_buff, cb[3]) + 2),
1025 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1026 offsetof(struct __sk_buff, cb[4])),
1027 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1028 offsetof(struct __sk_buff, cb[4]) + 2),
1029 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1030 offsetof(struct __sk_buff, cb[0])),
1031 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1032 offsetof(struct __sk_buff, cb[0]) + 2),
1033 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1034 offsetof(struct __sk_buff, cb[1])),
1035 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1036 offsetof(struct __sk_buff, cb[1]) + 2),
1037 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1038 offsetof(struct __sk_buff, cb[2])),
1039 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1040 offsetof(struct __sk_buff, cb[2]) + 2),
1041 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1042 offsetof(struct __sk_buff, cb[3])),
1043 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1044 offsetof(struct __sk_buff, cb[3]) + 2),
1045 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1046 offsetof(struct __sk_buff, cb[4])),
1047 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1048 offsetof(struct __sk_buff, cb[4]) + 2),
1049 BPF_EXIT_INSN(),
1050 },
1051 .result = ACCEPT,
1052 },
1053 {
1054 "check cb access: half, unaligned",
1055 .insns = {
1056 BPF_MOV64_IMM(BPF_REG_0, 0),
1057 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1058 offsetof(struct __sk_buff, cb[0]) + 1),
1059 BPF_EXIT_INSN(),
1060 },
1061 .errstr = "misaligned access",
1062 .result = REJECT,
1063 },
1064 {
1065 "check cb access: half, oob 1",
1066 .insns = {
1067 BPF_MOV64_IMM(BPF_REG_0, 0),
1068 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1069 offsetof(struct __sk_buff, cb[4]) + 4),
1070 BPF_EXIT_INSN(),
1071 },
1072 .errstr = "invalid bpf_context access",
1073 .result = REJECT,
1074 },
1075 {
1076 "check cb access: half, oob 2",
1077 .insns = {
1078 BPF_MOV64_IMM(BPF_REG_0, 0),
1079 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1080 offsetof(struct __sk_buff, cb[0]) - 2),
1081 BPF_EXIT_INSN(),
1082 },
1083 .errstr = "invalid bpf_context access",
1084 .result = REJECT,
1085 },
1086 {
1087 "check cb access: half, oob 3",
1088 .insns = {
1089 BPF_MOV64_IMM(BPF_REG_0, 0),
1090 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1091 offsetof(struct __sk_buff, cb[4]) + 4),
1092 BPF_EXIT_INSN(),
1093 },
1094 .errstr = "invalid bpf_context access",
1095 .result = REJECT,
1096 },
1097 {
1098 "check cb access: half, oob 4",
1099 .insns = {
1100 BPF_MOV64_IMM(BPF_REG_0, 0),
1101 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1102 offsetof(struct __sk_buff, cb[0]) - 2),
1103 BPF_EXIT_INSN(),
1104 },
1105 .errstr = "invalid bpf_context access",
1106 .result = REJECT,
1107 },
1108 {
1109 "check cb access: half, wrong type",
1110 .insns = {
1111 BPF_MOV64_IMM(BPF_REG_0, 0),
1112 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1113 offsetof(struct __sk_buff, cb[0])),
1114 BPF_EXIT_INSN(),
1115 },
1116 .errstr = "invalid bpf_context access",
1117 .result = REJECT,
1118 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1119 },
1120 {
1121 "check cb access: word",
1122 .insns = {
1123 BPF_MOV64_IMM(BPF_REG_0, 0),
1124 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1125 offsetof(struct __sk_buff, cb[0])),
1126 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1127 offsetof(struct __sk_buff, cb[1])),
1128 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1129 offsetof(struct __sk_buff, cb[2])),
1130 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1131 offsetof(struct __sk_buff, cb[3])),
1132 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1133 offsetof(struct __sk_buff, cb[4])),
1134 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1135 offsetof(struct __sk_buff, cb[0])),
1136 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1137 offsetof(struct __sk_buff, cb[1])),
1138 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1139 offsetof(struct __sk_buff, cb[2])),
1140 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1141 offsetof(struct __sk_buff, cb[3])),
1142 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1143 offsetof(struct __sk_buff, cb[4])),
1144 BPF_EXIT_INSN(),
1145 },
1146 .result = ACCEPT,
1147 },
1148 {
1149 "check cb access: word, unaligned 1",
1150 .insns = {
1151 BPF_MOV64_IMM(BPF_REG_0, 0),
1152 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1153 offsetof(struct __sk_buff, cb[0]) + 2),
1154 BPF_EXIT_INSN(),
1155 },
1156 .errstr = "misaligned access",
1157 .result = REJECT,
1158 },
1159 {
1160 "check cb access: word, unaligned 2",
1161 .insns = {
1162 BPF_MOV64_IMM(BPF_REG_0, 0),
1163 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1164 offsetof(struct __sk_buff, cb[4]) + 1),
1165 BPF_EXIT_INSN(),
1166 },
1167 .errstr = "misaligned access",
1168 .result = REJECT,
1169 },
1170 {
1171 "check cb access: word, unaligned 3",
1172 .insns = {
1173 BPF_MOV64_IMM(BPF_REG_0, 0),
1174 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1175 offsetof(struct __sk_buff, cb[4]) + 2),
1176 BPF_EXIT_INSN(),
1177 },
1178 .errstr = "misaligned access",
1179 .result = REJECT,
1180 },
1181 {
1182 "check cb access: word, unaligned 4",
1183 .insns = {
1184 BPF_MOV64_IMM(BPF_REG_0, 0),
1185 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1186 offsetof(struct __sk_buff, cb[4]) + 3),
1187 BPF_EXIT_INSN(),
1188 },
1189 .errstr = "misaligned access",
1190 .result = REJECT,
1191 },
1192 {
1193 "check cb access: double",
1194 .insns = {
1195 BPF_MOV64_IMM(BPF_REG_0, 0),
1196 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1197 offsetof(struct __sk_buff, cb[0])),
1198 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1199 offsetof(struct __sk_buff, cb[2])),
1200 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1201 offsetof(struct __sk_buff, cb[0])),
1202 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1203 offsetof(struct __sk_buff, cb[2])),
1204 BPF_EXIT_INSN(),
1205 },
1206 .result = ACCEPT,
1207 },
1208 {
1209 "check cb access: double, unaligned 1",
1210 .insns = {
1211 BPF_MOV64_IMM(BPF_REG_0, 0),
1212 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1213 offsetof(struct __sk_buff, cb[1])),
1214 BPF_EXIT_INSN(),
1215 },
1216 .errstr = "misaligned access",
1217 .result = REJECT,
1218 },
1219 {
1220 "check cb access: double, unaligned 2",
1221 .insns = {
1222 BPF_MOV64_IMM(BPF_REG_0, 0),
1223 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1224 offsetof(struct __sk_buff, cb[3])),
1225 BPF_EXIT_INSN(),
1226 },
1227 .errstr = "misaligned access",
1228 .result = REJECT,
1229 },
1230 {
1231 "check cb access: double, oob 1",
1232 .insns = {
1233 BPF_MOV64_IMM(BPF_REG_0, 0),
1234 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1235 offsetof(struct __sk_buff, cb[4])),
1236 BPF_EXIT_INSN(),
1237 },
1238 .errstr = "invalid bpf_context access",
1239 .result = REJECT,
1240 },
1241 {
1242 "check cb access: double, oob 2",
1243 .insns = {
1244 BPF_MOV64_IMM(BPF_REG_0, 0),
1245 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1246 offsetof(struct __sk_buff, cb[4]) + 8),
1247 BPF_EXIT_INSN(),
1248 },
1249 .errstr = "invalid bpf_context access",
1250 .result = REJECT,
1251 },
1252 {
1253 "check cb access: double, oob 3",
1254 .insns = {
1255 BPF_MOV64_IMM(BPF_REG_0, 0),
1256 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1257 offsetof(struct __sk_buff, cb[0]) - 8),
1258 BPF_EXIT_INSN(),
1259 },
1260 .errstr = "invalid bpf_context access",
1261 .result = REJECT,
1262 },
1263 {
1264 "check cb access: double, oob 4",
1265 .insns = {
1266 BPF_MOV64_IMM(BPF_REG_0, 0),
1267 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1268 offsetof(struct __sk_buff, cb[4])),
1269 BPF_EXIT_INSN(),
1270 },
1271 .errstr = "invalid bpf_context access",
1272 .result = REJECT,
1273 },
1274 {
1275 "check cb access: double, oob 5",
1276 .insns = {
1277 BPF_MOV64_IMM(BPF_REG_0, 0),
1278 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1279 offsetof(struct __sk_buff, cb[4]) + 8),
1280 BPF_EXIT_INSN(),
1281 },
1282 .errstr = "invalid bpf_context access",
1283 .result = REJECT,
1284 },
1285 {
1286 "check cb access: double, oob 6",
1287 .insns = {
1288 BPF_MOV64_IMM(BPF_REG_0, 0),
1289 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1290 offsetof(struct __sk_buff, cb[0]) - 8),
1291 BPF_EXIT_INSN(),
1292 },
1293 .errstr = "invalid bpf_context access",
1294 .result = REJECT,
1295 },
1296 {
1297 "check cb access: double, wrong type",
1298 .insns = {
1299 BPF_MOV64_IMM(BPF_REG_0, 0),
1300 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
d691f9e8
AS		 1301 offsetof(struct __sk_buff, cb[0])),
1302 BPF_EXIT_INSN(),
1303 },
1304 .errstr = "invalid bpf_context access",
1305 .result = REJECT,
62c7989b 1306 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
d691f9e8
AS		 1307 },
1308 {
1309 "check out of range skb->cb access",
1310 .insns = {
1311 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
bf508877 1312 offsetof(struct __sk_buff, cb[0]) + 256),
d691f9e8
AS		 1313 BPF_EXIT_INSN(),
1314 },
1315 .errstr = "invalid bpf_context access",
bf508877 1316 .errstr_unpriv = "",
d691f9e8
AS		 1317 .result = REJECT,
1318 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1319 },
1320 {
1321 "write skb fields from socket prog",
1322 .insns = {
1323 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1324 offsetof(struct __sk_buff, cb[4])),
1325 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1326 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1327 offsetof(struct __sk_buff, mark)),
1328 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1329 offsetof(struct __sk_buff, tc_index)),
1330 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1331 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1332 offsetof(struct __sk_buff, cb[0])),
1333 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1334 offsetof(struct __sk_buff, cb[2])),
1335 BPF_EXIT_INSN(),
1336 },
1337 .result = ACCEPT,
bf508877
AS		 1338 .errstr_unpriv = "R1 leaks addr",
1339 .result_unpriv = REJECT,
d691f9e8
AS		 1340 },
1341 {
1342 "write skb fields from tc_cls_act prog",
1343 .insns = {
1344 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1345 offsetof(struct __sk_buff, cb[0])),
1346 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1347 offsetof(struct __sk_buff, mark)),
1348 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1349 offsetof(struct __sk_buff, tc_index)),
1350 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1351 offsetof(struct __sk_buff, tc_index)),
1352 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1353 offsetof(struct __sk_buff, cb[3])),
1354 BPF_EXIT_INSN(),
1355 },
bf508877
AS		 1356 .errstr_unpriv = "",
1357 .result_unpriv = REJECT,
d691f9e8
AS		 1358 .result = ACCEPT,
1359 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1360 },
24b4d2ab
AG		 1361 {
1362 "PTR_TO_STACK store/load",
1363 .insns = {
1364 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1365 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1366 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1367 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1368 BPF_EXIT_INSN(),
1369 },
1370 .result = ACCEPT,
1371 },
1372 {
1373 "PTR_TO_STACK store/load - bad alignment on off",
1374 .insns = {
1375 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1377 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1378 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1379 BPF_EXIT_INSN(),
1380 },
1381 .result = REJECT,
1382 .errstr = "misaligned access off -6 size 8",
1383 },
1384 {
1385 "PTR_TO_STACK store/load - bad alignment on reg",
1386 .insns = {
1387 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1388 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1389 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1390 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1391 BPF_EXIT_INSN(),
1392 },
1393 .result = REJECT,
1394 .errstr = "misaligned access off -2 size 8",
1395 },
1396 {
1397 "PTR_TO_STACK store/load - out of bounds low",
1398 .insns = {
1399 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1401 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1402 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1403 BPF_EXIT_INSN(),
1404 },
1405 .result = REJECT,
1406 .errstr = "invalid stack off=-79992 size=8",
1407 },
1408 {
1409 "PTR_TO_STACK store/load - out of bounds high",
1410 .insns = {
1411 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1412 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1413 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1414 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1415 BPF_EXIT_INSN(),
1416 },
1417 .result = REJECT,
1418 .errstr = "invalid stack off=0 size=8",
1419 },
bf508877
AS		 1420 {
1421 "unpriv: return pointer",
1422 .insns = {
1423 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1424 BPF_EXIT_INSN(),
1425 },
1426 .result = ACCEPT,
1427 .result_unpriv = REJECT,
1428 .errstr_unpriv = "R0 leaks addr",
1429 },
1430 {
1431 "unpriv: add const to pointer",
1432 .insns = {
1433 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1434 BPF_MOV64_IMM(BPF_REG_0, 0),
1435 BPF_EXIT_INSN(),
1436 },
1437 .result = ACCEPT,
1438 .result_unpriv = REJECT,
1439 .errstr_unpriv = "R1 pointer arithmetic",
1440 },
1441 {
1442 "unpriv: add pointer to pointer",
1443 .insns = {
1444 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1445 BPF_MOV64_IMM(BPF_REG_0, 0),
1446 BPF_EXIT_INSN(),
1447 },
1448 .result = ACCEPT,
1449 .result_unpriv = REJECT,
1450 .errstr_unpriv = "R1 pointer arithmetic",
1451 },
1452 {
1453 "unpriv: neg pointer",
1454 .insns = {
1455 BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1456 BPF_MOV64_IMM(BPF_REG_0, 0),
1457 BPF_EXIT_INSN(),
1458 },
1459 .result = ACCEPT,
1460 .result_unpriv = REJECT,
1461 .errstr_unpriv = "R1 pointer arithmetic",
1462 },
1463 {
1464 "unpriv: cmp pointer with const",
1465 .insns = {
1466 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1467 BPF_MOV64_IMM(BPF_REG_0, 0),
1468 BPF_EXIT_INSN(),
1469 },
1470 .result = ACCEPT,
1471 .result_unpriv = REJECT,
1472 .errstr_unpriv = "R1 pointer comparison",
1473 },
1474 {
1475 "unpriv: cmp pointer with pointer",
1476 .insns = {
1477 BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1478 BPF_MOV64_IMM(BPF_REG_0, 0),
1479 BPF_EXIT_INSN(),
1480 },
1481 .result = ACCEPT,
1482 .result_unpriv = REJECT,
1483 .errstr_unpriv = "R10 pointer comparison",
1484 },
1485 {
1486 "unpriv: check that printk is disallowed",
1487 .insns = {
1488 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1489 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1490 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1491 BPF_MOV64_IMM(BPF_REG_2, 8),
1492 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
5aa5bd14
DB		 1493 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1494 BPF_FUNC_trace_printk),
bf508877
AS		 1495 BPF_MOV64_IMM(BPF_REG_0, 0),
1496 BPF_EXIT_INSN(),
1497 },
0eb6984f 1498 .errstr_unpriv = "unknown func bpf_trace_printk#6",
bf508877
AS		 1499 .result_unpriv = REJECT,
1500 .result = ACCEPT,
1501 },
1502 {
1503 "unpriv: pass pointer to helper function",
1504 .insns = {
1505 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1506 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1507 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1508 BPF_LD_MAP_FD(BPF_REG_1, 0),
1509 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1510 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
5aa5bd14
DB		 1511 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1512 BPF_FUNC_map_update_elem),
bf508877
AS		 1513 BPF_MOV64_IMM(BPF_REG_0, 0),
1514 BPF_EXIT_INSN(),
1515 },
5aa5bd14 1516 .fixup_map1 = { 3 },
bf508877
AS		 1517 .errstr_unpriv = "R4 leaks addr",
1518 .result_unpriv = REJECT,
1519 .result = ACCEPT,
1520 },
1521 {
1522 "unpriv: indirectly pass pointer on stack to helper function",
1523 .insns = {
1524 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1525 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1526 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1527 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 1528 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1529 BPF_FUNC_map_lookup_elem),
bf508877
AS		 1530 BPF_MOV64_IMM(BPF_REG_0, 0),
1531 BPF_EXIT_INSN(),
1532 },
5aa5bd14 1533 .fixup_map1 = { 3 },
bf508877
AS		 1534 .errstr = "invalid indirect read from stack off -8+0 size 8",
1535 .result = REJECT,
1536 },
1537 {
1538 "unpriv: mangle pointer on stack 1",
1539 .insns = {
