2 * Testsuite for eBPF verifier
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
5 * Copyright (c) 2017 Facebook
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of version 2 of the GNU General Public
9 * License as published by the Free Software Foundation.
13 #include <asm/types.h>
14 #include <linux/types.h>
25 #include <sys/capability.h>
26 #include <sys/resource.h>
28 #include <linux/unistd.h>
29 #include <linux/filter.h>
30 #include <linux/bpf_perf_event.h>
31 #include <linux/bpf.h>
36 # include "autoconf.h"
38 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
39 # define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
43 #include "../../../include/linux/filter.h"
46 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
53 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
54 #define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
58 struct bpf_insn insns
[MAX_INSNS
];
59 int fixup_map1
[MAX_FIXUPS
];
60 int fixup_map2
[MAX_FIXUPS
];
61 int fixup_prog
[MAX_FIXUPS
];
62 int fixup_map_in_map
[MAX_FIXUPS
];
64 const char *errstr_unpriv
;
69 } result
, result_unpriv
;
70 enum bpf_prog_type prog_type
;
74 /* Note we want this to be 64 bit aligned so that the end of our array is
75 * actually the end of the structure.
77 #define MAX_ENTRIES 11
84 static struct bpf_test tests
[] = {
88 BPF_MOV64_IMM(BPF_REG_1
, 1),
89 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 2),
90 BPF_MOV64_IMM(BPF_REG_2
, 3),
91 BPF_ALU64_REG(BPF_SUB
, BPF_REG_1
, BPF_REG_2
),
92 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -1),
93 BPF_ALU64_IMM(BPF_MUL
, BPF_REG_1
, 3),
94 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
105 .errstr
= "unreachable",
111 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
112 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
115 .errstr
= "unreachable",
121 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
124 .errstr
= "jump out of range",
128 "out of range jump2",
130 BPF_JMP_IMM(BPF_JA
, 0, 0, -2),
133 .errstr
= "jump out of range",
139 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
140 BPF_LD_IMM64(BPF_REG_0
, 0),
141 BPF_LD_IMM64(BPF_REG_0
, 0),
142 BPF_LD_IMM64(BPF_REG_0
, 1),
143 BPF_LD_IMM64(BPF_REG_0
, 1),
144 BPF_MOV64_IMM(BPF_REG_0
, 2),
147 .errstr
= "invalid BPF_LD_IMM insn",
148 .errstr_unpriv
= "R1 pointer comparison",
154 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
155 BPF_LD_IMM64(BPF_REG_0
, 0),
156 BPF_LD_IMM64(BPF_REG_0
, 0),
157 BPF_LD_IMM64(BPF_REG_0
, 1),
158 BPF_LD_IMM64(BPF_REG_0
, 1),
161 .errstr
= "invalid BPF_LD_IMM insn",
162 .errstr_unpriv
= "R1 pointer comparison",
168 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
169 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
170 BPF_LD_IMM64(BPF_REG_0
, 0),
171 BPF_LD_IMM64(BPF_REG_0
, 0),
172 BPF_LD_IMM64(BPF_REG_0
, 1),
173 BPF_LD_IMM64(BPF_REG_0
, 1),
176 .errstr
= "invalid bpf_ld_imm64 insn",
182 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
185 .errstr
= "invalid bpf_ld_imm64 insn",
191 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
193 .errstr
= "invalid bpf_ld_imm64 insn",
199 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
200 BPF_RAW_INSN(0, 0, 0, 0, 0),
208 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 1),
209 BPF_RAW_INSN(0, 0, 0, 0, 1),
217 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 1, 1),
218 BPF_RAW_INSN(0, 0, 0, 0, 1),
221 .errstr
= "uses reserved fields",
227 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 1),
228 BPF_RAW_INSN(0, 0, 0, 1, 1),
231 .errstr
= "invalid bpf_ld_imm64 insn",
237 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 1),
238 BPF_RAW_INSN(0, BPF_REG_1
, 0, 0, 1),
241 .errstr
= "invalid bpf_ld_imm64 insn",
247 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 1),
248 BPF_RAW_INSN(0, 0, BPF_REG_1
, 0, 1),
251 .errstr
= "invalid bpf_ld_imm64 insn",
257 BPF_MOV64_IMM(BPF_REG_1
, 0),
258 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, BPF_REG_1
, 0, 1),
259 BPF_RAW_INSN(0, 0, 0, 0, 1),
262 .errstr
= "not pointing to valid bpf_map",
268 BPF_MOV64_IMM(BPF_REG_1
, 0),
269 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, BPF_REG_1
, 0, 1),
270 BPF_RAW_INSN(0, 0, BPF_REG_1
, 0, 1),
273 .errstr
= "invalid bpf_ld_imm64 insn",
279 BPF_MOV64_IMM(BPF_REG_0
, 1),
280 BPF_ALU32_IMM(BPF_ARSH
, BPF_REG_0
, 5),
284 .errstr
= "BPF_ARSH not supported for 32 bit ALU",
289 BPF_MOV64_IMM(BPF_REG_0
, 1),
290 BPF_MOV64_IMM(BPF_REG_1
, 5),
291 BPF_ALU32_REG(BPF_ARSH
, BPF_REG_0
, BPF_REG_1
),
295 .errstr
= "BPF_ARSH not supported for 32 bit ALU",
300 BPF_MOV64_IMM(BPF_REG_0
, 1),
301 BPF_ALU64_IMM(BPF_ARSH
, BPF_REG_0
, 5),
309 BPF_MOV64_IMM(BPF_REG_0
, 1),
310 BPF_MOV64_IMM(BPF_REG_1
, 5),
311 BPF_ALU64_REG(BPF_ARSH
, BPF_REG_0
, BPF_REG_1
),
319 BPF_ALU64_REG(BPF_MOV
, BPF_REG_0
, BPF_REG_2
),
321 .errstr
= "not an exit",
327 BPF_JMP_IMM(BPF_JA
, 0, 0, -1),
330 .errstr
= "back-edge",
336 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
337 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_0
),
338 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_0
),
339 BPF_JMP_IMM(BPF_JA
, 0, 0, -4),
342 .errstr
= "back-edge",
348 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
349 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_0
),
350 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_0
),
351 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, -3),
354 .errstr
= "back-edge",
358 "read uninitialized register",
360 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
363 .errstr
= "R2 !read_ok",
367 "read invalid register",
369 BPF_MOV64_REG(BPF_REG_0
, -1),
372 .errstr
= "R15 is invalid",
376 "program doesn't init R0 before exit",
378 BPF_ALU64_REG(BPF_MOV
, BPF_REG_2
, BPF_REG_1
),
381 .errstr
= "R0 !read_ok",
385 "program doesn't init R0 before exit in all branches",
387 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
388 BPF_MOV64_IMM(BPF_REG_0
, 1),
389 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 2),
392 .errstr
= "R0 !read_ok",
393 .errstr_unpriv
= "R1 pointer comparison",
397 "stack out of bounds",
399 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, 8, 0),
402 .errstr
= "invalid stack",
406 "invalid call insn1",
408 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
| BPF_X
, 0, 0, 0, 0),
411 .errstr
= "BPF_CALL uses reserved",
415 "invalid call insn2",
417 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 1, 0),
420 .errstr
= "BPF_CALL uses reserved",
424 "invalid function call",
426 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, 1234567),
429 .errstr
= "invalid func unknown#1234567",
433 "uninitialized stack1",
435 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
436 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
437 BPF_LD_MAP_FD(BPF_REG_1
, 0),
438 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
439 BPF_FUNC_map_lookup_elem
),
443 .errstr
= "invalid indirect read from stack",
447 "uninitialized stack2",
449 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
450 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, -8),
453 .errstr
= "invalid read from stack",
457 "invalid fp arithmetic",
458 /* If this gets ever changed, make sure JITs can deal with it. */
460 BPF_MOV64_IMM(BPF_REG_0
, 0),
461 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
462 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 8),
463 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
466 .errstr
= "R1 subtraction from stack pointer",
470 "non-invalid fp arithmetic",
472 BPF_MOV64_IMM(BPF_REG_0
, 0),
473 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
479 "invalid argument register",
481 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
482 BPF_FUNC_get_cgroup_classid
),
483 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
484 BPF_FUNC_get_cgroup_classid
),
487 .errstr
= "R1 !read_ok",
489 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
492 "non-invalid argument register",
494 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_1
),
495 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
496 BPF_FUNC_get_cgroup_classid
),
497 BPF_ALU64_REG(BPF_MOV
, BPF_REG_1
, BPF_REG_6
),
498 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
499 BPF_FUNC_get_cgroup_classid
),
503 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
506 "check valid spill/fill",
508 /* spill R1(ctx) into stack */
509 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
510 /* fill it back into R2 */
511 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -8),
512 /* should be able to access R0 = *(R2 + 8) */
513 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
514 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
517 .errstr_unpriv
= "R0 leaks addr",
519 .result_unpriv
= REJECT
,
522 "check valid spill/fill, skb mark",
524 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_1
),
525 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_6
, -8),
526 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
527 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
528 offsetof(struct __sk_buff
, mark
)),
532 .result_unpriv
= ACCEPT
,
535 "check corrupted spill/fill",
537 /* spill R1(ctx) into stack */
538 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
539 /* mess up with R1 pointer on stack */
540 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -7, 0x23),
541 /* fill back into R0 should fail */
542 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
545 .errstr_unpriv
= "attempt to corrupt spilled",
546 .errstr
= "corrupted spill",
550 "invalid src register in STX",
552 BPF_STX_MEM(BPF_B
, BPF_REG_10
, -1, -1),
555 .errstr
= "R15 is invalid",
559 "invalid dst register in STX",
561 BPF_STX_MEM(BPF_B
, 14, BPF_REG_10
, -1),
564 .errstr
= "R14 is invalid",
568 "invalid dst register in ST",
570 BPF_ST_MEM(BPF_B
, 14, -1, -1),
573 .errstr
= "R14 is invalid",
577 "invalid src register in LDX",
579 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, 12, 0),
582 .errstr
= "R12 is invalid",
586 "invalid dst register in LDX",
588 BPF_LDX_MEM(BPF_B
, 11, BPF_REG_1
, 0),
591 .errstr
= "R11 is invalid",
597 BPF_RAW_INSN(0, 0, 0, 0, 0),
600 .errstr
= "invalid BPF_LD_IMM",
606 BPF_RAW_INSN(1, 0, 0, 0, 0),
609 .errstr
= "BPF_LDX uses reserved fields",
615 BPF_RAW_INSN(-1, 0, 0, 0, 0),
618 .errstr
= "invalid BPF_ALU opcode f0",
624 BPF_RAW_INSN(-1, -1, -1, -1, -1),
627 .errstr
= "invalid BPF_ALU opcode f0",
633 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
636 .errstr
= "BPF_ALU uses reserved fields",
640 "misaligned read from stack",
642 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
643 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, -4),
646 .errstr
= "misaligned stack access",
650 "invalid map_fd for function call",
652 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
653 BPF_ALU64_REG(BPF_MOV
, BPF_REG_2
, BPF_REG_10
),
654 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
655 BPF_LD_MAP_FD(BPF_REG_1
, 0),
656 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
657 BPF_FUNC_map_delete_elem
),
660 .errstr
= "fd 0 is not pointing to valid bpf_map",
664 "don't check return value before access",
666 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
667 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
668 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
669 BPF_LD_MAP_FD(BPF_REG_1
, 0),
670 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
671 BPF_FUNC_map_lookup_elem
),
672 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
676 .errstr
= "R0 invalid mem access 'map_value_or_null'",
680 "access memory with incorrect alignment",
682 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
683 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
684 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
685 BPF_LD_MAP_FD(BPF_REG_1
, 0),
686 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
687 BPF_FUNC_map_lookup_elem
),
688 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
689 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 4, 0),
693 .errstr
= "misaligned value access",
695 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
698 "sometimes access memory with incorrect alignment",
700 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
701 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
702 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
703 BPF_LD_MAP_FD(BPF_REG_1
, 0),
704 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
705 BPF_FUNC_map_lookup_elem
),
706 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
707 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
709 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 1),
713 .errstr
= "R0 invalid mem access",
714 .errstr_unpriv
= "R0 leaks addr",
716 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
721 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
722 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -8),
723 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
724 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
725 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 1),
726 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 1),
727 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 1),
728 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 2),
729 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 1),
730 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 3),
731 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 1),
732 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 4),
733 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 1),
734 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 5),
735 BPF_MOV64_IMM(BPF_REG_0
, 0),
738 .errstr_unpriv
= "R1 pointer comparison",
739 .result_unpriv
= REJECT
,
745 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
746 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 2),
747 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
748 BPF_JMP_IMM(BPF_JA
, 0, 0, 14),
749 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 2),
750 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 0),
751 BPF_JMP_IMM(BPF_JA
, 0, 0, 11),
752 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 2),
753 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 0),
754 BPF_JMP_IMM(BPF_JA
, 0, 0, 8),
755 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 2),
756 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -40, 0),
757 BPF_JMP_IMM(BPF_JA
, 0, 0, 5),
758 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 2),
759 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -48, 0),
760 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
761 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 1),
762 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -56, 0),
763 BPF_MOV64_IMM(BPF_REG_0
, 0),
766 .errstr_unpriv
= "R1 pointer comparison",
767 .result_unpriv
= REJECT
,
773 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
774 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
775 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
776 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
777 BPF_JMP_IMM(BPF_JA
, 0, 0, 19),
778 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 3),
779 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 0),
780 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
781 BPF_JMP_IMM(BPF_JA
, 0, 0, 15),
782 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 3),
783 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 0),
784 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -32),
785 BPF_JMP_IMM(BPF_JA
, 0, 0, 11),
786 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 3),
787 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -40, 0),
788 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -40),
789 BPF_JMP_IMM(BPF_JA
, 0, 0, 7),
790 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 3),
791 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -48, 0),
792 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -48),
793 BPF_JMP_IMM(BPF_JA
, 0, 0, 3),
794 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 0),
795 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -56, 0),
796 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -56),
797 BPF_LD_MAP_FD(BPF_REG_1
, 0),
798 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
799 BPF_FUNC_map_delete_elem
),
802 .fixup_map1
= { 24 },
803 .errstr_unpriv
= "R1 pointer comparison",
804 .result_unpriv
= REJECT
,
810 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
811 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
812 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
813 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
814 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
815 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
816 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
817 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
818 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
819 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
820 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
821 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
822 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
823 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
824 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
825 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
826 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
827 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
828 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
829 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
830 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
831 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
832 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
833 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
834 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
835 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
836 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
837 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
838 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
839 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
840 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
841 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
842 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
843 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
844 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
845 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
846 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
847 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
848 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
849 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
850 BPF_MOV64_IMM(BPF_REG_0
, 0),
853 .errstr_unpriv
= "R1 pointer comparison",
854 .result_unpriv
= REJECT
,
860 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
861 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
862 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
863 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
864 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
865 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
866 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
867 BPF_MOV64_IMM(BPF_REG_0
, 0),
868 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
869 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
870 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
871 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
872 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
873 BPF_MOV64_IMM(BPF_REG_0
, 0),
874 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
875 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
876 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
877 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
878 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
879 BPF_MOV64_IMM(BPF_REG_0
, 0),
880 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
881 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
882 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
883 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
884 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
885 BPF_MOV64_IMM(BPF_REG_0
, 0),
886 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
887 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
888 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
889 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
890 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
891 BPF_MOV64_IMM(BPF_REG_0
, 0),
894 .errstr_unpriv
= "R1 pointer comparison",
895 .result_unpriv
= REJECT
,
899 "access skb fields ok",
901 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
902 offsetof(struct __sk_buff
, len
)),
903 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
904 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
905 offsetof(struct __sk_buff
, mark
)),
906 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
907 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
908 offsetof(struct __sk_buff
, pkt_type
)),
909 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
910 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
911 offsetof(struct __sk_buff
, queue_mapping
)),
912 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
913 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
914 offsetof(struct __sk_buff
, protocol
)),
915 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
916 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
917 offsetof(struct __sk_buff
, vlan_present
)),
918 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
919 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
920 offsetof(struct __sk_buff
, vlan_tci
)),
921 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
922 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
923 offsetof(struct __sk_buff
, napi_id
)),
924 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
930 "access skb fields bad1",
932 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -4),
935 .errstr
= "invalid bpf_context access",
939 "access skb fields bad2",
941 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 9),
942 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
943 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
944 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
945 BPF_LD_MAP_FD(BPF_REG_1
, 0),
946 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
947 BPF_FUNC_map_lookup_elem
),
948 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
950 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
951 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
952 offsetof(struct __sk_buff
, pkt_type
)),
956 .errstr
= "different pointers",
957 .errstr_unpriv
= "R1 pointer comparison",
961 "access skb fields bad3",
963 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
964 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
965 offsetof(struct __sk_buff
, pkt_type
)),
967 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
968 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
969 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
970 BPF_LD_MAP_FD(BPF_REG_1
, 0),
971 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
972 BPF_FUNC_map_lookup_elem
),
973 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
975 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
976 BPF_JMP_IMM(BPF_JA
, 0, 0, -12),
979 .errstr
= "different pointers",
980 .errstr_unpriv
= "R1 pointer comparison",
984 "access skb fields bad4",
986 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 3),
987 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
988 offsetof(struct __sk_buff
, len
)),
989 BPF_MOV64_IMM(BPF_REG_0
, 0),
991 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
992 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
993 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
994 BPF_LD_MAP_FD(BPF_REG_1
, 0),
995 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
996 BPF_FUNC_map_lookup_elem
),
997 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
999 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
1000 BPF_JMP_IMM(BPF_JA
, 0, 0, -13),
1002 .fixup_map1
= { 7 },
1003 .errstr
= "different pointers",
1004 .errstr_unpriv
= "R1 pointer comparison",
1008 "invalid access __sk_buff family",
1010 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1011 offsetof(struct __sk_buff
, family
)),
1014 .errstr
= "invalid bpf_context access",
1018 "invalid access __sk_buff remote_ip4",
1020 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1021 offsetof(struct __sk_buff
, remote_ip4
)),
1024 .errstr
= "invalid bpf_context access",
1028 "invalid access __sk_buff local_ip4",
1030 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1031 offsetof(struct __sk_buff
, local_ip4
)),
1034 .errstr
= "invalid bpf_context access",
1038 "invalid access __sk_buff remote_ip6",
1040 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1041 offsetof(struct __sk_buff
, remote_ip6
)),
1044 .errstr
= "invalid bpf_context access",
1048 "invalid access __sk_buff local_ip6",
1050 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1051 offsetof(struct __sk_buff
, local_ip6
)),
1054 .errstr
= "invalid bpf_context access",
1058 "invalid access __sk_buff remote_port",
1060 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1061 offsetof(struct __sk_buff
, remote_port
)),
1064 .errstr
= "invalid bpf_context access",
1068 "invalid access __sk_buff remote_port",
1070 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1071 offsetof(struct __sk_buff
, local_port
)),
1074 .errstr
= "invalid bpf_context access",
1078 "valid access __sk_buff family",
1080 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1081 offsetof(struct __sk_buff
, family
)),
1085 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1088 "valid access __sk_buff remote_ip4",
1090 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1091 offsetof(struct __sk_buff
, remote_ip4
)),
1095 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1098 "valid access __sk_buff local_ip4",
1100 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1101 offsetof(struct __sk_buff
, local_ip4
)),
1105 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1108 "valid access __sk_buff remote_ip6",
1110 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1111 offsetof(struct __sk_buff
, remote_ip6
[0])),
1112 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1113 offsetof(struct __sk_buff
, remote_ip6
[1])),
1114 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1115 offsetof(struct __sk_buff
, remote_ip6
[2])),
1116 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1117 offsetof(struct __sk_buff
, remote_ip6
[3])),
1121 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1124 "valid access __sk_buff local_ip6",
1126 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1127 offsetof(struct __sk_buff
, local_ip6
[0])),
1128 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1129 offsetof(struct __sk_buff
, local_ip6
[1])),
1130 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1131 offsetof(struct __sk_buff
, local_ip6
[2])),
1132 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1133 offsetof(struct __sk_buff
, local_ip6
[3])),
1137 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1140 "valid access __sk_buff remote_port",
1142 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1143 offsetof(struct __sk_buff
, remote_port
)),
1147 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1150 "valid access __sk_buff remote_port",
1152 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1153 offsetof(struct __sk_buff
, local_port
)),
1157 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1160 "invalid access of tc_classid for SK_SKB",
1162 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1163 offsetof(struct __sk_buff
, tc_classid
)),
1167 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1168 .errstr
= "invalid bpf_context access",
1171 "invalid access of skb->mark for SK_SKB",
1173 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1174 offsetof(struct __sk_buff
, mark
)),
1178 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1179 .errstr
= "invalid bpf_context access",
1182 "check skb->mark is not writeable by SK_SKB",
1184 BPF_MOV64_IMM(BPF_REG_0
, 0),
1185 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1186 offsetof(struct __sk_buff
, mark
)),
1190 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1191 .errstr
= "invalid bpf_context access",
1194 "check skb->tc_index is writeable by SK_SKB",
1196 BPF_MOV64_IMM(BPF_REG_0
, 0),
1197 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1198 offsetof(struct __sk_buff
, tc_index
)),
1202 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1205 "check skb->priority is writeable by SK_SKB",
1207 BPF_MOV64_IMM(BPF_REG_0
, 0),
1208 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1209 offsetof(struct __sk_buff
, priority
)),
1213 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1216 "direct packet read for SK_SKB",
1218 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
1219 offsetof(struct __sk_buff
, data
)),
1220 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
1221 offsetof(struct __sk_buff
, data_end
)),
1222 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
1223 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
1224 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
1225 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
1226 BPF_MOV64_IMM(BPF_REG_0
, 0),
1230 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1233 "direct packet write for SK_SKB",
1235 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
1236 offsetof(struct __sk_buff
, data
)),
1237 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
1238 offsetof(struct __sk_buff
, data_end
)),
1239 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
1240 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
1241 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
1242 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
1243 BPF_MOV64_IMM(BPF_REG_0
, 0),
1247 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1250 "overlapping checks for direct packet access SK_SKB",
1252 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
1253 offsetof(struct __sk_buff
, data
)),
1254 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
1255 offsetof(struct __sk_buff
, data_end
)),
1256 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
1257 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
1258 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 4),
1259 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
1260 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 6),
1261 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
1262 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_2
, 6),
1263 BPF_MOV64_IMM(BPF_REG_0
, 0),
1267 .prog_type
= BPF_PROG_TYPE_SK_SKB
,
1270 "check skb->mark is not writeable by sockets",
1272 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1273 offsetof(struct __sk_buff
, mark
)),
1276 .errstr
= "invalid bpf_context access",
1277 .errstr_unpriv
= "R1 leaks addr",
1281 "check skb->tc_index is not writeable by sockets",
1283 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1284 offsetof(struct __sk_buff
, tc_index
)),
1287 .errstr
= "invalid bpf_context access",
1288 .errstr_unpriv
= "R1 leaks addr",
1292 "check cb access: byte",
1294 BPF_MOV64_IMM(BPF_REG_0
, 0),
1295 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1296 offsetof(struct __sk_buff
, cb
[0])),
1297 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1298 offsetof(struct __sk_buff
, cb
[0]) + 1),
1299 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1300 offsetof(struct __sk_buff
, cb
[0]) + 2),
1301 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1302 offsetof(struct __sk_buff
, cb
[0]) + 3),
1303 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1304 offsetof(struct __sk_buff
, cb
[1])),
1305 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1306 offsetof(struct __sk_buff
, cb
[1]) + 1),
1307 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1308 offsetof(struct __sk_buff
, cb
[1]) + 2),
1309 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1310 offsetof(struct __sk_buff
, cb
[1]) + 3),
1311 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1312 offsetof(struct __sk_buff
, cb
[2])),
1313 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1314 offsetof(struct __sk_buff
, cb
[2]) + 1),
1315 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1316 offsetof(struct __sk_buff
, cb
[2]) + 2),
1317 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1318 offsetof(struct __sk_buff
, cb
[2]) + 3),
1319 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1320 offsetof(struct __sk_buff
, cb
[3])),
1321 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1322 offsetof(struct __sk_buff
, cb
[3]) + 1),
1323 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1324 offsetof(struct __sk_buff
, cb
[3]) + 2),
1325 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1326 offsetof(struct __sk_buff
, cb
[3]) + 3),
1327 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1328 offsetof(struct __sk_buff
, cb
[4])),
1329 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1330 offsetof(struct __sk_buff
, cb
[4]) + 1),
1331 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1332 offsetof(struct __sk_buff
, cb
[4]) + 2),
1333 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1334 offsetof(struct __sk_buff
, cb
[4]) + 3),
1335 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1336 offsetof(struct __sk_buff
, cb
[0])),
1337 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1338 offsetof(struct __sk_buff
, cb
[0]) + 1),
1339 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1340 offsetof(struct __sk_buff
, cb
[0]) + 2),
1341 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1342 offsetof(struct __sk_buff
, cb
[0]) + 3),
1343 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1344 offsetof(struct __sk_buff
, cb
[1])),
1345 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1346 offsetof(struct __sk_buff
, cb
[1]) + 1),
1347 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1348 offsetof(struct __sk_buff
, cb
[1]) + 2),
1349 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1350 offsetof(struct __sk_buff
, cb
[1]) + 3),
1351 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1352 offsetof(struct __sk_buff
, cb
[2])),
1353 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1354 offsetof(struct __sk_buff
, cb
[2]) + 1),
1355 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1356 offsetof(struct __sk_buff
, cb
[2]) + 2),
1357 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1358 offsetof(struct __sk_buff
, cb
[2]) + 3),
1359 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1360 offsetof(struct __sk_buff
, cb
[3])),
1361 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1362 offsetof(struct __sk_buff
, cb
[3]) + 1),
1363 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1364 offsetof(struct __sk_buff
, cb
[3]) + 2),
1365 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1366 offsetof(struct __sk_buff
, cb
[3]) + 3),
1367 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1368 offsetof(struct __sk_buff
, cb
[4])),
1369 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1370 offsetof(struct __sk_buff
, cb
[4]) + 1),
1371 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1372 offsetof(struct __sk_buff
, cb
[4]) + 2),
1373 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1374 offsetof(struct __sk_buff
, cb
[4]) + 3),
1380 "__sk_buff->hash, offset 0, byte store not permitted",
1382 BPF_MOV64_IMM(BPF_REG_0
, 0),
1383 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1384 offsetof(struct __sk_buff
, hash
)),
1387 .errstr
= "invalid bpf_context access",
1391 "__sk_buff->tc_index, offset 3, byte store not permitted",
1393 BPF_MOV64_IMM(BPF_REG_0
, 0),
1394 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1395 offsetof(struct __sk_buff
, tc_index
) + 3),
1398 .errstr
= "invalid bpf_context access",
1402 "check skb->hash byte load permitted",
1404 BPF_MOV64_IMM(BPF_REG_0
, 0),
1405 #if __BYTE_ORDER == __LITTLE_ENDIAN
1406 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1407 offsetof(struct __sk_buff
, hash
)),
1409 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1410 offsetof(struct __sk_buff
, hash
) + 3),
1417 "check skb->hash byte load not permitted 1",
1419 BPF_MOV64_IMM(BPF_REG_0
, 0),
1420 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1421 offsetof(struct __sk_buff
, hash
) + 1),
1424 .errstr
= "invalid bpf_context access",
1428 "check skb->hash byte load not permitted 2",
1430 BPF_MOV64_IMM(BPF_REG_0
, 0),
1431 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1432 offsetof(struct __sk_buff
, hash
) + 2),
1435 .errstr
= "invalid bpf_context access",
1439 "check skb->hash byte load not permitted 3",
1441 BPF_MOV64_IMM(BPF_REG_0
, 0),
1442 #if __BYTE_ORDER == __LITTLE_ENDIAN
1443 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1444 offsetof(struct __sk_buff
, hash
) + 3),
1446 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1447 offsetof(struct __sk_buff
, hash
)),
1451 .errstr
= "invalid bpf_context access",
1455 "check cb access: byte, wrong type",
1457 BPF_MOV64_IMM(BPF_REG_0
, 0),
1458 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1459 offsetof(struct __sk_buff
, cb
[0])),
1462 .errstr
= "invalid bpf_context access",
1464 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1467 "check cb access: half",
1469 BPF_MOV64_IMM(BPF_REG_0
, 0),
1470 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1471 offsetof(struct __sk_buff
, cb
[0])),
1472 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1473 offsetof(struct __sk_buff
, cb
[0]) + 2),
1474 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1475 offsetof(struct __sk_buff
, cb
[1])),
1476 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1477 offsetof(struct __sk_buff
, cb
[1]) + 2),
1478 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1479 offsetof(struct __sk_buff
, cb
[2])),
1480 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1481 offsetof(struct __sk_buff
, cb
[2]) + 2),
1482 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1483 offsetof(struct __sk_buff
, cb
[3])),
1484 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1485 offsetof(struct __sk_buff
, cb
[3]) + 2),
1486 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1487 offsetof(struct __sk_buff
, cb
[4])),
1488 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1489 offsetof(struct __sk_buff
, cb
[4]) + 2),
1490 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1491 offsetof(struct __sk_buff
, cb
[0])),
1492 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1493 offsetof(struct __sk_buff
, cb
[0]) + 2),
1494 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1495 offsetof(struct __sk_buff
, cb
[1])),
1496 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1497 offsetof(struct __sk_buff
, cb
[1]) + 2),
1498 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1499 offsetof(struct __sk_buff
, cb
[2])),
1500 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1501 offsetof(struct __sk_buff
, cb
[2]) + 2),
1502 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1503 offsetof(struct __sk_buff
, cb
[3])),
1504 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1505 offsetof(struct __sk_buff
, cb
[3]) + 2),
1506 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1507 offsetof(struct __sk_buff
, cb
[4])),
1508 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1509 offsetof(struct __sk_buff
, cb
[4]) + 2),
1515 "check cb access: half, unaligned",
1517 BPF_MOV64_IMM(BPF_REG_0
, 0),
1518 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1519 offsetof(struct __sk_buff
, cb
[0]) + 1),
1522 .errstr
= "misaligned context access",
1524 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1527 "check __sk_buff->hash, offset 0, half store not permitted",
1529 BPF_MOV64_IMM(BPF_REG_0
, 0),
1530 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1531 offsetof(struct __sk_buff
, hash
)),
1534 .errstr
= "invalid bpf_context access",
1538 "check __sk_buff->tc_index, offset 2, half store not permitted",
1540 BPF_MOV64_IMM(BPF_REG_0
, 0),
1541 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1542 offsetof(struct __sk_buff
, tc_index
) + 2),
1545 .errstr
= "invalid bpf_context access",
1549 "check skb->hash half load permitted",
1551 BPF_MOV64_IMM(BPF_REG_0
, 0),
1552 #if __BYTE_ORDER == __LITTLE_ENDIAN
1553 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1554 offsetof(struct __sk_buff
, hash
)),
1556 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1557 offsetof(struct __sk_buff
, hash
) + 2),
1564 "check skb->hash half load not permitted",
1566 BPF_MOV64_IMM(BPF_REG_0
, 0),
1567 #if __BYTE_ORDER == __LITTLE_ENDIAN
1568 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1569 offsetof(struct __sk_buff
, hash
) + 2),
1571 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1572 offsetof(struct __sk_buff
, hash
)),
1576 .errstr
= "invalid bpf_context access",
1580 "check cb access: half, wrong type",
1582 BPF_MOV64_IMM(BPF_REG_0
, 0),
1583 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1584 offsetof(struct __sk_buff
, cb
[0])),
1587 .errstr
= "invalid bpf_context access",
1589 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1592 "check cb access: word",
1594 BPF_MOV64_IMM(BPF_REG_0
, 0),
1595 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1596 offsetof(struct __sk_buff
, cb
[0])),
1597 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1598 offsetof(struct __sk_buff
, cb
[1])),
1599 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1600 offsetof(struct __sk_buff
, cb
[2])),
1601 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1602 offsetof(struct __sk_buff
, cb
[3])),
1603 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1604 offsetof(struct __sk_buff
, cb
[4])),
1605 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1606 offsetof(struct __sk_buff
, cb
[0])),
1607 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1608 offsetof(struct __sk_buff
, cb
[1])),
1609 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1610 offsetof(struct __sk_buff
, cb
[2])),
1611 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1612 offsetof(struct __sk_buff
, cb
[3])),
1613 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1614 offsetof(struct __sk_buff
, cb
[4])),
1620 "check cb access: word, unaligned 1",
1622 BPF_MOV64_IMM(BPF_REG_0
, 0),
1623 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1624 offsetof(struct __sk_buff
, cb
[0]) + 2),
1627 .errstr
= "misaligned context access",
1629 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1632 "check cb access: word, unaligned 2",
1634 BPF_MOV64_IMM(BPF_REG_0
, 0),
1635 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1636 offsetof(struct __sk_buff
, cb
[4]) + 1),
1639 .errstr
= "misaligned context access",
1641 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1644 "check cb access: word, unaligned 3",
1646 BPF_MOV64_IMM(BPF_REG_0
, 0),
1647 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1648 offsetof(struct __sk_buff
, cb
[4]) + 2),
1651 .errstr
= "misaligned context access",
1653 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1656 "check cb access: word, unaligned 4",
1658 BPF_MOV64_IMM(BPF_REG_0
, 0),
1659 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1660 offsetof(struct __sk_buff
, cb
[4]) + 3),
1663 .errstr
= "misaligned context access",
1665 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1668 "check cb access: double",
1670 BPF_MOV64_IMM(BPF_REG_0
, 0),
1671 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1672 offsetof(struct __sk_buff
, cb
[0])),
1673 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1674 offsetof(struct __sk_buff
, cb
[2])),
1675 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1676 offsetof(struct __sk_buff
, cb
[0])),
1677 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1678 offsetof(struct __sk_buff
, cb
[2])),
1684 "check cb access: double, unaligned 1",
1686 BPF_MOV64_IMM(BPF_REG_0
, 0),
1687 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1688 offsetof(struct __sk_buff
, cb
[1])),
1691 .errstr
= "misaligned context access",
1693 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1696 "check cb access: double, unaligned 2",
1698 BPF_MOV64_IMM(BPF_REG_0
, 0),
1699 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1700 offsetof(struct __sk_buff
, cb
[3])),
1703 .errstr
= "misaligned context access",
1705 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
1708 "check cb access: double, oob 1",
1710 BPF_MOV64_IMM(BPF_REG_0
, 0),
1711 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1712 offsetof(struct __sk_buff
, cb
[4])),
1715 .errstr
