2 * Testsuite for eBPF verifier
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
11 #include <asm/types.h>
12 #include <linux/types.h>
23 #include <sys/capability.h>
24 #include <sys/resource.h>
26 #include <linux/unistd.h>
27 #include <linux/filter.h>
28 #include <linux/bpf_perf_event.h>
29 #include <linux/bpf.h>
34 # include "autoconf.h"
36 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
37 # define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
41 #include "../../../include/linux/filter.h"
44 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
50 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
54 struct bpf_insn insns
[MAX_INSNS
];
55 int fixup_map1
[MAX_FIXUPS
];
56 int fixup_map2
[MAX_FIXUPS
];
57 int fixup_prog
[MAX_FIXUPS
];
59 const char *errstr_unpriv
;
64 } result
, result_unpriv
;
65 enum bpf_prog_type prog_type
;
69 /* Note we want this to be 64 bit aligned so that the end of our array is
70 * actually the end of the structure.
72 #define MAX_ENTRIES 11
79 static struct bpf_test tests
[] = {
83 BPF_MOV64_IMM(BPF_REG_1
, 1),
84 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 2),
85 BPF_MOV64_IMM(BPF_REG_2
, 3),
86 BPF_ALU64_REG(BPF_SUB
, BPF_REG_1
, BPF_REG_2
),
87 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -1),
88 BPF_ALU64_IMM(BPF_MUL
, BPF_REG_1
, 3),
89 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_1
),
100 .errstr
= "unreachable",
106 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
107 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
110 .errstr
= "unreachable",
116 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
119 .errstr
= "jump out of range",
123 "out of range jump2",
125 BPF_JMP_IMM(BPF_JA
, 0, 0, -2),
128 .errstr
= "jump out of range",
134 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
135 BPF_LD_IMM64(BPF_REG_0
, 0),
136 BPF_LD_IMM64(BPF_REG_0
, 0),
137 BPF_LD_IMM64(BPF_REG_0
, 1),
138 BPF_LD_IMM64(BPF_REG_0
, 1),
139 BPF_MOV64_IMM(BPF_REG_0
, 2),
142 .errstr
= "invalid BPF_LD_IMM insn",
143 .errstr_unpriv
= "R1 pointer comparison",
149 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
150 BPF_LD_IMM64(BPF_REG_0
, 0),
151 BPF_LD_IMM64(BPF_REG_0
, 0),
152 BPF_LD_IMM64(BPF_REG_0
, 1),
153 BPF_LD_IMM64(BPF_REG_0
, 1),
156 .errstr
= "invalid BPF_LD_IMM insn",
157 .errstr_unpriv
= "R1 pointer comparison",
163 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
164 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
165 BPF_LD_IMM64(BPF_REG_0
, 0),
166 BPF_LD_IMM64(BPF_REG_0
, 0),
167 BPF_LD_IMM64(BPF_REG_0
, 1),
168 BPF_LD_IMM64(BPF_REG_0
, 1),
171 .errstr
= "invalid bpf_ld_imm64 insn",
177 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
180 .errstr
= "invalid bpf_ld_imm64 insn",
186 BPF_RAW_INSN(BPF_LD
| BPF_IMM
| BPF_DW
, 0, 0, 0, 0),
188 .errstr
= "invalid bpf_ld_imm64 insn",
194 BPF_ALU64_REG(BPF_MOV
, BPF_REG_0
, BPF_REG_2
),
196 .errstr
= "jump out of range",
202 BPF_JMP_IMM(BPF_JA
, 0, 0, -1),
205 .errstr
= "back-edge",
211 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
212 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_0
),
213 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_0
),
214 BPF_JMP_IMM(BPF_JA
, 0, 0, -4),
217 .errstr
= "back-edge",
223 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
224 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_0
),
225 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_0
),
226 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, -3),
229 .errstr
= "back-edge",
233 "read uninitialized register",
235 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
238 .errstr
= "R2 !read_ok",
242 "read invalid register",
244 BPF_MOV64_REG(BPF_REG_0
, -1),
247 .errstr
= "R15 is invalid",
251 "program doesn't init R0 before exit",
253 BPF_ALU64_REG(BPF_MOV
, BPF_REG_2
, BPF_REG_1
),
256 .errstr
= "R0 !read_ok",
260 "program doesn't init R0 before exit in all branches",
262 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
263 BPF_MOV64_IMM(BPF_REG_0
, 1),
264 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 2),
267 .errstr
= "R0 !read_ok",
268 .errstr_unpriv
= "R1 pointer comparison",
272 "stack out of bounds",
274 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, 8, 0),
277 .errstr
= "invalid stack",
281 "invalid call insn1",
283 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
| BPF_X
, 0, 0, 0, 0),
286 .errstr
= "BPF_CALL uses reserved",
290 "invalid call insn2",
292 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 1, 0),
295 .errstr
= "BPF_CALL uses reserved",
299 "invalid function call",
301 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, 1234567),
304 .errstr
= "invalid func unknown#1234567",
308 "uninitialized stack1",
310 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
311 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
312 BPF_LD_MAP_FD(BPF_REG_1
, 0),
313 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
314 BPF_FUNC_map_lookup_elem
),
318 .errstr
= "invalid indirect read from stack",
322 "uninitialized stack2",
324 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
325 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, -8),
328 .errstr
= "invalid read from stack",
332 "invalid argument register",
334 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
335 BPF_FUNC_get_cgroup_classid
),
336 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
337 BPF_FUNC_get_cgroup_classid
),
340 .errstr
= "R1 !read_ok",
342 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
345 "non-invalid argument register",
347 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_1
),
348 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
349 BPF_FUNC_get_cgroup_classid
),
350 BPF_ALU64_REG(BPF_MOV
, BPF_REG_1
, BPF_REG_6
),
351 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
352 BPF_FUNC_get_cgroup_classid
),
356 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
359 "check valid spill/fill",
361 /* spill R1(ctx) into stack */
362 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
363 /* fill it back into R2 */
364 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -8),
365 /* should be able to access R0 = *(R2 + 8) */
366 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
367 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
370 .errstr_unpriv
= "R0 leaks addr",
372 .result_unpriv
= REJECT
,
375 "check valid spill/fill, skb mark",
377 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_1
),
378 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_6
, -8),
379 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
380 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
381 offsetof(struct __sk_buff
, mark
)),
385 .result_unpriv
= ACCEPT
,
388 "check corrupted spill/fill",
390 /* spill R1(ctx) into stack */
391 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
392 /* mess up with R1 pointer on stack */
393 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -7, 0x23),
394 /* fill back into R0 should fail */
395 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_10
, -8),
398 .errstr_unpriv
= "attempt to corrupt spilled",
399 .errstr
= "corrupted spill",
403 "invalid src register in STX",
405 BPF_STX_MEM(BPF_B
, BPF_REG_10
, -1, -1),
408 .errstr
= "R15 is invalid",
412 "invalid dst register in STX",
414 BPF_STX_MEM(BPF_B
, 14, BPF_REG_10
, -1),
417 .errstr
= "R14 is invalid",
421 "invalid dst register in ST",
423 BPF_ST_MEM(BPF_B
, 14, -1, -1),
426 .errstr
= "R14 is invalid",
430 "invalid src register in LDX",
432 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, 12, 0),
435 .errstr
= "R12 is invalid",
439 "invalid dst register in LDX",
441 BPF_LDX_MEM(BPF_B
, 11, BPF_REG_1
, 0),
444 .errstr
= "R11 is invalid",
450 BPF_RAW_INSN(0, 0, 0, 0, 0),
453 .errstr
= "invalid BPF_LD_IMM",
459 BPF_RAW_INSN(1, 0, 0, 0, 0),
462 .errstr
= "BPF_LDX uses reserved fields",
468 BPF_RAW_INSN(-1, 0, 0, 0, 0),
471 .errstr
= "invalid BPF_ALU opcode f0",
477 BPF_RAW_INSN(-1, -1, -1, -1, -1),
480 .errstr
= "invalid BPF_ALU opcode f0",
486 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
489 .errstr
= "BPF_ALU uses reserved fields",
493 "misaligned read from stack",
495 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
496 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, -4),
499 .errstr
= "misaligned access",
503 "invalid map_fd for function call",
505 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
506 BPF_ALU64_REG(BPF_MOV
, BPF_REG_2
, BPF_REG_10
),
507 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
508 BPF_LD_MAP_FD(BPF_REG_1
, 0),
509 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
510 BPF_FUNC_map_delete_elem
),
513 .errstr
= "fd 0 is not pointing to valid bpf_map",
517 "don't check return value before access",
519 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
520 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
521 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
522 BPF_LD_MAP_FD(BPF_REG_1
, 0),
523 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
524 BPF_FUNC_map_lookup_elem
),
525 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
529 .errstr
= "R0 invalid mem access 'map_value_or_null'",
533 "access memory with incorrect alignment",
535 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
536 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
537 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
538 BPF_LD_MAP_FD(BPF_REG_1
, 0),
539 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
540 BPF_FUNC_map_lookup_elem
),
541 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
542 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 4, 0),
546 .errstr
= "misaligned access",
550 "sometimes access memory with incorrect alignment",
552 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
553 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
554 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
555 BPF_LD_MAP_FD(BPF_REG_1
, 0),
556 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
557 BPF_FUNC_map_lookup_elem
),
558 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
559 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 0),
561 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 1),
565 .errstr
= "R0 invalid mem access",
566 .errstr_unpriv
= "R0 leaks addr",
572 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
573 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -8),
574 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 1),
575 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
576 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 1),
577 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 1),
578 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 1),
579 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 2),
580 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 1),
581 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 3),
582 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 1),
583 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 4),
584 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 1),
585 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 5),
586 BPF_MOV64_IMM(BPF_REG_0
, 0),
589 .errstr_unpriv
= "R1 pointer comparison",
590 .result_unpriv
= REJECT
,
596 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
597 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 2),
598 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
599 BPF_JMP_IMM(BPF_JA
, 0, 0, 14),
600 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 2),
601 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 0),
602 BPF_JMP_IMM(BPF_JA
, 0, 0, 11),
603 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 2),
604 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 0),
605 BPF_JMP_IMM(BPF_JA
, 0, 0, 8),
606 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 2),
607 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -40, 0),
608 BPF_JMP_IMM(BPF_JA
, 0, 0, 5),
609 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 2),
610 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -48, 0),
611 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
612 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 1),
613 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -56, 0),
614 BPF_MOV64_IMM(BPF_REG_0
, 0),
617 .errstr_unpriv
= "R1 pointer comparison",
618 .result_unpriv
= REJECT
,
624 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
625 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
626 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -8, 0),
627 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
628 BPF_JMP_IMM(BPF_JA
, 0, 0, 19),
629 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 1, 3),
630 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -16, 0),
631 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
632 BPF_JMP_IMM(BPF_JA
, 0, 0, 15),
633 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 2, 3),
634 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -32, 0),
635 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -32),
636 BPF_JMP_IMM(BPF_JA
, 0, 0, 11),
637 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 3, 3),
638 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -40, 0),
639 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -40),
640 BPF_JMP_IMM(BPF_JA
, 0, 0, 7),
641 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 4, 3),
642 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -48, 0),
643 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -48),
644 BPF_JMP_IMM(BPF_JA
, 0, 0, 3),
645 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 5, 0),
646 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, -56, 0),
647 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -56),
648 BPF_LD_MAP_FD(BPF_REG_1
, 0),
649 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
650 BPF_FUNC_map_delete_elem
),
653 .fixup_map1
= { 24 },
654 .errstr_unpriv
= "R1 pointer comparison",
655 .result_unpriv
= REJECT
,
661 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
662 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
663 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
664 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
665 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
666 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
667 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
668 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
669 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
670 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
671 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
672 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
673 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
674 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
675 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
676 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
677 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
678 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
679 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
680 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
681 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
682 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
683 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
684 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
685 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
686 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
687 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
688 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
689 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
690 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
691 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
692 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
693 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 1),
694 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 2),
695 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 3),
696 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 4),
697 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
698 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
699 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
700 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
701 BPF_MOV64_IMM(BPF_REG_0
, 0),
704 .errstr_unpriv
= "R1 pointer comparison",
705 .result_unpriv
= REJECT
,
711 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
712 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
713 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
714 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
715 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
716 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
717 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
718 BPF_MOV64_IMM(BPF_REG_0
, 0),
719 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
720 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
721 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
722 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
723 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
724 BPF_MOV64_IMM(BPF_REG_0
, 0),
725 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
726 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
727 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
728 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
729 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
730 BPF_MOV64_IMM(BPF_REG_0
, 0),
731 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
732 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
733 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
734 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
735 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
736 BPF_MOV64_IMM(BPF_REG_0
, 0),
737 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
738 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_3
, -8),
739 BPF_JMP_IMM(BPF_JA
, 0, 0, 2),
740 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_2
, -8),
741 BPF_JMP_IMM(BPF_JA
, 0, 0, 0),
742 BPF_MOV64_IMM(BPF_REG_0
, 0),
745 .errstr_unpriv
= "R1 pointer comparison",
746 .result_unpriv
= REJECT
,
750 "access skb fields ok",
752 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
753 offsetof(struct __sk_buff
, len
)),
754 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
755 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
756 offsetof(struct __sk_buff
, mark
)),
757 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
758 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
759 offsetof(struct __sk_buff
, pkt_type
)),
760 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
761 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
762 offsetof(struct __sk_buff
, queue_mapping
)),
763 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
764 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
765 offsetof(struct __sk_buff
, protocol
)),
766 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
767 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
768 offsetof(struct __sk_buff
, vlan_present
)),
769 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
770 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
771 offsetof(struct __sk_buff
, vlan_tci
)),
772 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 0),
778 "access skb fields bad1",
780 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
, -4),
783 .errstr
= "invalid bpf_context access",
787 "access skb fields bad2",
789 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 9),
790 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
791 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
792 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
793 BPF_LD_MAP_FD(BPF_REG_1
, 0),
794 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
795 BPF_FUNC_map_lookup_elem
),
796 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
798 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
799 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
800 offsetof(struct __sk_buff
, pkt_type
)),
804 .errstr
= "different pointers",
805 .errstr_unpriv
= "R1 pointer comparison",
809 "access skb fields bad3",
811 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 2),
812 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