1540 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1541 BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1542 BPF_MOV64_IMM(BPF_REG_0, 0),
1543 BPF_EXIT_INSN(),
1544 },
1545 .errstr_unpriv = "attempt to corrupt spilled",
1546 .result_unpriv = REJECT,
1547 .result = ACCEPT,
1548 },
1549 {
1550 "unpriv: mangle pointer on stack 2",
1551 .insns = {
1552 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1553 BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
1554 BPF_MOV64_IMM(BPF_REG_0, 0),
1555 BPF_EXIT_INSN(),
1556 },
1557 .errstr_unpriv = "attempt to corrupt spilled",
1558 .result_unpriv = REJECT,
1559 .result = ACCEPT,
1560 },
1561 {
1562 "unpriv: read pointer from stack in small chunks",
1563 .insns = {
1564 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1565 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
1566 BPF_MOV64_IMM(BPF_REG_0, 0),
1567 BPF_EXIT_INSN(),
1568 },
1569 .errstr = "invalid size",
1570 .result = REJECT,
1571 },
1572 {
1573 "unpriv: write pointer into ctx",
1574 .insns = {
1575 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
1576 BPF_MOV64_IMM(BPF_REG_0, 0),
1577 BPF_EXIT_INSN(),
1578 },
1579 .errstr_unpriv = "R1 leaks addr",
1580 .result_unpriv = REJECT,
1581 .errstr = "invalid bpf_context access",
1582 .result = REJECT,
1583 },
1a776b9c
DB		 1584 {
1585 "unpriv: spill/fill of ctx",
1586 .insns = {
1587 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1588 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1589 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1590 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1591 BPF_MOV64_IMM(BPF_REG_0, 0),
1592 BPF_EXIT_INSN(),
1593 },
1594 .result = ACCEPT,
1595 },
1596 {
1597 "unpriv: spill/fill of ctx 2",
1598 .insns = {
1599 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1600 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1601 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1602 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 1603 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1604 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 1605 BPF_EXIT_INSN(),
1606 },
1607 .result = ACCEPT,
1608 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1609 },
1610 {
1611 "unpriv: spill/fill of ctx 3",
1612 .insns = {
1613 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1614 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1615 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1616 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1617 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 1618 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1619 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 1620 BPF_EXIT_INSN(),
1621 },
1622 .result = REJECT,
1623 .errstr = "R1 type=fp expected=ctx",
1624 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1625 },
1626 {
1627 "unpriv: spill/fill of ctx 4",
1628 .insns = {
1629 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1630 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1631 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1632 BPF_MOV64_IMM(BPF_REG_0, 1),
5aa5bd14
DB		 1633 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
1634 BPF_REG_0, -8, 0),
1a776b9c 1635 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
5aa5bd14
DB		 1636 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1637 BPF_FUNC_get_hash_recalc),
1a776b9c
DB		 1638 BPF_EXIT_INSN(),
1639 },
1640 .result = REJECT,
1641 .errstr = "R1 type=inv expected=ctx",
1642 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1643 },
1644 {
1645 "unpriv: spill/fill of different pointers stx",
1646 .insns = {
1647 BPF_MOV64_IMM(BPF_REG_3, 42),
1648 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1649 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1650 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1651 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1652 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1653 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1654 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1655 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1656 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1657 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
1658 offsetof(struct __sk_buff, mark)),
1659 BPF_MOV64_IMM(BPF_REG_0, 0),
1660 BPF_EXIT_INSN(),
1661 },
1662 .result = REJECT,
1663 .errstr = "same insn cannot be used with different pointers",
1664 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1665 },
1666 {
1667 "unpriv: spill/fill of different pointers ldx",
1668 .insns = {
1669 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1670 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1671 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1672 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1673 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
1674 -(__s32)offsetof(struct bpf_perf_event_data,
1675 sample_period) - 8),
1676 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1677 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1678 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1679 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1680 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
1681 offsetof(struct bpf_perf_event_data,
1682 sample_period)),
1683 BPF_MOV64_IMM(BPF_REG_0, 0),
1684 BPF_EXIT_INSN(),
1685 },
1686 .result = REJECT,
1687 .errstr = "same insn cannot be used with different pointers",
1688 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
1689 },
bf508877
AS		 1690 {
1691 "unpriv: write pointer into map elem value",
1692 .insns = {
1693 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1694 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1695 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1696 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 1697 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1698 BPF_FUNC_map_lookup_elem),
bf508877
AS		 1699 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1700 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
1701 BPF_EXIT_INSN(),
1702 },
5aa5bd14 1703 .fixup_map1 = { 3 },
bf508877
AS		 1704 .errstr_unpriv = "R0 leaks addr",
1705 .result_unpriv = REJECT,
1706 .result = ACCEPT,
1707 },
1708 {
1709 "unpriv: partial copy of pointer",
1710 .insns = {
1711 BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
1712 BPF_MOV64_IMM(BPF_REG_0, 0),
1713 BPF_EXIT_INSN(),
1714 },
1715 .errstr_unpriv = "R10 partial copy",
1716 .result_unpriv = REJECT,
1717 .result = ACCEPT,
1718 },
1719 {
1720 "unpriv: pass pointer to tail_call",
1721 .insns = {
1722 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1723 BPF_LD_MAP_FD(BPF_REG_2, 0),
5aa5bd14
DB		 1724 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1725 BPF_FUNC_tail_call),
bf508877
AS		 1726 BPF_MOV64_IMM(BPF_REG_0, 0),
1727 BPF_EXIT_INSN(),
1728 },
5aa5bd14 1729 .fixup_prog = { 1 },
bf508877
AS		 1730 .errstr_unpriv = "R3 leaks addr into helper",
1731 .result_unpriv = REJECT,
1732 .result = ACCEPT,
1733 },
1734 {
1735 "unpriv: cmp map pointer with zero",
1736 .insns = {
1737 BPF_MOV64_IMM(BPF_REG_1, 0),
1738 BPF_LD_MAP_FD(BPF_REG_1, 0),
1739 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1740 BPF_MOV64_IMM(BPF_REG_0, 0),
1741 BPF_EXIT_INSN(),
1742 },
5aa5bd14 1743 .fixup_map1 = { 1 },
bf508877
AS		 1744 .errstr_unpriv = "R1 pointer comparison",
1745 .result_unpriv = REJECT,
1746 .result = ACCEPT,
1747 },
1748 {
1749 "unpriv: write into frame pointer",
1750 .insns = {
1751 BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
1752 BPF_MOV64_IMM(BPF_REG_0, 0),
1753 BPF_EXIT_INSN(),
1754 },
1755 .errstr = "frame pointer is read only",
1756 .result = REJECT,
1757 },
1a776b9c
DB		 1758 {
1759 "unpriv: spill/fill frame pointer",
1760 .insns = {
1761 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1762 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1763 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1764 BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
1765 BPF_MOV64_IMM(BPF_REG_0, 0),
1766 BPF_EXIT_INSN(),
1767 },
1768 .errstr = "frame pointer is read only",
1769 .result = REJECT,
1770 },
bf508877
AS		 1771 {
1772 "unpriv: cmp of frame pointer",
1773 .insns = {
1774 BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
1775 BPF_MOV64_IMM(BPF_REG_0, 0),
1776 BPF_EXIT_INSN(),
1777 },
1778 .errstr_unpriv = "R10 pointer comparison",
1779 .result_unpriv = REJECT,
1780 .result = ACCEPT,
1781 },
1782 {
1783 "unpriv: cmp of stack pointer",
1784 .insns = {
1785 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1786 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1787 BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
1788 BPF_MOV64_IMM(BPF_REG_0, 0),
1789 BPF_EXIT_INSN(),
1790 },
1791 .errstr_unpriv = "R2 pointer comparison",
1792 .result_unpriv = REJECT,
1793 .result = ACCEPT,
1794 },
1795 {
1796 "unpriv: obfuscate stack pointer",
1797 .insns = {
1798 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1800 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1801 BPF_MOV64_IMM(BPF_REG_0, 0),
1802 BPF_EXIT_INSN(),
1803 },
1804 .errstr_unpriv = "R2 pointer arithmetic",
1805 .result_unpriv = REJECT,
1806 .result = ACCEPT,
1807 },
3f2050e2
DB		 1808 {
1809 "raw_stack: no skb_load_bytes",
1810 .insns = {
1811 BPF_MOV64_IMM(BPF_REG_2, 4),
1812 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1814 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1815 BPF_MOV64_IMM(BPF_REG_4, 8),
1816 /* Call to skb_load_bytes() omitted. */
1817 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1818 BPF_EXIT_INSN(),
1819 },
1820 .result = REJECT,
1821 .errstr = "invalid read from stack off -8+0 size 8",
1822 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1823 },
7d95b0ab
DB		 1824 {
1825 "raw_stack: skb_load_bytes, negative len",
1826 .insns = {
1827 BPF_MOV64_IMM(BPF_REG_2, 4),
1828 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1829 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1830 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1831 BPF_MOV64_IMM(BPF_REG_4, -8),
5aa5bd14
DB		 1832 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1833 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 1834 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1835 BPF_EXIT_INSN(),
1836 },
1837 .result = REJECT,
1838 .errstr = "invalid stack type R3",
1839 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1840 },
1841 {
1842 "raw_stack: skb_load_bytes, negative len 2",
1843 .insns = {
1844 BPF_MOV64_IMM(BPF_REG_2, 4),
1845 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1846 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1847 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1848 BPF_MOV64_IMM(BPF_REG_4, ~0),
5aa5bd14
DB		 1849 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1850 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 1851 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1852 BPF_EXIT_INSN(),
1853 },
1854 .result = REJECT,
1855 .errstr = "invalid stack type R3",
1856 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1857 },
1858 {
1859 "raw_stack: skb_load_bytes, zero len",
1860 .insns = {
1861 BPF_MOV64_IMM(BPF_REG_2, 4),
1862 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1863 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1864 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1865 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 1866 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1867 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 1868 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1869 BPF_EXIT_INSN(),
1870 },
1871 .result = REJECT,
1872 .errstr = "invalid stack type R3",
1873 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1874 },
3f2050e2
DB		 1875 {
1876 "raw_stack: skb_load_bytes, no init",
1877 .insns = {
1878 BPF_MOV64_IMM(BPF_REG_2, 4),
1879 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1880 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1881 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1882 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1883 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1884 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 1885 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1886 BPF_EXIT_INSN(),
1887 },
1888 .result = ACCEPT,
1889 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1890 },
1891 {
1892 "raw_stack: skb_load_bytes, init",
1893 .insns = {
1894 BPF_MOV64_IMM(BPF_REG_2, 4),
1895 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1896 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1897 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
1898 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1899 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1900 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1901 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 1902 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1903 BPF_EXIT_INSN(),
1904 },
1905 .result = ACCEPT,
1906 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1907 },
1908 {
1909 "raw_stack: skb_load_bytes, spilled regs around bounds",
1910 .insns = {
1911 BPF_MOV64_IMM(BPF_REG_2, 4),
1912 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1913 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 1914 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
1915 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 1916 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1917 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1918 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1919 BPF_FUNC_skb_load_bytes),
1920 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
1921 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
3f2050e2
DB		 1922 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
1923 offsetof(struct __sk_buff, mark)),
1924 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
1925 offsetof(struct __sk_buff, priority)),
1926 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
1927 BPF_EXIT_INSN(),
1928 },
1929 .result = ACCEPT,
1930 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1931 },
1932 {
1933 "raw_stack: skb_load_bytes, spilled regs corruption",
1934 .insns = {
1935 BPF_MOV64_IMM(BPF_REG_2, 4),
1936 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1937 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
5aa5bd14 1938 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3f2050e2
DB		 1939 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1940 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1941 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1942 BPF_FUNC_skb_load_bytes),
1943 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3f2050e2
DB		 1944 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
1945 offsetof(struct __sk_buff, mark)),
1946 BPF_EXIT_INSN(),
1947 },
1948 .result = REJECT,
1949 .errstr = "R0 invalid mem access 'inv'",
1950 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1951 },
1952 {
1953 "raw_stack: skb_load_bytes, spilled regs corruption 2",
1954 .insns = {
1955 BPF_MOV64_IMM(BPF_REG_2, 4),
1956 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1957 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 1958 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
1959 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1960 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 1961 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1962 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1963 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1964 BPF_FUNC_skb_load_bytes),
1965 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
1966 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
1967 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
3f2050e2
DB		 1968 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
1969 offsetof(struct __sk_buff, mark)),
1970 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
1971 offsetof(struct __sk_buff, priority)),
1972 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
1973 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
1974 offsetof(struct __sk_buff, pkt_type)),
1975 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
1976 BPF_EXIT_INSN(),
1977 },
1978 .result = REJECT,
1979 .errstr = "R3 invalid mem access 'inv'",
1980 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1981 },
1982 {
1983 "raw_stack: skb_load_bytes, spilled regs + data",
1984 .insns = {
1985 BPF_MOV64_IMM(BPF_REG_2, 4),
1986 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1987 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
5aa5bd14