= "invalid bpf_context access",
1719 "check cb access: double, oob 2",
1721 BPF_MOV64_IMM(BPF_REG_0
, 0),
1722 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1723 offsetof(struct __sk_buff
, cb
[4])),
1726 .errstr
= "invalid bpf_context access",
1730 "check __sk_buff->ifindex dw store not permitted",
1732 BPF_MOV64_IMM(BPF_REG_0
, 0),
1733 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1734 offsetof(struct __sk_buff
, ifindex
)),
1737 .errstr
= "invalid bpf_context access",
1741 "check __sk_buff->ifindex dw load not permitted",
1743 BPF_MOV64_IMM(BPF_REG_0
, 0),
1744 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1745 offsetof(struct __sk_buff
, ifindex
)),
1748 .errstr
= "invalid bpf_context access",
1752 "check cb access: double, wrong type",
1754 BPF_MOV64_IMM(BPF_REG_0
, 0),
1755 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1756 offsetof(struct __sk_buff
, cb
[0])),
1759 .errstr
= "invalid bpf_context access",
1761 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1764 "check out of range skb->cb access",
1766 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1767 offsetof(struct __sk_buff
, cb
[0]) + 256),
1770 .errstr
= "invalid bpf_context access",
1771 .errstr_unpriv
= "",
1773 .prog_type
= BPF_PROG_TYPE_SCHED_ACT
,
1776 "write skb fields from socket prog",
1778 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1779 offsetof(struct __sk_buff
, cb
[4])),
1780 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
1781 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1782 offsetof(struct __sk_buff
, mark
)),
1783 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1784 offsetof(struct __sk_buff
, tc_index
)),
1785 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
1786 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1787 offsetof(struct __sk_buff
, cb
[0])),
1788 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1789 offsetof(struct __sk_buff
, cb
[2])),
1793 .errstr_unpriv
= "R1 leaks addr",
1794 .result_unpriv
= REJECT
,
1797 "write skb fields from tc_cls_act prog",
1799 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1800 offsetof(struct __sk_buff
, cb
[0])),
1801 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1802 offsetof(struct __sk_buff
, mark
)),
1803 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1804 offsetof(struct __sk_buff
, tc_index
)),
1805 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1806 offsetof(struct __sk_buff
, tc_index
)),
1807 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1808 offsetof(struct __sk_buff
, cb
[3])),
1811 .errstr_unpriv
= "",
1812 .result_unpriv
= REJECT
,
1814 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1817 "PTR_TO_STACK store/load",
1819 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1820 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -10),
1821 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 2, 0xfaceb00c),
1822 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 2),
1828 "PTR_TO_STACK store/load - bad alignment on off",
1830 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1831 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1832 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 2, 0xfaceb00c),
1833 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 2),
1837 .errstr
= "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
1840 "PTR_TO_STACK store/load - bad alignment on reg",
1842 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1843 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -10),
1844 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1845 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1849 .errstr
= "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
1852 "PTR_TO_STACK store/load - out of bounds low",
1854 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1855 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -80000),
1856 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1857 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1861 .errstr
= "invalid stack off=-79992 size=8",
1864 "PTR_TO_STACK store/load - out of bounds high",
1866 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1867 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1868 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1869 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1873 .errstr
= "invalid stack off=0 size=8",
1876 "unpriv: return pointer",
1878 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_10
),
1882 .result_unpriv
= REJECT
,
1883 .errstr_unpriv
= "R0 leaks addr",
1886 "unpriv: add const to pointer",
1888 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
1889 BPF_MOV64_IMM(BPF_REG_0
, 0),
1895 "unpriv: add pointer to pointer",
1897 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_10
),
1898 BPF_MOV64_IMM(BPF_REG_0
, 0),
1902 .errstr
= "R1 pointer += pointer",
1905 "unpriv: neg pointer",
1907 BPF_ALU64_IMM(BPF_NEG
, BPF_REG_1
, 0),
1908 BPF_MOV64_IMM(BPF_REG_0
, 0),
1912 .result_unpriv
= REJECT
,
1913 .errstr_unpriv
= "R1 pointer arithmetic",
1916 "unpriv: cmp pointer with const",
1918 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 0),
1919 BPF_MOV64_IMM(BPF_REG_0
, 0),
1923 .result_unpriv
= REJECT
,
1924 .errstr_unpriv
= "R1 pointer comparison",
1927 "unpriv: cmp pointer with pointer",
1929 BPF_JMP_REG(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
1930 BPF_MOV64_IMM(BPF_REG_0
, 0),
1934 .result_unpriv
= REJECT
,
1935 .errstr_unpriv
= "R10 pointer comparison",
1938 "unpriv: check that printk is disallowed",
1940 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
1941 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1942 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1943 BPF_MOV64_IMM(BPF_REG_2
, 8),
1944 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_1
),
1945 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1946 BPF_FUNC_trace_printk
),
1947 BPF_MOV64_IMM(BPF_REG_0
, 0),
1950 .errstr_unpriv
= "unknown func bpf_trace_printk#6",
1951 .result_unpriv
= REJECT
,
1955 "unpriv: pass pointer to helper function",
1957 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
1958 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1959 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1960 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1961 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
1962 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
1963 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1964 BPF_FUNC_map_update_elem
),
1965 BPF_MOV64_IMM(BPF_REG_0
, 0),
1968 .fixup_map1
= { 3 },
1969 .errstr_unpriv
= "R4 leaks addr",
1970 .result_unpriv
= REJECT
,
1974 "unpriv: indirectly pass pointer on stack to helper function",
1976 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1977 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1978 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1979 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1980 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1981 BPF_FUNC_map_lookup_elem
),
1982 BPF_MOV64_IMM(BPF_REG_0
, 0),
1985 .fixup_map1
= { 3 },
1986 .errstr
= "invalid indirect read from stack off -8+0 size 8",
1990 "unpriv: mangle pointer on stack 1",
1992 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1993 BPF_ST_MEM(BPF_W
, BPF_REG_10
, -8, 0),
1994 BPF_MOV64_IMM(BPF_REG_0
, 0),
1997 .errstr_unpriv
= "attempt to corrupt spilled",
1998 .result_unpriv
= REJECT
,
2002 "unpriv: mangle pointer on stack 2",
2004 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
2005 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -1, 0),
2006 BPF_MOV64_IMM(BPF_REG_0
, 0),
2009 .errstr_unpriv
= "attempt to corrupt spilled",
2010 .result_unpriv
= REJECT
,
2014 "unpriv: read pointer from stack in small chunks",
2016 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
2017 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_10
, -8),
2018 BPF_MOV64_IMM(BPF_REG_0
, 0),
2021 .errstr
= "invalid size",
2025 "unpriv: write pointer into ctx",
2027 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_1
, 0),
2028 BPF_MOV64_IMM(BPF_REG_0
, 0),
2031 .errstr_unpriv
= "R1 leaks addr",
2032 .result_unpriv
= REJECT
,
2033 .errstr
= "invalid bpf_context access",
2037 "unpriv: spill/fill of ctx",
2039 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2040 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2041 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2042 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2043 BPF_MOV64_IMM(BPF_REG_0
, 0),
2049 "unpriv: spill/fill of ctx 2",
2051 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2052 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2053 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2054 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2055 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2056 BPF_FUNC_get_hash_recalc
),
2060 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2063 "unpriv: spill/fill of ctx 3",
2065 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2066 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2067 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2068 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_10
, 0),
2069 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2070 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2071 BPF_FUNC_get_hash_recalc
),
2075 .errstr
= "R1 type=fp expected=ctx",
2076 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2079 "unpriv: spill/fill of ctx 4",
2081 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2082 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2083 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2084 BPF_MOV64_IMM(BPF_REG_0
, 1),
2085 BPF_RAW_INSN(BPF_STX
| BPF_XADD
| BPF_DW
, BPF_REG_10
,
2087 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2088 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2089 BPF_FUNC_get_hash_recalc
),
2093 .errstr
= "R1 type=inv expected=ctx",
2094 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2097 "unpriv: spill/fill of different pointers stx",
2099 BPF_MOV64_IMM(BPF_REG_3
, 42),
2100 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2101 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2102 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
2103 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2104 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
2105 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_2
, 0),
2106 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 1),
2107 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2108 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2109 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_3
,
2110 offsetof(struct __sk_buff
, mark
)),
2111 BPF_MOV64_IMM(BPF_REG_0
, 0),
2115 .errstr
= "same insn cannot be used with different pointers",
2116 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2119 "unpriv: spill/fill of different pointers ldx",
2121 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2122 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2123 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
2124 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2125 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
,
2126 -(__s32
)offsetof(struct bpf_perf_event_data
,
2127 sample_period
) - 8),
2128 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_2
, 0),
2129 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 1),
2130 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2131 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
2132 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_1
,
2133 offsetof(struct bpf_perf_event_data
,
2135 BPF_MOV64_IMM(BPF_REG_0
, 0),
2139 .errstr
= "same insn cannot be used with different pointers",
2140 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
2143 "unpriv: write pointer into map elem value",
2145 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
2146 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2147 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
2148 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2149 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2150 BPF_FUNC_map_lookup_elem
),
2151 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
2152 BPF_STX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
2155 .fixup_map1
= { 3 },
2156 .errstr_unpriv
= "R0 leaks addr",
2157 .result_unpriv
= REJECT
,
2161 "unpriv: partial copy of pointer",
2163 BPF_MOV32_REG(BPF_REG_1
, BPF_REG_10
),
2164 BPF_MOV64_IMM(BPF_REG_0
, 0),
2167 .errstr_unpriv
= "R10 partial copy",
2168 .result_unpriv
= REJECT
,
2172 "unpriv: pass pointer to tail_call",
2174 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_1
),
2175 BPF_LD_MAP_FD(BPF_REG_2
, 0),
2176 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2177 BPF_FUNC_tail_call
),
2178 BPF_MOV64_IMM(BPF_REG_0
, 0),
2181 .fixup_prog
= { 1 },
2182 .errstr_unpriv
= "R3 leaks addr into helper",
2183 .result_unpriv
= REJECT
,
2187 "unpriv: cmp map pointer with zero",
2189 BPF_MOV64_IMM(BPF_REG_1
, 0),
2190 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2191 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 0),
2192 BPF_MOV64_IMM(BPF_REG_0
, 0),
2195 .fixup_map1
= { 1 },
2196 .errstr_unpriv
= "R1 pointer comparison",
2197 .result_unpriv
= REJECT
,
2201 "unpriv: write into frame pointer",
2203 BPF_MOV64_REG(BPF_REG_10
, BPF_REG_1
),
2204 BPF_MOV64_IMM(BPF_REG_0
, 0),
2207 .errstr
= "frame pointer is read only",
2211 "unpriv: spill/fill frame pointer",
2213 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2214 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2215 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_10
, 0),
2216 BPF_LDX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_6
, 0),
2217 BPF_MOV64_IMM(BPF_REG_0
, 0),
2220 .errstr
= "frame pointer is read only",
2224 "unpriv: cmp of frame pointer",
2226 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_10
, 0, 0),
2227 BPF_MOV64_IMM(BPF_REG_0
, 0),
2230 .errstr_unpriv
= "R10 pointer comparison",
2231 .result_unpriv
= REJECT
,
2235 "unpriv: adding of fp",
2237 BPF_MOV64_IMM(BPF_REG_0
, 0),
2238 BPF_MOV64_IMM(BPF_REG_1
, 0),
2239 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_10
),
2240 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, -8),
2246 "unpriv: cmp of stack pointer",
2248 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2249 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
2250 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_2
, 0, 0),
2251 BPF_MOV64_IMM(BPF_REG_0
, 0),
2254 .errstr_unpriv
= "R2 pointer comparison",
2255 .result_unpriv
= REJECT
,
2259 "stack pointer arithmetic",
2261 BPF_MOV64_IMM(BPF_REG_1
, 4),
2262 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
2263 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_10
),
2264 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_7
, -10),
2265 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_7
, -10),
2266 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
2267 BPF_ALU64_REG(BPF_ADD
, BPF_REG_2
, BPF_REG_1
),
2268 BPF_ST_MEM(0, BPF_REG_2
, 4, 0),
2269 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
2270 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 8),
2271 BPF_ST_MEM(0, BPF_REG_2
, 4, 0),
2272 BPF_MOV64_IMM(BPF_REG_0
, 0),
2278 "raw_stack: no skb_load_bytes",
2280 BPF_MOV64_IMM(BPF_REG_2
, 4),
2281 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2282 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2283 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2284 BPF_MOV64_IMM(BPF_REG_4
, 8),
2285 /* Call to skb_load_bytes() omitted. */
2286 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2290 .errstr
= "invalid read from stack off -8+0 size 8",
2291 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2294 "raw_stack: skb_load_bytes, negative len",
2296 BPF_MOV64_IMM(BPF_REG_2
, 4),
2297 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2298 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2299 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2300 BPF_MOV64_IMM(BPF_REG_4
, -8),
2301 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2302 BPF_FUNC_skb_load_bytes
),
2303 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2307 .errstr
= "R4 min value is negative",
2308 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2311 "raw_stack: skb_load_bytes, negative len 2",
2313 BPF_MOV64_IMM(BPF_REG_2
, 4),
2314 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2315 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2316 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2317 BPF_MOV64_IMM(BPF_REG_4
, ~0),
2318 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2319 BPF_FUNC_skb_load_bytes
),
2320 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2324 .errstr
= "R4 min value is negative",
2325 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2328 "raw_stack: skb_load_bytes, zero len",
2330 BPF_MOV64_IMM(BPF_REG_2
, 4),
2331 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2332 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2333 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2334 BPF_MOV64_IMM(BPF_REG_4
, 0),
2335 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2336 BPF_FUNC_skb_load_bytes
),
2337 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2341 .errstr
= "invalid stack type R3",
2342 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2345 "raw_stack: skb_load_bytes, no init",
2347 BPF_MOV64_IMM(BPF_REG_2
, 4),
2348 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2349 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2350 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2351 BPF_MOV64_IMM(BPF_REG_4
, 8),
2352 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2353 BPF_FUNC_skb_load_bytes
),
2354 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2358 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2361 "raw_stack: skb_load_bytes, init",
2363 BPF_MOV64_IMM(BPF_REG_2
, 4),
2364 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2365 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2366 BPF_ST_MEM(BPF_DW
, BPF_REG_6
, 0, 0xcafe),
2367 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2368 BPF_MOV64_IMM(BPF_REG_4
, 8),
2369 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2370 BPF_FUNC_skb_load_bytes
),
2371 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2375 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2378 "raw_stack: skb_load_bytes, spilled regs around bounds",
2380 BPF_MOV64_IMM(BPF_REG_2
, 4),
2381 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2382 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
2383 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
2384 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
2385 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2386 BPF_MOV64_IMM(BPF_REG_4
, 8),
2387 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2388 BPF_FUNC_skb_load_bytes
),
2389 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
2390 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
2391 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
2392 offsetof(struct __sk_buff
, mark
)),
2393 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
2394 offsetof(struct __sk_buff
, priority
)),
2395 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
2399 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2402 "raw_stack: skb_load_bytes, spilled regs corruption",
2404 BPF_MOV64_IMM(BPF_REG_2
, 4),
2405 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2406 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
2407 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2408 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2409 BPF_MOV64_IMM(BPF_REG_4
, 8),
2410 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2411 BPF_FUNC_skb_load_bytes
),
2412 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2413 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
2414 offsetof(struct __sk_buff
, mark
)),
2418 .errstr
= "R0 invalid mem access 'inv'",
2419 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2422 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2424 BPF_MOV64_IMM(BPF_REG_2
, 4),
2425 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2426 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
2427 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
2428 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2429 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
2430 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2431 BPF_MOV64_IMM(BPF_REG_4
, 8),
2432 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2433 BPF_FUNC_skb_load_bytes
),
2434 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
2435 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
2436 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_6
, 0),
2437 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
2438 offsetof(struct __sk_buff
, mark
)),
2439 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
2440 offsetof(struct __sk_buff
, priority
)),
2441 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
2442 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_3
,
2443 offsetof(struct __sk_buff
, pkt_type
)),
2444 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
2448 .errstr
= "R3 invalid mem access 'inv'",
2449 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2452 "raw_stack: skb_load_bytes, spilled regs + data",
2454 BPF_MOV64_IMM(BPF_REG_2
, 4),
2455 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2456 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
2457 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
2458 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2459 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
2460 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2461 BPF_MOV64_IMM(BPF_REG_4
, 8),
2462 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2463 BPF_FUNC_skb_load_bytes
),
2464 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
2465 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
2466 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_6
, 0),
2467 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
2468 offsetof(struct __sk_buff
, mark
)),
2469 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
2470 offsetof(struct __sk_buff
, priority
)),
2471 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
2472 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
2476 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2479 "raw_stack: skb_load_bytes, invalid access 1",
2481 BPF_MOV64_IMM(BPF_REG_2
, 4),
2482 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2483 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -513),
2484 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2485 BPF_MOV64_IMM(BPF_REG_4
, 8),
2486 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2487 BPF_FUNC_skb_load_bytes
),
2488 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2492 .errstr
= "invalid stack type R3 off=-513 access_size=8",
2493 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2496 "raw_stack: skb_load_bytes, invalid access 2",
2498 BPF_MOV64_IMM(BPF_REG_2
, 4),
2499 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2500 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -1),
2501 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2502 BPF_MOV64_IMM(BPF_REG_4
, 8),
2503 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2504 BPF_FUNC_skb_load_bytes
),
2505 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2509 .errstr
= "invalid stack type R3 off=-1 access_size=8",
2510 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2513 "raw_stack: skb_load_bytes, invalid access 3",
2515 BPF_MOV64_IMM(BPF_REG_2
, 4),
2516 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2517 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 0xffffffff),
2518 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2519 BPF_MOV64_IMM(BPF_REG_4
, 0xffffffff),
2520 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2521 BPF_FUNC_skb_load_bytes
),
2522 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2526 .errstr
= "R4 min value is negative",
2527 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2530 "raw_stack: skb_load_bytes, invalid access 4",
2532 BPF_MOV64_IMM(BPF_REG_2
, 4),
2533 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2534 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -1),
2535 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2536 BPF_MOV64_IMM(BPF_REG_4
, 0x7fffffff),
2537 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2538 BPF_FUNC_skb_load_bytes
),
2539 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2543 .errstr
= "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2544 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2547 "raw_stack: skb_load_bytes, invalid access 5",
2549 BPF_MOV64_IMM(BPF_REG_2
, 4),
2550 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2551 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2552 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2553 BPF_MOV64_IMM(BPF_REG_4
, 0x7fffffff),
2554 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2555 BPF_FUNC_skb_load_bytes
),
2556 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2560 .errstr
= "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2561 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2564 "raw_stack: skb_load_bytes, invalid access 6",
2566 BPF_MOV64_IMM(BPF_REG_2
, 4),
2567 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2568 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2569 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2570 BPF_MOV64_IMM(BPF_REG_4
, 0),
2571 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2572 BPF_FUNC_skb_load_bytes
),
2573 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2577 .errstr
= "invalid stack type R3 off=-512 access_size=0",
2578 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2581 "raw_stack: skb_load_bytes, large access",
2583 BPF_MOV64_IMM(BPF_REG_2
, 4),
2584 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2585 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2586 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2587 BPF_MOV64_IMM(BPF_REG_4
, 512),
2588 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2589 BPF_FUNC_skb_load_bytes
),
2590 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2594 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2597 "direct packet access: test1",
2599 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2600 offsetof(struct __sk_buff
, data
)),
2601 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2602 offsetof(struct __sk_buff
, data_end
)),
2603 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2604 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2605 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2606 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2607 BPF_MOV64_IMM(BPF_REG_0
, 0),
2611 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2614 "direct packet access: test2",
2616 BPF_MOV64_IMM(BPF_REG_0
, 1),
2617 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
2618 offsetof(struct __sk_buff
, data_end
)),
2619 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2620 offsetof(struct __sk_buff
, data
)),
2621 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2622 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 14),
2623 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_4
, 15),
2624 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_3
, 7),
2625 BPF_LDX_MEM(BPF_B
, BPF_REG_4
, BPF_REG_3
, 12),
2626 BPF_ALU64_IMM(BPF_MUL
, BPF_REG_4
, 14),
2627 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2628 offsetof(struct __sk_buff
, data
)),
2629 BPF_ALU64_REG(BPF_ADD
, BPF_REG_3
, BPF_REG_4
),
2630 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2631 offsetof(struct __sk_buff
, len
)),
2632 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_2
, 49),
2633 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_2
, 49),
2634 BPF_ALU64_REG(BPF_ADD
, BPF_REG_3
, BPF_REG_2
),
2635 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_3
),
2636 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 8),
2637 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
2638 offsetof(struct __sk_buff
, data_end
)),
2639 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 1),
2640 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_3
, 4),
2641 BPF_MOV64_IMM(BPF_REG_0
, 0),
2645 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2648 "direct packet access: test3",
2650 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2651 offsetof(struct __sk_buff
, data
)),
2652 BPF_MOV64_IMM(BPF_REG_0
, 0),
2655 .errstr
= "invalid bpf_context access off=76",
2657 .prog_type
= BPF_PROG_TYPE_SOCKET_FILTER
,
2660 "direct packet access: test4 (write)",
2662 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2663 offsetof(struct __sk_buff
, data
)),
2664 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2665 offsetof(struct __sk_buff
, data_end
)),
2666 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2667 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2668 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2669 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2670 BPF_MOV64_IMM(BPF_REG_0
, 0),
2674 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2677 "direct packet access: test5 (pkt_end >= reg, good access)",
2679 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2680 offsetof(struct __sk_buff
, data
)),
2681 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2682 offsetof(struct __sk_buff
, data_end
)),
2683 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2684 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2685 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 2),
2686 BPF_MOV64_IMM(BPF_REG_0
, 1),
2688 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2689 BPF_MOV64_IMM(BPF_REG_0
, 0),
2693 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2696 "direct packet access: test6 (pkt_end >= reg, bad access)",
2698 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2699 offsetof(struct __sk_buff
, data
)),
2700 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2701 offsetof(struct __sk_buff
, data_end
)),
2702 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2703 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2704 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 3),
2705 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2706 BPF_MOV64_IMM(BPF_REG_0
, 1),
2708 BPF_MOV64_IMM(BPF_REG_0
, 0),
2711 .errstr
= "invalid access to packet",
2713 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2716 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2718 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2719 offsetof(struct __sk_buff
, data
)),
2720 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2721 offsetof(struct __sk_buff
, data_end
)),
2722 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2723 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2724 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 3),
2725 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2726 BPF_MOV64_IMM(BPF_REG_0
, 1),
2728 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2729 BPF_MOV64_IMM(BPF_REG_0
, 0),
2732 .errstr
= "invalid access to packet",
2734 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2737 "direct packet access: test8 (double test, variant 1)",
2739 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2740 offsetof(struct __sk_buff
, data
)),
2741 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2742 offsetof(struct __sk_buff
, data_end
)),
2743 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2744 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2745 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 4),
2746 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2747 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2748 BPF_MOV64_IMM(BPF_REG_0
, 1),
2750 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2751 BPF_MOV64_IMM(BPF_REG_0
, 0),
2755 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2758 "direct packet access: test9 (double test, variant 2)",
2760 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2761 offsetof(struct __sk_buff
, data
)),
2762 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2763 offsetof(struct __sk_buff
, data_end
)),
2764 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2765 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2766 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 2),
2767 BPF_MOV64_IMM(BPF_REG_0
, 1),
2769 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2770 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2771 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2772 BPF_MOV64_IMM(BPF_REG_0
, 0),
2776 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2779 "direct packet access: test10 (write invalid)",
2781 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2782 offsetof(struct __sk_buff
, data
)),
2783 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2784 offsetof(struct __sk_buff
, data_end
)),
2785 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2786 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2787 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
2788 BPF_MOV64_IMM(BPF_REG_0
, 0),
2790 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2791 BPF_MOV64_IMM(BPF_REG_0
, 0),
2794 .errstr
= "invalid access to packet",
2796 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2799 "direct packet access: test11 (shift, good access)",
2801 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2802 offsetof(struct __sk_buff
, data
)),
2803 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2804 offsetof(struct __sk_buff
, data_end
)),
2805 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2806 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2807 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2808 BPF_MOV64_IMM(BPF_REG_3
, 144),
2809 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2810 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2811 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_5
, 3),
2812 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2813 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2814 BPF_MOV64_IMM(BPF_REG_0
, 1),
2816 BPF_MOV64_IMM(BPF_REG_0
, 0),
2820 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2823 "direct packet access: test12 (and, good access)",
2825 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2826 offsetof(struct __sk_buff
, data
)),
2827 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2828 offsetof(struct __sk_buff
, data_end
)),
2829 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2830 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2831 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2832 BPF_MOV64_IMM(BPF_REG_3
, 144),
2833 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2834 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2835 BPF_ALU64_IMM(BPF_AND
, BPF_REG_5
, 15),
2836 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2837 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2838 BPF_MOV64_IMM(BPF_REG_0
, 1),
2840 BPF_MOV64_IMM(BPF_REG_0
, 0),
2844 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2847 "direct packet access: test13 (branches, good access)",
2849 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2850 offsetof(struct __sk_buff
, data
)),
2851 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2852 offsetof(struct __sk_buff
, data_end
)),
2853 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2854 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2855 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 13),
2856 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2857 offsetof(struct __sk_buff
, mark
)),
2858 BPF_MOV64_IMM(BPF_REG_4
, 1),
2859 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_4
, 2),
2860 BPF_MOV64_IMM(BPF_REG_3
, 14),
2861 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
2862 BPF_MOV64_IMM(BPF_REG_3
, 24),
2863 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2864 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2865 BPF_ALU64_IMM(BPF_AND
, BPF_REG_5
, 15),
2866 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2867 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2868 BPF_MOV64_IMM(BPF_REG_0
, 1),
2870 BPF_MOV64_IMM(BPF_REG_0
, 0),
2874 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2877 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2879 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2880 offsetof(struct __sk_buff
, data
)),
2881 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2882 offsetof(struct __sk_buff
, data_end
)),
2883 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2884 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2885 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 7),
2886 BPF_MOV64_IMM(BPF_REG_5
, 12),
2887 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_5
, 4),
2888 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2889 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2890 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_6
, 0),
2891 BPF_MOV64_IMM(BPF_REG_0
, 1),
2893 BPF_MOV64_IMM(BPF_REG_0
, 0),
2897 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2900 "direct packet access: test15 (spill with xadd)",
2902 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2903 offsetof(struct __sk_buff
, data
)),
2904 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2905 offsetof(struct __sk_buff
, data_end
)),
2906 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2907 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2908 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2909 BPF_MOV64_IMM(BPF_REG_5
, 4096),
2910 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
2911 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
2912 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
2913 BPF_STX_XADD(BPF_DW
, BPF_REG_4
, BPF_REG_5
, 0),
2914 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_4
, 0),
2915 BPF_STX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_5
, 0),
2916 BPF_MOV64_IMM(BPF_REG_0
, 0),
2919 .errstr
= "R2 invalid mem access 'inv'",
2921 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2924 "direct packet access: test16 (arith on data_end)",
2926 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2927 offsetof(struct __sk_buff
, data
)),
2928 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2929 offsetof(struct __sk_buff
, data_end
)),
2930 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2931 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2932 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_3
, 16),
2933 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2934 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2935 BPF_MOV64_IMM(BPF_REG_0
, 0),
2938 .errstr
= "R3 pointer arithmetic on PTR_TO_PACKET_END",
2940 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2943 "direct packet access: test17 (pruning, alignment)",
2945 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2946 offsetof(struct __sk_buff
, data
)),
2947 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2948 offsetof(struct __sk_buff
, data_end
)),
2949 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2950 offsetof(struct __sk_buff
, mark
)),
2951 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2952 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 14),
2953 BPF_JMP_IMM(BPF_JGT
, BPF_REG_7
, 1, 4),
2954 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2955 BPF_STX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
, -4),
2956 BPF_MOV64_IMM(BPF_REG_0
, 0),
2958 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 1),
2961 .errstr
= "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
2963 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2964 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
2967 "direct packet access: test18 (imm += pkt_ptr, 1)",
2969 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2970 offsetof(struct __sk_buff
, data
)),
2971 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2972 offsetof(struct __sk_buff
, data_end
)),
2973 BPF_MOV64_IMM(BPF_REG_0
, 8),
2974 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
2975 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2976 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2977 BPF_MOV64_IMM(BPF_REG_0
, 0),
2981 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2984 "direct packet access: test19 (imm += pkt_ptr, 2)",
2986 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2987 offsetof(struct __sk_buff
, data
)),
2988 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2989 offsetof(struct __sk_buff
, data_end
)),
2990 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2991 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2992 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
2993 BPF_MOV64_IMM(BPF_REG_4
, 4),
2994 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_2
),
2995 BPF_STX_MEM(BPF_B
, BPF_REG_4
, BPF_REG_4
, 0),
2996 BPF_MOV64_IMM(BPF_REG_0
, 0),
3000 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3003 "direct packet access: test20 (x += pkt_ptr, 1)",
3005 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3006 offsetof(struct __sk_buff
, data
)),
3007 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3008 offsetof(struct __sk_buff
, data_end
)),
3009 BPF_MOV64_IMM(BPF_REG_0
, 0xffffffff),
3010 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
3011 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
3012 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 0x7fff),
3013 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3014 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_2
),
3015 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
3016 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 0x7fff - 1),
3017 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
3018 BPF_STX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_4
, 0),
3019 BPF_MOV64_IMM(BPF_REG_0
, 0),
3022 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3026 "direct packet access: test21 (x += pkt_ptr, 2)",
3028 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3029 offsetof(struct __sk_buff
, data
)),
3030 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3031 offsetof(struct __sk_buff
, data_end
)),
3032 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3033 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3034 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 9),
3035 BPF_MOV64_IMM(BPF_REG_4
, 0xffffffff),
3036 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_4
, -8),
3037 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
3038 BPF_ALU64_IMM(BPF_AND
, BPF_REG_4
, 0x7fff),
3039 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_2
),
3040 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
3041 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 0x7fff - 1),
3042 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
3043 BPF_STX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_4
, 0),
3044 BPF_MOV64_IMM(BPF_REG_0
, 0),
3047 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3051 "direct packet access: test22 (x += pkt_ptr, 3)",
3053 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3054 offsetof(struct __sk_buff
, data
)),
3055 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3056 offsetof(struct __sk_buff
, data_end
)),
3057 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3058 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3059 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -8),
3060 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_3
, -16),
3061 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_10
, -16),
3062 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 11),
3063 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -8),
3064 BPF_MOV64_IMM(BPF_REG_4
, 0xffffffff),
3065 BPF_STX_XADD(BPF_DW
, BPF_REG_10
, BPF_REG_4
, -8),
3066 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
3067 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_4
, 49),
3068 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_2
),
3069 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_4
),
3070 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 2),
3071 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
3072 BPF_MOV64_IMM(BPF_REG_2
, 1),
3073 BPF_STX_MEM(BPF_H
, BPF_REG_4
, BPF_REG_2
, 0),
3074 BPF_MOV64_IMM(BPF_REG_0
, 0),
3077 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3081 "direct packet access: test23 (x += pkt_ptr, 4)",
3083 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3084 offsetof(struct __sk_buff
, data
)),
3085 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3086 offsetof(struct __sk_buff