813 offsetof(struct __sk_buff
, pkt_type
)),
815 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
816 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
817 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
818 BPF_LD_MAP_FD(BPF_REG_1
, 0),
819 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
820 BPF_FUNC_map_lookup_elem
),
821 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
823 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
824 BPF_JMP_IMM(BPF_JA
, 0, 0, -12),
827 .errstr
= "different pointers",
828 .errstr_unpriv
= "R1 pointer comparison",
832 "access skb fields bad4",
834 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, 0, 3),
835 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
836 offsetof(struct __sk_buff
, len
)),
837 BPF_MOV64_IMM(BPF_REG_0
, 0),
839 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
840 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
841 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
842 BPF_LD_MAP_FD(BPF_REG_1
, 0),
843 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
844 BPF_FUNC_map_lookup_elem
),
845 BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, 1),
847 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
848 BPF_JMP_IMM(BPF_JA
, 0, 0, -13),
851 .errstr
= "different pointers",
852 .errstr_unpriv
= "R1 pointer comparison",
856 "check skb->mark is not writeable by sockets",
858 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
859 offsetof(struct __sk_buff
, mark
)),
862 .errstr
= "invalid bpf_context access",
863 .errstr_unpriv
= "R1 leaks addr",
867 "check skb->tc_index is not writeable by sockets",
869 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
870 offsetof(struct __sk_buff
, tc_index
)),
873 .errstr
= "invalid bpf_context access",
874 .errstr_unpriv
= "R1 leaks addr",
878 "check cb access: byte",
880 BPF_MOV64_IMM(BPF_REG_0
, 0),
881 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
882 offsetof(struct __sk_buff
, cb
[0])),
883 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
884 offsetof(struct __sk_buff
, cb
[0]) + 1),
885 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
886 offsetof(struct __sk_buff
, cb
[0]) + 2),
887 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
888 offsetof(struct __sk_buff
, cb
[0]) + 3),
889 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
890 offsetof(struct __sk_buff
, cb
[1])),
891 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
892 offsetof(struct __sk_buff
, cb
[1]) + 1),
893 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
894 offsetof(struct __sk_buff
, cb
[1]) + 2),
895 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
896 offsetof(struct __sk_buff
, cb
[1]) + 3),
897 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
898 offsetof(struct __sk_buff
, cb
[2])),
899 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
900 offsetof(struct __sk_buff
, cb
[2]) + 1),
901 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
902 offsetof(struct __sk_buff
, cb
[2]) + 2),
903 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
904 offsetof(struct __sk_buff
, cb
[2]) + 3),
905 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
906 offsetof(struct __sk_buff
, cb
[3])),
907 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
908 offsetof(struct __sk_buff
, cb
[3]) + 1),
909 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
910 offsetof(struct __sk_buff
, cb
[3]) + 2),
911 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
912 offsetof(struct __sk_buff
, cb
[3]) + 3),
913 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
914 offsetof(struct __sk_buff
, cb
[4])),
915 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
916 offsetof(struct __sk_buff
, cb
[4]) + 1),
917 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
918 offsetof(struct __sk_buff
, cb
[4]) + 2),
919 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
920 offsetof(struct __sk_buff
, cb
[4]) + 3),
921 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
922 offsetof(struct __sk_buff
, cb
[0])),
923 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
924 offsetof(struct __sk_buff
, cb
[0]) + 1),
925 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
926 offsetof(struct __sk_buff
, cb
[0]) + 2),
927 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
928 offsetof(struct __sk_buff
, cb
[0]) + 3),
929 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
930 offsetof(struct __sk_buff
, cb
[1])),
931 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
932 offsetof(struct __sk_buff
, cb
[1]) + 1),
933 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
934 offsetof(struct __sk_buff
, cb
[1]) + 2),
935 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
936 offsetof(struct __sk_buff
, cb
[1]) + 3),
937 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
938 offsetof(struct __sk_buff
, cb
[2])),
939 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
940 offsetof(struct __sk_buff
, cb
[2]) + 1),
941 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
942 offsetof(struct __sk_buff
, cb
[2]) + 2),
943 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
944 offsetof(struct __sk_buff
, cb
[2]) + 3),
945 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
946 offsetof(struct __sk_buff
, cb
[3])),
947 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
948 offsetof(struct __sk_buff
, cb
[3]) + 1),
949 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
950 offsetof(struct __sk_buff
, cb
[3]) + 2),
951 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
952 offsetof(struct __sk_buff
, cb
[3]) + 3),
953 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
954 offsetof(struct __sk_buff
, cb
[4])),
955 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
956 offsetof(struct __sk_buff
, cb
[4]) + 1),
957 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
958 offsetof(struct __sk_buff
, cb
[4]) + 2),
959 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
960 offsetof(struct __sk_buff
, cb
[4]) + 3),
966 "check cb access: byte, oob 1",
968 BPF_MOV64_IMM(BPF_REG_0
, 0),
969 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
970 offsetof(struct __sk_buff
, cb
[4]) + 4),
973 .errstr
= "invalid bpf_context access",
977 "check cb access: byte, oob 2",
979 BPF_MOV64_IMM(BPF_REG_0
, 0),
980 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
981 offsetof(struct __sk_buff
, cb
[0]) - 1),
984 .errstr
= "invalid bpf_context access",
988 "check cb access: byte, oob 3",
990 BPF_MOV64_IMM(BPF_REG_0
, 0),
991 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
992 offsetof(struct __sk_buff
, cb
[4]) + 4),
995 .errstr
= "invalid bpf_context access",
999 "check cb access: byte, oob 4",
1001 BPF_MOV64_IMM(BPF_REG_0
, 0),
1002 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_1
,
1003 offsetof(struct __sk_buff
, cb
[0]) - 1),
1006 .errstr
= "invalid bpf_context access",
1010 "check cb access: byte, wrong type",
1012 BPF_MOV64_IMM(BPF_REG_0
, 0),
1013 BPF_STX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_0
,
1014 offsetof(struct __sk_buff
, cb
[0])),
1017 .errstr
= "invalid bpf_context access",
1019 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1022 "check cb access: half",
1024 BPF_MOV64_IMM(BPF_REG_0
, 0),
1025 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1026 offsetof(struct __sk_buff
, cb
[0])),
1027 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1028 offsetof(struct __sk_buff
, cb
[0]) + 2),
1029 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1030 offsetof(struct __sk_buff
, cb
[1])),
1031 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1032 offsetof(struct __sk_buff
, cb
[1]) + 2),
1033 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1034 offsetof(struct __sk_buff
, cb
[2])),
1035 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1036 offsetof(struct __sk_buff
, cb
[2]) + 2),
1037 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1038 offsetof(struct __sk_buff
, cb
[3])),
1039 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1040 offsetof(struct __sk_buff
, cb
[3]) + 2),
1041 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1042 offsetof(struct __sk_buff
, cb
[4])),
1043 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1044 offsetof(struct __sk_buff
, cb
[4]) + 2),
1045 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1046 offsetof(struct __sk_buff
, cb
[0])),
1047 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1048 offsetof(struct __sk_buff
, cb
[0]) + 2),
1049 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1050 offsetof(struct __sk_buff
, cb
[1])),
1051 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1052 offsetof(struct __sk_buff
, cb
[1]) + 2),
1053 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1054 offsetof(struct __sk_buff
, cb
[2])),
1055 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1056 offsetof(struct __sk_buff
, cb
[2]) + 2),
1057 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1058 offsetof(struct __sk_buff
, cb
[3])),
1059 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1060 offsetof(struct __sk_buff
, cb
[3]) + 2),
1061 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1062 offsetof(struct __sk_buff
, cb
[4])),
1063 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1064 offsetof(struct __sk_buff
, cb
[4]) + 2),
1070 "check cb access: half, unaligned",
1072 BPF_MOV64_IMM(BPF_REG_0
, 0),
1073 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1074 offsetof(struct __sk_buff
, cb
[0]) + 1),
1077 .errstr
= "misaligned access",
1081 "check cb access: half, oob 1",
1083 BPF_MOV64_IMM(BPF_REG_0
, 0),
1084 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1085 offsetof(struct __sk_buff
, cb
[4]) + 4),
1088 .errstr
= "invalid bpf_context access",
1092 "check cb access: half, oob 2",
1094 BPF_MOV64_IMM(BPF_REG_0
, 0),
1095 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1096 offsetof(struct __sk_buff
, cb
[0]) - 2),
1099 .errstr
= "invalid bpf_context access",
1103 "check cb access: half, oob 3",
1105 BPF_MOV64_IMM(BPF_REG_0
, 0),
1106 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1107 offsetof(struct __sk_buff
, cb
[4]) + 4),
1110 .errstr
= "invalid bpf_context access",
1114 "check cb access: half, oob 4",
1116 BPF_MOV64_IMM(BPF_REG_0
, 0),
1117 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_1
,
1118 offsetof(struct __sk_buff
, cb
[0]) - 2),
1121 .errstr
= "invalid bpf_context access",
1125 "check cb access: half, wrong type",
1127 BPF_MOV64_IMM(BPF_REG_0
, 0),
1128 BPF_STX_MEM(BPF_H
, BPF_REG_1
, BPF_REG_0
,
1129 offsetof(struct __sk_buff
, cb
[0])),
1132 .errstr
= "invalid bpf_context access",
1134 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1137 "check cb access: word",
1139 BPF_MOV64_IMM(BPF_REG_0
, 0),
1140 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1141 offsetof(struct __sk_buff
, cb
[0])),
1142 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1143 offsetof(struct __sk_buff
, cb
[1])),
1144 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1145 offsetof(struct __sk_buff
, cb
[2])),
1146 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1147 offsetof(struct __sk_buff
, cb
[3])),
1148 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1149 offsetof(struct __sk_buff
, cb
[4])),
1150 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1151 offsetof(struct __sk_buff
, cb
[0])),
1152 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1153 offsetof(struct __sk_buff
, cb
[1])),
1154 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1155 offsetof(struct __sk_buff
, cb
[2])),
1156 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1157 offsetof(struct __sk_buff
, cb
[3])),
1158 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1159 offsetof(struct __sk_buff
, cb
[4])),
1165 "check cb access: word, unaligned 1",
1167 BPF_MOV64_IMM(BPF_REG_0
, 0),
1168 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1169 offsetof(struct __sk_buff
, cb
[0]) + 2),
1172 .errstr
= "misaligned access",
1176 "check cb access: word, unaligned 2",
1178 BPF_MOV64_IMM(BPF_REG_0
, 0),
1179 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1180 offsetof(struct __sk_buff
, cb
[4]) + 1),
1183 .errstr
= "misaligned access",
1187 "check cb access: word, unaligned 3",
1189 BPF_MOV64_IMM(BPF_REG_0
, 0),
1190 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1191 offsetof(struct __sk_buff
, cb
[4]) + 2),
1194 .errstr
= "misaligned access",
1198 "check cb access: word, unaligned 4",
1200 BPF_MOV64_IMM(BPF_REG_0
, 0),
1201 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1202 offsetof(struct __sk_buff
, cb
[4]) + 3),
1205 .errstr
= "misaligned access",
1209 "check cb access: double",
1211 BPF_MOV64_IMM(BPF_REG_0
, 0),
1212 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1213 offsetof(struct __sk_buff
, cb
[0])),
1214 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1215 offsetof(struct __sk_buff
, cb
[2])),
1216 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1217 offsetof(struct __sk_buff
, cb
[0])),
1218 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1219 offsetof(struct __sk_buff
, cb
[2])),
1225 "check cb access: double, unaligned 1",
1227 BPF_MOV64_IMM(BPF_REG_0
, 0),
1228 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1229 offsetof(struct __sk_buff
, cb
[1])),
1232 .errstr
= "misaligned access",
1236 "check cb access: double, unaligned 2",
1238 BPF_MOV64_IMM(BPF_REG_0
, 0),
1239 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1240 offsetof(struct __sk_buff
, cb
[3])),
1243 .errstr
= "misaligned access",
1247 "check cb access: double, oob 1",
1249 BPF_MOV64_IMM(BPF_REG_0
, 0),
1250 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1251 offsetof(struct __sk_buff
, cb
[4])),
1254 .errstr
= "invalid bpf_context access",
1258 "check cb access: double, oob 2",
1260 BPF_MOV64_IMM(BPF_REG_0
, 0),
1261 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1262 offsetof(struct __sk_buff
, cb
[4]) + 8),
1265 .errstr
= "invalid bpf_context access",
1269 "check cb access: double, oob 3",
1271 BPF_MOV64_IMM(BPF_REG_0
, 0),
1272 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1273 offsetof(struct __sk_buff
, cb
[0]) - 8),
1276 .errstr
= "invalid bpf_context access",
1280 "check cb access: double, oob 4",
1282 BPF_MOV64_IMM(BPF_REG_0
, 0),
1283 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1284 offsetof(struct __sk_buff
, cb
[4])),
1287 .errstr
= "invalid bpf_context access",
1291 "check cb access: double, oob 5",
1293 BPF_MOV64_IMM(BPF_REG_0
, 0),
1294 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1295 offsetof(struct __sk_buff
, cb
[4]) + 8),
1298 .errstr
= "invalid bpf_context access",
1302 "check cb access: double, oob 6",
1304 BPF_MOV64_IMM(BPF_REG_0
, 0),
1305 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
,
1306 offsetof(struct __sk_buff
, cb
[0]) - 8),
1309 .errstr
= "invalid bpf_context access",
1313 "check cb access: double, wrong type",
1315 BPF_MOV64_IMM(BPF_REG_0
, 0),
1316 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
,
1317 offsetof(struct __sk_buff
, cb
[0])),
1320 .errstr
= "invalid bpf_context access",
1322 .prog_type
= BPF_PROG_TYPE_CGROUP_SOCK
,
1325 "check out of range skb->cb access",
1327 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1328 offsetof(struct __sk_buff
, cb
[0]) + 256),
1331 .errstr
= "invalid bpf_context access",
1332 .errstr_unpriv
= "",
1334 .prog_type
= BPF_PROG_TYPE_SCHED_ACT
,
1337 "write skb fields from socket prog",
1339 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1340 offsetof(struct __sk_buff
, cb
[4])),
1341 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
1342 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1343 offsetof(struct __sk_buff
, mark
)),
1344 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1345 offsetof(struct __sk_buff
, tc_index
)),
1346 BPF_JMP_IMM(BPF_JGE
, BPF_REG_0
, 0, 1),
1347 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1348 offsetof(struct __sk_buff
, cb
[0])),
1349 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
1350 offsetof(struct __sk_buff
, cb
[2])),
1354 .errstr_unpriv
= "R1 leaks addr",
1355 .result_unpriv
= REJECT
,
1358 "write skb fields from tc_cls_act prog",
1360 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1361 offsetof(struct __sk_buff
, cb
[0])),
1362 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1363 offsetof(struct __sk_buff
, mark
)),
1364 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
1365 offsetof(struct __sk_buff
, tc_index
)),
1366 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1367 offsetof(struct __sk_buff
, tc_index
)),
1368 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
,
1369 offsetof(struct __sk_buff
, cb
[3])),
1372 .errstr_unpriv
= "",
1373 .result_unpriv
= REJECT
,
1375 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1378 "PTR_TO_STACK store/load",
1380 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1381 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -10),
1382 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 2, 0xfaceb00c),
1383 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 2),
1389 "PTR_TO_STACK store/load - bad alignment on off",
1391 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1392 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1393 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 2, 0xfaceb00c),
1394 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 2),
1398 .errstr
= "misaligned access off -6 size 8",
1401 "PTR_TO_STACK store/load - bad alignment on reg",
1403 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1404 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -10),
1405 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1406 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1410 .errstr
= "misaligned access off -2 size 8",
1413 "PTR_TO_STACK store/load - out of bounds low",
1415 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1416 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -80000),
1417 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1418 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1422 .errstr
= "invalid stack off=-79992 size=8",
1425 "PTR_TO_STACK store/load - out of bounds high",
1427 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1428 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1429 BPF_ST_MEM(BPF_DW
, BPF_REG_1
, 8, 0xfaceb00c),
1430 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 8),
1434 .errstr
= "invalid stack off=0 size=8",
1437 "unpriv: return pointer",
1439 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_10
),
1443 .result_unpriv
= REJECT
,
1444 .errstr_unpriv
= "R0 leaks addr",
1447 "unpriv: add const to pointer",
1449 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
1450 BPF_MOV64_IMM(BPF_REG_0
, 0),
1454 .result_unpriv
= REJECT
,
1455 .errstr_unpriv
= "R1 pointer arithmetic",
1458 "unpriv: add pointer to pointer",
1460 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_10
),
1461 BPF_MOV64_IMM(BPF_REG_0
, 0),
1465 .result_unpriv
= REJECT
,
1466 .errstr_unpriv
= "R1 pointer arithmetic",
1469 "unpriv: neg pointer",
1471 BPF_ALU64_IMM(BPF_NEG
, BPF_REG_1
, 0),
1472 BPF_MOV64_IMM(BPF_REG_0
, 0),
1476 .result_unpriv
= REJECT
,
1477 .errstr_unpriv
= "R1 pointer arithmetic",
1480 "unpriv: cmp pointer with const",
1482 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 0),
1483 BPF_MOV64_IMM(BPF_REG_0
, 0),
1487 .result_unpriv
= REJECT
,
1488 .errstr_unpriv
= "R1 pointer comparison",
1491 "unpriv: cmp pointer with pointer",
1493 BPF_JMP_REG(BPF_JEQ
, BPF_REG_1
, BPF_REG_10
, 0),
1494 BPF_MOV64_IMM(BPF_REG_0
, 0),
1498 .result_unpriv
= REJECT
,
1499 .errstr_unpriv
= "R10 pointer comparison",
1502 "unpriv: check that printk is disallowed",
1504 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
1505 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
1506 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
1507 BPF_MOV64_IMM(BPF_REG_2
, 8),
1508 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_1
),
1509 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1510 BPF_FUNC_trace_printk
),
1511 BPF_MOV64_IMM(BPF_REG_0
, 0),
1514 .errstr_unpriv
= "unknown func bpf_trace_printk#6",
1515 .result_unpriv
= REJECT
,
1519 "unpriv: pass pointer to helper function",
1521 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