DB		 1988 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
1989 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1990 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
3f2050e2
DB		 1991 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1992 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 1993 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1994 BPF_FUNC_skb_load_bytes),
1995 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
1996 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
1997 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
3f2050e2
DB		 1998 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
1999 offsetof(struct __sk_buff, mark)),
2000 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2001 offsetof(struct __sk_buff, priority)),
2002 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2003 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2004 BPF_EXIT_INSN(),
2005 },
2006 .result = ACCEPT,
2007 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2008 },
2009 {
2010 "raw_stack: skb_load_bytes, invalid access 1",
2011 .insns = {
2012 BPF_MOV64_IMM(BPF_REG_2, 4),
2013 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2014 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2015 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2016 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2017 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2018 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2019 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2020 BPF_EXIT_INSN(),
2021 },
2022 .result = REJECT,
2023 .errstr = "invalid stack type R3 off=-513 access_size=8",
2024 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2025 },
2026 {
2027 "raw_stack: skb_load_bytes, invalid access 2",
2028 .insns = {
2029 BPF_MOV64_IMM(BPF_REG_2, 4),
2030 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2031 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2032 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2033 BPF_MOV64_IMM(BPF_REG_4, 8),
5aa5bd14
DB		 2034 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2035 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2036 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2037 BPF_EXIT_INSN(),
2038 },
2039 .result = REJECT,
2040 .errstr = "invalid stack type R3 off=-1 access_size=8",
2041 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2042 },
2043 {
2044 "raw_stack: skb_load_bytes, invalid access 3",
2045 .insns = {
2046 BPF_MOV64_IMM(BPF_REG_2, 4),
2047 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2048 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2049 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2050 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
5aa5bd14
DB		 2051 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2052 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2053 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2054 BPF_EXIT_INSN(),
2055 },
2056 .result = REJECT,
2057 .errstr = "invalid stack type R3 off=-1 access_size=-1",
2058 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2059 },
2060 {
2061 "raw_stack: skb_load_bytes, invalid access 4",
2062 .insns = {
2063 BPF_MOV64_IMM(BPF_REG_2, 4),
2064 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2066 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2067 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
5aa5bd14
DB		 2068 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2069 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2070 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2071 BPF_EXIT_INSN(),
2072 },
2073 .result = REJECT,
2074 .errstr = "invalid stack type R3 off=-1 access_size=2147483647",
2075 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2076 },
2077 {
2078 "raw_stack: skb_load_bytes, invalid access 5",
2079 .insns = {
2080 BPF_MOV64_IMM(BPF_REG_2, 4),
2081 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2082 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2083 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2084 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
5aa5bd14
DB		 2085 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2086 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2087 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2088 BPF_EXIT_INSN(),
2089 },
2090 .result = REJECT,
2091 .errstr = "invalid stack type R3 off=-512 access_size=2147483647",
2092 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2093 },
2094 {
2095 "raw_stack: skb_load_bytes, invalid access 6",
2096 .insns = {
2097 BPF_MOV64_IMM(BPF_REG_2, 4),
2098 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2099 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2100 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2101 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 2102 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2103 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2104 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2105 BPF_EXIT_INSN(),
2106 },
2107 .result = REJECT,
2108 .errstr = "invalid stack type R3 off=-512 access_size=0",
2109 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2110 },
2111 {
2112 "raw_stack: skb_load_bytes, large access",
2113 .insns = {
2114 BPF_MOV64_IMM(BPF_REG_2, 4),
2115 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2116 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2117 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2118 BPF_MOV64_IMM(BPF_REG_4, 512),
5aa5bd14
DB		 2119 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2120 BPF_FUNC_skb_load_bytes),
3f2050e2
DB		 2121 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2122 BPF_EXIT_INSN(),
2123 },
2124 .result = ACCEPT,
2125 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2126 },
883e44e4 2127 {
1633ac0a 2128 "direct packet access: test1",
883e44e4
AS		 2129 .insns = {
2130 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2131 offsetof(struct __sk_buff, data)),
2132 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2133 offsetof(struct __sk_buff, data_end)),
2134 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2135 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2136 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2137 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2138 BPF_MOV64_IMM(BPF_REG_0, 0),
2139 BPF_EXIT_INSN(),
2140 },
2141 .result = ACCEPT,
2142 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2143 },
2144 {
1633ac0a 2145 "direct packet access: test2",
883e44e4
AS		 2146 .insns = {
2147 BPF_MOV64_IMM(BPF_REG_0, 1),
2148 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2149 offsetof(struct __sk_buff, data_end)),
2150 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2151 offsetof(struct __sk_buff, data)),
2152 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2153 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2154 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2155 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2156 BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2157 BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2158 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2159 offsetof(struct __sk_buff, data)),
2160 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2161 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
2162 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 48),
2163 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 48),
2164 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2165 BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2166 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2167 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2168 offsetof(struct __sk_buff, data_end)),
2169 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2170 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2171 BPF_MOV64_IMM(BPF_REG_0, 0),
2172 BPF_EXIT_INSN(),
2173 },
2174 .result = ACCEPT,
2175 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2176 },
2177 {
1633ac0a 2178 "direct packet access: test3",
883e44e4
AS		 2179 .insns = {
2180 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2181 offsetof(struct __sk_buff, data)),
2182 BPF_MOV64_IMM(BPF_REG_0, 0),
2183 BPF_EXIT_INSN(),
2184 },
2185 .errstr = "invalid bpf_context access off=76",
2186 .result = REJECT,
2187 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2188 },
2189 {
7d95b0ab 2190 "direct packet access: test4 (write)",
883e44e4
AS		 2191 .insns = {
2192 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2193 offsetof(struct __sk_buff, data)),
2194 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2195 offsetof(struct __sk_buff, data_end)),
2196 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2197 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2198 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2199 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2200 BPF_MOV64_IMM(BPF_REG_0, 0),
2201 BPF_EXIT_INSN(),
2202 },
7d95b0ab 2203 .result = ACCEPT,
883e44e4
AS		 2204 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2205 },
2d2be8ca
DB		 2206 {
2207 "direct packet access: test5 (pkt_end >= reg, good access)",
2208 .insns = {
2209 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2210 offsetof(struct __sk_buff, data)),
2211 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2212 offsetof(struct __sk_buff, data_end)),
2213 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2215 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2216 BPF_MOV64_IMM(BPF_REG_0, 1),
2217 BPF_EXIT_INSN(),
2218 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2219 BPF_MOV64_IMM(BPF_REG_0, 0),
2220 BPF_EXIT_INSN(),
2221 },
2222 .result = ACCEPT,
2223 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2224 },
2225 {
2226 "direct packet access: test6 (pkt_end >= reg, bad access)",
2227 .insns = {
2228 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2229 offsetof(struct __sk_buff, data)),
2230 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2231 offsetof(struct __sk_buff, data_end)),
2232 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2233 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2234 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2235 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2236 BPF_MOV64_IMM(BPF_REG_0, 1),
2237 BPF_EXIT_INSN(),
2238 BPF_MOV64_IMM(BPF_REG_0, 0),
2239 BPF_EXIT_INSN(),
2240 },
2241 .errstr = "invalid access to packet",
2242 .result = REJECT,
2243 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2244 },
2245 {
2246 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2247 .insns = {
2248 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2249 offsetof(struct __sk_buff, data)),
2250 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2251 offsetof(struct __sk_buff, data_end)),
2252 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2254 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2255 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2256 BPF_MOV64_IMM(BPF_REG_0, 1),
2257 BPF_EXIT_INSN(),
2258 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2259 BPF_MOV64_IMM(BPF_REG_0, 0),
2260 BPF_EXIT_INSN(),
2261 },
2262 .errstr = "invalid access to packet",
2263 .result = REJECT,
2264 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2265 },
2266 {
2267 "direct packet access: test8 (double test, variant 1)",
2268 .insns = {
2269 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2270 offsetof(struct __sk_buff, data)),
2271 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2272 offsetof(struct __sk_buff, data_end)),
2273 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2274 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2275 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2276 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2277 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2278 BPF_MOV64_IMM(BPF_REG_0, 1),
2279 BPF_EXIT_INSN(),
2280 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2281 BPF_MOV64_IMM(BPF_REG_0, 0),
2282 BPF_EXIT_INSN(),
2283 },
2284 .result = ACCEPT,
2285 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2286 },
2287 {
2288 "direct packet access: test9 (double test, variant 2)",
2289 .insns = {
2290 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2291 offsetof(struct __sk_buff, data)),
2292 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2293 offsetof(struct __sk_buff, data_end)),
2294 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2296 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2297 BPF_MOV64_IMM(BPF_REG_0, 1),
2298 BPF_EXIT_INSN(),
2299 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2300 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2301 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2302 BPF_MOV64_IMM(BPF_REG_0, 0),
2303 BPF_EXIT_INSN(),
2304 },
2305 .result = ACCEPT,
2306 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2307 },
7d95b0ab
DB		 2308 {
2309 "direct packet access: test10 (write invalid)",
2310 .insns = {
2311 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2312 offsetof(struct __sk_buff, data)),
2313 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2314 offsetof(struct __sk_buff, data_end)),
2315 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2316 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2317 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2318 BPF_MOV64_IMM(BPF_REG_0, 0),
2319 BPF_EXIT_INSN(),
2320 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2321 BPF_MOV64_IMM(BPF_REG_0, 0),
2322 BPF_EXIT_INSN(),
2323 },
2324 .errstr = "invalid access to packet",
2325 .result = REJECT,
2326 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2327 },
1633ac0a
AY		 2328 {
2329 "helper access to packet: test1, valid packet_ptr range",
2330 .insns = {
2331 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2332 offsetof(struct xdp_md, data)),
2333 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2334 offsetof(struct xdp_md, data_end)),
2335 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2336 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2337 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2338 BPF_LD_MAP_FD(BPF_REG_1, 0),
2339 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2340 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 2341 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2342 BPF_FUNC_map_update_elem),
1633ac0a
AY		 2343 BPF_MOV64_IMM(BPF_REG_0, 0),
2344 BPF_EXIT_INSN(),
2345 },
5aa5bd14 2346 .fixup_map1 = { 5 },
1633ac0a
AY		 2347 .result_unpriv = ACCEPT,
2348 .result = ACCEPT,
2349 .prog_type = BPF_PROG_TYPE_XDP,
2350 },
2351 {
2352 "helper access to packet: test2, unchecked packet_ptr",
2353 .insns = {
2354 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2355 offsetof(struct xdp_md, data)),
2356 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2358 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 2359 BPF_MOV64_IMM(BPF_REG_0, 0),
2360 BPF_EXIT_INSN(),
2361 },
5aa5bd14 2362 .fixup_map1 = { 1 },
1633ac0a
AY		 2363 .result = REJECT,
2364 .errstr = "invalid access to packet",
2365 .prog_type = BPF_PROG_TYPE_XDP,
2366 },
2367 {
2368 "helper access to packet: test3, variable add",
2369 .insns = {
2370 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2371 offsetof(struct xdp_md, data)),
2372 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2373 offsetof(struct xdp_md, data_end)),
2374 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2375 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2376 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2377 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2378 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2379 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2380 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2381 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2382 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2383 BPF_LD_MAP_FD(BPF_REG_1, 0),
2384 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
5aa5bd14
DB		 2385 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2386 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 2387 BPF_MOV64_IMM(BPF_REG_0, 0),
2388 BPF_EXIT_INSN(),
2389 },
5aa5bd14 2390 .fixup_map1 = { 11 },
1633ac0a
AY		 2391 .result = ACCEPT,
2392 .prog_type = BPF_PROG_TYPE_XDP,
2393 },
2394 {
2395 "helper access to packet: test4, packet_ptr with bad range",
2396 .insns = {
2397 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2398 offsetof(struct xdp_md, data)),
2399 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2400 offsetof(struct xdp_md, data_end)),