, data_end
)),
3087 BPF_MOV64_IMM(BPF_REG_0
, 0xffffffff),
3088 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
3089 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
3090 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 0xffff),
3091 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3092 BPF_MOV64_IMM(BPF_REG_0
, 31),
3093 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_4
),
3094 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
3095 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_0
),
3096 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0xffff - 1),
3097 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3098 BPF_STX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_0
, 0),
3099 BPF_MOV64_IMM(BPF_REG_0
, 0),
3102 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3104 .errstr
= "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3107 "direct packet access: test24 (x += pkt_ptr, 5)",
3109 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3110 offsetof(struct __sk_buff
, data
)),
3111 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3112 offsetof(struct __sk_buff
, data_end
)),
3113 BPF_MOV64_IMM(BPF_REG_0
, 0xffffffff),
3114 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
3115 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
3116 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 0xff),
3117 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3118 BPF_MOV64_IMM(BPF_REG_0
, 64),
3119 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_4
),
3120 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
3121 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_0
),
3122 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0x7fff - 1),
3123 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3124 BPF_STX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_0
, 0),
3125 BPF_MOV64_IMM(BPF_REG_0
, 0),
3128 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3132 "direct packet access: test25 (marking on <, good access)",
3134 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3135 offsetof(struct __sk_buff
, data
)),
3136 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3137 offsetof(struct __sk_buff
, data_end
)),
3138 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3139 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3140 BPF_JMP_REG(BPF_JLT
, BPF_REG_0
, BPF_REG_3
, 2),
3141 BPF_MOV64_IMM(BPF_REG_0
, 0),
3143 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3144 BPF_JMP_IMM(BPF_JA
, 0, 0, -4),
3147 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3150 "direct packet access: test26 (marking on <, bad access)",
3152 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3153 offsetof(struct __sk_buff
, data
)),
3154 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3155 offsetof(struct __sk_buff
, data_end
)),
3156 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3157 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3158 BPF_JMP_REG(BPF_JLT
, BPF_REG_0
, BPF_REG_3
, 3),
3159 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3160 BPF_MOV64_IMM(BPF_REG_0
, 0),
3162 BPF_JMP_IMM(BPF_JA
, 0, 0, -3),
3165 .errstr
= "invalid access to packet",
3166 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3169 "direct packet access: test27 (marking on <=, good access)",
3171 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3172 offsetof(struct __sk_buff
, data
)),
3173 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3174 offsetof(struct __sk_buff
, data_end
)),
3175 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3176 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3177 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_0
, 1),
3178 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3179 BPF_MOV64_IMM(BPF_REG_0
, 1),
3183 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3186 "direct packet access: test28 (marking on <=, bad access)",
3188 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3189 offsetof(struct __sk_buff
, data
)),
3190 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3191 offsetof(struct __sk_buff
, data_end
)),
3192 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3193 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3194 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_0
, 2),
3195 BPF_MOV64_IMM(BPF_REG_0
, 1),
3197 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3198 BPF_JMP_IMM(BPF_JA
, 0, 0, -4),
3201 .errstr
= "invalid access to packet",
3202 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3205 "helper access to packet: test1, valid packet_ptr range",
3207 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3208 offsetof(struct xdp_md
, data
)),
3209 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3210 offsetof(struct xdp_md
, data_end
)),
3211 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
3212 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
3213 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 5),
3214 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3215 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
3216 BPF_MOV64_IMM(BPF_REG_4
, 0),
3217 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3218 BPF_FUNC_map_update_elem
),
3219 BPF_MOV64_IMM(BPF_REG_0
, 0),
3222 .fixup_map1
= { 5 },
3223 .result_unpriv
= ACCEPT
,
3225 .prog_type
= BPF_PROG_TYPE_XDP
,
3228 "helper access to packet: test2, unchecked packet_ptr",
3230 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3231 offsetof(struct xdp_md
, data
)),
3232 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3233 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3234 BPF_FUNC_map_lookup_elem
),
3235 BPF_MOV64_IMM(BPF_REG_0
, 0),
3238 .fixup_map1
= { 1 },
3240 .errstr
= "invalid access to packet",
3241 .prog_type
= BPF_PROG_TYPE_XDP
,
3244 "helper access to packet: test3, variable add",
3246 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3247 offsetof(struct xdp_md
, data
)),
3248 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3249 offsetof(struct xdp_md
, data_end
)),
3250 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3251 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
3252 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 10),
3253 BPF_LDX_MEM(BPF_B
, BPF_REG_5
, BPF_REG_2
, 0),
3254 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3255 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_5
),
3256 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
3257 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 8),
3258 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_3
, 4),
3259 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3260 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_4
),
3261 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3262 BPF_FUNC_map_lookup_elem
),
3263 BPF_MOV64_IMM(BPF_REG_0
, 0),
3266 .fixup_map1
= { 11 },
3268 .prog_type
= BPF_PROG_TYPE_XDP
,
3271 "helper access to packet: test4, packet_ptr with bad range",
3273 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3274 offsetof(struct xdp_md
, data
)),
3275 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3276 offsetof(struct xdp_md
, data_end
)),
3277 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3278 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 4),
3279 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 2),
3280 BPF_MOV64_IMM(BPF_REG_0
, 0),
3282 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3283 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3284 BPF_FUNC_map_lookup_elem
),
3285 BPF_MOV64_IMM(BPF_REG_0
, 0),
3288 .fixup_map1
= { 7 },
3290 .errstr
= "invalid access to packet",
3291 .prog_type
= BPF_PROG_TYPE_XDP
,
3294 "helper access to packet: test5, packet_ptr with too short range",
3296 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3297 offsetof(struct xdp_md
, data
)),
3298 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3299 offsetof(struct xdp_md
, data_end
)),
3300 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
3301 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3302 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 7),
3303 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 3),
3304 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3305 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3306 BPF_FUNC_map_lookup_elem
),
3307 BPF_MOV64_IMM(BPF_REG_0
, 0),
3310 .fixup_map1
= { 6 },
3312 .errstr
= "invalid access to packet",
3313 .prog_type
= BPF_PROG_TYPE_XDP
,
3316 "helper access to packet: test6, cls valid packet_ptr range",
3318 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3319 offsetof(struct __sk_buff
, data
)),
3320 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3321 offsetof(struct __sk_buff
, data_end
)),
3322 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
3323 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
3324 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 5),
3325 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3326 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
3327 BPF_MOV64_IMM(BPF_REG_4
, 0),
3328 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3329 BPF_FUNC_map_update_elem
),
3330 BPF_MOV64_IMM(BPF_REG_0
, 0),
3333 .fixup_map1
= { 5 },
3335 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3338 "helper access to packet: test7, cls unchecked packet_ptr",
3340 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3341 offsetof(struct __sk_buff
, data
)),
3342 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3343 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3344 BPF_FUNC_map_lookup_elem
),
3345 BPF_MOV64_IMM(BPF_REG_0
, 0),
3348 .fixup_map1
= { 1 },
3350 .errstr
= "invalid access to packet",
3351 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3354 "helper access to packet: test8, cls variable add",
3356 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3357 offsetof(struct __sk_buff
, data
)),
3358 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3359 offsetof(struct __sk_buff
, data_end
)),
3360 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3361 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
3362 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 10),
3363 BPF_LDX_MEM(BPF_B
, BPF_REG_5
, BPF_REG_2
, 0),
3364 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3365 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_5
),
3366 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
3367 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 8),
3368 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_3
, 4),
3369 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3370 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_4
),
3371 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3372 BPF_FUNC_map_lookup_elem
),
3373 BPF_MOV64_IMM(BPF_REG_0
, 0),
3376 .fixup_map1
= { 11 },
3378 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3381 "helper access to packet: test9, cls packet_ptr with bad range",
3383 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3384 offsetof(struct __sk_buff
, data
)),
3385 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3386 offsetof(struct __sk_buff
, data_end
)),
3387 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3388 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 4),
3389 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 2),
3390 BPF_MOV64_IMM(BPF_REG_0
, 0),
3392 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3393 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3394 BPF_FUNC_map_lookup_elem
),
3395 BPF_MOV64_IMM(BPF_REG_0
, 0),
3398 .fixup_map1
= { 7 },
3400 .errstr
= "invalid access to packet",
3401 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3404 "helper access to packet: test10, cls packet_ptr with too short range",
3406 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3407 offsetof(struct __sk_buff
, data
)),
3408 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3409 offsetof(struct __sk_buff
, data_end
)),
3410 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
3411 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
3412 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 7),
3413 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 3),
3414 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3415 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3416 BPF_FUNC_map_lookup_elem
),
3417 BPF_MOV64_IMM(BPF_REG_0
, 0),
3420 .fixup_map1
= { 6 },
3422 .errstr
= "invalid access to packet",
3423 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3426 "helper access to packet: test11, cls unsuitable helper 1",
3428 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3429 offsetof(struct __sk_buff
, data
)),
3430 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3431 offsetof(struct __sk_buff
, data_end
)),
3432 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3433 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
3434 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_3
, 7),
3435 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_7
, 4),
3436 BPF_MOV64_IMM(BPF_REG_2
, 0),
3437 BPF_MOV64_IMM(BPF_REG_4
, 42),
3438 BPF_MOV64_IMM(BPF_REG_5
, 0),
3439 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3440 BPF_FUNC_skb_store_bytes
),
3441 BPF_MOV64_IMM(BPF_REG_0
, 0),
3445 .errstr
= "helper access to the packet",
3446 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3449 "helper access to packet: test12, cls unsuitable helper 2",
3451 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3452 offsetof(struct __sk_buff
, data
)),
3453 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3454 offsetof(struct __sk_buff
, data_end
)),
3455 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
3456 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 8),
3457 BPF_JMP_REG(BPF_JGT
, BPF_REG_6
, BPF_REG_7
, 3),
3458 BPF_MOV64_IMM(BPF_REG_2
, 0),
3459 BPF_MOV64_IMM(BPF_REG_4
, 4),
3460 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3461 BPF_FUNC_skb_load_bytes
),
3462 BPF_MOV64_IMM(BPF_REG_0
, 0),
3466 .errstr
= "helper access to the packet",
3467 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3470 "helper access to packet: test13, cls helper ok",
3472 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3473 offsetof(struct __sk_buff
, data
)),
3474 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3475 offsetof(struct __sk_buff
, data_end
)),
3476 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3477 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3478 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3479 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3480 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3481 BPF_MOV64_IMM(BPF_REG_2
, 4),
3482 BPF_MOV64_IMM(BPF_REG_3
, 0),
3483 BPF_MOV64_IMM(BPF_REG_4
, 0),
3484 BPF_MOV64_IMM(BPF_REG_5
, 0),
3485 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3486 BPF_FUNC_csum_diff
),
3487 BPF_MOV64_IMM(BPF_REG_0
, 0),
3491 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3494 "helper access to packet: test14, cls helper ok sub",
3496 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3497 offsetof(struct __sk_buff
, data
)),
3498 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3499 offsetof(struct __sk_buff
, data_end
)),
3500 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3501 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3502 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3503 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3504 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 4),
3505 BPF_MOV64_IMM(BPF_REG_2
, 4),
3506 BPF_MOV64_IMM(BPF_REG_3
, 0),
3507 BPF_MOV64_IMM(BPF_REG_4
, 0),
3508 BPF_MOV64_IMM(BPF_REG_5
, 0),
3509 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3510 BPF_FUNC_csum_diff
),
3511 BPF_MOV64_IMM(BPF_REG_0
, 0),
3515 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3518 "helper access to packet: test15, cls helper fail sub",
3520 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3521 offsetof(struct __sk_buff
, data
)),
3522 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3523 offsetof(struct __sk_buff
, data_end
)),
3524 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3525 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3526 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3527 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3528 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 12),
3529 BPF_MOV64_IMM(BPF_REG_2
, 4),
3530 BPF_MOV64_IMM(BPF_REG_3
, 0),
3531 BPF_MOV64_IMM(BPF_REG_4
, 0),
3532 BPF_MOV64_IMM(BPF_REG_5
, 0),
3533 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3534 BPF_FUNC_csum_diff
),
3535 BPF_MOV64_IMM(BPF_REG_0
, 0),
3539 .errstr
= "invalid access to packet",
3540 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3543 "helper access to packet: test16, cls helper fail range 1",
3545 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3546 offsetof(struct __sk_buff
, data
)),
3547 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3548 offsetof(struct __sk_buff
, data_end
)),
3549 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3550 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3551 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3552 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3553 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3554 BPF_MOV64_IMM(BPF_REG_2
, 8),
3555 BPF_MOV64_IMM(BPF_REG_3
, 0),
3556 BPF_MOV64_IMM(BPF_REG_4
, 0),
3557 BPF_MOV64_IMM(BPF_REG_5
, 0),
3558 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3559 BPF_FUNC_csum_diff
),
3560 BPF_MOV64_IMM(BPF_REG_0
, 0),
3564 .errstr
= "invalid access to packet",
3565 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3568 "helper access to packet: test17, cls helper fail range 2",
3570 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3571 offsetof(struct __sk_buff
, data
)),
3572 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3573 offsetof(struct __sk_buff
, data_end
)),
3574 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3575 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3576 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3577 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3578 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3579 BPF_MOV64_IMM(BPF_REG_2
, -9),
3580 BPF_MOV64_IMM(BPF_REG_3
, 0),
3581 BPF_MOV64_IMM(BPF_REG_4
, 0),
3582 BPF_MOV64_IMM(BPF_REG_5
, 0),
3583 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3584 BPF_FUNC_csum_diff
),
3585 BPF_MOV64_IMM(BPF_REG_0
, 0),
3589 .errstr
= "R2 min value is negative",
3590 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3593 "helper access to packet: test18, cls helper fail range 3",
3595 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3596 offsetof(struct __sk_buff
, data
)),
3597 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3598 offsetof(struct __sk_buff
, data_end
)),
3599 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3600 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3601 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3602 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3603 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3604 BPF_MOV64_IMM(BPF_REG_2
, ~0),
3605 BPF_MOV64_IMM(BPF_REG_3
, 0),
3606 BPF_MOV64_IMM(BPF_REG_4
, 0),
3607 BPF_MOV64_IMM(BPF_REG_5
, 0),
3608 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3609 BPF_FUNC_csum_diff
),
3610 BPF_MOV64_IMM(BPF_REG_0
, 0),
3614 .errstr
= "R2 min value is negative",
3615 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3618 "helper access to packet: test19, cls helper range zero",
3620 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3621 offsetof(struct __sk_buff
, data
)),
3622 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3623 offsetof(struct __sk_buff
, data_end
)),
3624 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3625 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3626 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3627 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3628 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3629 BPF_MOV64_IMM(BPF_REG_2
, 0),
3630 BPF_MOV64_IMM(BPF_REG_3
, 0),
3631 BPF_MOV64_IMM(BPF_REG_4
, 0),
3632 BPF_MOV64_IMM(BPF_REG_5
, 0),
3633 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3634 BPF_FUNC_csum_diff
),
3635 BPF_MOV64_IMM(BPF_REG_0
, 0),
3639 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3642 "helper access to packet: test20, pkt end as input",
3644 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3645 offsetof(struct __sk_buff
, data
)),
3646 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3647 offsetof(struct __sk_buff
, data_end
)),
3648 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3649 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3650 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3651 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3652 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
3653 BPF_MOV64_IMM(BPF_REG_2
, 4),
3654 BPF_MOV64_IMM(BPF_REG_3
, 0),
3655 BPF_MOV64_IMM(BPF_REG_4
, 0),
3656 BPF_MOV64_IMM(BPF_REG_5
, 0),
3657 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3658 BPF_FUNC_csum_diff
),
3659 BPF_MOV64_IMM(BPF_REG_0
, 0),
3663 .errstr
= "R1 type=pkt_end expected=fp",
3664 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3667 "helper access to packet: test21, wrong reg",
3669 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
3670 offsetof(struct __sk_buff
, data
)),
3671 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
3672 offsetof(struct __sk_buff
, data_end
)),
3673 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
3674 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
3675 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
3676 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
3677 BPF_MOV64_IMM(BPF_REG_2
, 4),
3678 BPF_MOV64_IMM(BPF_REG_3
, 0),
3679 BPF_MOV64_IMM(BPF_REG_4
, 0),
3680 BPF_MOV64_IMM(BPF_REG_5
, 0),
3681 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3682 BPF_FUNC_csum_diff
),
3683 BPF_MOV64_IMM(BPF_REG_0
, 0),
3687 .errstr
= "invalid access to packet",
3688 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
3691 "valid map access into an array with a constant",
3693 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3694 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3695 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3696 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3697 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3698 BPF_FUNC_map_lookup_elem
),
3699 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3700 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3701 offsetof(struct test_val
, foo
)),
3704 .fixup_map2
= { 3 },
3705 .errstr_unpriv
= "R0 leaks addr",
3706 .result_unpriv
= REJECT
,
3710 "valid map access into an array with a register",
3712 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3713 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3714 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3715 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3716 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3717 BPF_FUNC_map_lookup_elem
),
3718 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3719 BPF_MOV64_IMM(BPF_REG_1
, 4),
3720 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3721 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3722 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3723 offsetof(struct test_val
, foo
)),
3726 .fixup_map2
= { 3 },
3727 .errstr_unpriv
= "R0 leaks addr",
3728 .result_unpriv
= REJECT
,
3730 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3733 "valid map access into an array with a variable",
3735 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3736 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3737 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3738 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3739 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3740 BPF_FUNC_map_lookup_elem
),
3741 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3742 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3743 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
, 3),
3744 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3745 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3746 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3747 offsetof(struct test_val
, foo
)),
3750 .fixup_map2
= { 3 },
3751 .errstr_unpriv
= "R0 leaks addr",
3752 .result_unpriv
= REJECT
,
3754 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3757 "valid map access into an array with a signed variable",
3759 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3760 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3761 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3762 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3763 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3764 BPF_FUNC_map_lookup_elem
),
3765 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
3766 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3767 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 0xffffffff, 1),
3768 BPF_MOV32_IMM(BPF_REG_1
, 0),
3769 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
),
3770 BPF_JMP_REG(BPF_JSGT
, BPF_REG_2
, BPF_REG_1
, 1),
3771 BPF_MOV32_IMM(BPF_REG_1
, 0),
3772 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3773 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3774 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3775 offsetof(struct test_val
, foo
)),
3778 .fixup_map2
= { 3 },
3779 .errstr_unpriv
= "R0 leaks addr",
3780 .result_unpriv
= REJECT
,
3782 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3785 "invalid map access into an array with a constant",
3787 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3788 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3789 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3790 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3791 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3792 BPF_FUNC_map_lookup_elem
),
3793 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3794 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, (MAX_ENTRIES
+ 1) << 2,
3795 offsetof(struct test_val
, foo
)),
3798 .fixup_map2
= { 3 },
3799 .errstr
= "invalid access to map value, value_size=48 off=48 size=8",
3803 "invalid map access into an array with a register",
3805 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3806 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3807 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3808 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3809 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3810 BPF_FUNC_map_lookup_elem
),
3811 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3812 BPF_MOV64_IMM(BPF_REG_1
, MAX_ENTRIES
+ 1),
3813 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3814 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3815 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3816 offsetof(struct test_val
, foo
)),
3819 .fixup_map2
= { 3 },
3820 .errstr
= "R0 min value is outside of the array range",
3822 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3825 "invalid map access into an array with a variable",
3827 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3828 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3829 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3830 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3831 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3832 BPF_FUNC_map_lookup_elem
),
3833 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3834 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3835 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3836 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3837 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3838 offsetof(struct test_val
, foo
)),
3841 .fixup_map2
= { 3 },
3842 .errstr
= "R0 unbounded memory access, make sure to bounds check any array access into a map",
3844 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3847 "invalid map access into an array with no floor check",
3849 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3850 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3851 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3852 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3853 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3854 BPF_FUNC_map_lookup_elem
),
3855 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3856 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
3857 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
),
3858 BPF_JMP_REG(BPF_JSGT
, BPF_REG_2
, BPF_REG_1
, 1),
3859 BPF_MOV32_IMM(BPF_REG_1
, 0),
3860 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3861 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3862 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3863 offsetof(struct test_val
, foo
)),
3866 .fixup_map2
= { 3 },
3867 .errstr_unpriv
= "R0 leaks addr",
3868 .errstr
= "R0 unbounded memory access",
3869 .result_unpriv
= REJECT
,
3871 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3874 "invalid map access into an array with a invalid max check",
3876 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3877 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3878 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3879 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3880 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3881 BPF_FUNC_map_lookup_elem
),
3882 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3883 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3884 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
+ 1),
3885 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 1),
3886 BPF_MOV32_IMM(BPF_REG_1
, 0),
3887 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3888 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3889 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3890 offsetof(struct test_val
, foo
)),
3893 .fixup_map2
= { 3 },
3894 .errstr_unpriv
= "R0 leaks addr",
3895 .errstr
= "invalid access to map value, value_size=48 off=44 size=8",
3896 .result_unpriv
= REJECT
,
3898 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3901 "invalid map access into an array with a invalid max check",
3903 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3904 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3905 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3906 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3907 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3908 BPF_FUNC_map_lookup_elem
),
3909 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
3910 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
3911 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3912 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3913 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3914 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3915 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3916 BPF_FUNC_map_lookup_elem
),
3917 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
3918 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_8
),
3919 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
3920 offsetof(struct test_val
, foo
)),
3923 .fixup_map2
= { 3, 11 },
3924 .errstr
= "R0 pointer += pointer",
3926 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3929 "multiple registers share map_lookup_elem result",
3931 BPF_MOV64_IMM(BPF_REG_1
, 10),
3932 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3933 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3934 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3935 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3936 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3937 BPF_FUNC_map_lookup_elem
),
3938 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3939 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3940 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3943 .fixup_map1
= { 4 },
3945 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3948 "alu ops on ptr_to_map_value_or_null, 1",
3950 BPF_MOV64_IMM(BPF_REG_1
, 10),
3951 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3952 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3953 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3954 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3955 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3956 BPF_FUNC_map_lookup_elem
),
3957 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3958 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -2),
3959 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 2),
3960 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3961 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3964 .fixup_map1
= { 4 },
3965 .errstr
= "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
3967 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3970 "alu ops on ptr_to_map_value_or_null, 2",
3972 BPF_MOV64_IMM(BPF_REG_1
, 10),
3973 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3974 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3975 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3976 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3977 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3978 BPF_FUNC_map_lookup_elem
),
3979 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3980 BPF_ALU64_IMM(BPF_AND
, BPF_REG_4
, -1),
3981 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3982 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3985 .fixup_map1
= { 4 },
3986 .errstr
= "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
3988 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3991 "alu ops on ptr_to_map_value_or_null, 3",
3993 BPF_MOV64_IMM(BPF_REG_1
, 10),
3994 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3995 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3996 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3997 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3998 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3999 BPF_FUNC_map_lookup_elem
),
4000 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
4001 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_4
, 1),
4002 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
4003 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
4006 .fixup_map1
= { 4 },
4007 .errstr
= "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4009 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
4012 "invalid memory access with multiple map_lookup_elem calls",
4014 BPF_MOV64_IMM(BPF_REG_1
, 10),
4015 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
4016 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4017 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4018 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4019 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_1
),
4020 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
4021 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4022 BPF_FUNC_map_lookup_elem
),
4023 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
4024 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_8
),
4025 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
4026 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4027 BPF_FUNC_map_lookup_elem
),
4028 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
4029 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
4032 .fixup_map1
= { 4 },
4034 .errstr
= "R4 !read_ok",
4035 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
4038 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4040 BPF_MOV64_IMM(BPF_REG_1
, 10),
4041 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
4042 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4043 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4044 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4045 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_1
),
4046 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
4047 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4048 BPF_FUNC_map_lookup_elem
),
4049 BPF_MOV64_IMM(BPF_REG_2
, 10),
4050 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 0, 3),
4051 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_8
),
4052 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
4053 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4054 BPF_FUNC_map_lookup_elem
),
4055 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
4056 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
4057 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
4060 .fixup_map1
= { 4 },
4062 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
4065 "invalid map access from else condition",
4067 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
4068 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4069 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4070 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4071 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, BPF_FUNC_map_lookup_elem
),
4072 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4073 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
4074 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
-1, 1),
4075 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 1),
4076 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
4077 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
4078 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, offsetof(struct test_val
, foo
)),
4081 .fixup_map2
= { 3 },
4082 .errstr
= "R0 unbounded memory access",
4084 .errstr_unpriv
= "R0 leaks addr",
4085 .result_unpriv
= REJECT
,
4086 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4089 "constant register |= constant should keep constant type",
4091 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4092 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
4093 BPF_MOV64_IMM(BPF_REG_2
, 34),
4094 BPF_ALU64_IMM(BPF_OR
, BPF_REG_2
, 13),
4095 BPF_MOV64_IMM(BPF_REG_3
, 0),
4096 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4100 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4103 "constant register |= constant should not bypass stack boundary checks",
4105 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4106 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
4107 BPF_MOV64_IMM(BPF_REG_2
, 34),
4108 BPF_ALU64_IMM(BPF_OR
, BPF_REG_2
, 24),
4109 BPF_MOV64_IMM(BPF_REG_3
, 0),
4110 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4113 .errstr
= "invalid stack type R1 off=-48 access_size=58",
4115 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4118 "constant register |= constant register should keep constant type",
4120 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4121 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
4122 BPF_MOV64_IMM(BPF_REG_2
, 34),
4123 BPF_MOV64_IMM(BPF_REG_4
, 13),
4124 BPF_ALU64_REG(BPF_OR
, BPF_REG_2
, BPF_REG_4
),
4125 BPF_MOV64_IMM(BPF_REG_3
, 0),
4126 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4130 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4133 "constant register |= constant register should not bypass stack boundary checks",
4135 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4136 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
4137 BPF_MOV64_IMM(BPF_REG_2
, 34),
4138 BPF_MOV64_IMM(BPF_REG_4
, 24),
4139 BPF_ALU64_REG(BPF_OR
, BPF_REG_2
, BPF_REG_4
),
4140 BPF_MOV64_IMM(BPF_REG_3
, 0),
4141 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4144 .errstr
= "invalid stack type R1 off=-48 access_size=58",
4146 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4149 "invalid direct packet write for LWT_IN",
4151 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4152 offsetof(struct __sk_buff
, data
)),
4153 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4154 offsetof(struct __sk_buff
, data_end
)),
4155 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4156 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4157 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4158 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
4159 BPF_MOV64_IMM(BPF_REG_0
, 0),
4162 .errstr
= "cannot write into packet",
4164 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
4167 "invalid direct packet write for LWT_OUT",
4169 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4170 offsetof(struct __sk_buff
, data
)),
4171 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4172 offsetof(struct __sk_buff
, data_end
)),
4173 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4174 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4175 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4176 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
4177 BPF_MOV64_IMM(BPF_REG_0
, 0),
4180 .errstr
= "cannot write into packet",
4182 .prog_type
= BPF_PROG_TYPE_LWT_OUT
,
4185 "direct packet write for LWT_XMIT",
4187 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4188 offsetof(struct __sk_buff
, data
)),
4189 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4190 offsetof(struct __sk_buff
, data_end
)),
4191 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4192 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4193 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4194 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
4195 BPF_MOV64_IMM(BPF_REG_0
, 0),
4199 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
4202 "direct packet read for LWT_IN",
4204 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4205 offsetof(struct __sk_buff
, data
)),
4206 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4207 offsetof(struct __sk_buff
, data_end
)),
4208 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4209 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4210 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4211 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
4212 BPF_MOV64_IMM(BPF_REG_0
, 0),
4216 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
4219 "direct packet read for LWT_OUT",
4221 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4222 offsetof(struct __sk_buff
, data
)),
4223 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4224 offsetof(struct __sk_buff
, data_end
)),
4225 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4226 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4227 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4228 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
4229 BPF_MOV64_IMM(BPF_REG_0
, 0),
4233 .prog_type
= BPF_PROG_TYPE_LWT_OUT
,
4236 "direct packet read for LWT_XMIT",
4238 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4239 offsetof(struct __sk_buff
, data
)),
4240 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4241 offsetof(struct __sk_buff
, data_end
)),
4242 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4243 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4244 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
4245 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
4246 BPF_MOV64_IMM(BPF_REG_0
, 0),
4250 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
4253 "overlapping checks for direct packet access",
4255 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
4256 offsetof(struct __sk_buff
, data
)),
4257 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
4258 offsetof(struct __sk_buff
, data_end
)),
4259 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
4260 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
4261 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 4),
4262 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
4263 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 6),
4264 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
4265 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_2
, 6),
4266 BPF_MOV64_IMM(BPF_REG_0
, 0),
4270 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
4273 "invalid access of tc_classid for LWT_IN",
4275 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
4276 offsetof(struct __sk_buff
, tc_classid
)),
4280 .errstr
= "invalid bpf_context access",
4283 "invalid access of tc_classid for LWT_OUT",
4285 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
4286 offsetof(struct __sk_buff
, tc_classid
)),
4290 .errstr
= "invalid bpf_context access",
4293 "invalid access of tc_classid for LWT_XMIT",
4295 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
4296 offsetof(struct __sk_buff
, tc_classid
)),
4300 .errstr
= "invalid bpf_context access",
4303 "leak pointer into ctx 1",
4305 BPF_MOV64_IMM(BPF_REG_0
, 0),
4306 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
4307 offsetof(struct __sk_buff
, cb
[0])),
4308 BPF_LD_MAP_FD(BPF_REG_2
, 0),
4309 BPF_STX_XADD(BPF_DW
, BPF_REG_1
, BPF_REG_2
,
4310 offsetof(struct __sk_buff
, cb
[0])),
4313 .fixup_map1
= { 2 },