1522 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1523 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1524 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1525 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
1526 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
1527 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1528 BPF_FUNC_map_update_elem
),
1529 BPF_MOV64_IMM(BPF_REG_0
, 0),
1532 .fixup_map1
= { 3 },
1533 .errstr_unpriv
= "R4 leaks addr",
1534 .result_unpriv
= REJECT
,
1538 "unpriv: indirectly pass pointer on stack to helper function",
1540 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1541 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1542 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1543 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1544 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1545 BPF_FUNC_map_lookup_elem
),
1546 BPF_MOV64_IMM(BPF_REG_0
, 0),
1549 .fixup_map1
= { 3 },
1550 .errstr
= "invalid indirect read from stack off -8+0 size 8",
1554 "unpriv: mangle pointer on stack 1",
1556 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1557 BPF_ST_MEM(BPF_W
, BPF_REG_10
, -8, 0),
1558 BPF_MOV64_IMM(BPF_REG_0
, 0),
1561 .errstr_unpriv
= "attempt to corrupt spilled",
1562 .result_unpriv
= REJECT
,
1566 "unpriv: mangle pointer on stack 2",
1568 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1569 BPF_ST_MEM(BPF_B
, BPF_REG_10
, -1, 0),
1570 BPF_MOV64_IMM(BPF_REG_0
, 0),
1573 .errstr_unpriv
= "attempt to corrupt spilled",
1574 .result_unpriv
= REJECT
,
1578 "unpriv: read pointer from stack in small chunks",
1580 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_10
, -8),
1581 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_10
, -8),
1582 BPF_MOV64_IMM(BPF_REG_0
, 0),
1585 .errstr
= "invalid size",
1589 "unpriv: write pointer into ctx",
1591 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_1
, 0),
1592 BPF_MOV64_IMM(BPF_REG_0
, 0),
1595 .errstr_unpriv
= "R1 leaks addr",
1596 .result_unpriv
= REJECT
,
1597 .errstr
= "invalid bpf_context access",
1601 "unpriv: spill/fill of ctx",
1603 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1604 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1605 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1606 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1607 BPF_MOV64_IMM(BPF_REG_0
, 0),
1613 "unpriv: spill/fill of ctx 2",
1615 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1616 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1617 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1618 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1619 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1620 BPF_FUNC_get_hash_recalc
),
1624 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1627 "unpriv: spill/fill of ctx 3",
1629 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1630 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1631 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1632 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_10
, 0),
1633 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1634 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1635 BPF_FUNC_get_hash_recalc
),
1639 .errstr
= "R1 type=fp expected=ctx",
1640 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1643 "unpriv: spill/fill of ctx 4",
1645 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1646 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1647 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1648 BPF_MOV64_IMM(BPF_REG_0
, 1),
1649 BPF_RAW_INSN(BPF_STX
| BPF_XADD
| BPF_DW
, BPF_REG_10
,
1651 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1652 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1653 BPF_FUNC_get_hash_recalc
),
1657 .errstr
= "R1 type=inv expected=ctx",
1658 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1661 "unpriv: spill/fill of different pointers stx",
1663 BPF_MOV64_IMM(BPF_REG_3
, 42),
1664 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1665 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1666 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
1667 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1668 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -16),
1669 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_2
, 0),
1670 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 1),
1671 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1672 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1673 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_3
,
1674 offsetof(struct __sk_buff
, mark
)),
1675 BPF_MOV64_IMM(BPF_REG_0
, 0),
1679 .errstr
= "same insn cannot be used with different pointers",
1680 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1683 "unpriv: spill/fill of different pointers ldx",
1685 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1686 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1687 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 3),
1688 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1689 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
,
1690 -(__s32
)offsetof(struct bpf_perf_event_data
,
1691 sample_period
) - 8),
1692 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_2
, 0),
1693 BPF_JMP_IMM(BPF_JNE
, BPF_REG_1
, 0, 1),
1694 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1695 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_6
, 0),
1696 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_1
,
1697 offsetof(struct bpf_perf_event_data
,
1699 BPF_MOV64_IMM(BPF_REG_0
, 0),
1703 .errstr
= "same insn cannot be used with different pointers",
1704 .prog_type
= BPF_PROG_TYPE_PERF_EVENT
,
1707 "unpriv: write pointer into map elem value",
1709 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
1710 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1711 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1712 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1713 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1714 BPF_FUNC_map_lookup_elem
),
1715 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
1716 BPF_STX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_0
, 0),
1719 .fixup_map1
= { 3 },
1720 .errstr_unpriv
= "R0 leaks addr",
1721 .result_unpriv
= REJECT
,
1725 "unpriv: partial copy of pointer",
1727 BPF_MOV32_REG(BPF_REG_1
, BPF_REG_10
),
1728 BPF_MOV64_IMM(BPF_REG_0
, 0),
1731 .errstr_unpriv
= "R10 partial copy",
1732 .result_unpriv
= REJECT
,
1736 "unpriv: pass pointer to tail_call",
1738 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_1
),
1739 BPF_LD_MAP_FD(BPF_REG_2
, 0),
1740 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1741 BPF_FUNC_tail_call
),
1742 BPF_MOV64_IMM(BPF_REG_0
, 0),
1745 .fixup_prog
= { 1 },
1746 .errstr_unpriv
= "R3 leaks addr into helper",
1747 .result_unpriv
= REJECT
,
1751 "unpriv: cmp map pointer with zero",
1753 BPF_MOV64_IMM(BPF_REG_1
, 0),
1754 BPF_LD_MAP_FD(BPF_REG_1
, 0),
1755 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_1
, 0, 0),
1756 BPF_MOV64_IMM(BPF_REG_0
, 0),
1759 .fixup_map1
= { 1 },
1760 .errstr_unpriv
= "R1 pointer comparison",
1761 .result_unpriv
= REJECT
,
1765 "unpriv: write into frame pointer",
1767 BPF_MOV64_REG(BPF_REG_10
, BPF_REG_1
),
1768 BPF_MOV64_IMM(BPF_REG_0
, 0),
1771 .errstr
= "frame pointer is read only",
1775 "unpriv: spill/fill frame pointer",
1777 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1778 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1779 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_10
, 0),
1780 BPF_LDX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_6
, 0),
1781 BPF_MOV64_IMM(BPF_REG_0
, 0),
1784 .errstr
= "frame pointer is read only",
1788 "unpriv: cmp of frame pointer",
1790 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_10
, 0, 0),
1791 BPF_MOV64_IMM(BPF_REG_0
, 0),
1794 .errstr_unpriv
= "R10 pointer comparison",
1795 .result_unpriv
= REJECT
,
1799 "unpriv: cmp of stack pointer",
1801 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1802 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1803 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_2
, 0, 0),
1804 BPF_MOV64_IMM(BPF_REG_0
, 0),
1807 .errstr_unpriv
= "R2 pointer comparison",
1808 .result_unpriv
= REJECT
,
1812 "unpriv: obfuscate stack pointer",
1814 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
1815 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1816 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
1817 BPF_MOV64_IMM(BPF_REG_0
, 0),
1820 .errstr_unpriv
= "R2 pointer arithmetic",
1821 .result_unpriv
= REJECT
,
1825 "raw_stack: no skb_load_bytes",
1827 BPF_MOV64_IMM(BPF_REG_2
, 4),
1828 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1829 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1830 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1831 BPF_MOV64_IMM(BPF_REG_4
, 8),
1832 /* Call to skb_load_bytes() omitted. */
1833 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1837 .errstr
= "invalid read from stack off -8+0 size 8",
1838 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1841 "raw_stack: skb_load_bytes, negative len",
1843 BPF_MOV64_IMM(BPF_REG_2
, 4),
1844 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1845 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1846 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1847 BPF_MOV64_IMM(BPF_REG_4
, -8),
1848 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1849 BPF_FUNC_skb_load_bytes
),
1850 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1854 .errstr
= "invalid stack type R3",
1855 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1858 "raw_stack: skb_load_bytes, negative len 2",
1860 BPF_MOV64_IMM(BPF_REG_2
, 4),
1861 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1862 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1863 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1864 BPF_MOV64_IMM(BPF_REG_4
, ~0),
1865 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1866 BPF_FUNC_skb_load_bytes
),
1867 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1871 .errstr
= "invalid stack type R3",
1872 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1875 "raw_stack: skb_load_bytes, zero len",
1877 BPF_MOV64_IMM(BPF_REG_2
, 4),
1878 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1879 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1880 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1881 BPF_MOV64_IMM(BPF_REG_4
, 0),
1882 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1883 BPF_FUNC_skb_load_bytes
),
1884 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1888 .errstr
= "invalid stack type R3",
1889 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1892 "raw_stack: skb_load_bytes, no init",
1894 BPF_MOV64_IMM(BPF_REG_2
, 4),
1895 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1896 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1897 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1898 BPF_MOV64_IMM(BPF_REG_4
, 8),
1899 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1900 BPF_FUNC_skb_load_bytes
),
1901 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1905 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1908 "raw_stack: skb_load_bytes, init",
1910 BPF_MOV64_IMM(BPF_REG_2
, 4),
1911 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1912 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1913 BPF_ST_MEM(BPF_DW
, BPF_REG_6
, 0, 0xcafe),
1914 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1915 BPF_MOV64_IMM(BPF_REG_4
, 8),
1916 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1917 BPF_FUNC_skb_load_bytes
),
1918 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1922 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1925 "raw_stack: skb_load_bytes, spilled regs around bounds",
1927 BPF_MOV64_IMM(BPF_REG_2
, 4),
1928 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1929 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
1930 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
1931 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
1932 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1933 BPF_MOV64_IMM(BPF_REG_4
, 8),
1934 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1935 BPF_FUNC_skb_load_bytes
),
1936 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
1937 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
1938 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
1939 offsetof(struct __sk_buff
, mark
)),
1940 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
1941 offsetof(struct __sk_buff
, priority
)),
1942 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
1946 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1949 "raw_stack: skb_load_bytes, spilled regs corruption",
1951 BPF_MOV64_IMM(BPF_REG_2
, 4),
1952 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1953 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -8),
1954 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1955 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1956 BPF_MOV64_IMM(BPF_REG_4
, 8),
1957 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1958 BPF_FUNC_skb_load_bytes
),
1959 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
1960 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
1961 offsetof(struct __sk_buff
, mark
)),
1965 .errstr
= "R0 invalid mem access 'inv'",
1966 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1969 "raw_stack: skb_load_bytes, spilled regs corruption 2",
1971 BPF_MOV64_IMM(BPF_REG_2
, 4),
1972 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
1973 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
1974 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
1975 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
1976 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
1977 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
1978 BPF_MOV64_IMM(BPF_REG_4
, 8),
1979 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
1980 BPF_FUNC_skb_load_bytes
),
1981 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
1982 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
1983 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_6
, 0),
1984 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
1985 offsetof(struct __sk_buff
, mark
)),
1986 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
1987 offsetof(struct __sk_buff
, priority
)),
1988 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
1989 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_3
,
1990 offsetof(struct __sk_buff
, pkt_type
)),
1991 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
1995 .errstr
= "R3 invalid mem access 'inv'",
1996 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
1999 "raw_stack: skb_load_bytes, spilled regs + data",
2001 BPF_MOV64_IMM(BPF_REG_2
, 4),
2002 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2003 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -16),
2004 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, -8),
2005 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 0),
2006 BPF_STX_MEM(BPF_DW
, BPF_REG_6
, BPF_REG_1
, 8),
2007 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2008 BPF_MOV64_IMM(BPF_REG_4
, 8),
2009 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2010 BPF_FUNC_skb_load_bytes
),
2011 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, -8),
2012 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_6
, 8),
2013 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_6
, 0),
2014 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
2015 offsetof(struct __sk_buff
, mark
)),
2016 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_2
,
2017 offsetof(struct __sk_buff
, priority
)),
2018 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_2
),
2019 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
2023 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2026 "raw_stack: skb_load_bytes, invalid access 1",
2028 BPF_MOV64_IMM(BPF_REG_2
, 4),
2029 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2030 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -513),
2031 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2032 BPF_MOV64_IMM(BPF_REG_4
, 8),
2033 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2034 BPF_FUNC_skb_load_bytes
),
2035 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2039 .errstr
= "invalid stack type R3 off=-513 access_size=8",
2040 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2043 "raw_stack: skb_load_bytes, invalid access 2",
2045 BPF_MOV64_IMM(BPF_REG_2
, 4),
2046 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2047 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -1),
2048 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2049 BPF_MOV64_IMM(BPF_REG_4
, 8),
2050 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2051 BPF_FUNC_skb_load_bytes
),
2052 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2056 .errstr
= "invalid stack type R3 off=-1 access_size=8",
2057 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2060 "raw_stack: skb_load_bytes, invalid access 3",
2062 BPF_MOV64_IMM(BPF_REG_2
, 4),
2063 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2064 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 0xffffffff),
2065 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2066 BPF_MOV64_IMM(BPF_REG_4
, 0xffffffff),
2067 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2068 BPF_FUNC_skb_load_bytes
),
2069 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2073 .errstr
= "invalid stack type R3 off=-1 access_size=-1",
2074 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2077 "raw_stack: skb_load_bytes, invalid access 4",
2079 BPF_MOV64_IMM(BPF_REG_2
, 4),
2080 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2081 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -1),
2082 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2083 BPF_MOV64_IMM(BPF_REG_4
, 0x7fffffff),
2084 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2085 BPF_FUNC_skb_load_bytes
),
2086 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2090 .errstr
= "invalid stack type R3 off=-1 access_size=2147483647",
2091 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2094 "raw_stack: skb_load_bytes, invalid access 5",
2096 BPF_MOV64_IMM(BPF_REG_2
, 4),
2097 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2098 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2099 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2100 BPF_MOV64_IMM(BPF_REG_4
, 0x7fffffff),
2101 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2102 BPF_FUNC_skb_load_bytes
),
2103 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2107 .errstr
= "invalid stack type R3 off=-512 access_size=2147483647",
2108 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2111 "raw_stack: skb_load_bytes, invalid access 6",
2113 BPF_MOV64_IMM(BPF_REG_2
, 4),
2114 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2115 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2116 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2117 BPF_MOV64_IMM(BPF_REG_4
, 0),
2118 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2119 BPF_FUNC_skb_load_bytes
),
2120 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2124 .errstr
= "invalid stack type R3 off=-512 access_size=0",
2125 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2128 "raw_stack: skb_load_bytes, large access",
2130 BPF_MOV64_IMM(BPF_REG_2
, 4),
2131 BPF_ALU64_REG(BPF_MOV
, BPF_REG_6
, BPF_REG_10
),
2132 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, -512),
2133 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2134 BPF_MOV64_IMM(BPF_REG_4
, 512),
2135 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2136 BPF_FUNC_skb_load_bytes
),
2137 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_6
, 0),
2141 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2144 "direct packet access: test1",
2146 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2147 offsetof(struct __sk_buff
, data
)),
2148 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2149 offsetof(struct __sk_buff
, data_end
)),
2150 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2151 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2152 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2153 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2154 BPF_MOV64_IMM(BPF_REG_0