2401 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2402 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2403 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2404 BPF_MOV64_IMM(BPF_REG_0, 0),
2405 BPF_EXIT_INSN(),
2406 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2407 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2408 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 2409 BPF_MOV64_IMM(BPF_REG_0, 0),
2410 BPF_EXIT_INSN(),
2411 },
5aa5bd14 2412 .fixup_map1 = { 7 },
1633ac0a
AY		 2413 .result = REJECT,
2414 .errstr = "invalid access to packet",
2415 .prog_type = BPF_PROG_TYPE_XDP,
2416 },
2417 {
2418 "helper access to packet: test5, packet_ptr with too short range",
2419 .insns = {
2420 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2421 offsetof(struct xdp_md, data)),
2422 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2423 offsetof(struct xdp_md, data_end)),
2424 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2425 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2426 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2427 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2428 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2429 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2430 BPF_FUNC_map_lookup_elem),
1633ac0a
AY		 2431 BPF_MOV64_IMM(BPF_REG_0, 0),
2432 BPF_EXIT_INSN(),
2433 },
5aa5bd14 2434 .fixup_map1 = { 6 },
1633ac0a
AY		 2435 .result = REJECT,
2436 .errstr = "invalid access to packet",
2437 .prog_type = BPF_PROG_TYPE_XDP,
2438 },
7d95b0ab
DB		 2439 {
2440 "helper access to packet: test6, cls valid packet_ptr range",
2441 .insns = {
2442 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2443 offsetof(struct __sk_buff, data)),
2444 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2445 offsetof(struct __sk_buff, data_end)),
2446 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2447 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2448 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2449 BPF_LD_MAP_FD(BPF_REG_1, 0),
2450 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2451 BPF_MOV64_IMM(BPF_REG_4, 0),
5aa5bd14
DB		 2452 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2453 BPF_FUNC_map_update_elem),
7d95b0ab
DB		 2454 BPF_MOV64_IMM(BPF_REG_0, 0),
2455 BPF_EXIT_INSN(),
2456 },
5aa5bd14 2457 .fixup_map1 = { 5 },
7d95b0ab
DB		 2458 .result = ACCEPT,
2459 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2460 },
2461 {
2462 "helper access to packet: test7, cls unchecked packet_ptr",
2463 .insns = {
2464 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2465 offsetof(struct __sk_buff, data)),
2466 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2467 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2468 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 2469 BPF_MOV64_IMM(BPF_REG_0, 0),
2470 BPF_EXIT_INSN(),
2471 },
5aa5bd14 2472 .fixup_map1 = { 1 },
7d95b0ab
DB		 2473 .result = REJECT,
2474 .errstr = "invalid access to packet",
2475 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2476 },
2477 {
2478 "helper access to packet: test8, cls variable add",
2479 .insns = {
2480 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2481 offsetof(struct __sk_buff, data)),
2482 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2483 offsetof(struct __sk_buff, data_end)),
2484 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2485 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2486 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2487 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2488 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2489 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2490 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2492 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2493 BPF_LD_MAP_FD(BPF_REG_1, 0),
2494 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
5aa5bd14
DB		 2495 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2496 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 2497 BPF_MOV64_IMM(BPF_REG_0, 0),
2498 BPF_EXIT_INSN(),
2499 },
5aa5bd14 2500 .fixup_map1 = { 11 },
7d95b0ab
DB		 2501 .result = ACCEPT,
2502 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2503 },
2504 {
2505 "helper access to packet: test9, cls packet_ptr with bad range",
2506 .insns = {
2507 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2508 offsetof(struct __sk_buff, data)),
2509 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2510 offsetof(struct __sk_buff, data_end)),
2511 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2512 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2513 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2514 BPF_MOV64_IMM(BPF_REG_0, 0),
2515 BPF_EXIT_INSN(),
2516 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2517 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2518 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 2519 BPF_MOV64_IMM(BPF_REG_0, 0),
2520 BPF_EXIT_INSN(),
2521 },
5aa5bd14 2522 .fixup_map1 = { 7 },
7d95b0ab
DB		 2523 .result = REJECT,
2524 .errstr = "invalid access to packet",
2525 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2526 },
2527 {
2528 "helper access to packet: test10, cls packet_ptr with too short range",
2529 .insns = {
2530 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2531 offsetof(struct __sk_buff, data)),
2532 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2533 offsetof(struct __sk_buff, data_end)),
2534 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2535 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2536 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2537 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2538 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2539 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2540 BPF_FUNC_map_lookup_elem),
7d95b0ab
DB		 2541 BPF_MOV64_IMM(BPF_REG_0, 0),
2542 BPF_EXIT_INSN(),
2543 },
5aa5bd14 2544 .fixup_map1 = { 6 },
7d95b0ab
DB		 2545 .result = REJECT,
2546 .errstr = "invalid access to packet",
2547 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2548 },
2549 {
2550 "helper access to packet: test11, cls unsuitable helper 1",
2551 .insns = {
2552 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2553 offsetof(struct __sk_buff, data)),
2554 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2555 offsetof(struct __sk_buff, data_end)),
2556 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2557 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2558 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
2559 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
2560 BPF_MOV64_IMM(BPF_REG_2, 0),
2561 BPF_MOV64_IMM(BPF_REG_4, 42),
2562 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2563 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2564 BPF_FUNC_skb_store_bytes),
7d95b0ab
DB		 2565 BPF_MOV64_IMM(BPF_REG_0, 0),
2566 BPF_EXIT_INSN(),
2567 },
2568 .result = REJECT,
2569 .errstr = "helper access to the packet",
2570 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2571 },
2572 {
2573 "helper access to packet: test12, cls unsuitable helper 2",
2574 .insns = {
2575 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2576 offsetof(struct __sk_buff, data)),
2577 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2578 offsetof(struct __sk_buff, data_end)),
2579 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2580 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
2581 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
2582 BPF_MOV64_IMM(BPF_REG_2, 0),
2583 BPF_MOV64_IMM(BPF_REG_4, 4),
5aa5bd14
DB		 2584 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2585 BPF_FUNC_skb_load_bytes),
7d95b0ab
DB		 2586 BPF_MOV64_IMM(BPF_REG_0, 0),
2587 BPF_EXIT_INSN(),
2588 },
2589 .result = REJECT,
2590 .errstr = "helper access to the packet",
2591 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2592 },
2593 {
2594 "helper access to packet: test13, cls helper ok",
2595 .insns = {
2596 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2597 offsetof(struct __sk_buff, data)),
2598 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2599 offsetof(struct __sk_buff, data_end)),
2600 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2601 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2602 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2603 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2604 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2605 BPF_MOV64_IMM(BPF_REG_2, 4),
2606 BPF_MOV64_IMM(BPF_REG_3, 0),
2607 BPF_MOV64_IMM(BPF_REG_4, 0),
2608 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2609 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2610 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2611 BPF_MOV64_IMM(BPF_REG_0, 0),
2612 BPF_EXIT_INSN(),
2613 },
2614 .result = ACCEPT,
2615 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2616 },
2617 {
2618 "helper access to packet: test14, cls helper fail sub",
2619 .insns = {
2620 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2621 offsetof(struct __sk_buff, data)),
2622 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2623 offsetof(struct __sk_buff, data_end)),
2624 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2625 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2626 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2627 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2628 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
2629 BPF_MOV64_IMM(BPF_REG_2, 4),
2630 BPF_MOV64_IMM(BPF_REG_3, 0),
2631 BPF_MOV64_IMM(BPF_REG_4, 0),
2632 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2633 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2634 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2635 BPF_MOV64_IMM(BPF_REG_0, 0),
2636 BPF_EXIT_INSN(),
2637 },
2638 .result = REJECT,
2639 .errstr = "type=inv expected=fp",
2640 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2641 },
2642 {
2643 "helper access to packet: test15, cls helper fail range 1",
2644 .insns = {
2645 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2646 offsetof(struct __sk_buff, data)),
2647 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2648 offsetof(struct __sk_buff, data_end)),
2649 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2650 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2651 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2652 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2653 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2654 BPF_MOV64_IMM(BPF_REG_2, 8),
2655 BPF_MOV64_IMM(BPF_REG_3, 0),
2656 BPF_MOV64_IMM(BPF_REG_4, 0),
2657 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2658 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2659 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2660 BPF_MOV64_IMM(BPF_REG_0, 0),
2661 BPF_EXIT_INSN(),
2662 },
2663 .result = REJECT,
2664 .errstr = "invalid access to packet",
2665 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2666 },
2667 {
2668 "helper access to packet: test16, cls helper fail range 2",
2669 .insns = {
2670 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2671 offsetof(struct __sk_buff, data)),
2672 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2673 offsetof(struct __sk_buff, data_end)),
2674 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2675 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2676 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2677 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2678 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2679 BPF_MOV64_IMM(BPF_REG_2, -9),
2680 BPF_MOV64_IMM(BPF_REG_3, 0),
2681 BPF_MOV64_IMM(BPF_REG_4, 0),
2682 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2683 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2684 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2685 BPF_MOV64_IMM(BPF_REG_0, 0),
2686 BPF_EXIT_INSN(),
2687 },
2688 .result = REJECT,
2689 .errstr = "invalid access to packet",
2690 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2691 },
2692 {
2693 "helper access to packet: test17, cls helper fail range 3",
2694 .insns = {
2695 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2696 offsetof(struct __sk_buff, data)),
2697 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2698 offsetof(struct __sk_buff, data_end)),
2699 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2700 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2701 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2702 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2703 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2704 BPF_MOV64_IMM(BPF_REG_2, ~0),
2705 BPF_MOV64_IMM(BPF_REG_3, 0),
2706 BPF_MOV64_IMM(BPF_REG_4, 0),
2707 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2708 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2709 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2710 BPF_MOV64_IMM(BPF_REG_0, 0),
2711 BPF_EXIT_INSN(),
2712 },
2713 .result = REJECT,
2714 .errstr = "invalid access to packet",
2715 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2716 },
2717 {
2718 "helper access to packet: test18, cls helper fail range zero",
2719 .insns = {
2720 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2721 offsetof(struct __sk_buff, data)),
2722 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2723 offsetof(struct __sk_buff, data_end)),
2724 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2725 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2727 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2728 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2729 BPF_MOV64_IMM(BPF_REG_2, 0),
2730 BPF_MOV64_IMM(BPF_REG_3, 0),
2731 BPF_MOV64_IMM(BPF_REG_4, 0),
2732 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2733 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2734 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2735 BPF_MOV64_IMM(BPF_REG_0, 0),
2736 BPF_EXIT_INSN(),
2737 },
2738 .result = REJECT,
2739 .errstr = "invalid access to packet",
2740 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2741 },
2742 {
2743 "helper access to packet: test19, pkt end as input",
2744 .insns = {
2745 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2746 offsetof(struct __sk_buff, data)),
2747 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2748 offsetof(struct __sk_buff, data_end)),
2749 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2750 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2751 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2752 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2753 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
2754 BPF_MOV64_IMM(BPF_REG_2, 4),
2755 BPF_MOV64_IMM(BPF_REG_3, 0),
2756 BPF_MOV64_IMM(BPF_REG_4, 0),
2757 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2758 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2759 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2760 BPF_MOV64_IMM(BPF_REG_0, 0),
2761 BPF_EXIT_INSN(),
2762 },
2763 .result = REJECT,
2764 .errstr = "R1 type=pkt_end expected=fp",
2765 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2766 },
2767 {
2768 "helper access to packet: test20, wrong reg",
2769 .insns = {
2770 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2771 offsetof(struct __sk_buff, data)),
2772 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2773 offsetof(struct __sk_buff, data_end)),
2774 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2775 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2776 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2777 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2778 BPF_MOV64_IMM(BPF_REG_2, 4),
2779 BPF_MOV64_IMM(BPF_REG_3, 0),
2780 BPF_MOV64_IMM(BPF_REG_4, 0),
2781 BPF_MOV64_IMM(BPF_REG_5, 0),
5aa5bd14
DB		 2782 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2783 BPF_FUNC_csum_diff),
7d95b0ab
DB		 2784 BPF_MOV64_IMM(BPF_REG_0, 0),
2785 BPF_EXIT_INSN(),
2786 },
2787 .result = REJECT,
2788 .errstr = "invalid access to packet",
2789 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2790 },
48461135
JB		 2791 {
2792 "valid map access into an array with a constant",
2793 .insns = {
2794 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2795 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2796 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2797 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2798 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2799 BPF_FUNC_map_lookup_elem),
48461135 2800 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5aa5bd14