4314 .errstr_unpriv
= "R2 leaks addr into mem",
4315 .result_unpriv
= REJECT
,
4319 "leak pointer into ctx 2",
4321 BPF_MOV64_IMM(BPF_REG_0
, 0),
4322 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
4323 offsetof(struct __sk_buff
, cb
[0])),
4324 BPF_STX_XADD(BPF_DW
, BPF_REG_1
, BPF_REG_10
,
4325 offsetof(struct __sk_buff
, cb
[0])),
4328 .errstr_unpriv
= "R10 leaks addr into mem",
4329 .result_unpriv
= REJECT
,
4333 "leak pointer into ctx 3",
4335 BPF_MOV64_IMM(BPF_REG_0
, 0),
4336 BPF_LD_MAP_FD(BPF_REG_2
, 0),
4337 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
,
4338 offsetof(struct __sk_buff
, cb
[0])),
4341 .fixup_map1
= { 1 },
4342 .errstr_unpriv
= "R2 leaks addr into ctx",
4343 .result_unpriv
= REJECT
,
4347 "leak pointer into map val",
4349 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
4350 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
4351 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4352 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4353 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4354 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4355 BPF_FUNC_map_lookup_elem
),
4356 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
4357 BPF_MOV64_IMM(BPF_REG_3
, 0),
4358 BPF_STX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
4359 BPF_STX_XADD(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
4360 BPF_MOV64_IMM(BPF_REG_0
, 0),
4363 .fixup_map1
= { 4 },
4364 .errstr_unpriv
= "R6 leaks addr into mem",
4365 .result_unpriv
= REJECT
,
4369 "helper access to map: full range",
4371 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4372 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4373 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4374 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4375 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4376 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4377 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4378 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
4379 BPF_MOV64_IMM(BPF_REG_3
, 0),
4380 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4383 .fixup_map2
= { 3 },
4385 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4388 "helper access to map: partial range",
4390 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4391 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4392 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4393 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4394 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4395 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4396 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4397 BPF_MOV64_IMM(BPF_REG_2
, 8),
4398 BPF_MOV64_IMM(BPF_REG_3
, 0),
4399 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4402 .fixup_map2
= { 3 },
4404 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4407 "helper access to map: empty range",
4409 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4410 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4411 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4412 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4413 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4414 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
4415 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4416 BPF_MOV64_IMM(BPF_REG_2
, 0),
4417 BPF_EMIT_CALL(BPF_FUNC_trace_printk
),
4420 .fixup_map2
= { 3 },
4421 .errstr
= "invalid access to map value, value_size=48 off=0 size=0",
4423 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4426 "helper access to map: out-of-bound range",
4428 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4429 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4430 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4431 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4432 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4433 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4434 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4435 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
) + 8),
4436 BPF_MOV64_IMM(BPF_REG_3
, 0),
4437 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4440 .fixup_map2
= { 3 },
4441 .errstr
= "invalid access to map value, value_size=48 off=0 size=56",
4443 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4446 "helper access to map: negative range",
4448 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4449 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4450 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4451 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4452 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4453 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4454 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4455 BPF_MOV64_IMM(BPF_REG_2
, -8),
4456 BPF_MOV64_IMM(BPF_REG_3
, 0),
4457 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4460 .fixup_map2
= { 3 },
4461 .errstr
= "R2 min value is negative",
4463 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4466 "helper access to adjusted map (via const imm): full range",
4468 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4469 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4470 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4471 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4472 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4473 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4474 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4475 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4476 offsetof(struct test_val
, foo
)),
4477 BPF_MOV64_IMM(BPF_REG_2
,
4478 sizeof(struct test_val
) -
4479 offsetof(struct test_val
, foo
)),
4480 BPF_MOV64_IMM(BPF_REG_3
, 0),
4481 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4484 .fixup_map2
= { 3 },
4486 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4489 "helper access to adjusted map (via const imm): partial range",
4491 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4492 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4493 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4494 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4495 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4496 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4497 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4498 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4499 offsetof(struct test_val
, foo
)),
4500 BPF_MOV64_IMM(BPF_REG_2
, 8),
4501 BPF_MOV64_IMM(BPF_REG_3
, 0),
4502 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4505 .fixup_map2
= { 3 },
4507 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4510 "helper access to adjusted map (via const imm): empty range",
4512 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4513 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4514 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4515 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4516 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4517 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4518 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4519 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4520 offsetof(struct test_val
, foo
)),
4521 BPF_MOV64_IMM(BPF_REG_2
, 0),
4522 BPF_EMIT_CALL(BPF_FUNC_trace_printk
),
4525 .fixup_map2
= { 3 },
4526 .errstr
= "invalid access to map value, value_size=48 off=4 size=0",
4528 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4531 "helper access to adjusted map (via const imm): out-of-bound range",
4533 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4534 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4535 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4536 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4537 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4538 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4539 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4540 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4541 offsetof(struct test_val
, foo
)),
4542 BPF_MOV64_IMM(BPF_REG_2
,
4543 sizeof(struct test_val
) -
4544 offsetof(struct test_val
, foo
) + 8),
4545 BPF_MOV64_IMM(BPF_REG_3
, 0),
4546 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4549 .fixup_map2
= { 3 },
4550 .errstr
= "invalid access to map value, value_size=48 off=4 size=52",
4552 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4555 "helper access to adjusted map (via const imm): negative range (> adjustment)",
4557 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4558 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4559 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4560 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4561 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4562 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4563 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4564 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4565 offsetof(struct test_val
, foo
)),
4566 BPF_MOV64_IMM(BPF_REG_2
, -8),
4567 BPF_MOV64_IMM(BPF_REG_3
, 0),
4568 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4571 .fixup_map2
= { 3 },
4572 .errstr
= "R2 min value is negative",
4574 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4577 "helper access to adjusted map (via const imm): negative range (< adjustment)",
4579 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4580 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4581 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4582 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4583 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4584 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4585 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4586 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
4587 offsetof(struct test_val
, foo
)),
4588 BPF_MOV64_IMM(BPF_REG_2
, -1),
4589 BPF_MOV64_IMM(BPF_REG_3
, 0),
4590 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4593 .fixup_map2
= { 3 },
4594 .errstr
= "R2 min value is negative",
4596 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4599 "helper access to adjusted map (via const reg): full range",
4601 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4602 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4603 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4604 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4605 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4606 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4607 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4608 BPF_MOV64_IMM(BPF_REG_3
,
4609 offsetof(struct test_val
, foo
)),
4610 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4611 BPF_MOV64_IMM(BPF_REG_2
,
4612 sizeof(struct test_val
) -
4613 offsetof(struct test_val
, foo
)),
4614 BPF_MOV64_IMM(BPF_REG_3
, 0),
4615 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4618 .fixup_map2
= { 3 },
4620 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4623 "helper access to adjusted map (via const reg): partial range",
4625 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4626 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4627 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4628 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4629 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4630 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4631 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4632 BPF_MOV64_IMM(BPF_REG_3
,
4633 offsetof(struct test_val
, foo
)),
4634 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4635 BPF_MOV64_IMM(BPF_REG_2
, 8),
4636 BPF_MOV64_IMM(BPF_REG_3
, 0),
4637 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4640 .fixup_map2
= { 3 },
4642 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4645 "helper access to adjusted map (via const reg): empty range",
4647 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4648 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4649 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4650 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4651 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4652 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
4653 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4654 BPF_MOV64_IMM(BPF_REG_3
, 0),
4655 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4656 BPF_MOV64_IMM(BPF_REG_2
, 0),
4657 BPF_EMIT_CALL(BPF_FUNC_trace_printk
),
4660 .fixup_map2
= { 3 },
4661 .errstr
= "R1 min value is outside of the array range",
4663 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4666 "helper access to adjusted map (via const reg): out-of-bound range",
4668 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4669 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4670 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4671 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4672 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4673 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4674 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4675 BPF_MOV64_IMM(BPF_REG_3
,
4676 offsetof(struct test_val
, foo
)),
4677 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4678 BPF_MOV64_IMM(BPF_REG_2
,
4679 sizeof(struct test_val
) -
4680 offsetof(struct test_val
, foo
) + 8),
4681 BPF_MOV64_IMM(BPF_REG_3
, 0),
4682 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4685 .fixup_map2
= { 3 },
4686 .errstr
= "invalid access to map value, value_size=48 off=4 size=52",
4688 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4691 "helper access to adjusted map (via const reg): negative range (> adjustment)",
4693 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4694 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4695 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4696 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4697 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4698 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4699 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4700 BPF_MOV64_IMM(BPF_REG_3
,
4701 offsetof(struct test_val
, foo
)),
4702 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4703 BPF_MOV64_IMM(BPF_REG_2
, -8),
4704 BPF_MOV64_IMM(BPF_REG_3
, 0),
4705 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4708 .fixup_map2
= { 3 },
4709 .errstr
= "R2 min value is negative",
4711 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4714 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4716 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4717 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4718 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4719 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4720 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4721 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4722 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4723 BPF_MOV64_IMM(BPF_REG_3
,
4724 offsetof(struct test_val
, foo
)),
4725 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4726 BPF_MOV64_IMM(BPF_REG_2
, -1),
4727 BPF_MOV64_IMM(BPF_REG_3
, 0),
4728 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4731 .fixup_map2
= { 3 },
4732 .errstr
= "R2 min value is negative",
4734 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4737 "helper access to adjusted map (via variable): full range",
4739 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4740 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4741 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4742 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4743 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4744 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
4745 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4746 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4747 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
4748 offsetof(struct test_val
, foo
), 4),
4749 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4750 BPF_MOV64_IMM(BPF_REG_2
,
4751 sizeof(struct test_val
) -
4752 offsetof(struct test_val
, foo
)),
4753 BPF_MOV64_IMM(BPF_REG_3
, 0),
4754 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4757 .fixup_map2
= { 3 },
4759 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4762 "helper access to adjusted map (via variable): partial range",
4764 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4765 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4766 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4767 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4768 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4769 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
4770 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4771 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4772 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
4773 offsetof(struct test_val
, foo
), 4),
4774 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4775 BPF_MOV64_IMM(BPF_REG_2
, 8),
4776 BPF_MOV64_IMM(BPF_REG_3
, 0),
4777 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4780 .fixup_map2
= { 3 },
4782 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4785 "helper access to adjusted map (via variable): empty range",
4787 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4788 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4789 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4790 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4791 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4792 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4793 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4794 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4795 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
4796 offsetof(struct test_val
, foo
), 3),
4797 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4798 BPF_MOV64_IMM(BPF_REG_2
, 0),
4799 BPF_EMIT_CALL(BPF_FUNC_trace_printk
),
4802 .fixup_map2
= { 3 },
4803 .errstr
= "R1 min value is outside of the array range",
4805 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4808 "helper access to adjusted map (via variable): no max check",
4810 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4811 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4812 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4813 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4814 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4815 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4816 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4817 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4818 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4819 BPF_MOV64_IMM(BPF_REG_2
, 1),
4820 BPF_MOV64_IMM(BPF_REG_3
, 0),
4821 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4824 .fixup_map2
= { 3 },
4825 .errstr
= "R1 unbounded memory access",
4827 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4830 "helper access to adjusted map (via variable): wrong max check",
4832 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4833 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4834 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4835 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4836 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4837 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
4838 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4839 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4840 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
4841 offsetof(struct test_val
, foo
), 4),
4842 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4843 BPF_MOV64_IMM(BPF_REG_2
,
4844 sizeof(struct test_val
) -
4845 offsetof(struct test_val
, foo
) + 1),
4846 BPF_MOV64_IMM(BPF_REG_3
, 0),
4847 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4850 .fixup_map2
= { 3 },
4851 .errstr
= "invalid access to map value, value_size=48 off=4 size=45",
4853 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4856 "helper access to map: bounds check using <, good access",
4858 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4859 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4860 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4861 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4862 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4863 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4864 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4865 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4866 BPF_JMP_IMM(BPF_JLT
, BPF_REG_3
, 32, 2),
4867 BPF_MOV64_IMM(BPF_REG_0
, 0),
4869 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4870 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4871 BPF_MOV64_IMM(BPF_REG_0
, 0),
4874 .fixup_map2
= { 3 },
4876 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4879 "helper access to map: bounds check using <, bad access",
4881 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4882 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4883 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4884 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4885 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4886 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4887 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4888 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4889 BPF_JMP_IMM(BPF_JLT
, BPF_REG_3
, 32, 4),
4890 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4891 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4892 BPF_MOV64_IMM(BPF_REG_0
, 0),
4894 BPF_MOV64_IMM(BPF_REG_0
, 0),
4897 .fixup_map2
= { 3 },
4899 .errstr
= "R1 unbounded memory access",
4900 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4903 "helper access to map: bounds check using <=, good access",
4905 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4906 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4907 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4908 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4909 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4910 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4911 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4912 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4913 BPF_JMP_IMM(BPF_JLE
, BPF_REG_3
, 32, 2),
4914 BPF_MOV64_IMM(BPF_REG_0
, 0),
4916 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4917 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4918 BPF_MOV64_IMM(BPF_REG_0
, 0),
4921 .fixup_map2
= { 3 },
4923 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4926 "helper access to map: bounds check using <=, bad access",
4928 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4929 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4930 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4931 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4932 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4933 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4934 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4935 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4936 BPF_JMP_IMM(BPF_JLE
, BPF_REG_3
, 32, 4),
4937 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4938 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4939 BPF_MOV64_IMM(BPF_REG_0
, 0),
4941 BPF_MOV64_IMM(BPF_REG_0
, 0),
4944 .fixup_map2
= { 3 },
4946 .errstr
= "R1 unbounded memory access",
4947 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4950 "helper access to map: bounds check using s<, good access",
4952 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4953 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4954 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4955 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4956 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4957 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4958 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4959 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4960 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, 32, 2),
4961 BPF_MOV64_IMM(BPF_REG_0
, 0),
4963 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, 0, -3),
4964 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4965 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4966 BPF_MOV64_IMM(BPF_REG_0
, 0),
4969 .fixup_map2
= { 3 },
4971 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4974 "helper access to map: bounds check using s<, good access 2",
4976 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4977 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4978 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4979 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4980 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4981 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4982 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4983 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
4984 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, 32, 2),
4985 BPF_MOV64_IMM(BPF_REG_0
, 0),
4987 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, -3, -3),
4988 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
4989 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
4990 BPF_MOV64_IMM(BPF_REG_0
, 0),
4993 .fixup_map2
= { 3 },
4995 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4998 "helper access to map: bounds check using s<, bad access",
5000 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5001 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5002 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5003 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5004 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5005 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5006 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5007 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_0
, 0),
5008 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, 32, 2),
5009 BPF_MOV64_IMM(BPF_REG_0
, 0),
5011 BPF_JMP_IMM(BPF_JSLT
, BPF_REG_3
, -3, -3),
5012 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
5013 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
5014 BPF_MOV64_IMM(BPF_REG_0
, 0),
5017 .fixup_map2
= { 3 },
5019 .errstr
= "R1 min value is negative",
5020 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5023 "helper access to map: bounds check using s<=, good access",
5025 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5026 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5027 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5028 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5029 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5030 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5031 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5032 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
5033 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, 32, 2),
5034 BPF_MOV64_IMM(BPF_REG_0
, 0),
5036 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, 0, -3),
5037 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
5038 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
5039 BPF_MOV64_IMM(BPF_REG_0
, 0),
5042 .fixup_map2
= { 3 },
5044 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5047 "helper access to map: bounds check using s<=, good access 2",
5049 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5050 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5051 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5052 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5053 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5054 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5055 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5056 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
5057 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, 32, 2),
5058 BPF_MOV64_IMM(BPF_REG_0
, 0),
5060 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, -3, -3),
5061 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
5062 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
5063 BPF_MOV64_IMM(BPF_REG_0
, 0),
5066 .fixup_map2
= { 3 },
5068 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5071 "helper access to map: bounds check using s<=, bad access",
5073 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5074 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5075 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5076 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5077 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5078 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5079 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5080 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_0
, 0),
5081 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, 32, 2),
5082 BPF_MOV64_IMM(BPF_REG_0
, 0),
5084 BPF_JMP_IMM(BPF_JSLE
, BPF_REG_3
, -3, -3),
5085 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
5086 BPF_ST_MEM(BPF_B
, BPF_REG_1
, 0, 0),
5087 BPF_MOV64_IMM(BPF_REG_0
, 0),
5090 .fixup_map2
= { 3 },
5092 .errstr
= "R1 min value is negative",
5093 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5096 "map element value is preserved across register spilling",
5098 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5099 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5100 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5101 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5102 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5103 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
5104 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
5105 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5106 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -184),
5107 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
5108 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
5109 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
5112 .fixup_map2
= { 3 },
5113 .errstr_unpriv
= "R0 leaks addr",
5115 .result_unpriv
= REJECT
,
5118 "map element value or null is marked on register spilling",
5120 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5121 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5122 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5123 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5124 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5125 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5126 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -152),
5127 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
5128 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
5129 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
5130 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
5133 .fixup_map2
= { 3 },
5134 .errstr_unpriv
= "R0 leaks addr",
5136 .result_unpriv
= REJECT
,
5139 "map element value store of cleared call register",
5141 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5142 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5143 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5144 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5145 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5146 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
5147 BPF_STX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
5150 .fixup_map2
= { 3 },
5151 .errstr_unpriv
= "R1 !read_ok",
5152 .errstr
= "R1 !read_ok",
5154 .result_unpriv
= REJECT
,
5157 "map element value with unaligned store",
5159 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5160 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5161 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5162 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5163 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5164 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 17),
5165 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 3),
5166 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
5167 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 2, 43),
5168 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, -2, 44),
5169 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
5170 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 0, 32),
5171 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 2, 33),
5172 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, -2, 34),
5173 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_8
, 5),
5174 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 0, 22),
5175 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 4, 23),
5176 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, -7, 24),
5177 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_8
),
5178 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_7
, 3),
5179 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, 0, 22),
5180 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, 4, 23),
5181 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, -4, 24),
5184 .fixup_map2
= { 3 },
5185 .errstr_unpriv
= "R0 leaks addr",
5187 .result_unpriv
= REJECT
,
5188 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
5191 "map element value with unaligned load",
5193 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5194 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5195 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5196 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5197 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5198 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
5199 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
5200 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
, 9),
5201 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 3),
5202 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
5203 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 2),
5204 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
5205 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_8
, 0),
5206 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_8
, 2),
5207 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 5),
5208 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
5209 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 4),
5212 .fixup_map2
= { 3 },
5213 .errstr_unpriv
= "R0 leaks addr",
5215 .result_unpriv
= REJECT
,
5216 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
5219 "map element value illegal alu op, 1",
5221 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5222 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5223 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5224 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5225 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5226 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
5227 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 8),
5228 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
5231 .fixup_map2
= { 3 },
5232 .errstr
= "R0 bitwise operator &= on pointer",
5236 "map element value illegal alu op, 2",
5238 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5239 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5240 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5241 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5242 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5243 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
5244 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_0
, 0),
5245 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
5248 .fixup_map2
= { 3 },
5249 .errstr
= "R0 32-bit pointer arithmetic prohibited",
5253 "map element value illegal alu op, 3",
5255 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5256 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5257 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5258 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5259 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5260 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
5261 BPF_ALU64_IMM(BPF_DIV
, BPF_REG_0
, 42),
5262 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
5265 .fixup_map2
= { 3 },
5266 .errstr
= "R0 pointer arithmetic with /= operator",
5270 "map element value illegal alu op, 4",
5272 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5273 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5274 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5275 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5276 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5277 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
5278 BPF_ENDIAN(BPF_FROM_BE
, BPF_REG_0
, 64),
5279 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
5282 .fixup_map2
= { 3 },
5283 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
5284 .errstr
= "invalid mem access 'inv'",
5286 .result_unpriv
= REJECT
,
5289 "map element value illegal alu op, 5",
5291 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5292 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5293 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5294 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5295 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5296 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
5297 BPF_MOV64_IMM(BPF_REG_3
, 4096),
5298 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5299 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5300 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
5301 BPF_STX_XADD(BPF_DW
, BPF_REG_2
, BPF_REG_3
, 0),
5302 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, 0),
5303 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
5306 .fixup_map2
= { 3 },
5307 .errstr
= "R0 invalid mem access 'inv'",
5311 "map element value is preserved across register spilling",
5313 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5314 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5315 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5316 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5317 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5318 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
5319 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
,
5320 offsetof(struct test_val
, foo
)),
5321 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
5322 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5323 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -184),
5324 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
5325 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
5326 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
5329 .fixup_map2
= { 3 },
5330 .errstr_unpriv
= "R0 leaks addr",
5332 .result_unpriv
= REJECT
,
5333 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
5336 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
5338 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5339 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5340 BPF_MOV64_IMM(BPF_REG_0
, 0),
5341 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
5342 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
5343 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
5344 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
5345 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
5346 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
5347 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
5348 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
5349 BPF_MOV64_IMM(BPF_REG_2
, 16),
5350 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5351 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5352 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
5353 BPF_MOV64_IMM(BPF_REG_4
, 0),
5354 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
5355 BPF_MOV64_IMM(BPF_REG_3
, 0),
5356 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5357 BPF_MOV64_IMM(BPF_REG_0
, 0),
5361 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5364 "helper access to variable memory: stack, bitwise AND, zero included",
5366 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5367 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5368 BPF_MOV64_IMM(BPF_REG_2
, 16),
5369 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5370 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5371 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
5372 BPF_MOV64_IMM(BPF_REG_3
, 0),
5373 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5376 .errstr
= "invalid indirect read from stack off -64+0 size 64",
5378 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5381 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
5383 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5384 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5385 BPF_MOV64_IMM(BPF_REG_2
, 16),
5386 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5387 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5388 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 65),
5389 BPF_MOV64_IMM(BPF_REG_4
, 0),
5390 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
5391 BPF_MOV64_IMM(BPF_REG_3
, 0),
5392 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5393 BPF_MOV64_IMM(BPF_REG_0
, 0),
5396 .errstr
= "invalid stack type R1 off=-64 access_size=65",
5398 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5401 "helper access to variable memory: stack, JMP, correct bounds",
5403 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5404 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5405 BPF_MOV64_IMM(BPF_REG_0
, 0),
5406 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
5407 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
5408 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
5409 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
5410 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
5411 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
5412 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
5413 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
5414 BPF_MOV64_IMM(BPF_REG_2
, 16),
5415 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5416 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5417 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 4),
5418 BPF_MOV64_IMM(BPF_REG_4
, 0),
5419 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
5420 BPF_MOV64_IMM(BPF_REG_3
, 0),
5421 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5422 BPF_MOV64_IMM(BPF_REG_0
, 0),
5426 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5429 "helper access to variable memory: stack, JMP (signed), correct bounds",
5431 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5432 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5433 BPF_MOV64_IMM(BPF_REG_0
, 0),
5434 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
5435 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
5436 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
5437 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
5438 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
5439 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
5440 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
5441 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
5442 BPF_MOV64_IMM(BPF_REG_2
, 16),
5443 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5444 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5445 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
, 64, 4),
5446 BPF_MOV64_IMM(BPF_REG_4
, 0),
5447 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
5448 BPF_MOV64_IMM(BPF_REG_3
, 0),
5449 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5450 BPF_MOV64_IMM(BPF_REG_0
, 0),
5454 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5457 "helper access to variable memory: stack, JMP, bounds + offset",
5459 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5460 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5461 BPF_MOV64_IMM(BPF_REG_2
, 16),
5462 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5463 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5464 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 5),
5465 BPF_MOV64_IMM(BPF_REG_4
, 0),
5466 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 3),
5467 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
5468 BPF_MOV64_IMM(BPF_REG_3
, 0),
5469 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5470 BPF_MOV64_IMM(BPF_REG_0
, 0),
5473 .errstr
= "invalid stack type R1 off=-64 access_size=65",
5475 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5478 "helper access to variable memory: stack, JMP, wrong max",
5480 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5481 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5482 BPF_MOV64_IMM(BPF_REG_2
, 16),
5483 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5484 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5485 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 65, 4),
5486 BPF_MOV64_IMM(BPF_REG_4
, 0),
5487 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
5488 BPF_MOV64_IMM(BPF_REG_3
, 0),
5489 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5490 BPF_MOV64_IMM(BPF_REG_0
, 0),
5493 .errstr