, 0),
2158 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2161 "direct packet access: test2",
2163 BPF_MOV64_IMM(BPF_REG_0
, 1),
2164 BPF_LDX_MEM(BPF_W
, BPF_REG_4
, BPF_REG_1
,
2165 offsetof(struct __sk_buff
, data_end
)),
2166 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2167 offsetof(struct __sk_buff
, data
)),
2168 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2169 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 14),
2170 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_4
, 15),
2171 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_3
, 7),
2172 BPF_LDX_MEM(BPF_B
, BPF_REG_4
, BPF_REG_3
, 12),
2173 BPF_ALU64_IMM(BPF_MUL
, BPF_REG_4
, 14),
2174 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2175 offsetof(struct __sk_buff
, data
)),
2176 BPF_ALU64_REG(BPF_ADD
, BPF_REG_3
, BPF_REG_4
),
2177 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_1
),
2178 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_2
, 48),
2179 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_2
, 48),
2180 BPF_ALU64_REG(BPF_ADD
, BPF_REG_3
, BPF_REG_2
),
2181 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_3
),
2182 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 8),
2183 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_1
,
2184 offsetof(struct __sk_buff
, data_end
)),
2185 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 1),
2186 BPF_LDX_MEM(BPF_B
, BPF_REG_1
, BPF_REG_3
, 4),
2187 BPF_MOV64_IMM(BPF_REG_0
, 0),
2191 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2194 "direct packet access: test3",
2196 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2197 offsetof(struct __sk_buff
, data
)),
2198 BPF_MOV64_IMM(BPF_REG_0
, 0),
2201 .errstr
= "invalid bpf_context access off=76",
2203 .prog_type
= BPF_PROG_TYPE_SOCKET_FILTER
,
2206 "direct packet access: test4 (write)",
2208 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2209 offsetof(struct __sk_buff
, data
)),
2210 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2211 offsetof(struct __sk_buff
, data_end
)),
2212 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2213 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2214 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2215 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2216 BPF_MOV64_IMM(BPF_REG_0
, 0),
2220 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2223 "direct packet access: test5 (pkt_end >= reg, good access)",
2225 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2226 offsetof(struct __sk_buff
, data
)),
2227 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2228 offsetof(struct __sk_buff
, data_end
)),
2229 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2230 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2231 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 2),
2232 BPF_MOV64_IMM(BPF_REG_0
, 1),
2234 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2235 BPF_MOV64_IMM(BPF_REG_0
, 0),
2239 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2242 "direct packet access: test6 (pkt_end >= reg, bad access)",
2244 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2245 offsetof(struct __sk_buff
, data
)),
2246 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2247 offsetof(struct __sk_buff
, data_end
)),
2248 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2249 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2250 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 3),
2251 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2252 BPF_MOV64_IMM(BPF_REG_0
, 1),
2254 BPF_MOV64_IMM(BPF_REG_0
, 0),
2257 .errstr
= "invalid access to packet",
2259 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2262 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2264 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2265 offsetof(struct __sk_buff
, data
)),
2266 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2267 offsetof(struct __sk_buff
, data_end
)),
2268 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2269 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2270 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 3),
2271 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2272 BPF_MOV64_IMM(BPF_REG_0
, 1),
2274 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2275 BPF_MOV64_IMM(BPF_REG_0
, 0),
2278 .errstr
= "invalid access to packet",
2280 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2283 "direct packet access: test8 (double test, variant 1)",
2285 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2286 offsetof(struct __sk_buff
, data
)),
2287 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2288 offsetof(struct __sk_buff
, data_end
)),
2289 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2290 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2291 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 4),
2292 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2293 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2294 BPF_MOV64_IMM(BPF_REG_0
, 1),
2296 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2297 BPF_MOV64_IMM(BPF_REG_0
, 0),
2301 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2304 "direct packet access: test9 (double test, variant 2)",
2306 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2307 offsetof(struct __sk_buff
, data
)),
2308 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2309 offsetof(struct __sk_buff
, data_end
)),
2310 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2311 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2312 BPF_JMP_REG(BPF_JGE
, BPF_REG_3
, BPF_REG_0
, 2),
2313 BPF_MOV64_IMM(BPF_REG_0
, 1),
2315 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
2316 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2317 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
2318 BPF_MOV64_IMM(BPF_REG_0
, 0),
2322 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2325 "direct packet access: test10 (write invalid)",
2327 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2328 offsetof(struct __sk_buff
, data
)),
2329 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2330 offsetof(struct __sk_buff
, data_end
)),
2331 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2332 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2333 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 2),
2334 BPF_MOV64_IMM(BPF_REG_0
, 0),
2336 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
2337 BPF_MOV64_IMM(BPF_REG_0
, 0),
2340 .errstr
= "invalid access to packet",
2342 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2345 "direct packet access: test11 (shift, good access)",
2347 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2348 offsetof(struct __sk_buff
, data
)),
2349 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2350 offsetof(struct __sk_buff
, data_end
)),
2351 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2352 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2353 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2354 BPF_MOV64_IMM(BPF_REG_3
, 144),
2355 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2356 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2357 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_5
, 3),
2358 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2359 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2360 BPF_MOV64_IMM(BPF_REG_0
, 1),
2362 BPF_MOV64_IMM(BPF_REG_0
, 0),
2366 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2369 "direct packet access: test12 (and, good access)",
2371 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2372 offsetof(struct __sk_buff
, data
)),
2373 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2374 offsetof(struct __sk_buff
, data_end
)),
2375 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2376 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2377 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2378 BPF_MOV64_IMM(BPF_REG_3
, 144),
2379 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2380 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2381 BPF_ALU64_IMM(BPF_AND
, BPF_REG_5
, 15),
2382 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2383 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2384 BPF_MOV64_IMM(BPF_REG_0
, 1),
2386 BPF_MOV64_IMM(BPF_REG_0
, 0),
2390 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2393 "direct packet access: test13 (branches, good access)",
2395 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2396 offsetof(struct __sk_buff
, data
)),
2397 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2398 offsetof(struct __sk_buff
, data_end
)),
2399 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2400 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2401 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 13),
2402 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2403 offsetof(struct __sk_buff
, mark
)),
2404 BPF_MOV64_IMM(BPF_REG_4
, 1),
2405 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_4
, 2),
2406 BPF_MOV64_IMM(BPF_REG_3
, 14),
2407 BPF_JMP_IMM(BPF_JA
, 0, 0, 1),
2408 BPF_MOV64_IMM(BPF_REG_3
, 24),
2409 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_3
),
2410 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 23),
2411 BPF_ALU64_IMM(BPF_AND
, BPF_REG_5
, 15),
2412 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2413 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2414 BPF_MOV64_IMM(BPF_REG_0
, 1),
2416 BPF_MOV64_IMM(BPF_REG_0
, 0),
2420 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2423 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2425 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2426 offsetof(struct __sk_buff
, data
)),
2427 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2428 offsetof(struct __sk_buff
, data_end
)),
2429 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2430 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 22),
2431 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 7),
2432 BPF_MOV64_IMM(BPF_REG_5
, 12),
2433 BPF_ALU64_IMM(BPF_RSH
, BPF_REG_5
, 4),
2434 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_2
),
2435 BPF_ALU64_REG(BPF_ADD
, BPF_REG_6
, BPF_REG_5
),
2436 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_6
, 0),
2437 BPF_MOV64_IMM(BPF_REG_0
, 1),
2439 BPF_MOV64_IMM(BPF_REG_0
, 0),
2443 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2446 "direct packet access: test15 (spill with xadd)",
2448 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2449 offsetof(struct __sk_buff
, data
)),
2450 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2451 offsetof(struct __sk_buff
, data_end
)),
2452 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
2453 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
2454 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 8),
2455 BPF_MOV64_IMM(BPF_REG_5
, 4096),
2456 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_10
),
2457 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, -8),
2458 BPF_STX_MEM(BPF_DW
, BPF_REG_4
, BPF_REG_2
, 0),
2459 BPF_STX_XADD(BPF_DW
, BPF_REG_4
, BPF_REG_5
, 0),
2460 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_4
, 0),
2461 BPF_STX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_5
, 0),
2462 BPF_MOV64_IMM(BPF_REG_0
, 0),
2465 .errstr
= "R2 invalid mem access 'inv'",
2467 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2470 "helper access to packet: test1, valid packet_ptr range",
2472 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2473 offsetof(struct xdp_md
, data
)),
2474 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2475 offsetof(struct xdp_md
, data_end
)),
2476 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
2477 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
2478 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 5),
2479 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2480 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
2481 BPF_MOV64_IMM(BPF_REG_4
, 0),
2482 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2483 BPF_FUNC_map_update_elem
),
2484 BPF_MOV64_IMM(BPF_REG_0
, 0),
2487 .fixup_map1
= { 5 },
2488 .result_unpriv
= ACCEPT
,
2490 .prog_type
= BPF_PROG_TYPE_XDP
,
2493 "helper access to packet: test2, unchecked packet_ptr",
2495 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2496 offsetof(struct xdp_md
, data
)),
2497 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2498 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2499 BPF_FUNC_map_lookup_elem
),
2500 BPF_MOV64_IMM(BPF_REG_0
, 0),
2503 .fixup_map1
= { 1 },
2505 .errstr
= "invalid access to packet",
2506 .prog_type
= BPF_PROG_TYPE_XDP
,
2509 "helper access to packet: test3, variable add",
2511 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2512 offsetof(struct xdp_md
, data
)),
2513 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2514 offsetof(struct xdp_md
, data_end
)),
2515 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2516 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
2517 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 10),
2518 BPF_LDX_MEM(BPF_B
, BPF_REG_5
, BPF_REG_2
, 0),
2519 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2520 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_5
),
2521 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
2522 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 8),
2523 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_3
, 4),
2524 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2525 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_4
),
2526 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2527 BPF_FUNC_map_lookup_elem
),
2528 BPF_MOV64_IMM(BPF_REG_0
, 0),
2531 .fixup_map1
= { 11 },
2533 .prog_type
= BPF_PROG_TYPE_XDP
,
2536 "helper access to packet: test4, packet_ptr with bad range",
2538 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2539 offsetof(struct xdp_md
, data
)),
2540 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2541 offsetof(struct xdp_md
, data_end
)),
2542 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2543 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 4),
2544 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 2),
2545 BPF_MOV64_IMM(BPF_REG_0
, 0),
2547 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2548 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2549 BPF_FUNC_map_lookup_elem
),
2550 BPF_MOV64_IMM(BPF_REG_0
, 0),
2553 .fixup_map1
= { 7 },
2555 .errstr
= "invalid access to packet",
2556 .prog_type
= BPF_PROG_TYPE_XDP
,
2559 "helper access to packet: test5, packet_ptr with too short range",
2561 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2562 offsetof(struct xdp_md
, data
)),
2563 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2564 offsetof(struct xdp_md
, data_end
)),
2565 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
2566 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2567 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 7),
2568 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 3),
2569 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2570 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2571 BPF_FUNC_map_lookup_elem
),
2572 BPF_MOV64_IMM(BPF_REG_0
, 0),
2575 .fixup_map1
= { 6 },
2577 .errstr
= "invalid access to packet",
2578 .prog_type
= BPF_PROG_TYPE_XDP
,
2581 "helper access to packet: test6, cls valid packet_ptr range",
2583 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2584 offsetof(struct __sk_buff
, data
)),
2585 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2586 offsetof(struct __sk_buff
, data_end
)),
2587 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
2588 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 8),
2589 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 5),
2590 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2591 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_2
),
2592 BPF_MOV64_IMM(BPF_REG_4
, 0),
2593 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2594 BPF_FUNC_map_update_elem
),
2595 BPF_MOV64_IMM(BPF_REG_0
, 0),
2598 .fixup_map1
= { 5 },
2600 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2603 "helper access to packet: test7, cls unchecked packet_ptr",
2605 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2606 offsetof(struct __sk_buff
, data
)),
2607 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2608 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2609 BPF_FUNC_map_lookup_elem
),
2610 BPF_MOV64_IMM(BPF_REG_0
, 0),
2613 .fixup_map1
= { 1 },
2615 .errstr
= "invalid access to packet",
2616 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2619 "helper access to packet: test8, cls variable add",
2621 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2622 offsetof(struct __sk_buff
, data
)),
2623 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2624 offsetof(struct __sk_buff
, data_end
)),
2625 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2626 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 8),
2627 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 10),
2628 BPF_LDX_MEM(BPF_B
, BPF_REG_5
, BPF_REG_2
, 0),
2629 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2630 BPF_ALU64_REG(BPF_ADD
, BPF_REG_4
, BPF_REG_5
),
2631 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_4
),
2632 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_5
, 8),
2633 BPF_JMP_REG(BPF_JGT
, BPF_REG_5
, BPF_REG_3
, 4),
2634 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2635 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_4
),
2636 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2637 BPF_FUNC_map_lookup_elem
),
2638 BPF_MOV64_IMM(BPF_REG_0
, 0),
2641 .fixup_map1
= { 11 },
2643 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2646 "helper access to packet: test9, cls packet_ptr with bad range",
2648 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2649 offsetof(struct __sk_buff
, data
)),
2650 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2651 offsetof(struct __sk_buff
, data_end
)),
2652 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2653 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 4),
2654 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 2),
2655 BPF_MOV64_IMM(BPF_REG_0
, 0),
2657 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2658 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2659 BPF_FUNC_map_lookup_elem
),
2660 BPF_MOV64_IMM(BPF_REG_0
, 0),
2663 .fixup_map1
= { 7 },
2665 .errstr
= "invalid access to packet",
2666 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2669 "helper access to packet: test10, cls packet_ptr with too short range",
2671 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
2672 offsetof(struct __sk_buff
, data
)),
2673 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
2674 offsetof(struct __sk_buff
, data_end
)),
2675 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
2676 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_2
),
2677 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_4
, 7),
2678 BPF_JMP_REG(BPF_JGT
, BPF_REG_4
, BPF_REG_3
, 3),
2679 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2680 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2681 BPF_FUNC_map_lookup_elem
),
2682 BPF_MOV64_IMM(BPF_REG_0
, 0),
2685 .fixup_map1
= { 6 },
2687 .errstr
= "invalid access to packet",
2688 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2691 "helper access to packet: test11, cls unsuitable helper 1",
2693 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2694 offsetof(struct __sk_buff
, data
)),
2695 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2696 offsetof(struct __sk_buff
, data_end
)),
2697 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2698 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2699 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_3
, 7),
2700 BPF_JMP_REG(BPF_JGT
, BPF_REG_3
, BPF_REG_7
, 4),
2701 BPF_MOV64_IMM(BPF_REG_2
, 0),
2702 BPF_MOV64_IMM(BPF_REG_4
, 42),
2703 BPF_MOV64_IMM(BPF_REG_5
, 0),
2704 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2705 BPF_FUNC_skb_store_bytes
),
2706 BPF_MOV64_IMM(BPF_REG_0
, 0),
2710 .errstr
= "helper access to the packet",
2711 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2714 "helper access to packet: test12, cls unsuitable helper 2",