DB		 2801 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2802 offsetof(struct test_val, foo)),
48461135
JB		 2803 BPF_EXIT_INSN(),
2804 },
5aa5bd14 2805 .fixup_map2 = { 3 },
48461135
JB		 2806 .errstr_unpriv = "R0 leaks addr",
2807 .result_unpriv = REJECT,
2808 .result = ACCEPT,
2809 },
2810 {
2811 "valid map access into an array with a register",
2812 .insns = {
2813 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2814 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2815 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2816 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2817 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2818 BPF_FUNC_map_lookup_elem),
48461135
JB		 2819 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
2820 BPF_MOV64_IMM(BPF_REG_1, 4),
2821 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
2822 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2823 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2824 offsetof(struct test_val, foo)),
48461135
JB		 2825 BPF_EXIT_INSN(),
2826 },
5aa5bd14
DB		 2827 .fixup_map2 = { 3 },
2828 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135
JB		 2829 .result_unpriv = REJECT,
2830 .result = ACCEPT,
2831 },
2832 {
2833 "valid map access into an array with a variable",
2834 .insns = {
2835 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2836 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2837 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2838 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2839 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2840 BPF_FUNC_map_lookup_elem),
48461135
JB		 2841 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
2842 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
2843 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
2844 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
2845 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2846 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2847 offsetof(struct test_val, foo)),
48461135
JB		 2848 BPF_EXIT_INSN(),
2849 },
5aa5bd14
DB		 2850 .fixup_map2 = { 3 },
2851 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135
JB		 2852 .result_unpriv = REJECT,
2853 .result = ACCEPT,
2854 },
2855 {
2856 "valid map access into an array with a signed variable",
2857 .insns = {
2858 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2859 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2860 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2861 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2862 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2863 BPF_FUNC_map_lookup_elem),
48461135
JB		 2864 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
2865 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
2866 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
2867 BPF_MOV32_IMM(BPF_REG_1, 0),
2868 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
2869 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
2870 BPF_MOV32_IMM(BPF_REG_1, 0),
2871 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
2872 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2873 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2874 offsetof(struct test_val, foo)),
48461135
JB		 2875 BPF_EXIT_INSN(),
2876 },
5aa5bd14
DB		 2877 .fixup_map2 = { 3 },
2878 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135
JB		 2879 .result_unpriv = REJECT,
2880 .result = ACCEPT,
2881 },
2882 {
2883 "invalid map access into an array with a constant",
2884 .insns = {
2885 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2886 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2887 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2888 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2889 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2890 BPF_FUNC_map_lookup_elem),
48461135
JB		 2891 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2892 BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
2893 offsetof(struct test_val, foo)),
2894 BPF_EXIT_INSN(),
2895 },
5aa5bd14 2896 .fixup_map2 = { 3 },
48461135
JB		 2897 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
2898 .result = REJECT,
2899 },
2900 {
2901 "invalid map access into an array with a register",
2902 .insns = {
2903 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2904 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2905 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2906 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2907 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2908 BPF_FUNC_map_lookup_elem),
48461135
JB		 2909 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
2910 BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
2911 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
2912 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2913 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2914 offsetof(struct test_val, foo)),
48461135
JB		 2915 BPF_EXIT_INSN(),
2916 },
5aa5bd14
DB		 2917 .fixup_map2 = { 3 },
2918 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135 2919 .errstr = "R0 min value is outside of the array range",
5aa5bd14 2920 .result_unpriv = REJECT,
48461135
JB		 2921 .result = REJECT,
2922 },
2923 {
2924 "invalid map access into an array with a variable",
2925 .insns = {
2926 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2927 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2928 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2929 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2930 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2931 BPF_FUNC_map_lookup_elem),
48461135
JB		 2932 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
2933 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
2934 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
2935 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2936 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2937 offsetof(struct test_val, foo)),
48461135
JB		 2938 BPF_EXIT_INSN(),
2939 },
5aa5bd14
DB		 2940 .fixup_map2 = { 3 },
2941 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135 2942 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
5aa5bd14 2943 .result_unpriv = REJECT,
48461135
JB		 2944 .result = REJECT,
2945 },
2946 {
2947 "invalid map access into an array with no floor check",
2948 .insns = {
2949 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2950 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2951 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2952 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2953 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2954 BPF_FUNC_map_lookup_elem),
48461135
JB		 2955 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
2956 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
2957 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
2958 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
2959 BPF_MOV32_IMM(BPF_REG_1, 0),
2960 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
2961 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2962 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2963 offsetof(struct test_val, foo)),
48461135
JB		 2964 BPF_EXIT_INSN(),
2965 },
5aa5bd14
DB		 2966 .fixup_map2 = { 3 },
2967 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135 2968 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
5aa5bd14 2969 .result_unpriv = REJECT,
48461135
JB		 2970 .result = REJECT,
2971 },
2972 {
2973 "invalid map access into an array with a invalid max check",
2974 .insns = {
2975 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2976 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2977 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2978 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 2979 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2980 BPF_FUNC_map_lookup_elem),
48461135
JB		 2981 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
2982 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
2983 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
2984 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2985 BPF_MOV32_IMM(BPF_REG_1, 0),
2986 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
2987 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5aa5bd14
DB		 2988 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
2989 offsetof(struct test_val, foo)),
48461135
JB		 2990 BPF_EXIT_INSN(),
2991 },
5aa5bd14
DB		 2992 .fixup_map2 = { 3 },
2993 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135 2994 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
5aa5bd14 2995 .result_unpriv = REJECT,
48461135
JB		 2996 .result = REJECT,
2997 },
2998 {
2999 "invalid map access into an array with a invalid max check",
3000 .insns = {
3001 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3002 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3003 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3004 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3005 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3006 BPF_FUNC_map_lookup_elem),
48461135
JB		 3007 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3008 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3009 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3010 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3012 BPF_LD_MAP_FD(BPF_REG_1, 0),
5aa5bd14
DB		 3013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3014 BPF_FUNC_map_lookup_elem),
48461135
JB		 3015 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3016 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
5aa5bd14
DB		 3017 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3018 offsetof(struct test_val, foo)),
48461135
JB		 3019 BPF_EXIT_INSN(),
3020 },
5aa5bd14
DB		 3021 .fixup_map2 = { 3, 11 },
3022 .errstr_unpriv = "R0 pointer arithmetic prohibited",
48461135 3023 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
5aa5bd14 3024 .result_unpriv = REJECT,
48461135
JB		 3025 .result = REJECT,
3026 },
57a09bf0
TG		 3027 {
3028 "multiple registers share map_lookup_elem result",
3029 .insns = {
3030 BPF_MOV64_IMM(BPF_REG_1, 10),
3031 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3032 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3033 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3034 BPF_LD_MAP_FD(BPF_REG_1, 0),
3035 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3036 BPF_FUNC_map_lookup_elem),
3037 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3038 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3039 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3040 BPF_EXIT_INSN(),
3041 },
3042 .fixup_map1 = { 4 },
3043 .result = ACCEPT,
3044 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3045 },
3046 {
3047 "invalid memory access with multiple map_lookup_elem calls",
3048 .insns = {
3049 BPF_MOV64_IMM(BPF_REG_1, 10),
3050 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3051 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3052 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3053 BPF_LD_MAP_FD(BPF_REG_1, 0),
3054 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3055 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3056 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3057 BPF_FUNC_map_lookup_elem),
3058 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3059 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3060 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3061 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3062 BPF_FUNC_map_lookup_elem),
3063 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3064 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3065 BPF_EXIT_INSN(),
3066 },
3067 .fixup_map1 = { 4 },
3068 .result = REJECT,
3069 .errstr = "R4 !read_ok",
3070 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3071 },
3072 {
3073 "valid indirect map_lookup_elem access with 2nd lookup in branch",
3074 .insns = {
3075 BPF_MOV64_IMM(BPF_REG_1, 10),
3076 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3077 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3078 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3079 BPF_LD_MAP_FD(BPF_REG_1, 0),
3080 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3081 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3082 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3083 BPF_FUNC_map_lookup_elem),
3084 BPF_MOV64_IMM(BPF_REG_2, 10),
3085 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
3086 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3087 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3088 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3089 BPF_FUNC_map_lookup_elem),
3090 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3091 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3092 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3093 BPF_EXIT_INSN(),
3094 },
3095 .fixup_map1 = { 4 },
3096 .result = ACCEPT,
3097 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3098 },
a08dd0da
DB		 3099 {
3100 "multiple registers share map_lookup_elem bad reg type",
3101 .insns = {
3102 BPF_MOV64_IMM(BPF_REG_1, 10),
3103 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3104 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3105 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3106 BPF_LD_MAP_FD(BPF_REG_1, 0),
3107 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3108 BPF_FUNC_map_lookup_elem),
3109 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
3110 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
3111 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3112 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3113 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3114 BPF_MOV64_IMM(BPF_REG_1, 1),
3115 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3116 BPF_MOV64_IMM(BPF_REG_1, 2),
3117 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
3118 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
3119 BPF_MOV64_IMM(BPF_REG_1, 3),
3120 BPF_EXIT_INSN(),
3121 },
3122 .fixup_map1 = { 4 },
3123 .result = REJECT,
3124 .errstr = "R3 invalid mem access 'inv'",
3125 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3126 },
e9548901
JB		 3127 {
3128 "invalid map access from else condition",
3129 .insns = {
3130 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3131 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3132 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3133 BPF_LD_MAP_FD(BPF_REG_1, 0),
3134 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
3135 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3136 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3137 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
3138 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
3139 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3140 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3141 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
3142 BPF_EXIT_INSN(),
3143 },
3144 .fixup_map2 = { 3 },
3145 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
3146 .result = REJECT,
3147 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3148 .result_unpriv = REJECT,
3149 },
3c839744
GB		 3150 {
3151 "constant register |= constant should keep constant type",
3152 .insns = {
3153 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3154 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3155 BPF_MOV64_IMM(BPF_REG_2, 34),
3156 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
3157 BPF_MOV64_IMM(BPF_REG_3, 0),
3158 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3159 BPF_EXIT_INSN(),
3160 },
3161 .result = ACCEPT,
3162 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3163 },
3164 {
3165 "constant register |= constant should not bypass stack boundary checks",
3166 .insns = {
3167 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3168 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3169 BPF_MOV64_IMM(BPF_REG_2, 34),
3170 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
3171 BPF_MOV64_IMM(BPF_REG_3, 0),
3172 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3173 BPF_EXIT_INSN(),
3174 },
3175 .errstr = "invalid stack type R1 off=-48 access_size=58",
3176 .result = REJECT,
3177 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3178 },
3179 {
3180 "constant register |= constant register should keep constant type",
3181 .insns = {
3182 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3183 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3184 BPF_MOV64_IMM(BPF_REG_2, 34),
3185 BPF_MOV64_IMM(BPF_REG_4, 13),
3186 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3187 BPF_MOV64_IMM(BPF_REG_3, 0),