= "invalid stack type R1 off=-64 access_size=65",
5495 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5498 "helper access to variable memory: stack, JMP, no max check",
5500 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5501 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5502 BPF_MOV64_IMM(BPF_REG_2
, 16),
5503 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5504 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5505 BPF_MOV64_IMM(BPF_REG_4
, 0),
5506 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
5507 BPF_MOV64_IMM(BPF_REG_3
, 0),
5508 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5509 BPF_MOV64_IMM(BPF_REG_0
, 0),
5512 /* because max wasn't checked, signed min is negative */
5513 .errstr
= "R2 min value is negative, either use unsigned or 'var &= const'",
5515 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5518 "helper access to variable memory: stack, JMP, no min check",
5520 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5521 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5522 BPF_MOV64_IMM(BPF_REG_2
, 16),
5523 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5524 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5525 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 3),
5526 BPF_MOV64_IMM(BPF_REG_3
, 0),
5527 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5528 BPF_MOV64_IMM(BPF_REG_0
, 0),
5531 .errstr
= "invalid indirect read from stack off -64+0 size 64",
5533 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5536 "helper access to variable memory: stack, JMP (signed), no min check",
5538 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5539 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5540 BPF_MOV64_IMM(BPF_REG_2
, 16),
5541 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
5542 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
5543 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
, 64, 3),
5544 BPF_MOV64_IMM(BPF_REG_3
, 0),
5545 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5546 BPF_MOV64_IMM(BPF_REG_0
, 0),
5549 .errstr
= "R2 min value is negative",
5551 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5554 "helper access to variable memory: map, JMP, correct bounds",
5556 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5557 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5558 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5559 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5560 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5561 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
5562 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5563 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
5564 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5565 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5566 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
5567 sizeof(struct test_val
), 4),
5568 BPF_MOV64_IMM(BPF_REG_4
, 0),
5569 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
5570 BPF_MOV64_IMM(BPF_REG_3
, 0),
5571 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5572 BPF_MOV64_IMM(BPF_REG_0
, 0),
5575 .fixup_map2
= { 3 },
5577 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5580 "helper access to variable memory: map, JMP, wrong max",
5582 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5583 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5584 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5585 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5586 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5587 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
5588 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5589 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
5590 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5591 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5592 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
5593 sizeof(struct test_val
) + 1, 4),
5594 BPF_MOV64_IMM(BPF_REG_4
, 0),
5595 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
5596 BPF_MOV64_IMM(BPF_REG_3
, 0),
5597 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5598 BPF_MOV64_IMM(BPF_REG_0
, 0),
5601 .fixup_map2
= { 3 },
5602 .errstr
= "invalid access to map value, value_size=48 off=0 size=49",
5604 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5607 "helper access to variable memory: map adjusted, JMP, correct bounds",
5609 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5610 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5611 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5612 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5613 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5614 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
5615 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5616 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 20),
5617 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
5618 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5619 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5620 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
5621 sizeof(struct test_val
) - 20, 4),
5622 BPF_MOV64_IMM(BPF_REG_4
, 0),
5623 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
5624 BPF_MOV64_IMM(BPF_REG_3
, 0),
5625 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5626 BPF_MOV64_IMM(BPF_REG_0
, 0),
5629 .fixup_map2
= { 3 },
5631 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5634 "helper access to variable memory: map adjusted, JMP, wrong max",
5636 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5637 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5638 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
5639 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5640 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5641 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
5642 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5643 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 20),
5644 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
5645 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5646 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5647 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
5648 sizeof(struct test_val
) - 19, 4),
5649 BPF_MOV64_IMM(BPF_REG_4
, 0),
5650 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
5651 BPF_MOV64_IMM(BPF_REG_3
, 0),
5652 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5653 BPF_MOV64_IMM(BPF_REG_0
, 0),
5656 .fixup_map2
= { 3 },
5657 .errstr
= "R1 min value is outside of the array range",
5659 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5662 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
5664 BPF_MOV64_IMM(BPF_REG_1
, 0),
5665 BPF_MOV64_IMM(BPF_REG_2
, 0),
5666 BPF_MOV64_IMM(BPF_REG_3
, 0),
5667 BPF_MOV64_IMM(BPF_REG_4
, 0),
5668 BPF_MOV64_IMM(BPF_REG_5
, 0),
5669 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5673 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5676 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
5678 BPF_MOV64_IMM(BPF_REG_1
, 0),
5679 BPF_MOV64_IMM(BPF_REG_2
, 1),
5680 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5681 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5682 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
5683 BPF_MOV64_IMM(BPF_REG_3
, 0),
5684 BPF_MOV64_IMM(BPF_REG_4
, 0),
5685 BPF_MOV64_IMM(BPF_REG_5
, 0),
5686 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5689 .errstr
= "R1 type=inv expected=fp",
5691 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5694 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
5696 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5697 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
5698 BPF_MOV64_IMM(BPF_REG_2
, 0),
5699 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, 0),
5700 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 8),
5701 BPF_MOV64_IMM(BPF_REG_3
, 0),
5702 BPF_MOV64_IMM(BPF_REG_4
, 0),
5703 BPF_MOV64_IMM(BPF_REG_5
, 0),
5704 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5708 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5711 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
5713 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5714 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5715 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5716 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5717 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
5718 BPF_FUNC_map_lookup_elem
),
5719 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
5720 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5721 BPF_MOV64_IMM(BPF_REG_2
, 0),
5722 BPF_MOV64_IMM(BPF_REG_3
, 0),
5723 BPF_MOV64_IMM(BPF_REG_4
, 0),
5724 BPF_MOV64_IMM(BPF_REG_5
, 0),
5725 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5728 .fixup_map1
= { 3 },
5730 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5733 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
5735 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5736 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5737 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5738 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5739 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
5740 BPF_FUNC_map_lookup_elem
),
5741 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
5742 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
5743 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 8, 7),
5744 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5745 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
5746 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, 0),
5747 BPF_MOV64_IMM(BPF_REG_3
, 0),
5748 BPF_MOV64_IMM(BPF_REG_4
, 0),
5749 BPF_MOV64_IMM(BPF_REG_5
, 0),
5750 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5753 .fixup_map1
= { 3 },
5755 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5758 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
5760 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5761 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5762 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5763 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5764 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
5765 BPF_FUNC_map_lookup_elem
),
5766 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
5767 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5768 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
5769 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 8, 4),
5770 BPF_MOV64_IMM(BPF_REG_3
, 0),
5771 BPF_MOV64_IMM(BPF_REG_4
, 0),
5772 BPF_MOV64_IMM(BPF_REG_5
, 0),
5773 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5776 .fixup_map1
= { 3 },
5778 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5781 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
5783 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
5784 offsetof(struct __sk_buff
, data
)),
5785 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
5786 offsetof(struct __sk_buff
, data_end
)),
5787 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_6
),
5788 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
5789 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 7),
5790 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
5791 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 0),
5792 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 8, 4),
5793 BPF_MOV64_IMM(BPF_REG_3
, 0),
5794 BPF_MOV64_IMM(BPF_REG_4
, 0),
5795 BPF_MOV64_IMM(BPF_REG_5
, 0),
5796 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
5800 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
5803 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
5805 BPF_MOV64_IMM(BPF_REG_1
, 0),
5806 BPF_MOV64_IMM(BPF_REG_2
, 0),
5807 BPF_MOV64_IMM(BPF_REG_3
, 0),
5808 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5811 .errstr
= "R1 type=inv expected=fp",
5813 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5816 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
5818 BPF_MOV64_IMM(BPF_REG_1
, 0),
5819 BPF_MOV64_IMM(BPF_REG_2
, 1),
5820 BPF_MOV64_IMM(BPF_REG_3
, 0),
5821 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5824 .errstr
= "R1 type=inv expected=fp",
5826 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5829 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
5831 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5832 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
5833 BPF_MOV64_IMM(BPF_REG_2
, 0),
5834 BPF_MOV64_IMM(BPF_REG_3
, 0),
5835 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5839 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5842 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
5844 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5845 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5846 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5847 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5848 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5849 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5850 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5851 BPF_MOV64_IMM(BPF_REG_2
, 0),
5852 BPF_MOV64_IMM(BPF_REG_3
, 0),
5853 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5856 .fixup_map1
= { 3 },
5858 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5861 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
5863 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5864 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5865 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5866 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5867 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5868 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
5869 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
5870 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 8, 4),
5871 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5872 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
5873 BPF_MOV64_IMM(BPF_REG_3
, 0),
5874 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5877 .fixup_map1
= { 3 },
5879 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5882 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
5884 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5885 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5886 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5887 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5888 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
5889 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
5890 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
5891 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
5892 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 8, 2),
5893 BPF_MOV64_IMM(BPF_REG_3
, 0),
5894 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5897 .fixup_map1
= { 3 },
5899 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5902 "helper access to variable memory: 8 bytes leak",
5904 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5905 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5906 BPF_MOV64_IMM(BPF_REG_0
, 0),
5907 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
5908 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
5909 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
5910 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
5911 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
5912 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
5913 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
5914 BPF_MOV64_IMM(BPF_REG_2
, 1),
5915 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
5916 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
5917 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 63),
5918 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
5919 BPF_MOV64_IMM(BPF_REG_3
, 0),
5920 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5921 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
5924 .errstr
= "invalid indirect read from stack off -64+32 size 64",
5926 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5929 "helper access to variable memory: 8 bytes no leak (init memory)",
5931 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
5932 BPF_MOV64_IMM(BPF_REG_0
, 0),
5933 BPF_MOV64_IMM(BPF_REG_0
, 0),
5934 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
5935 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
5936 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
5937 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
5938 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
5939 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
5940 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
5941 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
5942 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
5943 BPF_MOV64_IMM(BPF_REG_2
, 0),
5944 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 32),
5945 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 32),
5946 BPF_MOV64_IMM(BPF_REG_3
, 0),
5947 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
5948 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
5952 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
5955 "invalid and of negative number",
5957 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5958 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5959 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5960 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5961 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
5962 BPF_FUNC_map_lookup_elem
),
5963 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
5964 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
5965 BPF_ALU64_IMM(BPF_AND
, BPF_REG_1
, -4),
5966 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
5967 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
5968 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
5969 offsetof(struct test_val
, foo
)),
5972 .fixup_map2
= { 3 },
5973 .errstr
= "R0 max value is outside of the array range",
5975 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
5978 "invalid range check",
5980 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
5981 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
5982 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
5983 BPF_LD_MAP_FD(BPF_REG_1
, 0),
5984 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
5985 BPF_FUNC_map_lookup_elem
),
5986 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 12),
5987 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
5988 BPF_MOV64_IMM(BPF_REG_9
, 1),
5989 BPF_ALU32_IMM(BPF_MOD
, BPF_REG_1
, 2),
5990 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_1
, 1),
5991 BPF_ALU32_REG(BPF_AND
, BPF_REG_9
, BPF_REG_1
),
5992 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_9
, 1),
5993 BPF_ALU32_IMM(BPF_RSH
, BPF_REG_9
, 1),
5994 BPF_MOV32_IMM(BPF_REG_3
, 1),
5995 BPF_ALU32_REG(BPF_SUB
, BPF_REG_3
, BPF_REG_9
),
5996 BPF_ALU32_IMM(BPF_MUL
, BPF_REG_3
, 0x10000000),
5997 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
5998 BPF_STX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_3
, 0),
5999 BPF_MOV64_REG(BPF_REG_0
, 0),
6002 .fixup_map2
= { 3 },
6003 .errstr
= "R0 max value is outside of the array range",
6005 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
6008 "map in map access",
6010 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6011 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6012 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6013 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6014 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6015 BPF_FUNC_map_lookup_elem
),
6016 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
6017 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6018 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6019 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6020 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
6021 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6022 BPF_FUNC_map_lookup_elem
),
6023 BPF_MOV64_REG(BPF_REG_0
, 0),
6026 .fixup_map_in_map
= { 3 },
6030 "invalid inner map pointer",
6032 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6033 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6034 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6035 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6036 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6037 BPF_FUNC_map_lookup_elem
),
6038 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
6039 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6040 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6041 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6042 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
6043 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
6044 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6045 BPF_FUNC_map_lookup_elem
),
6046 BPF_MOV64_REG(BPF_REG_0
, 0),
6049 .fixup_map_in_map
= { 3 },
6050 .errstr
= "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
6054 "forgot null checking on the inner map pointer",
6056 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6057 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6058 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6059 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6060 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6061 BPF_FUNC_map_lookup_elem
),
6062 BPF_ST_MEM(0, BPF_REG_10
, -4, 0),
6063 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6064 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4),
6065 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
6066 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6067 BPF_FUNC_map_lookup_elem
),
6068 BPF_MOV64_REG(BPF_REG_0
, 0),
6071 .fixup_map_in_map
= { 3 },
6072 .errstr
= "R1 type=map_value_or_null expected=map_ptr",
6076 "ld_abs: check calling conv, r1",
6078 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6079 BPF_MOV64_IMM(BPF_REG_1
, 0),
6080 BPF_LD_ABS(BPF_W
, -0x200000),
6081 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
6084 .errstr
= "R1 !read_ok",
6088 "ld_abs: check calling conv, r2",
6090 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6091 BPF_MOV64_IMM(BPF_REG_2
, 0),
6092 BPF_LD_ABS(BPF_W
, -0x200000),
6093 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
6096 .errstr
= "R2 !read_ok",
6100 "ld_abs: check calling conv, r3",
6102 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6103 BPF_MOV64_IMM(BPF_REG_3
, 0),
6104 BPF_LD_ABS(BPF_W
, -0x200000),
6105 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_3
),
6108 .errstr
= "R3 !read_ok",
6112 "ld_abs: check calling conv, r4",
6114 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6115 BPF_MOV64_IMM(BPF_REG_4
, 0),
6116 BPF_LD_ABS(BPF_W
, -0x200000),
6117 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_4
),
6120 .errstr
= "R4 !read_ok",
6124 "ld_abs: check calling conv, r5",
6126 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6127 BPF_MOV64_IMM(BPF_REG_5
, 0),
6128 BPF_LD_ABS(BPF_W
, -0x200000),
6129 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
6132 .errstr
= "R5 !read_ok",
6136 "ld_abs: check calling conv, r7",
6138 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6139 BPF_MOV64_IMM(BPF_REG_7
, 0),
6140 BPF_LD_ABS(BPF_W
, -0x200000),
6141 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
6147 "ld_abs: tests on r6 and skb data reload helper",
6149 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6150 BPF_LD_ABS(BPF_B
, 0),
6151 BPF_LD_ABS(BPF_H
, 0),
6152 BPF_LD_ABS(BPF_W
, 0),
6153 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_6
),
6154 BPF_MOV64_IMM(BPF_REG_6
, 0),
6155 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
6156 BPF_MOV64_IMM(BPF_REG_2
, 1),
6157 BPF_MOV64_IMM(BPF_REG_3
, 2),
6158 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6159 BPF_FUNC_skb_vlan_push
),
6160 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_7
),
6161 BPF_LD_ABS(BPF_B
, 0),
6162 BPF_LD_ABS(BPF_H
, 0),
6163 BPF_LD_ABS(BPF_W
, 0),
6164 BPF_MOV64_IMM(BPF_REG_0
, 42),
6167 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
6171 "ld_ind: check calling conv, r1",
6173 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6174 BPF_MOV64_IMM(BPF_REG_1
, 1),
6175 BPF_LD_IND(BPF_W
, BPF_REG_1
, -0x200000),
6176 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
6179 .errstr
= "R1 !read_ok",
6183 "ld_ind: check calling conv, r2",
6185 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6186 BPF_MOV64_IMM(BPF_REG_2
, 1),
6187 BPF_LD_IND(BPF_W
, BPF_REG_2
, -0x200000),
6188 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
6191 .errstr
= "R2 !read_ok",
6195 "ld_ind: check calling conv, r3",
6197 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6198 BPF_MOV64_IMM(BPF_REG_3
, 1),
6199 BPF_LD_IND(BPF_W
, BPF_REG_3
, -0x200000),
6200 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_3
),
6203 .errstr
= "R3 !read_ok",
6207 "ld_ind: check calling conv, r4",
6209 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6210 BPF_MOV64_IMM(BPF_REG_4
, 1),
6211 BPF_LD_IND(BPF_W
, BPF_REG_4
, -0x200000),
6212 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_4
),
6215 .errstr
= "R4 !read_ok",
6219 "ld_ind: check calling conv, r5",
6221 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6222 BPF_MOV64_IMM(BPF_REG_5
, 1),
6223 BPF_LD_IND(BPF_W
, BPF_REG_5
, -0x200000),
6224 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
6227 .errstr
= "R5 !read_ok",
6231 "ld_ind: check calling conv, r7",
6233 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
6234 BPF_MOV64_IMM(BPF_REG_7
, 1),
6235 BPF_LD_IND(BPF_W
, BPF_REG_7
, -0x200000),
6236 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
6242 "check bpf_perf_event_data->sample_period byte load permitted",
6244 BPF_MOV64_IMM(BPF_REG_0
, 0),
6245 #if __BYTE_ORDER == __LITTLE_ENDIAN
6246 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
6247 offsetof(struct bpf_perf_event_data
, sample_period
)),
6249 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
6250 offsetof(struct bpf_perf_event_data
, sample_period
) + 7),
6255 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
6258 "check bpf_perf_event_data->sample_period half load permitted",
6260 BPF_MOV64_IMM(BPF_REG_0
, 0),
6261 #if __BYTE_ORDER == __LITTLE_ENDIAN
6262 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6263 offsetof(struct bpf_perf_event_data
, sample_period
)),
6265 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6266 offsetof(struct bpf_perf_event_data
, sample_period
) + 6),
6271 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
6274 "check bpf_perf_event_data->sample_period word load permitted",
6276 BPF_MOV64_IMM(BPF_REG_0
, 0),
6277 #if __BYTE_ORDER == __LITTLE_ENDIAN
6278 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
6279 offsetof(struct bpf_perf_event_data
, sample_period
)),
6281 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
6282 offsetof(struct bpf_perf_event_data
, sample_period
) + 4),
6287 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
6290 "check bpf_perf_event_data->sample_period dword load permitted",
6292 BPF_MOV64_IMM(BPF_REG_0
, 0),
6293 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
6294 offsetof(struct bpf_perf_event_data
, sample_period
)),
6298 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
6301 "check skb->data half load not permitted",
6303 BPF_MOV64_IMM(BPF_REG_0
, 0),
6304 #if __BYTE_ORDER == __LITTLE_ENDIAN
6305 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6306 offsetof(struct __sk_buff
, data
)),
6308 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6309 offsetof(struct __sk_buff
, data
) + 2),
6314 .errstr
= "invalid bpf_context access",
6317 "check skb->tc_classid half load not permitted for lwt prog",
6319 BPF_MOV64_IMM(BPF_REG_0
, 0),
6320 #if __BYTE_ORDER == __LITTLE_ENDIAN
6321 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6322 offsetof(struct __sk_buff
, tc_classid
)),
6324 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
6325 offsetof(struct __sk_buff
, tc_classid
) + 2),
6330 .errstr
= "invalid bpf_context access",
6331 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
6334 "bounds checks mixing signed and unsigned, positive bounds",
6336 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6337 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6338 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6339 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6340 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6341 BPF_FUNC_map_lookup_elem
),
6342 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
6343 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6344 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6345 BPF_MOV64_IMM(BPF_REG_2
, 2),
6346 BPF_JMP_REG(BPF_JGE
, BPF_REG_2
, BPF_REG_1
, 3),
6347 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 4, 2),
6348 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6349 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6350 BPF_MOV64_IMM(BPF_REG_0
, 0),
6353 .fixup_map1
= { 3 },
6354 .errstr
= "unbounded min value",
6358 "bounds checks mixing signed and unsigned",
6360 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6361 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6362 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6363 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6364 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6365 BPF_FUNC_map_lookup_elem
),
6366 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
6367 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6368 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6369 BPF_MOV64_IMM(BPF_REG_2
, -1),
6370 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, 3),
6371 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6372 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6373 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6374 BPF_MOV64_IMM(BPF_REG_0
, 0),
6377 .fixup_map1
= { 3 },
6378 .errstr
= "unbounded min value",
6382 "bounds checks mixing signed and unsigned, variant 2",
6384 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6385 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6386 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6387 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6388 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6389 BPF_FUNC_map_lookup_elem
),
6390 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6391 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6392 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6393 BPF_MOV64_IMM(BPF_REG_2
, -1),
6394 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, 5),
6395 BPF_MOV64_IMM(BPF_REG_8
, 0),
6396 BPF_ALU64_REG(BPF_ADD
, BPF_REG_8
, BPF_REG_1
),
6397 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_8
, 1, 2),
6398 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_8
),
6399 BPF_ST_MEM(BPF_B
, BPF_REG_8
, 0, 0),
6400 BPF_MOV64_IMM(BPF_REG_0
, 0),
6403 .fixup_map1
= { 3 },
6404 .errstr
= "unbounded min value",
6408 "bounds checks mixing signed and unsigned, variant 3",
6410 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6411 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6412 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6413 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6414 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6415 BPF_FUNC_map_lookup_elem
),
6416 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 8),
6417 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6418 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6419 BPF_MOV64_IMM(BPF_REG_2
, -1),
6420 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, 4),
6421 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_1
),
6422 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_8
, 1, 2),
6423 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_8
),
6424 BPF_ST_MEM(BPF_B
, BPF_REG_8
, 0, 0),
6425 BPF_MOV64_IMM(BPF_REG_0
, 0),
6428 .fixup_map1
= { 3 },
6429 .errstr
= "unbounded min value",
6433 "bounds checks mixing signed and unsigned, variant 4",
6435 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6436 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6437 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6438 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6439 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6440 BPF_FUNC_map_lookup_elem
),
6441 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
6442 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6443 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6444 BPF_MOV64_IMM(BPF_REG_2
, 1),
6445 BPF_ALU64_REG(BPF_AND
, BPF_REG_1
, BPF_REG_2
),
6446 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6447 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6448 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6449 BPF_MOV64_IMM(BPF_REG_0
, 0),
6452 .fixup_map1
= { 3 },
6456 "bounds checks mixing signed and unsigned, variant 5",
6458 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6459 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6460 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6461 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6462 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6463 BPF_FUNC_map_lookup_elem
),
6464 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6465 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6466 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6467 BPF_MOV64_IMM(BPF_REG_2
, -1),
6468 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, 5),
6469 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 4),
6470 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 4),
6471 BPF_ALU64_REG(BPF_SUB
, BPF_REG_0
, BPF_REG_1
),
6472 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6473 BPF_MOV64_IMM(BPF_REG_0
, 0),
6476 .fixup_map1
= { 3 },
6477 .errstr
= "unbounded min value",
6481 "bounds checks mixing signed and unsigned, variant 6",
6483 BPF_MOV64_IMM(BPF_REG_2
, 0),
6484 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_10
),
6485 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_3
, -512),
6486 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6487 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -16),
6488 BPF_MOV64_IMM(BPF_REG_6
, -1),
6489 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_6
, 5),
6490 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_4
, 1, 4),
6491 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 1),
6492 BPF_MOV64_IMM(BPF_REG_5
, 0),
6493 BPF_ST_MEM(BPF_H
, BPF_REG_10
, -512, 0),
6494 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6495 BPF_FUNC_skb_load_bytes
),
6496 BPF_MOV64_IMM(BPF_REG_0
, 0),
6499 .errstr
= "R4 min value is negative, either use unsigned",
6503 "bounds checks mixing signed and unsigned, variant 7",
6505 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6506 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6507 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6508 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6509 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6510 BPF_FUNC_map_lookup_elem
),
6511 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
6512 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6513 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6514 BPF_MOV64_IMM(BPF_REG_2
, 1024 * 1024 * 1024),
6515 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, 3),
6516 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6517 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6518 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6519 BPF_MOV64_IMM(BPF_REG_0
, 0),
6522 .fixup_map1
= { 3 },
6526 "bounds checks mixing signed and unsigned, variant 8",
6528 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6529 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6530 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6531 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6532 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6533 BPF_FUNC_map_lookup_elem
),
6534 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6535 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6536 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6537 BPF_MOV64_IMM(BPF_REG_2
, -1),
6538 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 2),
6539 BPF_MOV64_IMM(BPF_REG_0
, 0),
6541 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6542 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6543 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6544 BPF_MOV64_IMM(BPF_REG_0
, 0),
6547 .fixup_map1
= { 3 },
6548 .errstr
= "unbounded min value",
6552 "bounds checks mixing signed and unsigned, variant 9",
6554 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6555 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6556 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6557 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6558 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6559 BPF_FUNC_map_lookup_elem
),
6560 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
6561 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6562 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6563 BPF_LD_IMM64(BPF_REG_2
, -9223372036854775808ULL),
6564 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 2),
6565 BPF_MOV64_IMM(BPF_REG_0
, 0),
6567 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6568 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6569 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6570 BPF_MOV64_IMM(BPF_REG_0
, 0),
6573 .fixup_map1
= { 3 },
6577 "bounds checks mixing signed and unsigned, variant 10",
6579 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6580 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6581 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6582 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6583 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6584 BPF_FUNC_map_lookup_elem
),
6585 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6586 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6587 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6588 BPF_MOV64_IMM(BPF_REG_2
, 0),
6589 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 2),
6590 BPF_MOV64_IMM(BPF_REG_0
, 0),
6592 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6593 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6594 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6595 BPF_MOV64_IMM(BPF_REG_0
, 0),
6598 .fixup_map1
= { 3 },
6599 .errstr
= "unbounded min value",
6603 "bounds checks mixing signed and unsigned, variant 11",
6605 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6606 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6607 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6608 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6609 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6610 BPF_FUNC_map_lookup_elem
),
6611 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6612 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6613 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6614 BPF_MOV64_IMM(BPF_REG_2
, -1),
6615 BPF_JMP_REG(BPF_JGE
, BPF_REG_2
, BPF_REG_1
, 2),
6617 BPF_MOV64_IMM(BPF_REG_0
, 0),
6619 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6620 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6621 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6622 BPF_MOV64_IMM(BPF_REG_0
, 0),
6625 .fixup_map1
= { 3 },
6626 .errstr
= "unbounded min value",
6630 "bounds checks mixing signed and unsigned, variant 12",
6632 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6633 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6634 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6635 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6636 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6637 BPF_FUNC_map_lookup_elem
),
6638 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6639 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6640 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6641 BPF_MOV64_IMM(BPF_REG_2
, -6),
6642 BPF_JMP_REG(BPF_JGE
, BPF_REG_2
, BPF_REG_1
, 2),
6643 BPF_MOV64_IMM(BPF_REG_0
, 0),
6645 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6646 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6647 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6648 BPF_MOV64_IMM(BPF_REG_0
, 0),
6651 .fixup_map1
= { 3 },
6652 .errstr
= "unbounded min value",
6656 "bounds checks mixing signed and unsigned, variant 13",
6658 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6659 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6660 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6661 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6662 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6663 BPF_FUNC_map_lookup_elem
),
6664 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
6665 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6666 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6667 BPF_MOV64_IMM(BPF_REG_2
, 2),
6668 BPF_JMP_REG(BPF_JGE
, BPF_REG_2
, BPF_REG_1
, 2),
6669 BPF_MOV64_IMM(BPF_REG_7
, 1),
6670 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_7
, 0, 2),
6671 BPF_MOV64_IMM(BPF_REG_0
, 0),
6673 BPF_ALU64_REG(BPF_ADD
, BPF_REG_7
, BPF_REG_1
),
6674 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_7
, 4, 2),
6675 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_7
),
6676 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6677 BPF_MOV64_IMM(BPF_REG_0
, 0),
6680 .fixup_map1
= { 3 },
6681 .errstr
= "unbounded min value",
6685 "bounds checks mixing signed and unsigned, variant 14",
6687 BPF_LDX_MEM(BPF_W
, BPF_REG_9
, BPF_REG_1
,
6688 offsetof(struct __sk_buff
, mark
)),
6689 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6690 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6691 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6692 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6693 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6694 BPF_FUNC_map_lookup_elem
),
6695 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 8),
6696 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6697 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6698 BPF_MOV64_IMM(BPF_REG_2
, -1),
6699 BPF_MOV64_IMM(BPF_REG_8
, 2),
6700 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_9
, 42, 6),
6701 BPF_JMP_REG(BPF_JSGT
, BPF_REG_8
, BPF_REG_1
, 3),
6702 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 1, 2),
6703 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6704 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6705 BPF_MOV64_IMM(BPF_REG_0
, 0),
6707 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_2
, -3),
6708 BPF_JMP_IMM(BPF_JA
, 0, 0, -7),
6710 .fixup_map1
= { 4 },
6711 .errstr
= "unbounded min value",
6715 "bounds checks mixing signed and unsigned, variant 15",
6717 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6718 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6719 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6720 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6721 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6722 BPF_FUNC_map_lookup_elem
),
6723 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6724 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, -8),
6725 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
6726 BPF_MOV64_IMM(BPF_REG_2
, -6),
6727 BPF_JMP_REG(BPF_JGE
, BPF_REG_2
, BPF_REG_1
, 2),
6728 BPF_MOV64_IMM(BPF_REG_0
, 0),
6730 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6731 BPF_JMP_IMM(BPF_JGT
, BPF_REG_0
, 1, 2),
6732 BPF_MOV64_IMM(BPF_REG_0
, 0),
6734 BPF_ST_MEM(BPF_B
, BPF_REG_0
, 0, 0),
6735 BPF_MOV64_IMM(BPF_REG_0
, 0),
6738 .fixup_map1
= { 3 },
6739 .errstr
= "unbounded min value",
6741 .result_unpriv
= REJECT
,
6744 "subtraction bounds (map value) variant 1",
6746 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6747 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6748 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6749 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6750 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6751 BPF_FUNC_map_lookup_elem
),
6752 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6753 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
6754 BPF_JMP_IMM(BPF_JGT
, BPF_REG_1
, 0xff, 7),
6755 BPF_LDX_MEM(BPF_B
, BPF_REG_3
, BPF_REG_0
, 1),
6756 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
, 0xff, 5),
6757 BPF_ALU64_REG(BPF_SUB
, BPF_REG_1
, BPF_REG_3
),
6758 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 56),
6759 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6760 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6762 BPF_MOV64_IMM(BPF_REG_0
, 0),
6765 .fixup_map1
= { 3 },
6766 .errstr
= "R0 max value is outside of the array range",
6770 "subtraction bounds (map value) variant 2",