2716 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2717 offsetof(struct __sk_buff
, data
)),
2718 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2719 offsetof(struct __sk_buff
, data_end
)),
2720 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_6
),
2721 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 8),
2722 BPF_JMP_REG(BPF_JGT
, BPF_REG_6
, BPF_REG_7
, 3),
2723 BPF_MOV64_IMM(BPF_REG_2
, 0),
2724 BPF_MOV64_IMM(BPF_REG_4
, 4),
2725 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2726 BPF_FUNC_skb_load_bytes
),
2727 BPF_MOV64_IMM(BPF_REG_0
, 0),
2731 .errstr
= "helper access to the packet",
2732 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2735 "helper access to packet: test13, cls helper ok",
2737 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2738 offsetof(struct __sk_buff
, data
)),
2739 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2740 offsetof(struct __sk_buff
, data_end
)),
2741 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2742 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2743 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2744 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2745 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2746 BPF_MOV64_IMM(BPF_REG_2
, 4),
2747 BPF_MOV64_IMM(BPF_REG_3
, 0),
2748 BPF_MOV64_IMM(BPF_REG_4
, 0),
2749 BPF_MOV64_IMM(BPF_REG_5
, 0),
2750 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2751 BPF_FUNC_csum_diff
),
2752 BPF_MOV64_IMM(BPF_REG_0
, 0),
2756 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2759 "helper access to packet: test14, cls helper fail sub",
2761 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2762 offsetof(struct __sk_buff
, data
)),
2763 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2764 offsetof(struct __sk_buff
, data_end
)),
2765 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2766 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2767 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2768 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2769 BPF_ALU64_IMM(BPF_SUB
, BPF_REG_1
, 4),
2770 BPF_MOV64_IMM(BPF_REG_2
, 4),
2771 BPF_MOV64_IMM(BPF_REG_3
, 0),
2772 BPF_MOV64_IMM(BPF_REG_4
, 0),
2773 BPF_MOV64_IMM(BPF_REG_5
, 0),
2774 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2775 BPF_FUNC_csum_diff
),
2776 BPF_MOV64_IMM(BPF_REG_0
, 0),
2780 .errstr
= "type=inv expected=fp",
2781 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2784 "helper access to packet: test15, cls helper fail range 1",
2786 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2787 offsetof(struct __sk_buff
, data
)),
2788 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2789 offsetof(struct __sk_buff
, data_end
)),
2790 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2791 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2792 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2793 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2794 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2795 BPF_MOV64_IMM(BPF_REG_2
, 8),
2796 BPF_MOV64_IMM(BPF_REG_3
, 0),
2797 BPF_MOV64_IMM(BPF_REG_4
, 0),
2798 BPF_MOV64_IMM(BPF_REG_5
, 0),
2799 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2800 BPF_FUNC_csum_diff
),
2801 BPF_MOV64_IMM(BPF_REG_0
, 0),
2805 .errstr
= "invalid access to packet",
2806 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2809 "helper access to packet: test16, cls helper fail range 2",
2811 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2812 offsetof(struct __sk_buff
, data
)),
2813 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2814 offsetof(struct __sk_buff
, data_end
)),
2815 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2816 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2817 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2818 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2819 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2820 BPF_MOV64_IMM(BPF_REG_2
, -9),
2821 BPF_MOV64_IMM(BPF_REG_3
, 0),
2822 BPF_MOV64_IMM(BPF_REG_4
, 0),
2823 BPF_MOV64_IMM(BPF_REG_5
, 0),
2824 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2825 BPF_FUNC_csum_diff
),
2826 BPF_MOV64_IMM(BPF_REG_0
, 0),
2830 .errstr
= "invalid access to packet",
2831 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2834 "helper access to packet: test17, cls helper fail range 3",
2836 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2837 offsetof(struct __sk_buff
, data
)),
2838 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2839 offsetof(struct __sk_buff
, data_end
)),
2840 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2841 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2842 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2843 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2844 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2845 BPF_MOV64_IMM(BPF_REG_2
, ~0),
2846 BPF_MOV64_IMM(BPF_REG_3
, 0),
2847 BPF_MOV64_IMM(BPF_REG_4
, 0),
2848 BPF_MOV64_IMM(BPF_REG_5
, 0),
2849 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2850 BPF_FUNC_csum_diff
),
2851 BPF_MOV64_IMM(BPF_REG_0
, 0),
2855 .errstr
= "invalid access to packet",
2856 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2859 "helper access to packet: test18, cls helper fail range zero",
2861 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2862 offsetof(struct __sk_buff
, data
)),
2863 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2864 offsetof(struct __sk_buff
, data_end
)),
2865 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2866 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2867 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2868 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2869 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2870 BPF_MOV64_IMM(BPF_REG_2
, 0),
2871 BPF_MOV64_IMM(BPF_REG_3
, 0),
2872 BPF_MOV64_IMM(BPF_REG_4
, 0),
2873 BPF_MOV64_IMM(BPF_REG_5
, 0),
2874 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2875 BPF_FUNC_csum_diff
),
2876 BPF_MOV64_IMM(BPF_REG_0
, 0),
2880 .errstr
= "invalid access to packet",
2881 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2884 "helper access to packet: test19, pkt end as input",
2886 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2887 offsetof(struct __sk_buff
, data
)),
2888 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2889 offsetof(struct __sk_buff
, data_end
)),
2890 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2891 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2892 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2893 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2894 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_7
),
2895 BPF_MOV64_IMM(BPF_REG_2
, 4),
2896 BPF_MOV64_IMM(BPF_REG_3
, 0),
2897 BPF_MOV64_IMM(BPF_REG_4
, 0),
2898 BPF_MOV64_IMM(BPF_REG_5
, 0),
2899 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2900 BPF_FUNC_csum_diff
),
2901 BPF_MOV64_IMM(BPF_REG_0
, 0),
2905 .errstr
= "R1 type=pkt_end expected=fp",
2906 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2909 "helper access to packet: test20, wrong reg",
2911 BPF_LDX_MEM(BPF_W
, BPF_REG_6
, BPF_REG_1
,
2912 offsetof(struct __sk_buff
, data
)),
2913 BPF_LDX_MEM(BPF_W
, BPF_REG_7
, BPF_REG_1
,
2914 offsetof(struct __sk_buff
, data_end
)),
2915 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_6
, 1),
2916 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_6
),
2917 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 7),
2918 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_7
, 6),
2919 BPF_MOV64_IMM(BPF_REG_2
, 4),
2920 BPF_MOV64_IMM(BPF_REG_3
, 0),
2921 BPF_MOV64_IMM(BPF_REG_4
, 0),
2922 BPF_MOV64_IMM(BPF_REG_5
, 0),
2923 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2924 BPF_FUNC_csum_diff
),
2925 BPF_MOV64_IMM(BPF_REG_0
, 0),
2929 .errstr
= "invalid access to packet",
2930 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
2933 "valid map access into an array with a constant",
2935 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
2936 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2937 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
2938 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2939 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2940 BPF_FUNC_map_lookup_elem
),
2941 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
2942 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
2943 offsetof(struct test_val
, foo
)),
2946 .fixup_map2
= { 3 },
2947 .errstr_unpriv
= "R0 leaks addr",
2948 .result_unpriv
= REJECT
,
2952 "valid map access into an array with a register",
2954 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
2955 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2956 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
2957 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2958 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2959 BPF_FUNC_map_lookup_elem
),
2960 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
2961 BPF_MOV64_IMM(BPF_REG_1
, 4),
2962 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
2963 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
2964 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
2965 offsetof(struct test_val
, foo
)),
2968 .fixup_map2
= { 3 },
2969 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
2970 .result_unpriv
= REJECT
,
2972 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
2975 "valid map access into an array with a variable",
2977 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
2978 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
2979 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
2980 BPF_LD_MAP_FD(BPF_REG_1
, 0),
2981 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
2982 BPF_FUNC_map_lookup_elem
),
2983 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
2984 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
2985 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
, 3),
2986 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
2987 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
2988 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
2989 offsetof(struct test_val
, foo
)),
2992 .fixup_map2
= { 3 },
2993 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
2994 .result_unpriv
= REJECT
,
2996 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
2999 "valid map access into an array with a signed variable",
3001 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3002 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3003 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3004 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3005 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3006 BPF_FUNC_map_lookup_elem
),
3007 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 9),
3008 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3009 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_1
, 0xffffffff, 1),
3010 BPF_MOV32_IMM(BPF_REG_1
, 0),
3011 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
),
3012 BPF_JMP_REG(BPF_JSGT
, BPF_REG_2
, BPF_REG_1
, 1),
3013 BPF_MOV32_IMM(BPF_REG_1
, 0),
3014 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3015 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3016 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3017 offsetof(struct test_val
, foo
)),
3020 .fixup_map2
= { 3 },
3021 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3022 .result_unpriv
= REJECT
,
3024 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3027 "invalid map access into an array with a constant",
3029 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3030 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3031 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3032 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3033 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3034 BPF_FUNC_map_lookup_elem
),
3035 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3036 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, (MAX_ENTRIES
+ 1) << 2,
3037 offsetof(struct test_val
, foo
)),
3040 .fixup_map2
= { 3 },
3041 .errstr
= "invalid access to map value, value_size=48 off=48 size=8",
3045 "invalid map access into an array with a register",
3047 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3048 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3049 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3050 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3051 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3052 BPF_FUNC_map_lookup_elem
),
3053 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3054 BPF_MOV64_IMM(BPF_REG_1
, MAX_ENTRIES
+ 1),
3055 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3056 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3057 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3058 offsetof(struct test_val
, foo
)),
3061 .fixup_map2
= { 3 },
3062 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3063 .errstr
= "R0 min value is outside of the array range",
3064 .result_unpriv
= REJECT
,
3066 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3069 "invalid map access into an array with a variable",
3071 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3072 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3073 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3074 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3075 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3076 BPF_FUNC_map_lookup_elem
),
3077 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3078 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3079 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3080 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3081 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3082 offsetof(struct test_val
, foo
)),
3085 .fixup_map2
= { 3 },
3086 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3087 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3088 .result_unpriv
= REJECT
,
3090 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3093 "invalid map access into an array with no floor check",
3095 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3096 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3097 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3098 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3099 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3100 BPF_FUNC_map_lookup_elem
),
3101 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3102 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3103 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
),
3104 BPF_JMP_REG(BPF_JSGT
, BPF_REG_2
, BPF_REG_1
, 1),
3105 BPF_MOV32_IMM(BPF_REG_1
, 0),
3106 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3107 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3108 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3109 offsetof(struct test_val
, foo
)),
3112 .fixup_map2
= { 3 },
3113 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3114 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3115 .result_unpriv
= REJECT
,
3117 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3120 "invalid map access into an array with a invalid max check",
3122 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3123 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3124 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3125 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3126 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3127 BPF_FUNC_map_lookup_elem
),
3128 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3129 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3130 BPF_MOV32_IMM(BPF_REG_2
, MAX_ENTRIES
+ 1),
3131 BPF_JMP_REG(BPF_JGT
, BPF_REG_2
, BPF_REG_1
, 1),
3132 BPF_MOV32_IMM(BPF_REG_1
, 0),
3133 BPF_ALU32_IMM(BPF_LSH
, BPF_REG_1
, 2),
3134 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3135 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
3136 offsetof(struct test_val
, foo
)),
3139 .fixup_map2
= { 3 },
3140 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3141 .errstr
= "invalid access to map value, value_size=48 off=44 size=8",
3142 .result_unpriv
= REJECT
,
3144 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3147 "invalid map access into an array with a invalid max check",
3149 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3150 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3151 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3152 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3153 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3154 BPF_FUNC_map_lookup_elem
),
3155 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
3156 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
3157 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3158 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3159 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3160 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3161 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3162 BPF_FUNC_map_lookup_elem
),
3163 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
3164 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_8
),
3165 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_0
,
3166 offsetof(struct test_val
, foo
)),
3169 .fixup_map2
= { 3, 11 },
3170 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3171 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3172 .result_unpriv
= REJECT
,
3174 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3177 "multiple registers share map_lookup_elem result",
3179 BPF_MOV64_IMM(BPF_REG_1
, 10),
3180 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3181 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3182 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3183 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3184 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3185 BPF_FUNC_map_lookup_elem
),
3186 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3187 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3188 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3191 .fixup_map1
= { 4 },
3193 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3196 "invalid memory access with multiple map_lookup_elem calls",
3198 BPF_MOV64_IMM(BPF_REG_1
, 10),
3199 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3200 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3201 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3202 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3203 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_1
),
3204 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
3205 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3206 BPF_FUNC_map_lookup_elem
),
3207 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3208 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_8
),
3209 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
3210 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3211 BPF_FUNC_map_lookup_elem
),
3212 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3213 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3216 .fixup_map1
= { 4 },
3218 .errstr
= "R4 !read_ok",
3219 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3222 "valid indirect map_lookup_elem access with 2nd lookup in branch",
3224 BPF_MOV64_IMM(BPF_REG_1
, 10),
3225 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3226 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3227 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3228 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3229 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_1
),
3230 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_2
),
3231 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3232 BPF_FUNC_map_lookup_elem
),
3233 BPF_MOV64_IMM(BPF_REG_2
, 10),
3234 BPF_JMP_IMM(BPF_JNE
, BPF_REG_2
, 0, 3),
3235 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_8
),
3236 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_7
),
3237 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3238 BPF_FUNC_map_lookup_elem
),
3239 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3240 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3241 BPF_ST_MEM(BPF_DW
, BPF_REG_4
, 0, 0),
3244 .fixup_map1