3188 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3189 BPF_EXIT_INSN(),
3190 },
3191 .result = ACCEPT,
3192 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3193 },
3194 {
3195 "constant register |= constant register should not bypass stack boundary checks",
3196 .insns = {
3197 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3198 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3199 BPF_MOV64_IMM(BPF_REG_2, 34),
3200 BPF_MOV64_IMM(BPF_REG_4, 24),
3201 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3202 BPF_MOV64_IMM(BPF_REG_3, 0),
3203 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3204 BPF_EXIT_INSN(),
3205 },
3206 .errstr = "invalid stack type R1 off=-48 access_size=58",
3207 .result = REJECT,
3208 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3209 },
3f731d89
TG		 3210 {
3211 "invalid direct packet write for LWT_IN",
3212 .insns = {
3213 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3214 offsetof(struct __sk_buff, data)),
3215 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3216 offsetof(struct __sk_buff, data_end)),
3217 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3218 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3219 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3220 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3221 BPF_MOV64_IMM(BPF_REG_0, 0),
3222 BPF_EXIT_INSN(),
3223 },
3224 .errstr = "cannot write into packet",
3225 .result = REJECT,
3226 .prog_type = BPF_PROG_TYPE_LWT_IN,
3227 },
3228 {
3229 "invalid direct packet write for LWT_OUT",
3230 .insns = {
3231 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3232 offsetof(struct __sk_buff, data)),
3233 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3234 offsetof(struct __sk_buff, data_end)),
3235 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3236 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3237 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3238 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3239 BPF_MOV64_IMM(BPF_REG_0, 0),
3240 BPF_EXIT_INSN(),
3241 },
3242 .errstr = "cannot write into packet",
3243 .result = REJECT,
3244 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3245 },
3246 {
3247 "direct packet write for LWT_XMIT",
3248 .insns = {
3249 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3250 offsetof(struct __sk_buff, data)),
3251 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3252 offsetof(struct __sk_buff, data_end)),
3253 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3254 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3255 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3256 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3257 BPF_MOV64_IMM(BPF_REG_0, 0),
3258 BPF_EXIT_INSN(),
3259 },
3260 .result = ACCEPT,
3261 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3262 },
3263 {
3264 "direct packet read for LWT_IN",
3265 .insns = {
3266 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3267 offsetof(struct __sk_buff, data)),
3268 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3269 offsetof(struct __sk_buff, data_end)),
3270 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3271 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3272 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3273 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3274 BPF_MOV64_IMM(BPF_REG_0, 0),
3275 BPF_EXIT_INSN(),
3276 },
3277 .result = ACCEPT,
3278 .prog_type = BPF_PROG_TYPE_LWT_IN,
3279 },
3280 {
3281 "direct packet read for LWT_OUT",
3282 .insns = {
3283 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3284 offsetof(struct __sk_buff, data)),
3285 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3286 offsetof(struct __sk_buff, data_end)),
3287 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3288 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3289 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3290 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3291 BPF_MOV64_IMM(BPF_REG_0, 0),
3292 BPF_EXIT_INSN(),
3293 },
3294 .result = ACCEPT,
3295 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3296 },
3297 {
3298 "direct packet read for LWT_XMIT",
3299 .insns = {
3300 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3301 offsetof(struct __sk_buff, data)),
3302 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3303 offsetof(struct __sk_buff, data_end)),
3304 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3305 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3306 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3307 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3308 BPF_MOV64_IMM(BPF_REG_0, 0),
3309 BPF_EXIT_INSN(),
3310 },
3311 .result = ACCEPT,
3312 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3313 },
3314 {
3315 "invalid access of tc_classid for LWT_IN",
3316 .insns = {
3317 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3318 offsetof(struct __sk_buff, tc_classid)),
3319 BPF_EXIT_INSN(),
3320 },
3321 .result = REJECT,
3322 .errstr = "invalid bpf_context access",
3323 },
3324 {
3325 "invalid access of tc_classid for LWT_OUT",
3326 .insns = {
3327 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3328 offsetof(struct __sk_buff, tc_classid)),
3329 BPF_EXIT_INSN(),
3330 },
3331 .result = REJECT,
3332 .errstr = "invalid bpf_context access",
3333 },
3334 {
3335 "invalid access of tc_classid for LWT_XMIT",
3336 .insns = {
3337 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3338 offsetof(struct __sk_buff, tc_classid)),
3339 BPF_EXIT_INSN(),
3340 },
3341 .result = REJECT,
3342 .errstr = "invalid bpf_context access",
3343 },
5722569b
GB		 3344 {
3345 "helper access to map: full range",
3346 .insns = {
3347 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3348 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3349 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3350 BPF_LD_MAP_FD(BPF_REG_1, 0),
3351 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3352 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3353 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3354 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
3355 BPF_MOV64_IMM(BPF_REG_3, 0),
3356 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3357 BPF_EXIT_INSN(),
3358 },
3359 .fixup_map2 = { 3 },
3360 .result = ACCEPT,
3361 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3362 },
3363 {
3364 "helper access to map: partial range",
3365 .insns = {
3366 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3367 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3368 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3369 BPF_LD_MAP_FD(BPF_REG_1, 0),
3370 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3371 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3372 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3373 BPF_MOV64_IMM(BPF_REG_2, 8),
3374 BPF_MOV64_IMM(BPF_REG_3, 0),
3375 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3376 BPF_EXIT_INSN(),
3377 },
3378 .fixup_map2 = { 3 },
3379 .result = ACCEPT,
3380 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3381 },
3382 {
3383 "helper access to map: empty range",
3384 .insns = {
3385 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3386 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3387 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3388 BPF_LD_MAP_FD(BPF_REG_1, 0),
3389 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3390 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3391 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3392 BPF_MOV64_IMM(BPF_REG_2, 0),
3393 BPF_MOV64_IMM(BPF_REG_3, 0),
3394 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3395 BPF_EXIT_INSN(),
3396 },
3397 .fixup_map2 = { 3 },
3398 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
3399 .result = REJECT,
3400 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3401 },
3402 {
3403 "helper access to map: out-of-bound range",
3404 .insns = {
3405 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3406 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3407 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3408 BPF_LD_MAP_FD(BPF_REG_1, 0),
3409 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3410 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3411 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3412 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
3413 BPF_MOV64_IMM(BPF_REG_3, 0),
3414 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3415 BPF_EXIT_INSN(),
3416 },
3417 .fixup_map2 = { 3 },
3418 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
3419 .result = REJECT,
3420 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3421 },
3422 {
3423 "helper access to map: negative range",
3424 .insns = {
3425 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3426 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3427 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3428 BPF_LD_MAP_FD(BPF_REG_1, 0),
3429 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3430 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3431 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3432 BPF_MOV64_IMM(BPF_REG_2, -8),
3433 BPF_MOV64_IMM(BPF_REG_3, 0),
3434 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3435 BPF_EXIT_INSN(),
3436 },
3437 .fixup_map2 = { 3 },
3438 .errstr = "invalid access to map value, value_size=48 off=0 size=-8",
3439 .result = REJECT,
3440 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3441 },
3442 {
3443 "helper access to adjusted map (via const imm): full range",
3444 .insns = {
3445 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3446 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3447 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3448 BPF_LD_MAP_FD(BPF_REG_1, 0),
3449 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3450 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3451 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3452 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3453 offsetof(struct test_val, foo)),
3454 BPF_MOV64_IMM(BPF_REG_2,
3455 sizeof(struct test_val) -
3456 offsetof(struct test_val, foo)),
3457 BPF_MOV64_IMM(BPF_REG_3, 0),
3458 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3459 BPF_EXIT_INSN(),
3460 },
3461 .fixup_map2 = { 3 },
3462 .result = ACCEPT,
3463 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3464 },
3465 {
3466 "helper access to adjusted map (via const imm): partial range",
3467 .insns = {
3468 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3469 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3470 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3471 BPF_LD_MAP_FD(BPF_REG_1, 0),
3472 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3473 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3474 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3475 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3476 offsetof(struct test_val, foo)),
3477 BPF_MOV64_IMM(BPF_REG_2, 8),
3478 BPF_MOV64_IMM(BPF_REG_3, 0),
3479 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3480 BPF_EXIT_INSN(),
3481 },
3482 .fixup_map2 = { 3 },
3483 .result = ACCEPT,
3484 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3485 },
3486 {
3487 "helper access to adjusted map (via const imm): empty range",
3488 .insns = {
3489 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3490 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3491 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3492 BPF_LD_MAP_FD(BPF_REG_1, 0),
3493 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3494 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3495 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3496 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3497 offsetof(struct test_val, foo)),
3498 BPF_MOV64_IMM(BPF_REG_2, 0),
3499 BPF_MOV64_IMM(BPF_REG_3, 0),
3500 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3501 BPF_EXIT_INSN(),
3502 },
3503 .fixup_map2 = { 3 },
3504 .errstr = "R1 min value is outside of the array range",
3505 .result = REJECT,
3506 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3507 },
3508 {
3509 "helper access to adjusted map (via const imm): out-of-bound range",
3510 .insns = {
3511 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3512 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3513 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3514 BPF_LD_MAP_FD(BPF_REG_1, 0),
3515 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3516 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3517 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3518 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3519 offsetof(struct test_val, foo)),
3520 BPF_MOV64_IMM(BPF_REG_2,
3521 sizeof(struct test_val) -
3522 offsetof(struct test_val, foo) + 8),
3523 BPF_MOV64_IMM(BPF_REG_3, 0),
3524 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3525 BPF_EXIT_INSN(),
3526 },
3527 .fixup_map2 = { 3 },
3528 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3529 .result = REJECT,
3530 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3531 },
3532 {
3533 "helper access to adjusted map (via const imm): negative range (> adjustment)",
3534 .insns = {
3535 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3536 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3537 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3538 BPF_LD_MAP_FD(BPF_REG_1, 0),
3539 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3540 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3541 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3542 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3543 offsetof(struct test_val, foo)),
3544 BPF_MOV64_IMM(BPF_REG_2, -8),
3545 BPF_MOV64_IMM(BPF_REG_3, 0),
3546 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3547 BPF_EXIT_INSN(),
3548 },
3549 .fixup_map2 = { 3 },
3550 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
3551 .result = REJECT,
3552 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3553 },
3554 {
3555 "helper access to adjusted map (via const imm): negative range (< adjustment)",
3556 .insns = {
3557 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3558 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3559 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3560 BPF_LD_MAP_FD(BPF_REG_1, 0),
3561 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3562 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3563 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3564 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3565 offsetof(struct test_val, foo)),
3566 BPF_MOV64_IMM(BPF_REG_2, -1),
3567 BPF_MOV64_IMM(BPF_REG_3, 0),
3568 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3569 BPF_EXIT_INSN(),
3570 },
3571 .fixup_map2 = { 3 },
3572 .errstr = "R1 min value is outside of the array range",
3573 .result = REJECT,
3574 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3575 },
3576 {
3577 "helper access to adjusted map (via const reg): full range",
3578 .insns = {
3579 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3580 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3581 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3582 BPF_LD_MAP_FD(BPF_REG_1, 0),
3583 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3584 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3585 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3586 BPF_MOV64_IMM(BPF_REG_3,
3587 offsetof(struct test_val, foo)),
3588 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3589 BPF_MOV64_IMM(BPF_REG_2,
3590 sizeof(struct test_val) -
3591 offsetof(struct test_val, foo)),
3592 BPF_MOV64_IMM(BPF_REG_3, 0),
3593 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3594 BPF_EXIT_INSN(),
3595 },
3596 .fixup_map2 = { 3 },
3597 .result = ACCEPT,
3598 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3599 },
3600 {
3601 "helper access to adjusted map (via const reg): partial range",
3602 .insns = {
3603 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3604 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3605 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3606 BPF_LD_MAP_FD(BPF_REG_1, 0),
3607 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3608 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3609 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3610 BPF_MOV64_IMM(BPF_REG_3,
3611 offsetof(struct test_val, foo)),
3612 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3613 BPF_MOV64_IMM(BPF_REG_2, 8),
3614 BPF_MOV64_IMM(BPF_REG_3, 0),
3615 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3616 BPF_EXIT_INSN(),