6772 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6773 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6774 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6775 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6776 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6777 BPF_FUNC_map_lookup_elem
),
6778 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 8),
6779 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
6780 BPF_JMP_IMM(BPF_JGT
, BPF_REG_1
, 0xff, 6),
6781 BPF_LDX_MEM(BPF_B
, BPF_REG_3
, BPF_REG_0
, 1),
6782 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
, 0xff, 4),
6783 BPF_ALU64_REG(BPF_SUB
, BPF_REG_1
, BPF_REG_3
),
6784 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6785 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6787 BPF_MOV64_IMM(BPF_REG_0
, 0),
6790 .fixup_map1
= { 3 },
6791 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
6795 "bounds check based on zero-extended MOV",
6797 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6798 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6799 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6800 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6801 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6802 BPF_FUNC_map_lookup_elem
),
6803 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6804 /* r2 = 0x0000'0000'ffff'ffff */
6805 BPF_MOV32_IMM(BPF_REG_2
, 0xffffffff),
6807 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_2
, 32),
6809 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
6810 /* access at offset 0 */
6811 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6813 BPF_MOV64_IMM(BPF_REG_0
, 0),
6816 .fixup_map1
= { 3 },
6820 "bounds check based on sign-extended MOV. test1",
6822 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6823 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6824 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6825 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6826 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6827 BPF_FUNC_map_lookup_elem
),
6828 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6829 /* r2 = 0xffff'ffff'ffff'ffff */
6830 BPF_MOV64_IMM(BPF_REG_2
, 0xffffffff),
6831 /* r2 = 0xffff'ffff */
6832 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_2
, 32),
6833 /* r0 = <oob pointer> */
6834 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
6835 /* access to OOB pointer */
6836 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6838 BPF_MOV64_IMM(BPF_REG_0
, 0),
6841 .fixup_map1
= { 3 },
6842 .errstr
= "map_value pointer and 4294967295",
6846 "bounds check based on sign-extended MOV. test2",
6848 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6849 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6850 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6851 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6852 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6853 BPF_FUNC_map_lookup_elem
),
6854 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6855 /* r2 = 0xffff'ffff'ffff'ffff */
6856 BPF_MOV64_IMM(BPF_REG_2
, 0xffffffff),
6857 /* r2 = 0xfff'ffff */
6858 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_2
, 36),
6859 /* r0 = <oob pointer> */
6860 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
6861 /* access to OOB pointer */
6862 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6864 BPF_MOV64_IMM(BPF_REG_0
, 0),
6867 .fixup_map1
= { 3 },
6868 .errstr
= "R0 min value is outside of the array range",
6872 "bounds check based on reg_off + var_off + insn_off. test1",
6874 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
6875 offsetof(struct __sk_buff
, mark
)),
6876 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6877 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6878 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6879 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6880 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6881 BPF_FUNC_map_lookup_elem
),
6882 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6883 BPF_ALU64_IMM(BPF_AND
, BPF_REG_6
, 1),
6884 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, (1 << 29) - 1),
6885 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_6
),
6886 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, (1 << 29) - 1),
6887 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 3),
6888 BPF_MOV64_IMM(BPF_REG_0
, 0),
6891 .fixup_map1
= { 4 },
6892 .errstr
= "value_size=8 off=1073741825",
6894 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
6897 "bounds check based on reg_off + var_off + insn_off. test2",
6899 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
6900 offsetof(struct __sk_buff
, mark
)),
6901 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6902 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6903 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6904 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6905 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6906 BPF_FUNC_map_lookup_elem
),
6907 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
6908 BPF_ALU64_IMM(BPF_AND
, BPF_REG_6
, 1),
6909 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, (1 << 30) - 1),
6910 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_6
),
6911 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, (1 << 29) - 1),
6912 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 3),
6913 BPF_MOV64_IMM(BPF_REG_0
, 0),
6916 .fixup_map1
= { 4 },
6917 .errstr
= "value 1073741823",
6919 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
6922 "bounds check after truncation of non-boundary-crossing range",
6924 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6925 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6926 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6927 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6928 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6929 BPF_FUNC_map_lookup_elem
),
6930 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6931 /* r1 = [0x00, 0xff] */
6932 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
6933 BPF_MOV64_IMM(BPF_REG_2
, 1),
6934 /* r2 = 0x10'0000'0000 */
6935 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_2
, 36),
6936 /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
6937 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_2
),
6938 /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
6939 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x7fffffff),
6940 /* r1 = [0x00, 0xff] */
6941 BPF_ALU32_IMM(BPF_SUB
, BPF_REG_1
, 0x7fffffff),
6943 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 8),
6945 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6946 /* access at offset 0 */
6947 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6949 BPF_MOV64_IMM(BPF_REG_0
, 0),
6952 .fixup_map1
= { 3 },
6956 "bounds check after truncation of boundary-crossing range (1)",
6958 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
6959 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
6960 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
6961 BPF_LD_MAP_FD(BPF_REG_1
, 0),
6962 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
6963 BPF_FUNC_map_lookup_elem
),
6964 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
6965 /* r1 = [0x00, 0xff] */
6966 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
6967 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0xffffff80 >> 1),
6968 /* r1 = [0xffff'ff80, 0x1'0000'007f] */
6969 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0xffffff80 >> 1),
6970 /* r1 = [0xffff'ff80, 0xffff'ffff] or
6971 * [0x0000'0000, 0x0000'007f]
6973 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_1
, 0),
6974 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 0xffffff80 >> 1),
6975 /* r1 = [0x00, 0xff] or
6976 * [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
6978 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 0xffffff80 >> 1),
6980 * [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
6982 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 8),
6983 /* no-op or OOB pointer computation */
6984 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
6985 /* potentially OOB access */
6986 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
6988 BPF_MOV64_IMM(BPF_REG_0
, 0),
6991 .fixup_map1
= { 3 },
6992 /* not actually fully unbounded, but the bound is very high */
6993 .errstr
= "R0 unbounded memory access",
6997 "bounds check after truncation of boundary-crossing range (2)",
6999 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7000 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7001 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7002 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7003 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7004 BPF_FUNC_map_lookup_elem
),
7005 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
7006 /* r1 = [0x00, 0xff] */
7007 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
7008 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0xffffff80 >> 1),
7009 /* r1 = [0xffff'ff80, 0x1'0000'007f] */
7010 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0xffffff80 >> 1),
7011 /* r1 = [0xffff'ff80, 0xffff'ffff] or
7012 * [0x0000'0000, 0x0000'007f]
7013 * difference to previous test: truncation via MOV32
7016 BPF_MOV32_REG(BPF_REG_1
, BPF_REG_1
),
7017 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 0xffffff80 >> 1),
7018 /* r1 = [0x00, 0xff] or
7019 * [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
7021 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 0xffffff80 >> 1),
7023 * [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
7025 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 8),
7026 /* no-op or OOB pointer computation */
7027 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7028 /* potentially OOB access */
7029 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
7031 BPF_MOV64_IMM(BPF_REG_0
, 0),
7034 .fixup_map1
= { 3 },
7035 /* not actually fully unbounded, but the bound is very high */
7036 .errstr
= "R0 unbounded memory access",
7040 "bounds check after wrapping 32-bit addition",
7042 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7043 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7044 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7045 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7046 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7047 BPF_FUNC_map_lookup_elem
),
7048 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
7049 /* r1 = 0x7fff'ffff */
7050 BPF_MOV64_IMM(BPF_REG_1
, 0x7fffffff),
7051 /* r1 = 0xffff'fffe */
7052 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x7fffffff),
7054 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_1
, 2),
7056 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7057 /* access at offset 0 */
7058 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
7060 BPF_MOV64_IMM(BPF_REG_0
, 0),
7063 .fixup_map1
= { 3 },
7067 "bounds check after shift with oversized count operand",
7069 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7070 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7071 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7072 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7073 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7074 BPF_FUNC_map_lookup_elem
),
7075 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
7076 BPF_MOV64_IMM(BPF_REG_2
, 32),
7077 BPF_MOV64_IMM(BPF_REG_1
, 1),
7078 /* r1 = (u32)1 << (u32)32 = ? */
7079 BPF_ALU32_REG(BPF_LSH
, BPF_REG_1
, BPF_REG_2
),
7080 /* r1 = [0x0000, 0xffff] */
7081 BPF_ALU64_IMM(BPF_AND
, BPF_REG_1
, 0xffff),
7082 /* computes unknown pointer, potentially OOB */
7083 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7084 /* potentially OOB access */
7085 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
7087 BPF_MOV64_IMM(BPF_REG_0
, 0),
7090 .fixup_map1
= { 3 },
7091 .errstr
= "R0 max value is outside of the array range",
7095 "bounds check after right shift of maybe-negative number",
7097 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7098 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7099 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7100 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7101 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7102 BPF_FUNC_map_lookup_elem
),
7103 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
7104 /* r1 = [0x00, 0xff] */
7105 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
7106 /* r1 = [-0x01, 0xfe] */
7107 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 1),
7108 /* r1 = 0 or 0xff'ffff'ffff'ffff */
7109 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 8),
7110 /* r1 = 0 or 0xffff'ffff'ffff */
7111 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_1
, 8),
7112 /* computes unknown pointer, potentially OOB */
7113 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7114 /* potentially OOB access */
7115 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
7117 BPF_MOV64_IMM(BPF_REG_0
, 0),
7120 .fixup_map1
= { 3 },
7121 .errstr
= "R0 unbounded memory access",
7125 "bounds check map access with off+size signed 32bit overflow. test1",
7127 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7128 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7129 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7130 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7131 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7132 BPF_FUNC_map_lookup_elem
),
7133 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
7135 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0x7ffffffe),
7136 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
7140 .fixup_map1
= { 3 },
7141 .errstr
= "map_value pointer and 2147483646",
7145 "bounds check map access with off+size signed 32bit overflow. test2",
7147 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7148 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7149 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7150 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7151 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7152 BPF_FUNC_map_lookup_elem
),
7153 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
7155 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0x1fffffff),
7156 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0x1fffffff),
7157 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 0x1fffffff),
7158 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
7162 .fixup_map1
= { 3 },
7163 .errstr
= "pointer offset 1073741822",
7167 "bounds check map access with off+size signed 32bit overflow. test3",
7169 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7170 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7171 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7172 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7173 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7174 BPF_FUNC_map_lookup_elem
),
7175 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
7177 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_0
, 0x1fffffff),
7178 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_0
, 0x1fffffff),
7179 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 2),
7183 .fixup_map1
= { 3 },
7184 .errstr
= "pointer offset -1073741822",
7188 "bounds check map access with off+size signed 32bit overflow. test4",
7190 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7191 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7192 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7193 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7194 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7195 BPF_FUNC_map_lookup_elem
),
7196 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
7198 BPF_MOV64_IMM(BPF_REG_1
, 1000000),
7199 BPF_ALU64_IMM(BPF_MUL
, BPF_REG_1
, 1000000),
7200 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7201 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 2),
7205 .fixup_map1
= { 3 },
7206 .errstr
= "map_value pointer and 1000000000000",
7210 "pointer/scalar confusion in state equality check (way 1)",
7212 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7213 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7214 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7215 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7216 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7217 BPF_FUNC_map_lookup_elem
),
7218 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
7219 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
7221 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_10
),
7225 .fixup_map1
= { 3 },
7227 .result_unpriv
= REJECT
,
7228 .errstr_unpriv
= "R0 leaks addr as return value"
7231 "pointer/scalar confusion in state equality check (way 2)",
7233 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7234 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7235 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7236 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7237 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7238 BPF_FUNC_map_lookup_elem
),
7239 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
7240 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_10
),
7242 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
7245 .fixup_map1
= { 3 },
7247 .result_unpriv
= REJECT
,
7248 .errstr_unpriv
= "R0 leaks addr as return value"
7251 "variable-offset ctx access",
7253 /* Get an unknown value */
7254 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
, 0),
7255 /* Make it small and 4-byte aligned */
7256 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 4),
7257 /* add it to skb. We now have either &skb->len or
7258 * &skb->pkt_type, but we don't know which
7260 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_2
),
7261 /* dereference it */
7262 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
7265 .errstr
= "variable ctx access var_off=(0x0; 0x4)",
7267 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
7270 "variable-offset stack access",
7272 /* Fill the top 8 bytes of the stack */
7273 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7274 /* Get an unknown value */
7275 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
, 0),
7276 /* Make it small and 4-byte aligned */
7277 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 4),
7278 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_2
, 8),
7279 /* add it to fp. We now have either fp-4 or fp-8, but
7280 * we don't know which
7282 BPF_ALU64_REG(BPF_ADD
, BPF_REG_2
, BPF_REG_10
),
7283 /* dereference it */
7284 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_2
, 0),
7287 .errstr
= "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
7289 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
7292 "indirect variable-offset stack access",
7294 /* Fill the top 8 bytes of the stack */
7295 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7296 /* Get an unknown value */
7297 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
, 0),
7298 /* Make it small and 4-byte aligned */
7299 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 4),
7300 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_2
, 8),
7301 /* add it to fp. We now have either fp-4 or fp-8, but
7302 * we don't know which
7304 BPF_ALU64_REG(BPF_ADD
, BPF_REG_2
, BPF_REG_10
),
7305 /* dereference it indirectly */
7306 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7307 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7308 BPF_FUNC_map_lookup_elem
),
7309 BPF_MOV64_IMM(BPF_REG_0
, 0),
7312 .fixup_map1
= { 5 },
7313 .errstr
= "variable stack read R2",
7315 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
7318 "direct stack access with 32-bit wraparound. test1",
7320 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
7321 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x7fffffff),
7322 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x7fffffff),
7323 BPF_MOV32_IMM(BPF_REG_0
, 0),
7324 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
7327 .errstr
= "fp pointer and 2147483647",
7331 "direct stack access with 32-bit wraparound. test2",
7333 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
7334 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x3fffffff),
7335 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x3fffffff),
7336 BPF_MOV32_IMM(BPF_REG_0
, 0),
7337 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
7340 .errstr
= "fp pointer and 1073741823",
7344 "direct stack access with 32-bit wraparound. test3",
7346 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
7347 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x1fffffff),
7348 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 0x1fffffff),
7349 BPF_MOV32_IMM(BPF_REG_0
, 0),
7350 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
, 0),
7353 .errstr
= "fp pointer offset 1073741822",
7357 "liveness pruning and write screening",
7359 /* Get an unknown value */
7360 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
, 0),
7361 /* branch conditions teach us nothing about R2 */
7362 BPF_JMP_IMM(BPF_JGE
, BPF_REG_2
, 0, 1),
7363 BPF_MOV64_IMM(BPF_REG_0
, 0),
7364 BPF_JMP_IMM(BPF_JGE
, BPF_REG_2
, 0, 1),
7365 BPF_MOV64_IMM(BPF_REG_0
, 0),
7368 .errstr
= "R0 !read_ok",
7370 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
7373 "varlen_map_value_access pruning",
7375 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
7376 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
7377 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
7378 BPF_LD_MAP_FD(BPF_REG_1
, 0),
7379 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7380 BPF_FUNC_map_lookup_elem
),
7381 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 8),
7382 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
7383 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
),
7384 BPF_JMP_REG(BPF_JSGT
, BPF_REG_2
, BPF_REG_1
, 1),
7385 BPF_MOV32_IMM(BPF_REG_1
, 0),
7386 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
7387 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
7388 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
7389 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
7390 offsetof(struct test_val
, foo
)),
7393 .fixup_map2
= { 3 },
7394 .errstr_unpriv
= "R0 leaks addr",
7395 .errstr
= "R0 unbounded memory access",
7396 .result_unpriv
= REJECT
,
7398 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7401 "invalid 64-bit BPF_END",
7403 BPF_MOV32_IMM(BPF_REG_0
, 0),
7405 .code
= BPF_ALU64
| BPF_END
| BPF_TO_LE
,
7406 .dst_reg
= BPF_REG_0
,
7413 .errstr
= "BPF_END uses reserved fields",
7417 "meta access, test1",
7419 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7420 offsetof(struct xdp_md
, data_meta
)),
7421 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7422 offsetof(struct xdp_md
, data
)),
7423 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
7424 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7425 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
7426 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7427 BPF_MOV64_IMM(BPF_REG_0
, 0),
7431 .prog_type
= BPF_PROG_TYPE_XDP
,
7434 "meta access, test2",
7436 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7437 offsetof(struct xdp_md
, data_meta
)),
7438 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7439 offsetof(struct xdp_md
, data
)),
7440 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
7441 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_0
, 8),
7442 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
7443 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
7444 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
7445 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_0
, 0),
7446 BPF_MOV64_IMM(BPF_REG_0
, 0),
7450 .errstr
= "invalid access to packet, off=-8",
7451 .prog_type
= BPF_PROG_TYPE_XDP
,
7454 "meta access, test3",
7456 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7457 offsetof(struct xdp_md
, data_meta
)),
7458 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7459 offsetof(struct xdp_md
, data_end
)),
7460 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
7461 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7462 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
7463 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7464 BPF_MOV64_IMM(BPF_REG_0
, 0),
7468 .errstr
= "invalid access to packet",
7469 .prog_type
= BPF_PROG_TYPE_XDP
,
7472 "meta access, test4",
7474 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7475 offsetof(struct xdp_md
, data_meta
)),
7476 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7477 offsetof(struct xdp_md
, data_end
)),
7478 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
7479 offsetof(struct xdp_md
, data
)),
7480 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_4
),
7481 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7482 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
7483 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7484 BPF_MOV64_IMM(BPF_REG_0
, 0),
7488 .errstr
= "invalid access to packet",
7489 .prog_type
= BPF_PROG_TYPE_XDP
,
7492 "meta access, test5",
7494 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7495 offsetof(struct xdp_md
, data_meta
)),
7496 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
7497 offsetof(struct xdp_md
, data
)),
7498 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_3
),
7499 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7500 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_4
, 3),
7501 BPF_MOV64_IMM(BPF_REG_2
, -8),
7502 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
7503 BPF_FUNC_xdp_adjust_meta
),
7504 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_3
, 0),
7505 BPF_MOV64_IMM(BPF_REG_0
, 0),
7509 .errstr
= "R3 !read_ok",
7510 .prog_type
= BPF_PROG_TYPE_XDP
,
7513 "meta access, test6",
7515 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7516 offsetof(struct xdp_md
, data_meta
)),
7517 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7518 offsetof(struct xdp_md
, data
)),
7519 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_3
),
7520 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7521 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
7522 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
7523 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_0
, 1),
7524 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7525 BPF_MOV64_IMM(BPF_REG_0
, 0),
7529 .errstr
= "invalid access to packet",
7530 .prog_type
= BPF_PROG_TYPE_XDP
,
7533 "meta access, test7",
7535 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7536 offsetof(struct xdp_md
, data_meta
)),
7537 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7538 offsetof(struct xdp_md
, data
)),
7539 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_3
),
7540 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
7541 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
7542 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
7543 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
7544 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7545 BPF_MOV64_IMM(BPF_REG_0
, 0),
7549 .prog_type
= BPF_PROG_TYPE_XDP
,
7552 "meta access, test8",
7554 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7555 offsetof(struct xdp_md
, data_meta
)),
7556 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7557 offsetof(struct xdp_md
, data
)),
7558 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
7559 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 0xFFFF),
7560 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
7561 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7562 BPF_MOV64_IMM(BPF_REG_0
, 0),
7566 .prog_type
= BPF_PROG_TYPE_XDP
,
7569 "meta access, test9",
7571 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7572 offsetof(struct xdp_md
, data_meta
)),
7573 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7574 offsetof(struct xdp_md
, data
)),
7575 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
7576 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 0xFFFF),
7577 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 1),
7578 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 1),
7579 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7580 BPF_MOV64_IMM(BPF_REG_0
, 0),
7584 .errstr
= "invalid access to packet",
7585 .prog_type
= BPF_PROG_TYPE_XDP
,
7588 "meta access, test10",
7590 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7591 offsetof(struct xdp_md
, data_meta
)),
7592 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7593 offsetof(struct xdp_md
, data
)),
7594 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
7595 offsetof(struct xdp_md
, data_end
)),
7596 BPF_MOV64_IMM(BPF_REG_5
, 42),
7597 BPF_MOV64_IMM(BPF_REG_6
, 24),
7598 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_5
, -8),
7599 BPF_STX_XADD(BPF_DW
, BPF_REG_10
, BPF_REG_6
, -8),
7600 BPF_LDX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_10
, -8),
7601 BPF_JMP_IMM(BPF_JGT
, BPF_REG_5
, 100, 6),
7602 BPF_ALU64_REG(BPF_ADD
, BPF_REG_3
, BPF_REG_5
),
7603 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
7604 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
7605 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 8),
7606 BPF_JMP_REG(BPF_JGT
, BPF_REG_6
, BPF_REG_5
, 1),
7607 BPF_LDX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
7608 BPF_MOV64_IMM(BPF_REG_0
, 0),
7612 .errstr
= "invalid access to packet",
7613 .prog_type
= BPF_PROG_TYPE_XDP
,
7616 "meta access, test11",
7618 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7619 offsetof(struct xdp_md
, data_meta
)),
7620 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7621 offsetof(struct xdp_md
, data
)),
7622 BPF_MOV64_IMM(BPF_REG_5
, 42),
7623 BPF_MOV64_IMM(BPF_REG_6
, 24),
7624 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_5
, -8),
7625 BPF_STX_XADD(BPF_DW
, BPF_REG_10
, BPF_REG_6
, -8),
7626 BPF_LDX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_10
, -8),
7627 BPF_JMP_IMM(BPF_JGT
, BPF_REG_5
, 100, 6),
7628 BPF_ALU64_REG(BPF_ADD
, BPF_REG_2
, BPF_REG_5
),
7629 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_2
),
7630 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
7631 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 8),
7632 BPF_JMP_REG(BPF_JGT
, BPF_REG_6
, BPF_REG_3
, 1),
7633 BPF_LDX_MEM(BPF_B
, BPF_REG_5
, BPF_REG_5
, 0),
7634 BPF_MOV64_IMM(BPF_REG_0
, 0),
7638 .prog_type
= BPF_PROG_TYPE_XDP
,
7641 "meta access, test12",
7643 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7644 offsetof(struct xdp_md
, data_meta
)),
7645 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7646 offsetof(struct xdp_md
, data
)),
7647 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
7648 offsetof(struct xdp_md
, data_end
)),
7649 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
7650 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 16),
7651 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_4
, 5),
7652 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_3
, 0),
7653 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_2
),
7654 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 16),
7655 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_3
, 1),
7656 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
7657 BPF_MOV64_IMM(BPF_REG_0
, 0),
7661 .prog_type
= BPF_PROG_TYPE_XDP
,
7664 "arithmetic ops make PTR_TO_CTX unusable",
7666 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
7667 offsetof(struct __sk_buff
, data
) -
7668 offsetof(struct __sk_buff
, mark
)),
7669 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
7670 offsetof(struct __sk_buff
, mark
)),
7673 .errstr
= "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
7675 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
7678 "pkt_end - pkt_start is allowed",
7680 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
7681 offsetof(struct __sk_buff
, data_end
)),
7682 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7683 offsetof(struct __sk_buff
, data
)),
7684 BPF_ALU64_REG(BPF_SUB
, BPF_REG_0
, BPF_REG_2
),
7688 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
7691 "XDP pkt read, pkt_end mangling, bad access 1",
7693 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7694 offsetof(struct xdp_md
, data
)),
7695 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7696 offsetof(struct xdp_md
, data_end
)),
7697 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7698 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7699 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_3
, 8),
7700 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
7701 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7702 BPF_MOV64_IMM(BPF_REG_0
, 0),
7705 .errstr
= "R3 pointer arithmetic on PTR_TO_PACKET_END",
7707 .prog_type
= BPF_PROG_TYPE_XDP
,
7710 "XDP pkt read, pkt_end mangling, bad access 2",
7712 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7713 offsetof(struct xdp_md
, data
)),
7714 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7715 offsetof(struct xdp_md
, data_end
)),
7716 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7717 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7718 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_3
, 8),
7719 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
7720 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7721 BPF_MOV64_IMM(BPF_REG_0
, 0),
7724 .errstr
= "R3 pointer arithmetic on PTR_TO_PACKET_END",
7726 .prog_type
= BPF_PROG_TYPE_XDP
,
7729 "XDP pkt read, pkt_data' > pkt_end, good access",
7731 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7732 offsetof(struct xdp_md
, data
)),
7733 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7734 offsetof(struct xdp_md
, data_end
)),
7735 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7736 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7737 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
7738 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7739 BPF_MOV64_IMM(BPF_REG_0
, 0),
7743 .prog_type
= BPF_PROG_TYPE_XDP
,
7746 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
7748 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7749 offsetof(struct xdp_md
, data
)),
7750 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7751 offsetof(struct xdp_md
, data_end
)),
7752 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7753 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7754 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
7755 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
7756 BPF_MOV64_IMM(BPF_REG_0
, 0),
7759 .errstr
= "R1 offset is outside of the packet",
7761 .prog_type
= BPF_PROG_TYPE_XDP
,
7762 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7765 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
7767 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7768 offsetof(struct xdp_md
, data
)),
7769 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7770 offsetof(struct xdp_md
, data_end
)),
7771 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7772 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7773 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 0),
7774 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7775 BPF_MOV64_IMM(BPF_REG_0
, 0),
7778 .errstr
= "R1 offset is outside of the packet",
7780 .prog_type
= BPF_PROG_TYPE_XDP
,
7783 "XDP pkt read, pkt_end > pkt_data', good access",
7785 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7786 offsetof(struct xdp_md
, data
)),
7787 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7788 offsetof(struct xdp_md
, data_end
)),
7789 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7790 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7791 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
7792 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
7793 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
7794 BPF_MOV64_IMM(BPF_REG_0
, 0),
7798 .prog_type
= BPF_PROG_TYPE_XDP
,
7799 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7802 "XDP pkt read, pkt_end > pkt_data', bad access 1",
7804 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7805 offsetof(struct xdp_md
, data
)),
7806 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7807 offsetof(struct xdp_md
, data_end
)),
7808 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7809 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7810 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
7811 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
7812 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7813 BPF_MOV64_IMM(BPF_REG_0
, 0),
7816 .errstr
= "R1 offset is outside of the packet",
7818 .prog_type
= BPF_PROG_TYPE_XDP
,
7821 "XDP pkt read, pkt_end > pkt_data', bad access 2",
7823 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7824 offsetof(struct xdp_md
, data
)),
7825 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7826 offsetof(struct xdp_md
, data_end
)),
7827 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7828 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7829 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
7830 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7831 BPF_MOV64_IMM(BPF_REG_0
, 0),
7834 .errstr
= "R1 offset is outside of the packet",
7836 .prog_type
= BPF_PROG_TYPE_XDP
,
7839 "XDP pkt read, pkt_data' < pkt_end, good access",
7841 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7842 offsetof(struct xdp_md
, data
)),
7843 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7844 offsetof(struct xdp_md
, data_end
)),
7845 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7846 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7847 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
7848 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
7849 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
7850 BPF_MOV64_IMM(BPF_REG_0
, 0),
7854 .prog_type
= BPF_PROG_TYPE_XDP
,
7855 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7858 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
7860 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7861 offsetof(struct xdp_md
, data
)),
7862 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7863 offsetof(struct xdp_md
, data_end
)),
7864 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7865 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7866 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
7867 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
7868 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7869 BPF_MOV64_IMM(BPF_REG_0
, 0),
7872 .errstr
= "R1 offset is outside of the packet",
7874 .prog_type
= BPF_PROG_TYPE_XDP
,
7877 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
7879 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7880 offsetof(struct xdp_md
, data
)),
7881 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7882 offsetof(struct xdp_md
, data_end
)),
7883 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7884 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7885 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
7886 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7887 BPF_MOV64_IMM(BPF_REG_0
, 0),
7890 .errstr
= "R1 offset is outside of the packet",
7892 .prog_type
= BPF_PROG_TYPE_XDP
,
7895 "XDP pkt read, pkt_end < pkt_data', good access",
7897 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7898 offsetof(struct xdp_md
, data
)),
7899 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7900 offsetof(struct xdp_md
, data_end
)),
7901 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7902 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7903 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 1),
7904 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7905 BPF_MOV64_IMM(BPF_REG_0
, 0),
7909 .prog_type
= BPF_PROG_TYPE_XDP
,
7912 "XDP pkt read, pkt_end < pkt_data', bad access 1",
7914 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7915 offsetof(struct xdp_md
, data
)),
7916 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7917 offsetof(struct xdp_md
, data_end
)),
7918 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7919 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7920 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 1),
7921 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
7922 BPF_MOV64_IMM(BPF_REG_0
, 0),
7925 .errstr
= "R1 offset is outside of the packet",
7927 .prog_type
= BPF_PROG_TYPE_XDP
,
7928 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7931 "XDP pkt read, pkt_end < pkt_data', bad access 2",
7933 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7934 offsetof(struct xdp_md
, data
)),
7935 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7936 offsetof(struct xdp_md
, data_end
)),
7937 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7938 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7939 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 0),
7940 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7941 BPF_MOV64_IMM(BPF_REG_0
, 0),
7944 .errstr
= "R1 offset is outside of the packet",
7946 .prog_type
= BPF_PROG_TYPE_XDP
,
7949 "XDP pkt read, pkt_data' >= pkt_end, good access",
7951 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7952 offsetof(struct xdp_md
, data
)),
7953 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7954 offsetof(struct xdp_md
, data_end
)),
7955 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7956 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7957 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 1),
7958 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
7959 BPF_MOV64_IMM(BPF_REG_0
, 0),
7963 .prog_type
= BPF_PROG_TYPE_XDP
,
7964 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
7967 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
7969 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7970 offsetof(struct xdp_md
, data
)),
7971 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7972 offsetof(struct xdp_md
, data_end
)),
7973 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7974 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7975 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 1),
7976 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
7977 BPF_MOV64_IMM(BPF_REG_0
, 0),
7980 .errstr
= "R1 offset is outside of the packet",
7982 .prog_type
= BPF_PROG_TYPE_XDP
,
7985 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
7987 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
7988 offsetof(struct xdp_md
, data
)),
7989 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
7990 offsetof(struct xdp_md
, data_end
)),
7991 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
7992 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
7993 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 0),
7994 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
7995 BPF_MOV64_IMM(BPF_REG_0
, 0),
7998 .errstr
= "R1 offset is outside of the packet",
8000 .prog_type
= BPF_PROG_TYPE_XDP
,
8001 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8004 "XDP pkt read, pkt_end >= pkt_data', good access",
8006 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8007 offsetof(struct xdp_md
, data
)),
8008 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8009 offsetof(struct xdp_md
, data_end
)),
8010 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8011 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8012 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8013 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8014 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8015 BPF_MOV64_IMM(BPF_REG_0
, 0),
8019 .prog_type
= BPF_PROG_TYPE_XDP
,
8022 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
8024 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8025 offsetof(struct xdp_md
, data
)),
8026 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8027 offsetof(struct xdp_md
, data_end
)),
8028 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8029 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8030 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8031 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8032 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8033 BPF_MOV64_IMM(BPF_REG_0
, 0),
8036 .errstr
= "R1 offset is outside of the packet",
8038 .prog_type
= BPF_PROG_TYPE_XDP
,
8039 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8042 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
8044 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8045 offsetof(struct xdp_md
, data
)),
8046 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8047 offsetof(struct xdp_md
, data_end
)),
8048 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8049 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8050 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8051 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8052 BPF_MOV64_IMM(BPF_REG_0