= { 4 },
3246 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3249 "multiple registers share map_lookup_elem bad reg type",
3251 BPF_MOV64_IMM(BPF_REG_1
, 10),
3252 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_1
, -8),
3253 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3254 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3255 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3256 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
3257 BPF_FUNC_map_lookup_elem
),
3258 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_0
),
3259 BPF_MOV64_REG(BPF_REG_3
, BPF_REG_0
),
3260 BPF_MOV64_REG(BPF_REG_4
, BPF_REG_0
),
3261 BPF_MOV64_REG(BPF_REG_5
, BPF_REG_0
),
3262 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3263 BPF_MOV64_IMM(BPF_REG_1
, 1),
3264 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
3265 BPF_MOV64_IMM(BPF_REG_1
, 2),
3266 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_3
, 0, 1),
3267 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 0),
3268 BPF_MOV64_IMM(BPF_REG_1
, 3),
3271 .fixup_map1
= { 4 },
3273 .errstr
= "R3 invalid mem access 'inv'",
3274 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
3277 "invalid map access from else condition",
3279 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
3280 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3281 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3282 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3283 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, BPF_FUNC_map_lookup_elem
),
3284 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3285 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
3286 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
-1, 1),
3287 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 1),
3288 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
3289 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
3290 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, offsetof(struct test_val
, foo
)),
3293 .fixup_map2
= { 3 },
3294 .errstr
= "R0 unbounded memory access, make sure to bounds check any array access into a map",
3296 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
3297 .result_unpriv
= REJECT
,
3298 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
3301 "constant register |= constant should keep constant type",
3303 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
3304 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
3305 BPF_MOV64_IMM(BPF_REG_2
, 34),
3306 BPF_ALU64_IMM(BPF_OR
, BPF_REG_2
, 13),
3307 BPF_MOV64_IMM(BPF_REG_3
, 0),
3308 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3312 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3315 "constant register |= constant should not bypass stack boundary checks",
3317 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
3318 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
3319 BPF_MOV64_IMM(BPF_REG_2
, 34),
3320 BPF_ALU64_IMM(BPF_OR
, BPF_REG_2
, 24),
3321 BPF_MOV64_IMM(BPF_REG_3
, 0),
3322 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3325 .errstr
= "invalid stack type R1 off=-48 access_size=58",
3327 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3330 "constant register |= constant register should keep constant type",
3332 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
3333 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
3334 BPF_MOV64_IMM(BPF_REG_2
, 34),
3335 BPF_MOV64_IMM(BPF_REG_4
, 13),
3336 BPF_ALU64_REG(BPF_OR
, BPF_REG_2
, BPF_REG_4
),
3337 BPF_MOV64_IMM(BPF_REG_3
, 0),
3338 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3342 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3345 "constant register |= constant register should not bypass stack boundary checks",
3347 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
3348 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -48),
3349 BPF_MOV64_IMM(BPF_REG_2
, 34),
3350 BPF_MOV64_IMM(BPF_REG_4
, 24),
3351 BPF_ALU64_REG(BPF_OR
, BPF_REG_2
, BPF_REG_4
),
3352 BPF_MOV64_IMM(BPF_REG_3
, 0),
3353 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3356 .errstr
= "invalid stack type R1 off=-48 access_size=58",
3358 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3361 "invalid direct packet write for LWT_IN",
3363 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3364 offsetof(struct __sk_buff
, data
)),
3365 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3366 offsetof(struct __sk_buff
, data_end
)),
3367 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3368 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3369 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3370 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
3371 BPF_MOV64_IMM(BPF_REG_0
, 0),
3374 .errstr
= "cannot write into packet",
3376 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
3379 "invalid direct packet write for LWT_OUT",
3381 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3382 offsetof(struct __sk_buff
, data
)),
3383 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3384 offsetof(struct __sk_buff
, data_end
)),
3385 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3386 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3387 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3388 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
3389 BPF_MOV64_IMM(BPF_REG_0
, 0),
3392 .errstr
= "cannot write into packet",
3394 .prog_type
= BPF_PROG_TYPE_LWT_OUT
,
3397 "direct packet write for LWT_XMIT",
3399 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3400 offsetof(struct __sk_buff
, data
)),
3401 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3402 offsetof(struct __sk_buff
, data_end
)),
3403 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3404 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3405 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3406 BPF_STX_MEM(BPF_B
, BPF_REG_2
, BPF_REG_2
, 0),
3407 BPF_MOV64_IMM(BPF_REG_0
, 0),
3411 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
3414 "direct packet read for LWT_IN",
3416 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3417 offsetof(struct __sk_buff
, data
)),
3418 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3419 offsetof(struct __sk_buff
, data_end
)),
3420 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3421 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3422 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3423 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3424 BPF_MOV64_IMM(BPF_REG_0
, 0),
3428 .prog_type
= BPF_PROG_TYPE_LWT_IN
,
3431 "direct packet read for LWT_OUT",
3433 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3434 offsetof(struct __sk_buff
, data
)),
3435 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3436 offsetof(struct __sk_buff
, data_end
)),
3437 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3438 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3439 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3440 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3441 BPF_MOV64_IMM(BPF_REG_0
, 0),
3445 .prog_type
= BPF_PROG_TYPE_LWT_OUT
,
3448 "direct packet read for LWT_XMIT",
3450 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3451 offsetof(struct __sk_buff
, data
)),
3452 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3453 offsetof(struct __sk_buff
, data_end
)),
3454 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3455 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3456 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 1),
3457 BPF_LDX_MEM(BPF_B
, BPF_REG_0
, BPF_REG_2
, 0),
3458 BPF_MOV64_IMM(BPF_REG_0
, 0),
3462 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
3465 "overlapping checks for direct packet access",
3467 BPF_LDX_MEM(BPF_W
, BPF_REG_2
, BPF_REG_1
,
3468 offsetof(struct __sk_buff
, data
)),
3469 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_1
,
3470 offsetof(struct __sk_buff
, data_end
)),
3471 BPF_MOV64_REG(BPF_REG_0
, BPF_REG_2
),
3472 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 8),
3473 BPF_JMP_REG(BPF_JGT
, BPF_REG_0
, BPF_REG_3
, 4),
3474 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_2
),
3475 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 6),
3476 BPF_JMP_REG(BPF_JGT
, BPF_REG_1
, BPF_REG_3
, 1),
3477 BPF_LDX_MEM(BPF_H
, BPF_REG_0
, BPF_REG_2
, 6),
3478 BPF_MOV64_IMM(BPF_REG_0
, 0),
3482 .prog_type
= BPF_PROG_TYPE_LWT_XMIT
,
3485 "invalid access of tc_classid for LWT_IN",
3487 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
3488 offsetof(struct __sk_buff
, tc_classid
)),
3492 .errstr
= "invalid bpf_context access",
3495 "invalid access of tc_classid for LWT_OUT",
3497 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
3498 offsetof(struct __sk_buff
, tc_classid
)),
3502 .errstr
= "invalid bpf_context access",
3505 "invalid access of tc_classid for LWT_XMIT",
3507 BPF_LDX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_1
,
3508 offsetof(struct __sk_buff
, tc_classid
)),
3512 .errstr
= "invalid bpf_context access",
3515 "helper access to map: full range",
3517 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3518 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3519 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3520 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3521 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3522 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3523 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3524 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
3525 BPF_MOV64_IMM(BPF_REG_3
, 0),
3526 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3529 .fixup_map2
= { 3 },
3531 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3534 "helper access to map: partial range",
3536 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3537 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3538 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3539 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3540 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3541 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3542 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3543 BPF_MOV64_IMM(BPF_REG_2
, 8),
3544 BPF_MOV64_IMM(BPF_REG_3
, 0),
3545 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3548 .fixup_map2
= { 3 },
3550 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3553 "helper access to map: empty range",
3555 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3556 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3557 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3558 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3559 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3560 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3561 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3562 BPF_MOV64_IMM(BPF_REG_2
, 0),
3563 BPF_MOV64_IMM(BPF_REG_3
, 0),
3564 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3567 .fixup_map2
= { 3 },
3568 .errstr
= "invalid access to map value, value_size=48 off=0 size=0",
3570 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3573 "helper access to map: out-of-bound range",
3575 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3576 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3577 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3578 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3579 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3580 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3581 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3582 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
) + 8),
3583 BPF_MOV64_IMM(BPF_REG_3
, 0),
3584 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3587 .fixup_map2
= { 3 },
3588 .errstr
= "invalid access to map value, value_size=48 off=0 size=56",
3590 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3593 "helper access to map: negative range",
3595 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3596 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3597 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3598 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3599 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3600 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
3601 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3602 BPF_MOV64_IMM(BPF_REG_2
, -8),
3603 BPF_MOV64_IMM(BPF_REG_3
, 0),
3604 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3607 .fixup_map2
= { 3 },
3608 .errstr
= "invalid access to map value, value_size=48 off=0 size=-8",
3610 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3613 "helper access to adjusted map (via const imm): full range",
3615 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3616 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3617 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3618 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3619 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3620 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3621 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3622 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3623 offsetof(struct test_val
, foo
)),
3624 BPF_MOV64_IMM(BPF_REG_2
,
3625 sizeof(struct test_val
) -
3626 offsetof(struct test_val
, foo
)),
3627 BPF_MOV64_IMM(BPF_REG_3
, 0),
3628 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3631 .fixup_map2
= { 3 },
3633 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3636 "helper access to adjusted map (via const imm): partial range",
3638 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3639 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3640 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3641 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3642 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3643 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3644 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3645 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3646 offsetof(struct test_val
, foo
)),
3647 BPF_MOV64_IMM(BPF_REG_2
, 8),
3648 BPF_MOV64_IMM(BPF_REG_3
, 0),
3649 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3652 .fixup_map2
= { 3 },
3654 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3657 "helper access to adjusted map (via const imm): empty range",
3659 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3660 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3661 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3662 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3663 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3664 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3665 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3666 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3667 offsetof(struct test_val
, foo
)),
3668 BPF_MOV64_IMM(BPF_REG_2
, 0),
3669 BPF_MOV64_IMM(BPF_REG_3
, 0),
3670 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3673 .fixup_map2
= { 3 },
3674 .errstr
= "R1 min value is outside of the array range",
3676 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3679 "helper access to adjusted map (via const imm): out-of-bound range",
3681 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3682 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3683 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3684 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3685 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3686 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3687 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3688 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3689 offsetof(struct test_val
, foo
)),
3690 BPF_MOV64_IMM(BPF_REG_2
,
3691 sizeof(struct test_val
) -
3692 offsetof(struct test_val
, foo
) + 8),
3693 BPF_MOV64_IMM(BPF_REG_3
, 0),
3694 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3697 .fixup_map2
= { 3 },
3698 .errstr
= "invalid access to map value, value_size=48 off=4 size=52",
3700 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3703 "helper access to adjusted map (via const imm): negative range (> adjustment)",
3705 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3706 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3707 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3708 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3709 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3710 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3711 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3712 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3713 offsetof(struct test_val
, foo
)),
3714 BPF_MOV64_IMM(BPF_REG_2
, -8),
3715 BPF_MOV64_IMM(BPF_REG_3
, 0),
3716 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3719 .fixup_map2
= { 3 },
3720 .errstr
= "invalid access to map value, value_size=48 off=4 size=-8",
3722 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3725 "helper access to adjusted map (via const imm): negative range (< adjustment)",
3727 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3728 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3729 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3730 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3731 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3732 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 5),
3733 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3734 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
,
3735 offsetof(struct test_val
, foo
)),
3736 BPF_MOV64_IMM(BPF_REG_2
, -1),
3737 BPF_MOV64_IMM(BPF_REG_3
, 0),
3738 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3741 .fixup_map2
= { 3 },
3742 .errstr
= "R1 min value is outside of the array range",
3744 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3747 "helper access to adjusted map (via const reg): full range",
3749 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3750 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3751 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3752 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3753 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3754 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3755 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3756 BPF_MOV64_IMM(BPF_REG_3
,
3757 offsetof(struct test_val
, foo
)),
3758 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3759 BPF_MOV64_IMM(BPF_REG_2
,
3760 sizeof(struct test_val
) -
3761 offsetof(struct test_val
, foo
)),
3762 BPF_MOV64_IMM(BPF_REG_3
, 0),
3763 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3766 .fixup_map2
= { 3 },
3768 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3771 "helper access to adjusted map (via const reg): partial range",
3773 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3774 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3775 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3776 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3777 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3778 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3779 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3780 BPF_MOV64_IMM(BPF_REG_3
,
3781 offsetof(struct test_val
, foo
)),
3782 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3783 BPF_MOV64_IMM(BPF_REG_2
, 8),
3784 BPF_MOV64_IMM(BPF_REG_3
, 0),
3785 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3788 .fixup_map2
= { 3 },
3790 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3793 "helper access to adjusted map (via const reg): empty range",
3795 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3796 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3797 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3798 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3799 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3800 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3801 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3802 BPF_MOV64_IMM(BPF_REG_3
, 0),
3803 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3804 BPF_MOV64_IMM(BPF_REG_2
, 0),
3805 BPF_MOV64_IMM(BPF_REG_3
, 0),
3806 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3809 .fixup_map2
= { 3 },
3810 .errstr
= "R1 min value is outside of the array range",
3812 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3815 "helper access to adjusted map (via const reg): out-of-bound range",