3617 },
3618 .fixup_map2 = { 3 },
3619 .result = ACCEPT,
3620 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3621 },
3622 {
3623 "helper access to adjusted map (via const reg): empty range",
3624 .insns = {
3625 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3626 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3627 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3628 BPF_LD_MAP_FD(BPF_REG_1, 0),
3629 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3630 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3631 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3632 BPF_MOV64_IMM(BPF_REG_3, 0),
3633 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3634 BPF_MOV64_IMM(BPF_REG_2, 0),
3635 BPF_MOV64_IMM(BPF_REG_3, 0),
3636 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3637 BPF_EXIT_INSN(),
3638 },
3639 .fixup_map2 = { 3 },
3640 .errstr = "R1 min value is outside of the array range",
3641 .result = REJECT,
3642 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3643 },
3644 {
3645 "helper access to adjusted map (via const reg): out-of-bound range",
3646 .insns = {
3647 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3648 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3649 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3650 BPF_LD_MAP_FD(BPF_REG_1, 0),
3651 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3652 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3653 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3654 BPF_MOV64_IMM(BPF_REG_3,
3655 offsetof(struct test_val, foo)),
3656 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3657 BPF_MOV64_IMM(BPF_REG_2,
3658 sizeof(struct test_val) -
3659 offsetof(struct test_val, foo) + 8),
3660 BPF_MOV64_IMM(BPF_REG_3, 0),
3661 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3662 BPF_EXIT_INSN(),
3663 },
3664 .fixup_map2 = { 3 },
3665 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3666 .result = REJECT,
3667 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3668 },
3669 {
3670 "helper access to adjusted map (via const reg): negative range (> adjustment)",
3671 .insns = {
3672 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3673 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3674 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3675 BPF_LD_MAP_FD(BPF_REG_1, 0),
3676 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3677 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3678 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3679 BPF_MOV64_IMM(BPF_REG_3,
3680 offsetof(struct test_val, foo)),
3681 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3682 BPF_MOV64_IMM(BPF_REG_2, -8),
3683 BPF_MOV64_IMM(BPF_REG_3, 0),
3684 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3685 BPF_EXIT_INSN(),
3686 },
3687 .fixup_map2 = { 3 },
3688 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
3689 .result = REJECT,
3690 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3691 },
3692 {
3693 "helper access to adjusted map (via const reg): negative range (< adjustment)",
3694 .insns = {
3695 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3696 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3697 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3698 BPF_LD_MAP_FD(BPF_REG_1, 0),
3699 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3700 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3701 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3702 BPF_MOV64_IMM(BPF_REG_3,
3703 offsetof(struct test_val, foo)),
3704 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3705 BPF_MOV64_IMM(BPF_REG_2, -1),
3706 BPF_MOV64_IMM(BPF_REG_3, 0),
3707 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3708 BPF_EXIT_INSN(),
3709 },
3710 .fixup_map2 = { 3 },
3711 .errstr = "R1 min value is outside of the array range",
3712 .result = REJECT,
3713 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3714 },
3715 {
3716 "helper access to adjusted map (via variable): full range",
3717 .insns = {
3718 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3719 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3720 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3721 BPF_LD_MAP_FD(BPF_REG_1, 0),
3722 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3723 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3724 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3725 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
3726 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
3727 offsetof(struct test_val, foo), 4),
3728 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3729 BPF_MOV64_IMM(BPF_REG_2,
3730 sizeof(struct test_val) -
3731 offsetof(struct test_val, foo)),
3732 BPF_MOV64_IMM(BPF_REG_3, 0),
3733 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3734 BPF_EXIT_INSN(),
3735 },
3736 .fixup_map2 = { 3 },
3737 .result = ACCEPT,
3738 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3739 },
3740 {
3741 "helper access to adjusted map (via variable): partial range",
3742 .insns = {
3743 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3744 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3745 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3746 BPF_LD_MAP_FD(BPF_REG_1, 0),
3747 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3748 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3749 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3750 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
3751 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
3752 offsetof(struct test_val, foo), 4),
3753 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3754 BPF_MOV64_IMM(BPF_REG_2, 8),
3755 BPF_MOV64_IMM(BPF_REG_3, 0),
3756 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3757 BPF_EXIT_INSN(),
3758 },
3759 .fixup_map2 = { 3 },
3760 .result = ACCEPT,
3761 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3762 },
3763 {
3764 "helper access to adjusted map (via variable): empty range",
3765 .insns = {
3766 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3767 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3768 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3769 BPF_LD_MAP_FD(BPF_REG_1, 0),
3770 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3771 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3772 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3773 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
3774 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
3775 offsetof(struct test_val, foo), 4),
3776 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3777 BPF_MOV64_IMM(BPF_REG_2, 0),
3778 BPF_MOV64_IMM(BPF_REG_3, 0),
3779 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3780 BPF_EXIT_INSN(),
3781 },
3782 .fixup_map2 = { 3 },
3783 .errstr = "R1 min value is outside of the array range",
3784 .result = REJECT,
3785 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3786 },
3787 {
3788 "helper access to adjusted map (via variable): no max check",
3789 .insns = {
3790 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3792 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3793 BPF_LD_MAP_FD(BPF_REG_1, 0),
3794 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3796 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3797 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
3798 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3799 BPF_MOV64_IMM(BPF_REG_2, 0),
3800 BPF_MOV64_IMM(BPF_REG_3, 0),
3801 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3802 BPF_EXIT_INSN(),
3803 },
3804 .fixup_map2 = { 3 },
3805 .errstr = "R1 min value is negative, either use unsigned index or do a if (index >=0) check",
3806 .result = REJECT,
3807 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3808 },
3809 {
3810 "helper access to adjusted map (via variable): wrong max check",
3811 .insns = {
3812 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3814 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3815 BPF_LD_MAP_FD(BPF_REG_1, 0),
3816 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3817 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3818 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3819 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
3820 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
3821 offsetof(struct test_val, foo), 4),
3822 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3823 BPF_MOV64_IMM(BPF_REG_2,
3824 sizeof(struct test_val) -
3825 offsetof(struct test_val, foo) + 1),
3826 BPF_MOV64_IMM(BPF_REG_3, 0),
3827 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3828 BPF_EXIT_INSN(),
3829 },
3830 .fixup_map2 = { 3 },
3831 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
3832 .result = REJECT,
3833 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3834 },
f0318d01
GB		 3835 {
3836 "map element value is preserved across register spilling",
3837 .insns = {
3838 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3839 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3840 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3841 BPF_LD_MAP_FD(BPF_REG_1, 0),
3842 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3843 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3844 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
3845 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3846 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
3847 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
3848 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
3849 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
3850 BPF_EXIT_INSN(),
3851 },
3852 .fixup_map2 = { 3 },
3853 .errstr_unpriv = "R0 leaks addr",
3854 .result = ACCEPT,
3855 .result_unpriv = REJECT,
3856 },
3857 {
3858 "map element value (adjusted) is preserved across register spilling",
3859 .insns = {
3860 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3861 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3862 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3863 BPF_LD_MAP_FD(BPF_REG_1, 0),
3864 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3865 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3866 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
3867 offsetof(struct test_val, foo)),
3868 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
3869 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3870 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
3871 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
3872 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
3873 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
3874 BPF_EXIT_INSN(),
3875 },
3876 .fixup_map2 = { 3 },
3877 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3878 .result = ACCEPT,
3879 .result_unpriv = REJECT,
3880 },
06c1c049
GB		 3881 {
3882 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
3883 .insns = {
3884 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3885 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
3886 BPF_MOV64_IMM(BPF_REG_0, 0),
3887 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
3888 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
3889 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
3890 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
3891 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
3892 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
3893 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
3894 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3895 BPF_MOV64_IMM(BPF_REG_2, 16),
3896 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
3897 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
3898 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
3899 BPF_MOV64_IMM(BPF_REG_4, 0),
3900 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
3901 BPF_MOV64_IMM(BPF_REG_3, 0),
3902 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3903 BPF_MOV64_IMM(BPF_REG_0, 0),
3904 BPF_EXIT_INSN(),
3905 },
3906 .result = ACCEPT,
3907 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3908 },
3909 {
3910 "helper access to variable memory: stack, bitwise AND, zero included",
3911 .insns = {
3912 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3913 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
3914 BPF_MOV64_IMM(BPF_REG_2, 16),
3915 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
3916 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
3917 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
3918 BPF_MOV64_IMM(BPF_REG_3, 0),
3919 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3920 BPF_EXIT_INSN(),
3921 },
3922 .errstr = "invalid stack type R1 off=-64 access_size=0",
3923 .result = REJECT,
3924 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3925 },
3926 {
3927 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
3928 .insns = {
3929 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3930 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
3931 BPF_MOV64_IMM(BPF_REG_2, 16),
3932 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
3933 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
3934 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
3935 BPF_MOV64_IMM(BPF_REG_4, 0),
3936 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
3937 BPF_MOV64_IMM(BPF_REG_3, 0),
3938 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3939 BPF_MOV64_IMM(BPF_REG_0, 0),
3940 BPF_EXIT_INSN(),
3941 },
3942 .errstr = "invalid stack type R1 off=-64 access_size=65",
3943 .result = REJECT,
3944 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3945 },
3946 {
3947 "helper access to variable memory: stack, JMP, correct bounds",
3948 .insns = {
3949 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3950 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
3951 BPF_MOV64_IMM(BPF_REG_0, 0),
3952 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
3953 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
3954 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
3955 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
3956 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
3957 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
3958 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
3959 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3960 BPF_MOV64_IMM(BPF_REG_2, 16),
3961 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
3962 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
3963 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
3964 BPF_MOV64_IMM(BPF_REG_4, 0),
3965 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
3966 BPF_MOV64_IMM(BPF_REG_3, 0),
3967 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3968 BPF_MOV64_IMM(BPF_REG_0, 0),
3969 BPF_EXIT_INSN(),
3970 },
3971 .result = ACCEPT,
3972 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3973 },
3974 {
3975 "helper access to variable memory: stack, JMP (signed), correct bounds",
3976 .insns = {
3977 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3978 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
3979 BPF_MOV64_IMM(BPF_REG_0, 0),
3980 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
3981 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
3982 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
3983 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
3984 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
3985 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
3986 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
3987 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3988 BPF_MOV64_IMM(BPF_REG_2, 16),
3989 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
3990 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
3991 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
3992 BPF_MOV64_IMM(BPF_REG_4, 0),
3993 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
3994 BPF_MOV64_IMM(BPF_REG_3, 0),
3995 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3996 BPF_MOV64_IMM(BPF_REG_0, 0),
3997 BPF_EXIT_INSN(),
3998 },
3999 .result = ACCEPT,
4000 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4001 },
4002 {
4003 "helper access to variable memory: stack, JMP, bounds + offset",
4004 .insns = {
4005 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4006 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4007 BPF_MOV64_IMM(BPF_REG_2, 16),
4008 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4009 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4010 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
4011 BPF_MOV64_IMM(BPF_REG_4, 0),
4012 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