, 0),
8055 .errstr
= "R1 offset is outside of the packet",
8057 .prog_type
= BPF_PROG_TYPE_XDP
,
8060 "XDP pkt read, pkt_data' <= pkt_end, good access",
8062 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8063 offsetof(struct xdp_md
, data
)),
8064 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8065 offsetof(struct xdp_md
, data_end
)),
8066 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8067 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8068 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8069 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8070 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8071 BPF_MOV64_IMM(BPF_REG_0
, 0),
8075 .prog_type
= BPF_PROG_TYPE_XDP
,
8078 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
8080 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8081 offsetof(struct xdp_md
, data
)),
8082 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8083 offsetof(struct xdp_md
, data_end
)),
8084 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8085 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8086 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8087 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8088 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8089 BPF_MOV64_IMM(BPF_REG_0
, 0),
8092 .errstr
= "R1 offset is outside of the packet",
8094 .prog_type
= BPF_PROG_TYPE_XDP
,
8095 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8098 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
8100 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8101 offsetof(struct xdp_md
, data
)),
8102 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8103 offsetof(struct xdp_md
, data_end
)),
8104 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8105 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8106 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8107 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8108 BPF_MOV64_IMM(BPF_REG_0
, 0),
8111 .errstr
= "R1 offset is outside of the packet",
8113 .prog_type
= BPF_PROG_TYPE_XDP
,
8116 "XDP pkt read, pkt_end <= pkt_data', good access",
8118 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8119 offsetof(struct xdp_md
, data
)),
8120 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8121 offsetof(struct xdp_md
, data_end
)),
8122 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8123 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8124 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 1),
8125 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8126 BPF_MOV64_IMM(BPF_REG_0
, 0),
8130 .prog_type
= BPF_PROG_TYPE_XDP
,
8131 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8134 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
8136 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8137 offsetof(struct xdp_md
, data
)),
8138 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8139 offsetof(struct xdp_md
, data_end
)),
8140 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8141 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8142 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 1),
8143 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8144 BPF_MOV64_IMM(BPF_REG_0
, 0),
8147 .errstr
= "R1 offset is outside of the packet",
8149 .prog_type
= BPF_PROG_TYPE_XDP
,
8152 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
8154 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8155 offsetof(struct xdp_md
, data
)),
8156 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8157 offsetof(struct xdp_md
, data_end
)),
8158 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8159 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8160 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 0),
8161 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8162 BPF_MOV64_IMM(BPF_REG_0
, 0),
8165 .errstr
= "R1 offset is outside of the packet",
8167 .prog_type
= BPF_PROG_TYPE_XDP
,
8168 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8171 "XDP pkt read, pkt_meta' > pkt_data, good access",
8173 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8174 offsetof(struct xdp_md
, data_meta
)),
8175 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8176 offsetof(struct xdp_md
, data
)),
8177 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8178 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8179 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
8180 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8181 BPF_MOV64_IMM(BPF_REG_0
, 0),
8185 .prog_type
= BPF_PROG_TYPE_XDP
,
8188 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
8190 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8191 offsetof(struct xdp_md
, data_meta
)),
8192 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8193 offsetof(struct xdp_md
, data
)),
8194 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8195 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8196 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
8197 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8198 BPF_MOV64_IMM(BPF_REG_0
, 0),
8201 .errstr
= "R1 offset is outside of the packet",
8203 .prog_type
= BPF_PROG_TYPE_XDP
,
8204 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8207 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
8209 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8210 offsetof(struct xdp_md
, data_meta
)),
8211 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8212 offsetof(struct xdp_md
, data
)),
8213 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8214 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8215 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 0),
8216 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8217 BPF_MOV64_IMM(BPF_REG_0
, 0),
8220 .errstr
= "R1 offset is outside of the packet",
8222 .prog_type
= BPF_PROG_TYPE_XDP
,
8225 "XDP pkt read, pkt_data > pkt_meta', good access",
8227 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8228 offsetof(struct xdp_md
, data_meta
)),
8229 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8230 offsetof(struct xdp_md
, data
)),
8231 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8232 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8233 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
8234 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8235 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8236 BPF_MOV64_IMM(BPF_REG_0
, 0),
8240 .prog_type
= BPF_PROG_TYPE_XDP
,
8241 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8244 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
8246 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8247 offsetof(struct xdp_md
, data_meta
)),
8248 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8249 offsetof(struct xdp_md
, data
)),
8250 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8251 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8252 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
8253 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8254 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8255 BPF_MOV64_IMM(BPF_REG_0
, 0),
8258 .errstr
= "R1 offset is outside of the packet",
8260 .prog_type
= BPF_PROG_TYPE_XDP
,
8263 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
8265 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8266 offsetof(struct xdp_md
, data_meta
)),
8267 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8268 offsetof(struct xdp_md
, data
)),
8269 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8270 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8271 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_1
, 1),
8272 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8273 BPF_MOV64_IMM(BPF_REG_0
, 0),
8276 .errstr
= "R1 offset is outside of the packet",
8278 .prog_type
= BPF_PROG_TYPE_XDP
,
8281 "XDP pkt read, pkt_meta' < pkt_data, good access",
8283 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8284 offsetof(struct xdp_md
, data_meta
)),
8285 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8286 offsetof(struct xdp_md
, data
)),
8287 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8288 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8289 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
8290 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8291 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8292 BPF_MOV64_IMM(BPF_REG_0
, 0),
8296 .prog_type
= BPF_PROG_TYPE_XDP
,
8297 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8300 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
8302 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8303 offsetof(struct xdp_md
, data_meta
)),
8304 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8305 offsetof(struct xdp_md
, data
)),
8306 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8307 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8308 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
8309 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8310 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8311 BPF_MOV64_IMM(BPF_REG_0
, 0),
8314 .errstr
= "R1 offset is outside of the packet",
8316 .prog_type
= BPF_PROG_TYPE_XDP
,
8319 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
8321 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8322 offsetof(struct xdp_md
, data_meta
)),
8323 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8324 offsetof(struct xdp_md
, data
)),
8325 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8326 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8327 BPF_JMP_REG(BPF_JLT
, BPF_REG_1
, BPF_REG_3
, 1),
8328 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8329 BPF_MOV64_IMM(BPF_REG_0
, 0),
8332 .errstr
= "R1 offset is outside of the packet",
8334 .prog_type
= BPF_PROG_TYPE_XDP
,
8337 "XDP pkt read, pkt_data < pkt_meta', good access",
8339 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8340 offsetof(struct xdp_md
, data_meta
)),
8341 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8342 offsetof(struct xdp_md
, data
)),
8343 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8344 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8345 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 1),
8346 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8347 BPF_MOV64_IMM(BPF_REG_0
, 0),
8351 .prog_type
= BPF_PROG_TYPE_XDP
,
8354 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
8356 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8357 offsetof(struct xdp_md
, data_meta
)),
8358 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8359 offsetof(struct xdp_md
, data
)),
8360 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8361 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8362 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 1),
8363 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8364 BPF_MOV64_IMM(BPF_REG_0
, 0),
8367 .errstr
= "R1 offset is outside of the packet",
8369 .prog_type
= BPF_PROG_TYPE_XDP
,
8370 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8373 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
8375 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8376 offsetof(struct xdp_md
, data_meta
)),
8377 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8378 offsetof(struct xdp_md
, data
)),
8379 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8380 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8381 BPF_JMP_REG(BPF_JLT
, BPF_REG_3
, BPF_REG_1
, 0),
8382 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8383 BPF_MOV64_IMM(BPF_REG_0
, 0),
8386 .errstr
= "R1 offset is outside of the packet",
8388 .prog_type
= BPF_PROG_TYPE_XDP
,
8391 "XDP pkt read, pkt_meta' >= pkt_data, good access",
8393 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8394 offsetof(struct xdp_md
, data_meta
)),
8395 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8396 offsetof(struct xdp_md
, data
)),
8397 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8398 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8399 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 1),
8400 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8401 BPF_MOV64_IMM(BPF_REG_0
, 0),
8405 .prog_type
= BPF_PROG_TYPE_XDP
,
8406 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8409 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
8411 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8412 offsetof(struct xdp_md
, data_meta
)),
8413 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8414 offsetof(struct xdp_md
, data
)),
8415 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8416 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8417 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 1),
8418 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8419 BPF_MOV64_IMM(BPF_REG_0
, 0),
8422 .errstr
= "R1 offset is outside of the packet",
8424 .prog_type
= BPF_PROG_TYPE_XDP
,
8427 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
8429 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8430 offsetof(struct xdp_md
, data_meta
)),
8431 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8432 offsetof(struct xdp_md
, data
)),
8433 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8434 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8435 BPF_JMP_REG(BPF_JGE
, BPF_REG_1
, BPF_REG_3
, 0),
8436 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8437 BPF_MOV64_IMM(BPF_REG_0
, 0),
8440 .errstr
= "R1 offset is outside of the packet",
8442 .prog_type
= BPF_PROG_TYPE_XDP
,
8443 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8446 "XDP pkt read, pkt_data >= pkt_meta', good access",
8448 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8449 offsetof(struct xdp_md
, data_meta
)),
8450 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8451 offsetof(struct xdp_md
, data
)),
8452 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8453 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8454 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8455 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8456 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8457 BPF_MOV64_IMM(BPF_REG_0
, 0),
8461 .prog_type
= BPF_PROG_TYPE_XDP
,
8464 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
8466 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8467 offsetof(struct xdp_md
, data_meta
)),
8468 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8469 offsetof(struct xdp_md
, data
)),
8470 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8471 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8472 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8473 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8474 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8475 BPF_MOV64_IMM(BPF_REG_0
, 0),
8478 .errstr
= "R1 offset is outside of the packet",
8480 .prog_type
= BPF_PROG_TYPE_XDP
,
8481 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8484 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
8486 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8487 offsetof(struct xdp_md
, data_meta
)),
8488 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8489 offsetof(struct xdp_md
, data
)),
8490 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8491 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8492 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_1
, 1),
8493 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8494 BPF_MOV64_IMM(BPF_REG_0
, 0),
8497 .errstr
= "R1 offset is outside of the packet",
8499 .prog_type
= BPF_PROG_TYPE_XDP
,
8502 "XDP pkt read, pkt_meta' <= pkt_data, good access",
8504 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8505 offsetof(struct xdp_md
, data_meta
)),
8506 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8507 offsetof(struct xdp_md
, data
)),
8508 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8509 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8510 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8511 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8512 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8513 BPF_MOV64_IMM(BPF_REG_0
, 0),
8517 .prog_type
= BPF_PROG_TYPE_XDP
,
8520 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
8522 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8523 offsetof(struct xdp_md
, data_meta
)),
8524 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8525 offsetof(struct xdp_md
, data
)),
8526 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8527 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8528 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8529 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
8530 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -4),
8531 BPF_MOV64_IMM(BPF_REG_0
, 0),
8534 .errstr
= "R1 offset is outside of the packet",
8536 .prog_type
= BPF_PROG_TYPE_XDP
,
8537 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8540 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
8542 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8543 offsetof(struct xdp_md
, data_meta
)),
8544 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8545 offsetof(struct xdp_md
, data
)),
8546 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8547 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8548 BPF_JMP_REG(BPF_JLE
, BPF_REG_1
, BPF_REG_3
, 1),
8549 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8550 BPF_MOV64_IMM(BPF_REG_0
, 0),
8553 .errstr
= "R1 offset is outside of the packet",
8555 .prog_type
= BPF_PROG_TYPE_XDP
,
8558 "XDP pkt read, pkt_data <= pkt_meta', good access",
8560 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8561 offsetof(struct xdp_md
, data_meta
)),
8562 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8563 offsetof(struct xdp_md
, data
)),
8564 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8565 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8566 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 1),
8567 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8568 BPF_MOV64_IMM(BPF_REG_0
, 0),
8572 .prog_type
= BPF_PROG_TYPE_XDP
,
8573 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8576 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
8578 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8579 offsetof(struct xdp_md
, data_meta
)),
8580 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8581 offsetof(struct xdp_md
, data
)),
8582 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8583 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8584 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 1),
8585 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, -8),
8586 BPF_MOV64_IMM(BPF_REG_0
, 0),
8589 .errstr
= "R1 offset is outside of the packet",
8591 .prog_type
= BPF_PROG_TYPE_XDP
,
8594 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
8596 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
8597 offsetof(struct xdp_md
, data_meta
)),
8598 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
8599 offsetof(struct xdp_md
, data
)),
8600 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
8601 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
8602 BPF_JMP_REG(BPF_JLE
, BPF_REG_3
, BPF_REG_1
, 0),
8603 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -5),
8604 BPF_MOV64_IMM(BPF_REG_0
, 0),
8607 .errstr
= "R1 offset is outside of the packet",
8609 .prog_type
= BPF_PROG_TYPE_XDP
,
8610 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
8613 "bpf_exit with invalid return code. test1",
8615 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
8618 .errstr
= "R0 has value (0x0; 0xffffffff)",
8620 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8623 "bpf_exit with invalid return code. test2",
8625 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
8626 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 1),
8630 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8633 "bpf_exit with invalid return code. test3",
8635 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
8636 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 3),
8639 .errstr
= "R0 has value (0x0; 0x3)",
8641 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8644 "bpf_exit with invalid return code. test4",
8646 BPF_MOV64_IMM(BPF_REG_0
, 1),
8650 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8653 "bpf_exit with invalid return code. test5",
8655 BPF_MOV64_IMM(BPF_REG_0
, 2),
8658 .errstr
= "R0 has value (0x2; 0x0)",
8660 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8663 "bpf_exit with invalid return code. test6",
8665 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
8668 .errstr
= "R0 is not a known value (ctx)",
8670 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8673 "bpf_exit with invalid return code. test7",
8675 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
8676 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
, 4),
8677 BPF_ALU64_REG(BPF_MUL
, BPF_REG_0
, BPF_REG_2
),
8680 .errstr
= "R0 has unknown scalar value",
8682 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
8685 "calls: basic sanity",
8687 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
8688 BPF_MOV64_IMM(BPF_REG_0
, 1),
8690 BPF_MOV64_IMM(BPF_REG_0
, 2),
8693 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8697 "calls: not on unpriviledged",
8699 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
8700 BPF_MOV64_IMM(BPF_REG_0
, 1),
8702 BPF_MOV64_IMM(BPF_REG_0
, 2),
8705 .errstr_unpriv
= "function calls to other bpf functions are allowed for root only",
8706 .result_unpriv
= REJECT
,
8710 "calls: overlapping caller/callee",
8712 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 0),
8713 BPF_MOV64_IMM(BPF_REG_0
, 1),
8716 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8717 .errstr
= "last insn is not an exit or jmp",
8721 "calls: wrong recursive calls",
8723 BPF_JMP_IMM(BPF_JA
, 0, 0, 4),
8724 BPF_JMP_IMM(BPF_JA
, 0, 0, 4),
8725 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -2),
8726 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -2),
8727 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -2),
8728 BPF_MOV64_IMM(BPF_REG_0
, 1),
8731 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8732 .errstr
= "jump out of range",
8736 "calls: wrong src reg",
8738 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 2, 0, 0),
8739 BPF_MOV64_IMM(BPF_REG_0
, 1),
8742 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8743 .errstr
= "BPF_CALL uses reserved fields",
8747 "calls: wrong off value",
8749 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, -1, 2),
8750 BPF_MOV64_IMM(BPF_REG_0
, 1),
8752 BPF_MOV64_IMM(BPF_REG_0
, 2),
8755 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8756 .errstr
= "BPF_CALL uses reserved fields",
8760 "calls: jump back loop",
8762 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -1),
8763 BPF_MOV64_IMM(BPF_REG_0
, 1),
8766 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8767 .errstr
= "back-edge from insn 0 to 0",
8771 "calls: conditional call",
8773 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8774 offsetof(struct __sk_buff
, mark
)),
8775 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
8776 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
8777 BPF_MOV64_IMM(BPF_REG_0
, 1),
8779 BPF_MOV64_IMM(BPF_REG_0
, 2),
8782 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8783 .errstr
= "jump out of range",
8787 "calls: conditional call 2",
8789 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8790 offsetof(struct __sk_buff
, mark
)),
8791 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
8792 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
8793 BPF_MOV64_IMM(BPF_REG_0
, 1),
8795 BPF_MOV64_IMM(BPF_REG_0
, 2),
8797 BPF_MOV64_IMM(BPF_REG_0
, 3),
8800 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8804 "calls: conditional call 3",
8806 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8807 offsetof(struct __sk_buff
, mark
)),
8808 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
8809 BPF_JMP_IMM(BPF_JA
, 0, 0, 4),
8810 BPF_MOV64_IMM(BPF_REG_0
, 1),
8812 BPF_MOV64_IMM(BPF_REG_0
, 1),
8813 BPF_JMP_IMM(BPF_JA
, 0, 0, -6),
8814 BPF_MOV64_IMM(BPF_REG_0
, 3),
8815 BPF_JMP_IMM(BPF_JA
, 0, 0, -6),
8817 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8818 .errstr
= "back-edge from insn",
8822 "calls: conditional call 4",
8824 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8825 offsetof(struct __sk_buff
, mark
)),
8826 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
8827 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
8828 BPF_MOV64_IMM(BPF_REG_0
, 1),
8830 BPF_MOV64_IMM(BPF_REG_0
, 1),
8831 BPF_JMP_IMM(BPF_JA
, 0, 0, -5),
8832 BPF_MOV64_IMM(BPF_REG_0
, 3),
8835 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8839 "calls: conditional call 5",
8841 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8842 offsetof(struct __sk_buff
, mark
)),
8843 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 3),
8844 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
8845 BPF_MOV64_IMM(BPF_REG_0
, 1),
8847 BPF_MOV64_IMM(BPF_REG_0
, 1),
8848 BPF_JMP_IMM(BPF_JA
, 0, 0, -6),
8849 BPF_MOV64_IMM(BPF_REG_0
, 3),
8852 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8853 .errstr
= "back-edge from insn",
8857 "calls: conditional call 6",
8859 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
8860 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, -2),
8862 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8863 offsetof(struct __sk_buff
, mark
)),
8866 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8867 .errstr
= "back-edge from insn",
8871 "calls: using r0 returned by callee",
8873 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8875 BPF_MOV64_IMM(BPF_REG_0
, 2),
8878 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8882 "calls: using uninit r0 from callee",
8884 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8888 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8889 .errstr
= "!read_ok",
8893 "calls: callee is using r1",
8895 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8897 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8898 offsetof(struct __sk_buff
, len
)),
8901 .prog_type
= BPF_PROG_TYPE_SCHED_ACT
,
8905 "calls: callee using args1",
8907 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8909 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
8912 .errstr_unpriv
= "allowed for root only",
8913 .result_unpriv
= REJECT
,
8917 "calls: callee using wrong args2",
8919 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8921 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
8924 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
8925 .errstr
= "R2 !read_ok",
8929 "calls: callee using two args",
8931 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
8932 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_6
,
8933 offsetof(struct __sk_buff
, len
)),
8934 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_6
,
8935 offsetof(struct __sk_buff
, len
)),
8936 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8938 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
8939 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
8942 .errstr_unpriv
= "allowed for root only",
8943 .result_unpriv
= REJECT
,
8947 "calls: callee changing pkt pointers",
8949 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
8950 offsetof(struct xdp_md
, data
)),
8951 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
8952 offsetof(struct xdp_md
, data_end
)),
8953 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_6
),
8954 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_8
, 8),
8955 BPF_JMP_REG(BPF_JGT
, BPF_REG_8
, BPF_REG_7
, 2),
8956 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
8957 /* clear_all_pkt_pointers() has to walk all frames
8958 * to make sure that pkt pointers in the caller
8959 * are cleared when callee is calling a helper that
8960 * adjusts packet size
8962 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
8963 BPF_MOV32_IMM(BPF_REG_0
, 0),
8965 BPF_MOV64_IMM(BPF_REG_2
, 0),
8966 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
8967 BPF_FUNC_xdp_adjust_head
),
8971 .errstr
= "R6 invalid mem access 'inv'",
8972 .prog_type
= BPF_PROG_TYPE_XDP
,
8975 "calls: two calls with args",
8977 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
8979 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
8980 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 6),
8981 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_0
),
8982 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
8983 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
8984 BPF_ALU64_REG(BPF_ADD
, BPF_REG_7
, BPF_REG_0
),
8985 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
8987 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
8988 offsetof(struct __sk_buff
, len
)),
8991 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
8995 "calls: calls with stack arith",
8997 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
8998 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -64),
8999 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9001 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -64),
9002 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9004 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -64),
9005 BPF_MOV64_IMM(BPF_REG_0
, 42),
9006 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
9009 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9013 "calls: calls with misaligned stack access",
9015 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9016 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -63),
9017 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9019 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -61),
9020 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9022 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -63),
9023 BPF_MOV64_IMM(BPF_REG_0
, 42),
9024 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
9027 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9028 .flags
= F_LOAD_WITH_STRICT_ALIGNMENT
,
9029 .errstr
= "misaligned stack access",
9033 "calls: calls control flow, jump test",
9035 BPF_MOV64_IMM(BPF_REG_0
, 42),
9036 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9037 BPF_MOV64_IMM(BPF_REG_0
, 43),
9038 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
9039 BPF_JMP_IMM(BPF_JA
, 0, 0, -3),
9042 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9046 "calls: calls control flow, jump test 2",
9048 BPF_MOV64_IMM(BPF_REG_0
, 42),
9049 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9050 BPF_MOV64_IMM(BPF_REG_0
, 43),
9051 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
9052 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -3),
9055 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9056 .errstr
= "jump out of range from insn 1 to 4",
9060 "calls: two calls with bad jump",
9062 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9064 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9065 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 6),
9066 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_0
),
9067 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9068 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9069 BPF_ALU64_REG(BPF_ADD
, BPF_REG_7
, BPF_REG_0
),
9070 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
9072 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
9073 offsetof(struct __sk_buff
, len
)),
9074 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, -3),
9077 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9078 .errstr
= "jump out of range from insn 11 to 9",
9082 "calls: recursive call. test1",
9084 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9086 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -1),
9089 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9090 .errstr
= "back-edge",
9094 "calls: recursive call. test2",
9096 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9098 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -3),
9101 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9102 .errstr
= "back-edge",
9106 "calls: unreachable code",
9108 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9110 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9112 BPF_MOV64_IMM(BPF_REG_0
, 0),
9114 BPF_MOV64_IMM(BPF_REG_0
, 0),
9117 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9118 .errstr
= "unreachable insn 6",
9122 "calls: invalid call",
9124 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9126 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, -4),
9129 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9130 .errstr
= "invalid destination",
9134 "calls: invalid call 2",
9136 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9138 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 0x7fffffff),
9141 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9142 .errstr
= "invalid destination",
9146 "calls: jumping across function bodies. test1",
9148 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9149 BPF_MOV64_IMM(BPF_REG_0
, 0),
9151 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, -3),
9154 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9155 .errstr
= "jump out of range",
9159 "calls: jumping across function bodies. test2",
9161 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
9162 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9163 BPF_MOV64_IMM(BPF_REG_0
, 0),
9167 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9168 .errstr
= "jump out of range",
9172 "calls: call without exit",
9174 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9176 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9178 BPF_MOV64_IMM(BPF_REG_0
, 0),
9179 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, -2),
9181 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9182 .errstr
= "not an exit",
9186 "calls: call into middle of ld_imm64",
9188 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9189 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9190 BPF_MOV64_IMM(BPF_REG_0
, 0),
9192 BPF_LD_IMM64(BPF_REG_0
, 0),
9195 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9196 .errstr
= "last insn",
9200 "calls: call into middle of other call",
9202 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9203 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9204 BPF_MOV64_IMM(BPF_REG_0
, 0),
9206 BPF_MOV64_IMM(BPF_REG_0
, 0),
9207 BPF_MOV64_IMM(BPF_REG_0
, 0),
9210 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9211 .errstr
= "last insn",
9215 "calls: ld_abs with changing ctx data in callee",
9217 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9218 BPF_LD_ABS(BPF_B
, 0),
9219 BPF_LD_ABS(BPF_H
, 0),
9220 BPF_LD_ABS(BPF_W
, 0),
9221 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_6
),
9222 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 5),
9223 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_7
),
9224 BPF_LD_ABS(BPF_B
, 0),
9225 BPF_LD_ABS(BPF_H
, 0),
9226 BPF_LD_ABS(BPF_W
, 0),
9228 BPF_MOV64_IMM(BPF_REG_2
, 1),
9229 BPF_MOV64_IMM(BPF_REG_3
, 2),
9230 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9231 BPF_FUNC_skb_vlan_push
),
9234 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9235 .errstr
= "BPF_LD_[ABS|IND] instructions cannot be mixed",
9239 "calls: two calls with bad fallthrough",
9241 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9243 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9244 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 6),
9245 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_0
),
9246 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9247 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9248 BPF_ALU64_REG(BPF_ADD
, BPF_REG_7
, BPF_REG_0
),
9249 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
9250 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_0
),
9251 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
9252 offsetof(struct __sk_buff
, len
)),
9255 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
9256 .errstr
= "not an exit",
9260 "calls: two calls with stack read",
9262 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9263 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9264 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9265 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9267 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9268 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 6),
9269 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_0
),
9270 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9271 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9272 BPF_ALU64_REG(BPF_ADD
, BPF_REG_7
, BPF_REG_0
),
9273 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_7
),
9275 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
9278 .prog_type
= BPF_PROG_TYPE_XDP
,
9282 "calls: two calls with stack write",
9285 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9286 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9287 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9288 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9289 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9290 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9291 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -16),
9295 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9296 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9297 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 7),
9298 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
9299 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9300 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
9301 BPF_ALU64_REG(BPF_ADD
, BPF_REG_8
, BPF_REG_0
),
9302 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_8
),
9303 /* write into stack frame of main prog */
9304 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
9308 /* read from stack frame of main prog */
9309 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, 0),
9312 .prog_type
= BPF_PROG_TYPE_XDP
,
9316 "calls: stack overflow using two frames (pre-call access)",
9319 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9320 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1),
9324 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9325 BPF_MOV64_IMM(BPF_REG_0
, 0),
9328 .prog_type
= BPF_PROG_TYPE_XDP
,
9329 .errstr
= "combined stack size",
9333 "calls: stack overflow using two frames (post-call access)",
9336 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 2),
9337 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9341 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9342 BPF_MOV64_IMM(BPF_REG_0
, 0),
9345 .prog_type
= BPF_PROG_TYPE_XDP
,
9346 .errstr
= "combined stack size",
9350 "calls: stack depth check using three frames. test1",
9353 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 4), /* call A */
9354 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 5), /* call B */
9355 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -32, 0),
9356 BPF_MOV64_IMM(BPF_REG_0
, 0),
9359 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -256, 0),
9362 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, -3), /* call A */
9363 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -64, 0),
9366 .prog_type
= BPF_PROG_TYPE_XDP
,
9367 /* stack_main=32, stack_A=256, stack_B=64
9368 * and max(main+A, main+A+B) < 512
9373 "calls: stack depth check using three frames. test2",
9376 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 4), /* call A */
9377 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 5), /* call B */
9378 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -32, 0),
9379 BPF_MOV64_IMM(BPF_REG_0
, 0),
9382 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -64, 0),
9385 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, -3), /* call A */
9386 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -256, 0),
9389 .prog_type
= BPF_PROG_TYPE_XDP
,
9390 /* stack_main=32, stack_A=64, stack_B=256
9391 * and max(main+A, main+A+B) < 512
9396 "calls: stack depth check using three frames. test3",
9399 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9400 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 6), /* call A */
9401 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9402 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 8), /* call B */
9403 BPF_JMP_IMM(BPF_JGE
, BPF_REG_6
, 0, 1),
9404 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -64, 0),
9405 BPF_MOV64_IMM(BPF_REG_0
, 0),
9408 BPF_JMP_IMM(BPF_JLT
, BPF_REG_1
, 10, 1),
9410 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -224, 0),
9411 BPF_JMP_IMM(BPF_JA
, 0, 0, -3),
9413 BPF_JMP_IMM(BPF_JGT
, BPF_REG_1
, 2, 1),
9414 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, -6), /* call A */
9415 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -256, 0),
9418 .prog_type
= BPF_PROG_TYPE_XDP
,
9419 /* stack_main=64, stack_A=224, stack_B=256
9420 * and max(main+A, main+A+B) > 512
9422 .errstr
= "combined stack",
9426 "calls: stack depth check using three frames. test4",
9427 /* void main(void) {
9432 * void func1(int alloc_or_recurse) {
9433 * if (alloc_or_recurse) {
9434 * frame_pointer[-300] = 1;
9436 * func2(alloc_or_recurse);
9439 * void func2(int alloc_or_recurse) {
9440 * if (alloc_or_recurse) {
9441 * frame_pointer[-300] = 1;
9447 BPF_MOV64_IMM(BPF_REG_1
, 0),
9448 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 6), /* call A */
9449 BPF_MOV64_IMM(BPF_REG_1
, 1),
9450 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 4), /* call A */
9451 BPF_MOV64_IMM(BPF_REG_1
, 1),
9452 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 7), /* call B */
9453 BPF_MOV64_IMM(BPF_REG_0
, 0),
9456 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 2),
9457 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9459 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call B */
9462 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
9463 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -300, 0),
9466 .prog_type
= BPF_PROG_TYPE_XDP
,
9468 .errstr
= "combined stack",
9471 "calls: stack depth check using three frames. test5",
9474 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call A */
9477 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call B */
9480 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call C */
9483 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call D */
9486 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call E */
9489 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call F */
9492 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call G */
9495 BPF_RAW_INSN(BPF_JMP
|BPF_CALL
, 0, 1, 0, 1), /* call H */
9498 BPF_MOV64_IMM(BPF_REG_0
, 0),
9501 .prog_type
= BPF_PROG_TYPE_XDP
,
9502 .errstr
= "call stack",
9506 "calls: spill into caller stack frame",
9508 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9509 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9510 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9511 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9513 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_1
, 0),
9514 BPF_MOV64_IMM(BPF_REG_0
, 0),
9517 .prog_type
= BPF_PROG_TYPE_XDP
,
9518 .errstr
= "cannot spill",
9522 "calls: write into caller stack frame",
9524 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9525 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9526 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9527 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9528 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
9530 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 0, 42),
9531 BPF_MOV64_IMM(BPF_REG_0
, 0),
9534 .prog_type
= BPF_PROG_TYPE_XDP
,
9538 "calls: write into callee stack frame",
9540 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9541 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
9543 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_10
),
9544 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, -8),
9547 .prog_type
= BPF_PROG_TYPE_XDP
,
9548 .errstr
= "cannot return stack pointer",
9552 "calls: two calls with stack write and void return",
9555 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9556 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9557 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9558 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9559 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9560 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9561 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -16),
9565 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9566 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9567 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9568 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
9569 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9573 /* write into stack frame of main prog */
9574 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 0, 0),