3817 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3818 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3819 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3820 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3821 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3822 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3823 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3824 BPF_MOV64_IMM(BPF_REG_3
,
3825 offsetof(struct test_val
, foo
)),
3826 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3827 BPF_MOV64_IMM(BPF_REG_2
,
3828 sizeof(struct test_val
) -
3829 offsetof(struct test_val
, foo
) + 8),
3830 BPF_MOV64_IMM(BPF_REG_3
, 0),
3831 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3834 .fixup_map2
= { 3 },
3835 .errstr
= "invalid access to map value, value_size=48 off=4 size=52",
3837 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3840 "helper access to adjusted map (via const reg): negative range (> adjustment)",
3842 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3843 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3844 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3845 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3846 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3847 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3848 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3849 BPF_MOV64_IMM(BPF_REG_3
,
3850 offsetof(struct test_val
, foo
)),
3851 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3852 BPF_MOV64_IMM(BPF_REG_2
, -8),
3853 BPF_MOV64_IMM(BPF_REG_3
, 0),
3854 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3857 .fixup_map2
= { 3 },
3858 .errstr
= "invalid access to map value, value_size=48 off=4 size=-8",
3860 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3863 "helper access to adjusted map (via const reg): negative range (< adjustment)",
3865 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3866 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3867 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3868 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3869 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3870 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3871 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3872 BPF_MOV64_IMM(BPF_REG_3
,
3873 offsetof(struct test_val
, foo
)),
3874 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3875 BPF_MOV64_IMM(BPF_REG_2
, -1),
3876 BPF_MOV64_IMM(BPF_REG_3
, 0),
3877 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3880 .fixup_map2
= { 3 },
3881 .errstr
= "R1 min value is outside of the array range",
3883 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3886 "helper access to adjusted map (via variable): full range",
3888 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3889 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3890 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3891 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3892 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3893 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3894 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3895 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
3896 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
3897 offsetof(struct test_val
, foo
), 4),
3898 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3899 BPF_MOV64_IMM(BPF_REG_2
,
3900 sizeof(struct test_val
) -
3901 offsetof(struct test_val
, foo
)),
3902 BPF_MOV64_IMM(BPF_REG_3
, 0),
3903 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3906 .fixup_map2
= { 3 },
3908 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3911 "helper access to adjusted map (via variable): partial range",
3913 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3914 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3915 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3916 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3917 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3918 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3919 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3920 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
3921 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
3922 offsetof(struct test_val
, foo
), 4),
3923 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3924 BPF_MOV64_IMM(BPF_REG_2
, 8),
3925 BPF_MOV64_IMM(BPF_REG_3
, 0),
3926 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3929 .fixup_map2
= { 3 },
3931 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3934 "helper access to adjusted map (via variable): empty range",
3936 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3937 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3938 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3939 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3940 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3941 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3942 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3943 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
3944 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
3945 offsetof(struct test_val
, foo
), 4),
3946 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3947 BPF_MOV64_IMM(BPF_REG_2
, 0),
3948 BPF_MOV64_IMM(BPF_REG_3
, 0),
3949 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3952 .fixup_map2
= { 3 },
3953 .errstr
= "R1 min value is outside of the array range",
3955 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3958 "helper access to adjusted map (via variable): no max check",
3960 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3961 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3962 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3963 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3964 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3965 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
3966 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3967 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
3968 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3969 BPF_MOV64_IMM(BPF_REG_2
, 0),
3970 BPF_MOV64_IMM(BPF_REG_3
, 0),
3971 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
3974 .fixup_map2
= { 3 },
3975 .errstr
= "R1 min value is negative, either use unsigned index or do a if (index >=0) check",
3977 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
3980 "helper access to adjusted map (via variable): wrong max check",
3982 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
3983 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
3984 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
3985 BPF_LD_MAP_FD(BPF_REG_1
, 0),
3986 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
3987 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
3988 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
3989 BPF_LDX_MEM(BPF_W
, BPF_REG_3
, BPF_REG_0
, 0),
3990 BPF_JMP_IMM(BPF_JGT
, BPF_REG_3
,
3991 offsetof(struct test_val
, foo
), 4),
3992 BPF_ALU64_REG(BPF_ADD
, BPF_REG_1
, BPF_REG_3
),
3993 BPF_MOV64_IMM(BPF_REG_2
,
3994 sizeof(struct test_val
) -
3995 offsetof(struct test_val
, foo
) + 1),
3996 BPF_MOV64_IMM(BPF_REG_3
, 0),
3997 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4000 .fixup_map2
= { 3 },
4001 .errstr
= "invalid access to map value, value_size=48 off=4 size=45",
4003 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4006 "map element value is preserved across register spilling",
4008 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4009 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4010 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4011 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4012 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4013 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 6),
4014 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
4015 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4016 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -184),
4017 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
4018 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
4019 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
4022 .fixup_map2
= { 3 },
4023 .errstr_unpriv
= "R0 leaks addr",
4025 .result_unpriv
= REJECT
,
4028 "map element value or null is marked on register spilling",
4030 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4031 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4032 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4033 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4034 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4035 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4036 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -152),
4037 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
4038 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
4039 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
4040 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
4043 .fixup_map2
= { 3 },
4044 .errstr_unpriv
= "R0 leaks addr",
4046 .result_unpriv
= REJECT
,
4049 "map element value store of cleared call register",
4051 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4052 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4053 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4054 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4055 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4056 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 1),
4057 BPF_STX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0),
4060 .fixup_map2
= { 3 },
4061 .errstr_unpriv
= "R1 !read_ok",
4062 .errstr
= "R1 !read_ok",
4064 .result_unpriv
= REJECT
,
4067 "map element value with unaligned store",
4069 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4070 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4071 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4072 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4073 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4074 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 17),
4075 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 3),
4076 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
4077 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 2, 43),
4078 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, -2, 44),
4079 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
4080 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 0, 32),
4081 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 2, 33),
4082 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, -2, 34),
4083 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_8
, 5),
4084 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 0, 22),
4085 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, 4, 23),
4086 BPF_ST_MEM(BPF_DW
, BPF_REG_8
, -7, 24),
4087 BPF_MOV64_REG(BPF_REG_7
, BPF_REG_8
),
4088 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_7
, 3),
4089 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, 0, 22),
4090 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, 4, 23),
4091 BPF_ST_MEM(BPF_DW
, BPF_REG_7
, -4, 24),
4094 .fixup_map2
= { 3 },
4095 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4097 .result_unpriv
= REJECT
,
4098 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4101 "map element value with unaligned load",
4103 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4104 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4105 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4106 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4107 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4108 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
4109 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
4110 BPF_JMP_IMM(BPF_JGE
, BPF_REG_1
, MAX_ENTRIES
, 9),
4111 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 3),
4112 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
4113 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 2),
4114 BPF_MOV64_REG(BPF_REG_8
, BPF_REG_0
),
4115 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_8
, 0),
4116 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_8
, 2),
4117 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
, 5),
4118 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 0),
4119 BPF_LDX_MEM(BPF_DW
, BPF_REG_7
, BPF_REG_0
, 4),
4122 .fixup_map2
= { 3 },
4123 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4125 .result_unpriv
= REJECT
,
4126 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4129 "map element value illegal alu op, 1",
4131 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4132 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4133 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4134 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4135 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4136 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
4137 BPF_ALU64_IMM(BPF_AND
, BPF_REG_0
, 8),
4138 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
4141 .fixup_map2
= { 3 },
4142 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4143 .errstr
= "invalid mem access 'inv'",
4145 .result_unpriv
= REJECT
,
4148 "map element value illegal alu op, 2",
4150 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4151 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4152 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4153 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4154 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4155 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
4156 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_0
, 0),
4157 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
4160 .fixup_map2
= { 3 },
4161 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4162 .errstr
= "invalid mem access 'inv'",
4164 .result_unpriv
= REJECT
,
4167 "map element value illegal alu op, 3",
4169 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4170 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4171 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4172 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4173 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4174 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
4175 BPF_ALU64_IMM(BPF_DIV
, BPF_REG_0
, 42),
4176 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
4179 .fixup_map2
= { 3 },
4180 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4181 .errstr
= "invalid mem access 'inv'",
4183 .result_unpriv
= REJECT
,
4186 "map element value illegal alu op, 4",
4188 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4189 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4190 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4191 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4192 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4193 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
4194 BPF_ENDIAN(BPF_FROM_BE
, BPF_REG_0
, 64),
4195 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
4198 .fixup_map2
= { 3 },
4199 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4200 .errstr
= "invalid mem access 'inv'",
4202 .result_unpriv
= REJECT
,
4205 "map element value illegal alu op, 5",
4207 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4208 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4209 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4210 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4211 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4212 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
4213 BPF_MOV64_IMM(BPF_REG_3
, 4096),
4214 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4215 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4216 BPF_STX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_0
, 0),
4217 BPF_STX_XADD(BPF_DW
, BPF_REG_2
, BPF_REG_3
, 0),
4218 BPF_LDX_MEM(BPF_DW
, BPF_REG_0
, BPF_REG_2
, 0),
4219 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 22),
4222 .fixup_map2
= { 3 },
4223 .errstr_unpriv
= "R0 invalid mem access 'inv'",
4224 .errstr
= "R0 invalid mem access 'inv'",
4226 .result_unpriv
= REJECT
,
4229 "map element value is preserved across register spilling",
4231 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4232 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4233 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4234 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4235 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4236 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 7),
4237 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_0
,
4238 offsetof(struct test_val
, foo
)),
4239 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0, 42),
4240 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4241 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -184),
4242 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_0
, 0),
4243 BPF_LDX_MEM(BPF_DW
, BPF_REG_3
, BPF_REG_1
, 0),
4244 BPF_ST_MEM(BPF_DW
, BPF_REG_3
, 0, 42),
4247 .fixup_map2
= { 3 },
4248 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4250 .result_unpriv
= REJECT
,
4251 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4254 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
4256 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4257 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4258 BPF_MOV64_IMM(BPF_REG_0
, 0),
4259 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
4260 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
4261 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
4262 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
4263 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
4264 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
4265 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
4266 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
4267 BPF_MOV64_IMM(BPF_REG_2
, 16),
4268 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4269 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4270 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
4271 BPF_MOV64_IMM(BPF_REG_4
, 0),
4272 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4273 BPF_MOV64_IMM(BPF_REG_3
, 0),
4274 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4275 BPF_MOV64_IMM(BPF_REG_0
, 0),
4279 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4282 "helper access to variable memory: stack, bitwise AND, zero included",
4284 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4285 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4286 BPF_MOV64_IMM(BPF_REG_2
, 16),
4287 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4288 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4289 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
4290 BPF_MOV64_IMM(BPF_REG_3
, 0),
4291 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4294 .errstr
= "invalid stack type R1 off=-64 access_size=0",
4296 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4299 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
4301 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4302 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4303 BPF_MOV64_IMM(BPF_REG_2
, 16),
4304 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4305 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4306 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 65),
4307 BPF_MOV64_IMM(BPF_REG_4
, 0),
4308 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4309 BPF_MOV64_IMM(BPF_REG_3
, 0),
4310 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4311 BPF_MOV64_IMM(BPF_REG_0
, 0),
4314 .errstr
= "invalid stack type R1 off=-64 access_size=65",
4316 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4319 "helper access to variable memory: stack, JMP, correct bounds",
4321 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4322 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4323 BPF_MOV64_IMM(BPF_REG_0
, 0),
4324 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
4325 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
4326 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
4327 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
4328 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