4013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4014 BPF_MOV64_IMM(BPF_REG_3, 0),
4015 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4016 BPF_MOV64_IMM(BPF_REG_0, 0),
4017 BPF_EXIT_INSN(),
4018 },
4019 .errstr = "invalid stack type R1 off=-64 access_size=65",
4020 .result = REJECT,
4021 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4022 },
4023 {
4024 "helper access to variable memory: stack, JMP, wrong max",
4025 .insns = {
4026 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4027 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4028 BPF_MOV64_IMM(BPF_REG_2, 16),
4029 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4030 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4031 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
4032 BPF_MOV64_IMM(BPF_REG_4, 0),
4033 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4034 BPF_MOV64_IMM(BPF_REG_3, 0),
4035 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4036 BPF_MOV64_IMM(BPF_REG_0, 0),
4037 BPF_EXIT_INSN(),
4038 },
4039 .errstr = "invalid stack type R1 off=-64 access_size=65",
4040 .result = REJECT,
4041 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4042 },
4043 {
4044 "helper access to variable memory: stack, JMP, no max check",
4045 .insns = {
4046 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4047 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4048 BPF_MOV64_IMM(BPF_REG_2, 16),
4049 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4050 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4051 BPF_MOV64_IMM(BPF_REG_4, 0),
4052 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4053 BPF_MOV64_IMM(BPF_REG_3, 0),
4054 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4055 BPF_MOV64_IMM(BPF_REG_0, 0),
4056 BPF_EXIT_INSN(),
4057 },
4058 .errstr = "R2 unbounded memory access",
4059 .result = REJECT,
4060 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4061 },
4062 {
4063 "helper access to variable memory: stack, JMP, no min check",
4064 .insns = {
4065 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4066 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4067 BPF_MOV64_IMM(BPF_REG_2, 16),
4068 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4069 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4070 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
4071 BPF_MOV64_IMM(BPF_REG_3, 0),
4072 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4073 BPF_MOV64_IMM(BPF_REG_0, 0),
4074 BPF_EXIT_INSN(),
4075 },
4076 .errstr = "invalid stack type R1 off=-64 access_size=0",
4077 .result = REJECT,
4078 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4079 },
4080 {
4081 "helper access to variable memory: stack, JMP (signed), no min check",
4082 .insns = {
4083 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4084 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4085 BPF_MOV64_IMM(BPF_REG_2, 16),
4086 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4087 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4088 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
4089 BPF_MOV64_IMM(BPF_REG_3, 0),
4090 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4091 BPF_MOV64_IMM(BPF_REG_0, 0),
4092 BPF_EXIT_INSN(),
4093 },
4094 .errstr = "R2 min value is negative",
4095 .result = REJECT,
4096 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4097 },
4098 {
4099 "helper access to variable memory: map, JMP, correct bounds",
4100 .insns = {
4101 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4102 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4103 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4104 BPF_LD_MAP_FD(BPF_REG_1, 0),
4105 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4106 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4107 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4108 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4109 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4110 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4111 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4112 sizeof(struct test_val), 4),
4113 BPF_MOV64_IMM(BPF_REG_4, 0),
4114 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4115 BPF_MOV64_IMM(BPF_REG_3, 0),
4116 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4117 BPF_MOV64_IMM(BPF_REG_0, 0),
4118 BPF_EXIT_INSN(),
4119 },
4120 .fixup_map2 = { 3 },
4121 .result = ACCEPT,
4122 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4123 },
4124 {
4125 "helper access to variable memory: map, JMP, wrong max",
4126 .insns = {
4127 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4128 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4129 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4130 BPF_LD_MAP_FD(BPF_REG_1, 0),
4131 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4132 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4133 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4134 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4135 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4136 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4137 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4138 sizeof(struct test_val) + 1, 4),
4139 BPF_MOV64_IMM(BPF_REG_4, 0),
4140 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4141 BPF_MOV64_IMM(BPF_REG_3, 0),
4142 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4143 BPF_MOV64_IMM(BPF_REG_0, 0),
4144 BPF_EXIT_INSN(),
4145 },
4146 .fixup_map2 = { 3 },
4147 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
4148 .result = REJECT,
4149 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4150 },
4151 {
4152 "helper access to variable memory: map adjusted, JMP, correct bounds",
4153 .insns = {
4154 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4155 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4156 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4157 BPF_LD_MAP_FD(BPF_REG_1, 0),
4158 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4159 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4160 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4161 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4162 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4163 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4164 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4165 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4166 sizeof(struct test_val) - 20, 4),
4167 BPF_MOV64_IMM(BPF_REG_4, 0),
4168 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4169 BPF_MOV64_IMM(BPF_REG_3, 0),
4170 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4171 BPF_MOV64_IMM(BPF_REG_0, 0),
4172 BPF_EXIT_INSN(),
4173 },
4174 .fixup_map2 = { 3 },
4175 .result = ACCEPT,
4176 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4177 },
4178 {
4179 "helper access to variable memory: map adjusted, JMP, wrong max",
4180 .insns = {
4181 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4182 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4183 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4184 BPF_LD_MAP_FD(BPF_REG_1, 0),
4185 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4186 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4187 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4188 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4189 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4190 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4191 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4192 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4193 sizeof(struct test_val) - 19, 4),
4194 BPF_MOV64_IMM(BPF_REG_4, 0),
4195 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4196 BPF_MOV64_IMM(BPF_REG_3, 0),
4197 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4198 BPF_MOV64_IMM(BPF_REG_0, 0),
4199 BPF_EXIT_INSN(),
4200 },
4201 .fixup_map2 = { 3 },
4202 .errstr = "R1 min value is outside of the array range",
4203 .result = REJECT,
4204 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4205 },
4206 {
4207 "helper access to variable memory: size > 0 not allowed on NULL",
4208 .insns = {
4209 BPF_MOV64_IMM(BPF_REG_1, 0),
4210 BPF_MOV64_IMM(BPF_REG_2, 0),
4211 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4212 BPF_MOV64_IMM(BPF_REG_3, 0),
4213 BPF_MOV64_IMM(BPF_REG_4, 0),
4214 BPF_MOV64_IMM(BPF_REG_5, 0),
4215 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4216 BPF_EXIT_INSN(),
4217 },
4218 .errstr = "R1 type=imm expected=fp",
4219 .result = REJECT,
4220 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4221 },
4222 {
4223 "helper access to variable memory: size = 0 not allowed on != NULL",
4224 .insns = {
4225 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4226 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
4227 BPF_MOV64_IMM(BPF_REG_2, 0),
4228 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
4229 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
4230 BPF_MOV64_IMM(BPF_REG_3, 0),
4231 BPF_MOV64_IMM(BPF_REG_4, 0),
4232 BPF_MOV64_IMM(BPF_REG_5, 0),
4233 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4234 BPF_EXIT_INSN(),
4235 },
4236 .errstr = "invalid stack type R1 off=-8 access_size=0",
4237 .result = REJECT,
4238 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4239 },
4240 {
4241 "helper access to variable memory: 8 bytes leak",
4242 .insns = {
4243 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4244 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4245 BPF_MOV64_IMM(BPF_REG_0, 0),
4246 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4247 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4248 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4249 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4250 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4251 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4252 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4253 BPF_MOV64_IMM(BPF_REG_2, 0),
4254 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
4255 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4256 BPF_MOV64_IMM(BPF_REG_3, 0),
4257 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4258 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4259 BPF_EXIT_INSN(),
4260 },
4261 .errstr = "invalid indirect read from stack off -64+32 size 64",
4262 .result = REJECT,
4263 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4264 },
4265 {
4266 "helper access to variable memory: 8 bytes no leak (init memory)",
4267 .insns = {
4268 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4269 BPF_MOV64_IMM(BPF_REG_0, 0),
4270 BPF_MOV64_IMM(BPF_REG_0, 0),
4271 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4272 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4273 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4274 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4275 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4276 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4277 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4278 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4280 BPF_MOV64_IMM(BPF_REG_2, 0),
4281 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
4282 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
4283 BPF_MOV64_IMM(BPF_REG_3, 0),
4284 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4285 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4286 BPF_EXIT_INSN(),
4287 },
4288 .result = ACCEPT,
4289 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4290 },
3c731eba
AS		 4291};
4292
5aa5bd14 4293static int probe_filter_length(const struct bpf_insn *fp)
3c731eba 4294{
5aa5bd14 4295 int len;
3c731eba
AS		 4296
4297 for (len = MAX_INSNS - 1; len > 0; --len)
4298 if (fp[len].code != 0 || fp[len].imm != 0)
4299 break;
3c731eba
AS		 4300 return len + 1;
4301}
4302
5aa5bd14 4303static int create_map(uint32_t size_value, uint32_t max_elem)
3c731eba 4304{
5aa5bd14 4305 int fd;
3c731eba 4306
5aa5bd14
DB		 4307 fd = bpf_map_create(BPF_MAP_TYPE_HASH, sizeof(long long),
4308 size_value, max_elem, BPF_F_NO_PREALLOC);
4309 if (fd < 0)
4310 printf("Failed to create hash map '%s'!\n", strerror(errno));
bf508877 4311
5aa5bd14 4312 return fd;
bf508877
AS		 4313}
4314
4315static int create_prog_array(void)
4316{
5aa5bd14 4317 int fd;
bf508877 4318
5aa5bd14
DB		 4319 fd = bpf_map_create(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
4320 sizeof(int), 4, 0);
4321 if (fd < 0)
4322 printf("Failed to create prog array '%s'!\n", strerror(errno));
3c731eba 4323
5aa5bd14 4324 return fd;
3c731eba
AS		 4325}
4326
5aa5bd14
DB		 4327static char bpf_vlog[32768];
4328
4329static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
4330 int *fd_f1, int *fd_f2, int *fd_f3)
3c731eba 4331{
5aa5bd14
DB		 4332 int *fixup_map1 = test->fixup_map1;
4333 int *fixup_map2 = test->fixup_map2;
4334 int *fixup_prog = test->fixup_prog;
3c731eba 4335
5aa5bd14
DB		 4336 /* Allocating HTs with 1 elem is fine here, since we only test
4337 * for verifier and not do a runtime lookup, so the only thing
4338 * that really matters is value size in this case.
4339 */
4340 if (*fixup_map1) {
4341 *fd_f1 = create_map(sizeof(long long), 1);
4342 do {
4343 prog[*fixup_map1].imm = *fd_f1;
4344 fixup_map1++;
4345 } while (*fixup_map1);
4346 }
3c731eba 4347
5aa5bd14
DB		 4348 if (*fixup_map2) {
4349 *fd_f2 = create_map(sizeof(struct test_val), 1);
4350 do {
4351 prog[*fixup_map2].imm = *fd_f2;
4352 fixup_map2++;
4353 } while (*fixup_map2);
4354 }
3c731eba 4355
5aa5bd14
DB		 4356 if (*fixup_prog) {
4357 *fd_f3 = create_prog_array();
4358 do {
4359 prog[*fixup_prog].imm = *fd_f3;
4360 fixup_prog++;
4361 } while (*fixup_prog);
4362 }
4363}
bf508877 4364
5aa5bd14
DB		 4365static void do_test_single(struct bpf_test *test, bool unpriv,
4366 int *passes, int *errors)
4367{
4368 struct bpf_insn *prog = test->insns;
4369 int prog_len = probe_filter_length(prog);
4370 int prog_type = test->prog_type;
4371 int fd_f1 = -1, fd_f2 = -1, fd_f3 = -1;
4372 int fd_prog, expected_ret;
4373 const char *expected_err;
48461135 4374
5aa5bd14 4375 do_test_fixup(test, prog, &fd_f1, &fd_f2, &fd_f3);
3c731eba 4376
5aa5bd14
DB		 4377 fd_prog = bpf_prog_load(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
4378 prog, prog_len * sizeof(struct bpf_insn),
4379 "GPL", bpf_vlog, sizeof(bpf_vlog));
3c731eba 4380
5aa5bd14
DB		 4381 expected_ret = unpriv && test->result_unpriv != UNDEF ?
4382 test->result_unpriv : test->result;
4383 expected_err = unpriv && test->errstr_unpriv ?
4384 test->errstr_unpriv : test->errstr;
4385 if (expected_ret == ACCEPT) {
4386 if (fd_prog < 0) {
4387 printf("FAIL\nFailed to load prog '%s'!\n",
4388 strerror(errno));
4389 goto fail_log;
4390 }
4391 } else {
4392 if (fd_prog >= 0) {
4393 printf("FAIL\nUnexpected success to load!\n");
4394 goto fail_log;
4395 }
4396 if (!strstr(bpf_vlog, expected_err)) {
4397 printf("FAIL\nUnexpected error message!\n");
4398 goto fail_log;
4399 }
4400 }
bf508877 4401
5aa5bd14
DB		 4402 (*passes)++;
4403 printf("OK\n");
4404close_fds:
4405 close(fd_prog);
4406 close(fd_f1);
4407 close(fd_f2);
4408 close(fd_f3);
4409 sched_yield();
4410 return;
4411fail_log:
4412 (*errors)++;
4413 printf("%s", bpf_vlog);
4414 goto close_fds;
4415}
bf508877 4416
5aa5bd14
DB		 4417static int do_test(bool unpriv, unsigned int from, unsigned int to)
4418{
4419 int i, passes = 0, errors = 0;
3c731eba 4420
5aa5bd14
DB		 4421 for (i = from; i < to; i++) {
4422 struct bpf_test *test = &tests[i];
3c731eba 4423
5aa5bd14
DB		 4424 /* Program types that are not supported by non-root we
4425 * skip right away.
4426 */
4427 if (unpriv && test->prog_type)
4428 continue;
4429
4430 printf("#%d %s ", i, test->descr);
4431 do_test_single(test, unpriv, &passes, &errors);
3c731eba
AS		 4432 }
4433
5aa5bd14
DB		 4434 printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
4435 return errors ? -errors : 0;
3c731eba
AS		 4436}
4437
5aa5bd14 4438int main(int argc, char **argv)
3c731eba 4439{
5aa5bd14
DB		 4440 struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
4441 struct rlimit rlim = { 1 << 20, 1 << 20 };
4442 unsigned int from = 0, to = ARRAY_SIZE(tests);
4443 bool unpriv = geteuid() != 0;
4444
4445 if (argc == 3) {
4446 unsigned int l = atoi(argv[argc - 2]);
4447 unsigned int u = atoi(argv[argc - 1]);
4448
4449 if (l < to && u < to) {
4450 from = l;
4451 to = u + 1;
4452 }
4453 } else if (argc == 2) {
4454 unsigned int t = atoi(argv[argc - 1]);
4455
4456 if (t < to) {
4457 from = t;
4458 to = t + 1;
4459 }
4460 }
bf508877 4461
5aa5bd14
DB		 4462 setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
4463 return do_test(unpriv, from, to);
3c731eba 4464}
Ubuntu Artful kernel mirror