9575 BPF_EXIT_INSN(), /* void return */
9577 .prog_type
= BPF_PROG_TYPE_XDP
,
9581 "calls: ambiguous return value",
9583 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9584 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 5),
9585 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
9586 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
9587 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9588 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
9590 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
9591 BPF_MOV64_IMM(BPF_REG_0
, 0),
9594 .errstr_unpriv
= "allowed for root only",
9595 .result_unpriv
= REJECT
,
9596 .errstr
= "R0 !read_ok",
9600 "calls: two calls that return map_value",
9603 /* pass fp-16, fp-8 into a function */
9604 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9605 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9606 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9607 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9608 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 8),
9610 /* fetch map_value_ptr from the stack of this function */
9611 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
9612 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
9613 /* write into map value */
9614 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9615 /* fetch secound map_value_ptr from the stack */
9616 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -16),
9617 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
9618 /* write into map value */
9619 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9620 BPF_MOV64_IMM(BPF_REG_0
, 0),
9624 /* call 3rd function twice */
9625 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9626 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9627 /* first time with fp-8 */
9628 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
9629 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
9630 /* second time with fp-16 */
9631 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
9635 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9636 /* lookup from map */
9637 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9638 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9639 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9640 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9641 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9642 BPF_FUNC_map_lookup_elem
),
9643 /* write map_value_ptr into stack frame of main prog */
9644 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9645 BPF_MOV64_IMM(BPF_REG_0
, 0),
9646 BPF_EXIT_INSN(), /* return 0 */
9648 .prog_type
= BPF_PROG_TYPE_XDP
,
9649 .fixup_map1
= { 23 },
9653 "calls: two calls that return map_value with bool condition",
9656 /* pass fp-16, fp-8 into a function */
9657 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9658 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9659 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9660 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9661 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9662 BPF_MOV64_IMM(BPF_REG_0
, 0),
9666 /* call 3rd function twice */
9667 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9668 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9669 /* first time with fp-8 */
9670 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 9),
9671 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 1, 2),
9672 /* fetch map_value_ptr from the stack of this function */
9673 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
9674 /* write into map value */
9675 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9676 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
9677 /* second time with fp-16 */
9678 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
9679 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 1, 2),
9680 /* fetch secound map_value_ptr from the stack */
9681 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_7
, 0),
9682 /* write into map value */
9683 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9687 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9688 /* lookup from map */
9689 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9690 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9691 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9692 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9693 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9694 BPF_FUNC_map_lookup_elem
),
9695 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9696 BPF_MOV64_IMM(BPF_REG_0
, 0),
9697 BPF_EXIT_INSN(), /* return 0 */
9698 /* write map_value_ptr into stack frame of main prog */
9699 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9700 BPF_MOV64_IMM(BPF_REG_0
, 1),
9701 BPF_EXIT_INSN(), /* return 1 */
9703 .prog_type
= BPF_PROG_TYPE_XDP
,
9704 .fixup_map1
= { 23 },
9708 "calls: two calls that return map_value with incorrect bool check",
9711 /* pass fp-16, fp-8 into a function */
9712 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9713 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9714 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9715 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9716 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9717 BPF_MOV64_IMM(BPF_REG_0
, 0),
9721 /* call 3rd function twice */
9722 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9723 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9724 /* first time with fp-8 */
9725 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 9),
9726 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 1, 2),
9727 /* fetch map_value_ptr from the stack of this function */
9728 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
9729 /* write into map value */
9730 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9731 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
9732 /* second time with fp-16 */
9733 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
9734 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9735 /* fetch secound map_value_ptr from the stack */
9736 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_7
, 0),
9737 /* write into map value */
9738 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9742 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9743 /* lookup from map */
9744 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9745 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9746 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9747 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9748 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9749 BPF_FUNC_map_lookup_elem
),
9750 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9751 BPF_MOV64_IMM(BPF_REG_0
, 0),
9752 BPF_EXIT_INSN(), /* return 0 */
9753 /* write map_value_ptr into stack frame of main prog */
9754 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9755 BPF_MOV64_IMM(BPF_REG_0
, 1),
9756 BPF_EXIT_INSN(), /* return 1 */
9758 .prog_type
= BPF_PROG_TYPE_XDP
,
9759 .fixup_map1
= { 23 },
9761 .errstr
= "invalid read from stack off -16+0 size 8",
9764 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
9767 /* pass fp-16, fp-8 into a function */
9768 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9769 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9770 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9771 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9772 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9773 BPF_MOV64_IMM(BPF_REG_0
, 0),
9777 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9778 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9779 /* 1st lookup from map */
9780 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9781 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9782 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9783 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9784 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9785 BPF_FUNC_map_lookup_elem
),
9786 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9787 BPF_MOV64_IMM(BPF_REG_8
, 0),
9788 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9789 /* write map_value_ptr into stack frame of main prog at fp-8 */
9790 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9791 BPF_MOV64_IMM(BPF_REG_8
, 1),
9793 /* 2nd lookup from map */
9794 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
), /* 20 */
9795 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9796 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9797 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, /* 24 */
9798 BPF_FUNC_map_lookup_elem
),
9799 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9800 BPF_MOV64_IMM(BPF_REG_9
, 0),
9801 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9802 /* write map_value_ptr into stack frame of main prog at fp-16 */
9803 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
9804 BPF_MOV64_IMM(BPF_REG_9
, 1),
9806 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
9807 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
), /* 30 */
9808 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_8
),
9809 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_7
),
9810 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_9
),
9811 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1), /* 34 */
9815 /* if arg2 == 1 do *arg1 = 0 */
9816 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 1, 2),
9817 /* fetch map_value_ptr from the stack of this function */
9818 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
9819 /* write into map value */
9820 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9822 /* if arg4 == 1 do *arg3 = 0 */
9823 BPF_JMP_IMM(BPF_JNE
, BPF_REG_4
, 1, 2),
9824 /* fetch map_value_ptr from the stack of this function */
9825 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
9826 /* write into map value */
9827 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 2, 0),
9830 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9831 .fixup_map1
= { 12, 22 },
9833 .errstr
= "invalid access to map value, value_size=8 off=2 size=8",
9836 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
9839 /* pass fp-16, fp-8 into a function */
9840 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9841 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9842 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9843 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9844 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9845 BPF_MOV64_IMM(BPF_REG_0
, 0),
9849 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9850 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9851 /* 1st lookup from map */
9852 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9853 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9854 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9855 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9856 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9857 BPF_FUNC_map_lookup_elem
),
9858 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9859 BPF_MOV64_IMM(BPF_REG_8
, 0),
9860 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9861 /* write map_value_ptr into stack frame of main prog at fp-8 */
9862 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9863 BPF_MOV64_IMM(BPF_REG_8
, 1),
9865 /* 2nd lookup from map */
9866 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
), /* 20 */
9867 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9868 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9869 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, /* 24 */
9870 BPF_FUNC_map_lookup_elem
),
9871 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9872 BPF_MOV64_IMM(BPF_REG_9
, 0),
9873 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9874 /* write map_value_ptr into stack frame of main prog at fp-16 */
9875 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
9876 BPF_MOV64_IMM(BPF_REG_9
, 1),
9878 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
9879 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
), /* 30 */
9880 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_8
),
9881 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_7
),
9882 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_9
),
9883 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1), /* 34 */
9887 /* if arg2 == 1 do *arg1 = 0 */
9888 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 1, 2),
9889 /* fetch map_value_ptr from the stack of this function */
9890 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
9891 /* write into map value */
9892 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9894 /* if arg4 == 1 do *arg3 = 0 */
9895 BPF_JMP_IMM(BPF_JNE
, BPF_REG_4
, 1, 2),
9896 /* fetch map_value_ptr from the stack of this function */
9897 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
9898 /* write into map value */
9899 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9902 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9903 .fixup_map1
= { 12, 22 },
9907 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
9910 /* pass fp-16, fp-8 into a function */
9911 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9912 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9913 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9914 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9915 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 2),
9916 BPF_MOV64_IMM(BPF_REG_0
, 0),
9920 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9921 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9922 /* 1st lookup from map */
9923 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -24, 0),
9924 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9925 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -24),
9926 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9927 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9928 BPF_FUNC_map_lookup_elem
),
9929 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9930 BPF_MOV64_IMM(BPF_REG_8
, 0),
9931 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9932 /* write map_value_ptr into stack frame of main prog at fp-8 */
9933 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
9934 BPF_MOV64_IMM(BPF_REG_8
, 1),
9936 /* 2nd lookup from map */
9937 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9938 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -24),
9939 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9940 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
9941 BPF_FUNC_map_lookup_elem
),
9942 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
9943 BPF_MOV64_IMM(BPF_REG_9
, 0), // 26
9944 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
9945 /* write map_value_ptr into stack frame of main prog at fp-16 */
9946 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
9947 BPF_MOV64_IMM(BPF_REG_9
, 1),
9949 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
9950 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
), // 30
9951 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_8
),
9952 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_7
),
9953 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_9
),
9954 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 1), // 34
9955 BPF_JMP_IMM(BPF_JA
, 0, 0, -30),
9958 /* if arg2 == 1 do *arg1 = 0 */
9959 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 1, 2),
9960 /* fetch map_value_ptr from the stack of this function */
9961 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
9962 /* write into map value */
9963 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
9965 /* if arg4 == 1 do *arg3 = 0 */
9966 BPF_JMP_IMM(BPF_JNE
, BPF_REG_4
, 1, 2),
9967 /* fetch map_value_ptr from the stack of this function */
9968 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
9969 /* write into map value */
9970 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 2, 0),
9971 BPF_JMP_IMM(BPF_JA
, 0, 0, -8),
9973 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
9974 .fixup_map1
= { 12, 22 },
9976 .errstr
= "invalid access to map value, value_size=8 off=2 size=8",
9979 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
9982 /* pass fp-16, fp-8 into a function */
9983 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
9984 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
9985 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9986 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
9987 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
9988 BPF_MOV64_IMM(BPF_REG_0
, 0),
9992 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
9993 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
9994 /* 1st lookup from map */
9995 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
9996 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
9997 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
9998 BPF_LD_MAP_FD(BPF_REG_1
, 0),
9999 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10000 BPF_FUNC_map_lookup_elem
),
10001 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10002 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
10003 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
10004 BPF_MOV64_IMM(BPF_REG_8
, 0),
10005 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
10006 BPF_MOV64_IMM(BPF_REG_8
, 1),
10008 /* 2nd lookup from map */
10009 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10010 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10011 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10012 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10013 BPF_FUNC_map_lookup_elem
),
10014 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10015 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
10016 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
10017 BPF_MOV64_IMM(BPF_REG_9
, 0),
10018 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
10019 BPF_MOV64_IMM(BPF_REG_9
, 1),
10021 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10022 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
10023 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_8
),
10024 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_7
),
10025 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_9
),
10026 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
10030 /* if arg2 == 1 do *arg1 = 0 */
10031 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 1, 2),
10032 /* fetch map_value_ptr from the stack of this function */
10033 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
10034 /* write into map value */
10035 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
10037 /* if arg4 == 1 do *arg3 = 0 */
10038 BPF_JMP_IMM(BPF_JNE
, BPF_REG_4
, 1, 2),
10039 /* fetch map_value_ptr from the stack of this function */
10040 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
10041 /* write into map value */
10042 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
10045 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10046 .fixup_map1
= { 12, 22 },
10050 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
10053 /* pass fp-16, fp-8 into a function */
10054 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
10055 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
10056 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10057 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
10058 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 2),
10059 BPF_MOV64_IMM(BPF_REG_0
, 0),
10063 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
10064 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
10065 /* 1st lookup from map */
10066 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
10067 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10068 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10069 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10070 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10071 BPF_FUNC_map_lookup_elem
),
10072 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10073 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
10074 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
10075 BPF_MOV64_IMM(BPF_REG_8
, 0),
10076 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
10077 BPF_MOV64_IMM(BPF_REG_8
, 1),
10079 /* 2nd lookup from map */
10080 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10081 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10082 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10083 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10084 BPF_FUNC_map_lookup_elem
),
10085 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10086 BPF_STX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
10087 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 2),
10088 BPF_MOV64_IMM(BPF_REG_9
, 0),
10089 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
10090 BPF_MOV64_IMM(BPF_REG_9
, 1),
10092 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10093 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
10094 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_8
),
10095 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_7
),
10096 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_9
),
10097 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
10101 /* if arg2 == 1 do *arg1 = 0 */
10102 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 1, 2),
10103 /* fetch map_value_ptr from the stack of this function */
10104 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
10105 /* write into map value */
10106 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
10108 /* if arg4 == 0 do *arg3 = 0 */
10109 BPF_JMP_IMM(BPF_JNE
, BPF_REG_4
, 0, 2),
10110 /* fetch map_value_ptr from the stack of this function */
10111 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_3
, 0),
10112 /* write into map value */
10113 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
10116 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10117 .fixup_map1
= { 12, 22 },
10119 .errstr
= "R0 invalid mem access 'inv'",
10122 "calls: pkt_ptr spill into caller stack",
10124 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10125 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10126 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 1),
10130 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10131 offsetof(struct __sk_buff
, data
)),
10132 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10133 offsetof(struct __sk_buff
, data_end
)),
10134 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10135 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10136 /* spill unchecked pkt_ptr into stack of caller */
10137 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10138 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
10139 /* now the pkt range is verified, read pkt_ptr from stack */
10140 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_4
, 0),
10141 /* write 4 bytes into packet */
10142 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10146 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10149 "calls: pkt_ptr spill into caller stack 2",
10151 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10152 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10153 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10154 /* Marking is still kept, but not in all cases safe. */
10155 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10156 BPF_ST_MEM(BPF_W
, BPF_REG_4
, 0, 0),
10160 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10161 offsetof(struct __sk_buff
, data
)),
10162 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10163 offsetof(struct __sk_buff
, data_end
)),
10164 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10165 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10166 /* spill unchecked pkt_ptr into stack of caller */
10167 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10168 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
10169 /* now the pkt range is verified, read pkt_ptr from stack */
10170 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_4
, 0),
10171 /* write 4 bytes into packet */
10172 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10175 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10176 .errstr
= "invalid access to packet",
10180 "calls: pkt_ptr spill into caller stack 3",
10182 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10183 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10184 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
10185 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
10186 /* Marking is still kept and safe here. */
10187 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10188 BPF_ST_MEM(BPF_W
, BPF_REG_4
, 0, 0),
10192 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10193 offsetof(struct __sk_buff
, data
)),
10194 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10195 offsetof(struct __sk_buff
, data_end
)),
10196 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10197 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10198 /* spill unchecked pkt_ptr into stack of caller */
10199 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10200 BPF_MOV64_IMM(BPF_REG_5
, 0),
10201 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
10202 BPF_MOV64_IMM(BPF_REG_5
, 1),
10203 /* now the pkt range is verified, read pkt_ptr from stack */
10204 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_4
, 0),
10205 /* write 4 bytes into packet */
10206 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10207 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10210 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10214 "calls: pkt_ptr spill into caller stack 4",
10216 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10217 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10218 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
10219 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
10220 /* Check marking propagated. */
10221 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10222 BPF_ST_MEM(BPF_W
, BPF_REG_4
, 0, 0),
10226 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10227 offsetof(struct __sk_buff
, data
)),
10228 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10229 offsetof(struct __sk_buff
, data_end
)),
10230 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10231 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10232 /* spill unchecked pkt_ptr into stack of caller */
10233 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10234 BPF_MOV64_IMM(BPF_REG_5
, 0),
10235 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
10236 BPF_MOV64_IMM(BPF_REG_5
, 1),
10237 /* don't read back pkt_ptr from stack here */
10238 /* write 4 bytes into packet */
10239 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10240 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10243 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10247 "calls: pkt_ptr spill into caller stack 5",
10249 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10250 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10251 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_1
, 0),
10252 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10253 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10254 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_4
, 0),
10258 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10259 offsetof(struct __sk_buff
, data
)),
10260 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10261 offsetof(struct __sk_buff
, data_end
)),
10262 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10263 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10264 BPF_MOV64_IMM(BPF_REG_5
, 0),
10265 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
10266 /* spill checked pkt_ptr into stack of caller */
10267 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10268 BPF_MOV64_IMM(BPF_REG_5
, 1),
10269 /* don't read back pkt_ptr from stack here */
10270 /* write 4 bytes into packet */
10271 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10272 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10275 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10276 .errstr
= "same insn cannot be used with different",
10280 "calls: pkt_ptr spill into caller stack 6",
10282 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10283 offsetof(struct __sk_buff
, data_end
)),
10284 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10285 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10286 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10287 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10288 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10289 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_4
, 0),
10293 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10294 offsetof(struct __sk_buff
, data
)),
10295 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10296 offsetof(struct __sk_buff
, data_end
)),
10297 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10298 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10299 BPF_MOV64_IMM(BPF_REG_5
, 0),
10300 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
10301 /* spill checked pkt_ptr into stack of caller */
10302 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10303 BPF_MOV64_IMM(BPF_REG_5
, 1),
10304 /* don't read back pkt_ptr from stack here */
10305 /* write 4 bytes into packet */
10306 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10307 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10310 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10311 .errstr
= "R4 invalid mem access",
10315 "calls: pkt_ptr spill into caller stack 7",
10317 BPF_MOV64_IMM(BPF_REG_2
, 0),
10318 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10319 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10320 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10321 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10322 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10323 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_4
, 0),
10327 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10328 offsetof(struct __sk_buff
, data
)),
10329 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10330 offsetof(struct __sk_buff
, data_end
)),
10331 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10332 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10333 BPF_MOV64_IMM(BPF_REG_5
, 0),
10334 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
10335 /* spill checked pkt_ptr into stack of caller */
10336 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10337 BPF_MOV64_IMM(BPF_REG_5
, 1),
10338 /* don't read back pkt_ptr from stack here */
10339 /* write 4 bytes into packet */
10340 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10341 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10344 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10345 .errstr
= "R4 invalid mem access",
10349 "calls: pkt_ptr spill into caller stack 8",
10351 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10352 offsetof(struct __sk_buff
, data
)),
10353 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10354 offsetof(struct __sk_buff
, data_end
)),
10355 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10356 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10357 BPF_JMP_REG(BPF_JLE
, BPF_REG_0
, BPF_REG_3
, 1),
10359 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10360 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10361 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10362 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10363 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10364 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_4
, 0),
10368 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10369 offsetof(struct __sk_buff
, data
)),
10370 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10371 offsetof(struct __sk_buff
, data_end
)),
10372 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10373 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10374 BPF_MOV64_IMM(BPF_REG_5
, 0),
10375 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 3),
10376 /* spill checked pkt_ptr into stack of caller */
10377 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10378 BPF_MOV64_IMM(BPF_REG_5
, 1),
10379 /* don't read back pkt_ptr from stack here */
10380 /* write 4 bytes into packet */
10381 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10382 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10385 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10389 "calls: pkt_ptr spill into caller stack 9",
10391 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10392 offsetof(struct __sk_buff
, data
)),
10393 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10394 offsetof(struct __sk_buff
, data_end
)),
10395 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10396 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10397 BPF_JMP_REG(BPF_JLE
, BPF_REG_0
, BPF_REG_3
, 1),
10399 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
10400 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
10401 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10402 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 3),
10403 BPF_LDX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_10
, -8),
10404 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_4
, 0),
10408 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
10409 offsetof(struct __sk_buff
, data
)),
10410 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
10411 offsetof(struct __sk_buff
, data_end
)),
10412 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
10413 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
10414 BPF_MOV64_IMM(BPF_REG_5
, 0),
10415 /* spill unchecked pkt_ptr into stack of caller */
10416 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
10417 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
10418 BPF_MOV64_IMM(BPF_REG_5
, 1),
10419 /* don't read back pkt_ptr from stack here */
10420 /* write 4 bytes into packet */
10421 BPF_ST_MEM(BPF_W
, BPF_REG_2
, 0, 0),
10422 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_5
),
10425 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
10426 .errstr
= "invalid access to packet",
10430 "calls: caller stack init to zero or map_value_or_null",
10432 BPF_MOV64_IMM(BPF_REG_0
, 0),
10433 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
10434 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10435 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10436 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 1, 0, 4),
10437 /* fetch map_value_or_null or const_zero from stack */
10438 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
10439 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
10440 /* store into map_value */
10441 BPF_ST_MEM(BPF_W
, BPF_REG_0
, 0, 0),
10445 /* if (ctx == 0) return; */
10446 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 8),
10447 /* else bpf_map_lookup() and *(fp - 8) = r0 */
10448 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
10449 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10450 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10451 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10452 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
10453 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10454 BPF_FUNC_map_lookup_elem
),
10455 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10456 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_0
, 0),
10459 .fixup_map1
= { 13 },
10461 .prog_type
= BPF_PROG_TYPE_XDP
,
10464 "calls: stack init to zero and pruning",
10466 /* first make allocated_stack 16 byte */
10467 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -16, 0),
10468 /* now fork the execution such that the false branch
10469 * of JGT insn will be verified second and it skisp zero
10470 * init of fp-8 stack slot. If stack liveness marking
10471 * is missing live_read marks from call map_lookup
10472 * processing then pruning will incorrectly assume
10473 * that fp-8 stack slot was unused in the fall-through
10474 * branch and will accept the program incorrectly
10476 BPF_JMP_IMM(BPF_JGT
, BPF_REG_1
, 2, 2),
10477 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
10478 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
10479 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10480 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10481 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10482 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
10483 BPF_FUNC_map_lookup_elem
),
10486 .fixup_map2
= { 6 },
10487 .errstr
= "invalid indirect read from stack off -8+0 size 8",
10489 .prog_type
= BPF_PROG_TYPE_XDP
,
10492 "search pruning: all branches should be verified (nop operation)",
10494 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10495 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10496 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
10497 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10498 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
10499 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
10500 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_0
, 0),
10501 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_3
, 0xbeef, 2),
10502 BPF_MOV64_IMM(BPF_REG_4
, 0),
10504 BPF_MOV64_IMM(BPF_REG_4
, 1),
10505 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_4
, -16),
10506 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns
),
10507 BPF_LDX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_10
, -16),
10508 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_5
, 0, 2),
10509 BPF_MOV64_IMM(BPF_REG_6
, 0),
10510 BPF_ST_MEM(BPF_DW
, BPF_REG_6
, 0, 0xdead),
10513 .fixup_map1
= { 3 },
10514 .errstr
= "R6 invalid mem access 'inv'",
10516 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
10519 "search pruning: all branches should be verified (invalid stack access)",
10521 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
10522 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
10523 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
10524 BPF_LD_MAP_FD(BPF_REG_1
, 0),
10525 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
10526 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 8),
10527 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_0
, 0),
10528 BPF_MOV64_IMM(BPF_REG_4
, 0),
10529 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_3
, 0xbeef, 2),
10530 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_4
, -16),
10532 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_4
, -24),
10533 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns
),
10534 BPF_LDX_MEM(BPF_DW
, BPF_REG_5
, BPF_REG_10
, -16),
10537 .fixup_map1
= { 3 },
10538 .errstr
= "invalid read from stack off -16+0 size 8",
10540 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
10544 static int probe_filter_length(const struct bpf_insn
*fp
)
10548 for (len
= MAX_INSNS
- 1; len
> 0; --len
)
10549 if (fp
[len
].code
!= 0 || fp
[len
].imm
!= 0)
10554 static int create_map(uint32_t size_value
, uint32_t max_elem
)
10558 fd
= bpf_create_map(BPF_MAP_TYPE_HASH
, sizeof(long long),
10559 size_value
, max_elem
, BPF_F_NO_PREALLOC
);
10561 printf("Failed to create hash map '%s'!\n", strerror(errno
));
10566 static int create_prog_array(void)
10570 fd
= bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY
, sizeof(int),
10571 sizeof(int), 4, 0);
10573 printf("Failed to create prog array '%s'!\n", strerror(errno
));
10578 static int create_map_in_map(void)
10580 int inner_map_fd
, outer_map_fd
;
10582 inner_map_fd
= bpf_create_map(BPF_MAP_TYPE_ARRAY
, sizeof(int),
10583 sizeof(int), 1, 0);
10584 if (inner_map_fd
< 0) {
10585 printf("Failed to create array '%s'!\n", strerror(errno
));
10586 return inner_map_fd
;
10589 outer_map_fd
= bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS
, NULL
,
10590 sizeof(int), inner_map_fd
, 1, 0);
10591 if (outer_map_fd
< 0)
10592 printf("Failed to create array of maps '%s'!\n",
10595 close(inner_map_fd
);
10597 return outer_map_fd
;
10600 static char bpf_vlog
[32768];
10602 static void do_test_fixup(struct bpf_test
*test
, struct bpf_insn
*prog
,
10605 int *fixup_map1
= test
->fixup_map1
;
10606 int *fixup_map2
= test
->fixup_map2
;
10607 int *fixup_prog
= test
->fixup_prog
;
10608 int *fixup_map_in_map
= test
->fixup_map_in_map
;
10610 /* Allocating HTs with 1 elem is fine here, since we only test
10611 * for verifier and not do a runtime lookup, so the only thing
10612 * that really matters is value size in this case.
10615 map_fds
[0] = create_map(sizeof(long long), 1);
10617 prog
[*fixup_map1
].imm
= map_fds
[0];
10619 } while (*fixup_map1
);
10623 map_fds
[1] = create_map(sizeof(struct test_val
), 1);
10625 prog
[*fixup_map2
].imm
= map_fds
[1];
10627 } while (*fixup_map2
);
10631 map_fds
[2] = create_prog_array();
10633 prog
[*fixup_prog
].imm
= map_fds
[2];
10635 } while (*fixup_prog
);
10638 if (*fixup_map_in_map
) {
10639 map_fds
[3] = create_map_in_map();
10641 prog
[*fixup_map_in_map
].imm
= map_fds
[3];
10642 fixup_map_in_map
++;
10643 } while (*fixup_map_in_map
);
10647 static void do_test_single(struct bpf_test
*test
, bool unpriv
,
10648 int *passes
, int *errors
)
10650 int fd_prog
, expected_ret
, reject_from_alignment
;
10651 struct bpf_insn
*prog
= test
->insns
;
10652 int prog_len
= probe_filter_length(prog
);
10653 int prog_type
= test
->prog_type
;
10654 int map_fds
[MAX_NR_MAPS
];
10655 const char *expected_err
;
10658 for (i
= 0; i
< MAX_NR_MAPS
; i
++)
10661 do_test_fixup(test
, prog
, map_fds
);
10663 fd_prog
= bpf_verify_program(prog_type
? : BPF_PROG_TYPE_SOCKET_FILTER
,
10664 prog
, prog_len
, test
->flags
& F_LOAD_WITH_STRICT_ALIGNMENT
,
10665 "GPL", 0, bpf_vlog
, sizeof(bpf_vlog
), 1);
10667 expected_ret
= unpriv
&& test
->result_unpriv
!= UNDEF
?
10668 test
->result_unpriv
: test
->result
;
10669 expected_err
= unpriv
&& test
->errstr_unpriv
?
10670 test
->errstr_unpriv
: test
->errstr
;
10672 reject_from_alignment
= fd_prog
< 0 &&
10673 (test
->flags
& F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
) &&
10674 strstr(bpf_vlog
, "Unknown alignment.");
10675 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
10676 if (reject_from_alignment
) {
10677 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
10682 if (expected_ret
== ACCEPT
) {
10683 if (fd_prog
< 0 && !reject_from_alignment
) {
10684 printf("FAIL\nFailed to load prog '%s'!\n",
10689 if (fd_prog
>= 0) {
10690 printf("FAIL\nUnexpected success to load!\n");
10693 if (!strstr(bpf_vlog
, expected_err
) && !reject_from_alignment
) {
10694 printf("FAIL\nUnexpected error message!\n");
10700 printf("OK%s\n", reject_from_alignment
?
10701 " (NOTE: reject due to unknown alignment)" : "");
10704 for (i
= 0; i
< MAX_NR_MAPS
; i
++)
10710 printf("%s", bpf_vlog
);
10714 static bool is_admin(void)
10717 cap_flag_value_t sysadmin
= CAP_CLEAR
;
10718 const cap_value_t cap_val
= CAP_SYS_ADMIN
;
10720 #ifdef CAP_IS_SUPPORTED
10721 if (!CAP_IS_SUPPORTED(CAP_SETFCAP
)) {
10722 perror("cap_get_flag");
10726 caps
= cap_get_proc();
10728 perror("cap_get_proc");
10731 if (cap_get_flag(caps
, cap_val
, CAP_EFFECTIVE
, &sysadmin
))
10732 perror("cap_get_flag");
10733 if (cap_free(caps
))
10734 perror("cap_free");
10735 return (sysadmin
== CAP_SET
);
10738 static int set_admin(bool admin
)
10741 const cap_value_t cap_val
= CAP_SYS_ADMIN
;
10744 caps
= cap_get_proc();
10746 perror("cap_get_proc");
10749 if (cap_set_flag(caps
, CAP_EFFECTIVE
, 1, &cap_val
,
10750 admin
? CAP_SET
: CAP_CLEAR
)) {
10751 perror("cap_set_flag");
10754 if (cap_set_proc(caps
)) {
10755 perror("cap_set_proc");
10760 if (cap_free(caps
))
10761 perror("cap_free");
10765 static int do_test(bool unpriv
, unsigned int from
, unsigned int to
)
10767 int i
, passes
= 0, errors
= 0;
10769 for (i
= from
; i
< to
; i
++) {
10770 struct bpf_test
*test
= &tests
[i
];
10772 /* Program types that are not supported by non-root we
10775 if (!test
->prog_type
) {
10778 printf("#%d/u %s ", i
, test
->descr
);
10779 do_test_single(test
, true, &passes
, &errors
);
10785 printf("#%d/p %s ", i
, test
->descr
);
10786 do_test_single(test
, false, &passes
, &errors
);
10790 printf("Summary: %d PASSED, %d FAILED\n", passes
, errors
);
10791 return errors
? EXIT_FAILURE
: EXIT_SUCCESS
;
10794 int main(int argc
, char **argv
)
10796 struct rlimit rinf
= { RLIM_INFINITY
, RLIM_INFINITY
};
10797 struct rlimit rlim
= { 1 << 20, 1 << 20 };
10798 unsigned int from
= 0, to
= ARRAY_SIZE(tests
);
10799 bool unpriv
= !is_admin();
10802 unsigned int l
= atoi(argv
[argc
- 2]);
10803 unsigned int u
= atoi(argv
[argc
- 1]);
10805 if (l
< to
&& u
< to
) {
10809 } else if (argc
== 2) {
10810 unsigned int t
= atoi(argv
[argc
- 1]);
10818 setrlimit(RLIMIT_MEMLOCK
, unpriv
? &rlim
: &rinf
);
10819 return do_test(unpriv
, from
, to
);