4329 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
4330 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
4331 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
4332 BPF_MOV64_IMM(BPF_REG_2
, 16),
4333 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4334 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4335 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 4),
4336 BPF_MOV64_IMM(BPF_REG_4
, 0),
4337 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4338 BPF_MOV64_IMM(BPF_REG_3
, 0),
4339 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4340 BPF_MOV64_IMM(BPF_REG_0
, 0),
4344 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4347 "helper access to variable memory: stack, JMP (signed), correct bounds",
4349 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4350 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4351 BPF_MOV64_IMM(BPF_REG_0
, 0),
4352 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
4353 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
4354 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
4355 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
4356 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
4357 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
4358 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
4359 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
4360 BPF_MOV64_IMM(BPF_REG_2
, 16),
4361 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4362 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4363 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
, 64, 4),
4364 BPF_MOV64_IMM(BPF_REG_4
, 0),
4365 BPF_JMP_REG(BPF_JSGE
, BPF_REG_4
, BPF_REG_2
, 2),
4366 BPF_MOV64_IMM(BPF_REG_3
, 0),
4367 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4368 BPF_MOV64_IMM(BPF_REG_0
, 0),
4372 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4375 "helper access to variable memory: stack, JMP, bounds + offset",
4377 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4378 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4379 BPF_MOV64_IMM(BPF_REG_2
, 16),
4380 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4381 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4382 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 5),
4383 BPF_MOV64_IMM(BPF_REG_4
, 0),
4384 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 3),
4385 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
4386 BPF_MOV64_IMM(BPF_REG_3
, 0),
4387 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4388 BPF_MOV64_IMM(BPF_REG_0
, 0),
4391 .errstr
= "invalid stack type R1 off=-64 access_size=65",
4393 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4396 "helper access to variable memory: stack, JMP, wrong max",
4398 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4399 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4400 BPF_MOV64_IMM(BPF_REG_2
, 16),
4401 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4402 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4403 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 65, 4),
4404 BPF_MOV64_IMM(BPF_REG_4
, 0),
4405 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4406 BPF_MOV64_IMM(BPF_REG_3
, 0),
4407 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4408 BPF_MOV64_IMM(BPF_REG_0
, 0),
4411 .errstr
= "invalid stack type R1 off=-64 access_size=65",
4413 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4416 "helper access to variable memory: stack, JMP, no max check",
4418 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4419 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4420 BPF_MOV64_IMM(BPF_REG_2
, 16),
4421 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4422 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4423 BPF_MOV64_IMM(BPF_REG_4
, 0),
4424 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4425 BPF_MOV64_IMM(BPF_REG_3
, 0),
4426 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4427 BPF_MOV64_IMM(BPF_REG_0
, 0),
4430 .errstr
= "R2 unbounded memory access",
4432 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4435 "helper access to variable memory: stack, JMP, no min check",
4437 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4438 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4439 BPF_MOV64_IMM(BPF_REG_2
, 16),
4440 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4441 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4442 BPF_JMP_IMM(BPF_JGT
, BPF_REG_2
, 64, 3),
4443 BPF_MOV64_IMM(BPF_REG_3
, 0),
4444 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4445 BPF_MOV64_IMM(BPF_REG_0
, 0),
4448 .errstr
= "invalid stack type R1 off=-64 access_size=0",
4450 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4453 "helper access to variable memory: stack, JMP (signed), no min check",
4455 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4456 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4457 BPF_MOV64_IMM(BPF_REG_2
, 16),
4458 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, -128),
4459 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_1
, -128),
4460 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
, 64, 3),
4461 BPF_MOV64_IMM(BPF_REG_3
, 0),
4462 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4463 BPF_MOV64_IMM(BPF_REG_0
, 0),
4466 .errstr
= "R2 min value is negative",
4468 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4471 "helper access to variable memory: map, JMP, correct bounds",
4473 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4474 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4475 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4476 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4477 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4478 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
4479 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4480 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
4481 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4482 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4483 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
4484 sizeof(struct test_val
), 4),
4485 BPF_MOV64_IMM(BPF_REG_4
, 0),
4486 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4487 BPF_MOV64_IMM(BPF_REG_3
, 0),
4488 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4489 BPF_MOV64_IMM(BPF_REG_0
, 0),
4492 .fixup_map2
= { 3 },
4494 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4497 "helper access to variable memory: map, JMP, wrong max",
4499 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4500 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4501 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4502 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4503 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4504 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 10),
4505 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4506 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
4507 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4508 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4509 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
4510 sizeof(struct test_val
) + 1, 4),
4511 BPF_MOV64_IMM(BPF_REG_4
, 0),
4512 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4513 BPF_MOV64_IMM(BPF_REG_3
, 0),
4514 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4515 BPF_MOV64_IMM(BPF_REG_0
, 0),
4518 .fixup_map2
= { 3 },
4519 .errstr
= "invalid access to map value, value_size=48 off=0 size=49",
4521 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4524 "helper access to variable memory: map adjusted, JMP, correct bounds",
4526 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4527 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4528 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4529 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4530 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4531 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
4532 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4533 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 20),
4534 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
4535 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4536 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4537 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
4538 sizeof(struct test_val
) - 20, 4),
4539 BPF_MOV64_IMM(BPF_REG_4
, 0),
4540 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4541 BPF_MOV64_IMM(BPF_REG_3
, 0),
4542 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4543 BPF_MOV64_IMM(BPF_REG_0
, 0),
4546 .fixup_map2
= { 3 },
4548 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4551 "helper access to variable memory: map adjusted, JMP, wrong max",
4553 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4554 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4555 BPF_ST_MEM(BPF_DW
, BPF_REG_2
, 0, 0),
4556 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4557 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem
),
4558 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 11),
4559 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_0
),
4560 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, 20),
4561 BPF_MOV64_IMM(BPF_REG_2
, sizeof(struct test_val
)),
4562 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4563 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4564 BPF_JMP_IMM(BPF_JSGT
, BPF_REG_2
,
4565 sizeof(struct test_val
) - 19, 4),
4566 BPF_MOV64_IMM(BPF_REG_4
, 0),
4567 BPF_JMP_REG(BPF_JGE
, BPF_REG_4
, BPF_REG_2
, 2),
4568 BPF_MOV64_IMM(BPF_REG_3
, 0),
4569 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4570 BPF_MOV64_IMM(BPF_REG_0
, 0),
4573 .fixup_map2
= { 3 },
4574 .errstr
= "R1 min value is outside of the array range",
4576 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4579 "helper access to variable memory: size > 0 not allowed on NULL",
4581 BPF_MOV64_IMM(BPF_REG_1
, 0),
4582 BPF_MOV64_IMM(BPF_REG_2
, 0),
4583 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4584 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4585 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 64),
4586 BPF_MOV64_IMM(BPF_REG_3
, 0),
4587 BPF_MOV64_IMM(BPF_REG_4
, 0),
4588 BPF_MOV64_IMM(BPF_REG_5
, 0),
4589 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
4592 .errstr
= "R1 type=imm expected=fp",
4594 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
4597 "helper access to variable memory: size = 0 not allowed on != NULL",
4599 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4600 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -8),
4601 BPF_MOV64_IMM(BPF_REG_2
, 0),
4602 BPF_STX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_2
, 0),
4603 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 8),
4604 BPF_MOV64_IMM(BPF_REG_3
, 0),
4605 BPF_MOV64_IMM(BPF_REG_4
, 0),
4606 BPF_MOV64_IMM(BPF_REG_5
, 0),
4607 BPF_EMIT_CALL(BPF_FUNC_csum_diff
),
4610 .errstr
= "invalid stack type R1 off=-8 access_size=0",
4612 .prog_type
= BPF_PROG_TYPE_SCHED_CLS
,
4615 "helper access to variable memory: 8 bytes leak",
4617 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4618 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4619 BPF_MOV64_IMM(BPF_REG_0
, 0),
4620 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
4621 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
4622 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
4623 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
4624 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
4625 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
4626 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
4627 BPF_MOV64_IMM(BPF_REG_2
, 0),
4628 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_2
, -128),
4629 BPF_LDX_MEM(BPF_DW
, BPF_REG_2
, BPF_REG_10
, -128),
4630 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 63),
4631 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 1),
4632 BPF_MOV64_IMM(BPF_REG_3
, 0),
4633 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4634 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
4637 .errstr
= "invalid indirect read from stack off -64+32 size 64",
4639 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4642 "helper access to variable memory: 8 bytes no leak (init memory)",
4644 BPF_MOV64_REG(BPF_REG_1
, BPF_REG_10
),
4645 BPF_MOV64_IMM(BPF_REG_0
, 0),
4646 BPF_MOV64_IMM(BPF_REG_0
, 0),
4647 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -64),
4648 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -56),
4649 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -48),
4650 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -40),
4651 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -32),
4652 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -24),
4653 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -16),
4654 BPF_STX_MEM(BPF_DW
, BPF_REG_10
, BPF_REG_0
, -8),
4655 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_1
, -64),
4656 BPF_MOV64_IMM(BPF_REG_2
, 0),
4657 BPF_ALU64_IMM(BPF_AND
, BPF_REG_2
, 32),
4658 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, 32),
4659 BPF_MOV64_IMM(BPF_REG_3
, 0),
4660 BPF_EMIT_CALL(BPF_FUNC_probe_read
),
4661 BPF_LDX_MEM(BPF_DW
, BPF_REG_1
, BPF_REG_10
, -16),
4665 .prog_type
= BPF_PROG_TYPE_TRACEPOINT
,
4668 "invalid and of negative number",
4670 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
4671 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4672 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4673 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4674 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4675 BPF_FUNC_map_lookup_elem
),
4676 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 4),
4677 BPF_MOV64_IMM(BPF_REG_1
, 6),
4678 BPF_ALU64_IMM(BPF_AND
, BPF_REG_1
, -4),
4679 BPF_ALU64_IMM(BPF_LSH
, BPF_REG_1
, 2),
4680 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_1
),
4681 BPF_ST_MEM(BPF_DW
, BPF_REG_0
, 0,
4682 offsetof(struct test_val
, foo
)),
4685 .fixup_map2
= { 3 },
4686 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4687 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4689 .result_unpriv
= REJECT
,
4690 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4693 "invalid range check",
4695 BPF_ST_MEM(BPF_DW
, BPF_REG_10
, -8, 0),
4696 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
4697 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -8),
4698 BPF_LD_MAP_FD(BPF_REG_1
, 0),
4699 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0,
4700 BPF_FUNC_map_lookup_elem
),
4701 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 12),
4702 BPF_LDX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_0
, 0),
4703 BPF_MOV64_IMM(BPF_REG_9
, 1),
4704 BPF_ALU32_IMM(BPF_MOD
, BPF_REG_1
, 2),
4705 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_1
, 1),
4706 BPF_ALU32_REG(BPF_AND
, BPF_REG_9
, BPF_REG_1
),
4707 BPF_ALU32_IMM(BPF_ADD
, BPF_REG_9
, 1),
4708 BPF_ALU32_IMM(BPF_RSH
, BPF_REG_9
, 1),
4709 BPF_MOV32_IMM(BPF_REG_3
, 1),
4710 BPF_ALU32_REG(BPF_SUB
, BPF_REG_3
, BPF_REG_9
),
4711 BPF_ALU32_IMM(BPF_MUL
, BPF_REG_3
, 0x10000000),
4712 BPF_ALU64_REG(BPF_ADD
, BPF_REG_0
, BPF_REG_3
),
4713 BPF_STX_MEM(BPF_W
, BPF_REG_0
, BPF_REG_3
, 0),
4714 BPF_MOV64_REG(BPF_REG_0
, 0),
4717 .fixup_map2
= { 3 },
4718 .errstr_unpriv
= "R0 pointer arithmetic prohibited",
4719 .errstr
= "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4721 .result_unpriv
= REJECT
,
4722 .flags
= F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
,
4726 static int probe_filter_length(const struct bpf_insn
*fp
)
4730 for (len
= MAX_INSNS
- 1; len
> 0; --len
)
4731 if (fp
[len
].code
!= 0 || fp
[len
].imm
!= 0)
4736 static int create_map(uint32_t size_value
, uint32_t max_elem
)
4740 fd
= bpf_create_map(BPF_MAP_TYPE_HASH
, sizeof(long long),
4741 size_value
, max_elem
, BPF_F_NO_PREALLOC
);
4743 printf("Failed to create hash map '%s'!\n", strerror(errno
));
4748 static int create_prog_array(void)
4752 fd
= bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY
, sizeof(int),
4755 printf("Failed to create prog array '%s'!\n", strerror(errno
));
4760 static char bpf_vlog
[32768];
4762 static void do_test_fixup(struct bpf_test
*test
, struct bpf_insn
*prog
,
4763 int *fd_f1
, int *fd_f2
, int *fd_f3
)
4765 int *fixup_map1
= test
->fixup_map1
;
4766 int *fixup_map2
= test
->fixup_map2
;
4767 int *fixup_prog
= test
->fixup_prog
;
4769 /* Allocating HTs with 1 elem is fine here, since we only test
4770 * for verifier and not do a runtime lookup, so the only thing
4771 * that really matters is value size in this case.
4774 *fd_f1
= create_map(sizeof(long long), 1);
4776 prog
[*fixup_map1
].imm
= *fd_f1
;
4778 } while (*fixup_map1
);
4782 *fd_f2
= create_map(sizeof(struct test_val
), 1);
4784 prog
[*fixup_map2
].imm
= *fd_f2
;
4786 } while (*fixup_map2
);
4790 *fd_f3
= create_prog_array();
4792 prog
[*fixup_prog
].imm
= *fd_f3
;
4794 } while (*fixup_prog
);
4798 static void do_test_single(struct bpf_test
*test
, bool unpriv
,
4799 int *passes
, int *errors
)
4801 int fd_prog
, expected_ret
, reject_from_alignment
;
4802 struct bpf_insn
*prog
= test
->insns
;
4803 int prog_len
= probe_filter_length(prog
);
4804 int prog_type
= test
->prog_type
;
4805 int fd_f1
= -1, fd_f2
= -1, fd_f3
= -1;
4806 const char *expected_err
;
4808 do_test_fixup(test
, prog
, &fd_f1
, &fd_f2
, &fd_f3
);
4810 fd_prog
= bpf_load_program(prog_type
? : BPF_PROG_TYPE_SOCKET_FILTER
,
4811 prog
, prog_len
, "GPL", 0, bpf_vlog
,
4814 expected_ret
= unpriv
&& test
->result_unpriv
!= UNDEF
?
4815 test
->result_unpriv
: test
->result
;
4816 expected_err
= unpriv
&& test
->errstr_unpriv
?
4817 test
->errstr_unpriv
: test
->errstr
;
4819 reject_from_alignment
= fd_prog
< 0 &&
4820 (test
->flags
& F_NEEDS_EFFICIENT_UNALIGNED_ACCESS
) &&
4821 strstr(bpf_vlog
, "Unknown alignment.");
4822 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
4823 if (reject_from_alignment
) {
4824 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
4829 if (expected_ret
== ACCEPT
) {
4830 if (fd_prog
< 0 && !reject_from_alignment
) {
4831 printf("FAIL\nFailed to load prog '%s'!\n",
4837 printf("FAIL\nUnexpected success to load!\n");
4840 if (!strstr(bpf_vlog
, expected_err
) && !reject_from_alignment
) {
4841 printf("FAIL\nUnexpected error message!\n");
4847 printf("OK%s\n", reject_from_alignment
?
4848 " (NOTE: reject due to unknown alignment)" : "");
4858 printf("%s", bpf_vlog
);
4862 static bool is_admin(void)
4865 cap_flag_value_t sysadmin
= CAP_CLEAR
;
4866 const cap_value_t cap_val
= CAP_SYS_ADMIN
;
4868 #ifdef CAP_IS_SUPPORTED
4869 if (!CAP_IS_SUPPORTED(CAP_SETFCAP
)) {
4870 perror("cap_get_flag");
4874 caps
= cap_get_proc();
4876 perror("cap_get_proc");
4879 if (cap_get_flag(caps
, cap_val
, CAP_EFFECTIVE
, &sysadmin
))
4880 perror("cap_get_flag");
4883 return (sysadmin
== CAP_SET
);
4886 static int set_admin(bool admin
)
4889 const cap_value_t cap_val
= CAP_SYS_ADMIN
;
4892 caps
= cap_get_proc();
4894 perror("cap_get_proc");
4897 if (cap_set_flag(caps
, CAP_EFFECTIVE
, 1, &cap_val
,
4898 admin
? CAP_SET
: CAP_CLEAR
)) {
4899 perror("cap_set_flag");
4902 if (cap_set_proc(caps
)) {
4903 perror("cap_set_proc");
4913 static int do_test(bool unpriv
, unsigned int from
, unsigned int to
)
4915 int i
, passes
= 0, errors
= 0;
4917 for (i
= from
; i
< to
; i
++) {
4918 struct bpf_test
*test
= &tests
[i
];
4920 /* Program types that are not supported by non-root we
4923 if (!test
->prog_type
) {
4926 printf("#%d/u %s ", i
, test
->descr
);
4927 do_test_single(test
, true, &passes
, &errors
);
4933 printf("#%d/p %s ", i
, test
->descr
);
4934 do_test_single(test
, false, &passes
, &errors
);
4938 printf("Summary: %d PASSED, %d FAILED\n", passes
, errors
);
4939 return errors
? -errors
: 0;
4942 int main(int argc
, char **argv
)
4944 struct rlimit rinf
= { RLIM_INFINITY
, RLIM_INFINITY
};
4945 struct rlimit rlim
= { 1 << 20, 1 << 20 };
4946 unsigned int from
= 0, to
= ARRAY_SIZE(tests
);
4947 bool unpriv
= !is_admin();
4950 unsigned int l
= atoi(argv
[argc
- 2]);
4951 unsigned int u
= atoi(argv
[argc
- 1]);
4953 if (l
< to
&& u
< to
) {
4957 } else if (argc
== 2) {
4958 unsigned int t
= atoi(argv
[argc
- 1]);
4966 setrlimit(RLIMIT_MEMLOCK
, unpriv
? &rlim
: &rinf
);
4967 return do_test(unpriv
, from
, to
);