]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - tools/testing/selftests/bpf/test_verifier.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'actions-drivers-for-4.13' of git://git.kernel.org/pub/scm/linux/kernel...
[mirror_ubuntu-artful-kernel.git] / tools / testing / selftests / bpf / test_verifier.c
1 /*
2 * Testsuite for eBPF verifier
3 *
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
9 */
10
11 #include <asm/types.h>
12 #include <linux/types.h>
13 #include <stdint.h>
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <unistd.h>
17 #include <errno.h>
18 #include <string.h>
19 #include <stddef.h>
20 #include <stdbool.h>
21 #include <sched.h>
22
23 #include <sys/capability.h>
24 #include <sys/resource.h>
25
26 #include <linux/unistd.h>
27 #include <linux/filter.h>
28 #include <linux/bpf_perf_event.h>
29 #include <linux/bpf.h>
30
31 #include <bpf/bpf.h>
32
33 #ifdef HAVE_GENHDR
34 # include "autoconf.h"
35 #else
36 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
37 # define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
38 # endif
39 #endif
40
41 #include "../../../include/linux/filter.h"
42
43 #ifndef ARRAY_SIZE
44 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
45 #endif
46
47 #define MAX_INSNS 512
48 #define MAX_FIXUPS 8
49 #define MAX_NR_MAPS 4
50
51 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
52 #define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
53
54 struct bpf_test {
55 const char *descr;
56 struct bpf_insn insns[MAX_INSNS];
57 int fixup_map1[MAX_FIXUPS];
58 int fixup_map2[MAX_FIXUPS];
59 int fixup_prog[MAX_FIXUPS];
60 int fixup_map_in_map[MAX_FIXUPS];
61 const char *errstr;
62 const char *errstr_unpriv;
63 enum {
64 UNDEF,
65 ACCEPT,
66 REJECT
67 } result, result_unpriv;
68 enum bpf_prog_type prog_type;
69 uint8_t flags;
70 };
71
72 /* Note we want this to be 64 bit aligned so that the end of our array is
73 * actually the end of the structure.
74 */
75 #define MAX_ENTRIES 11
76
77 struct test_val {
78 unsigned int index;
79 int foo[MAX_ENTRIES];
80 };
81
82 static struct bpf_test tests[] = {
83 {
84 "add+sub+mul",
85 .insns = {
86 BPF_MOV64_IMM(BPF_REG_1, 1),
87 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
88 BPF_MOV64_IMM(BPF_REG_2, 3),
89 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
90 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
91 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
92 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
93 BPF_EXIT_INSN(),
94 },
95 .result = ACCEPT,
96 },
97 {
98 "unreachable",
99 .insns = {
100 BPF_EXIT_INSN(),
101 BPF_EXIT_INSN(),
102 },
103 .errstr = "unreachable",
104 .result = REJECT,
105 },
106 {
107 "unreachable2",
108 .insns = {
109 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
110 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
111 BPF_EXIT_INSN(),
112 },
113 .errstr = "unreachable",
114 .result = REJECT,
115 },
116 {
117 "out of range jump",
118 .insns = {
119 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
120 BPF_EXIT_INSN(),
121 },
122 .errstr = "jump out of range",
123 .result = REJECT,
124 },
125 {
126 "out of range jump2",
127 .insns = {
128 BPF_JMP_IMM(BPF_JA, 0, 0, -2),
129 BPF_EXIT_INSN(),
130 },
131 .errstr = "jump out of range",
132 .result = REJECT,
133 },
134 {
135 "test1 ld_imm64",
136 .insns = {
137 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
138 BPF_LD_IMM64(BPF_REG_0, 0),
139 BPF_LD_IMM64(BPF_REG_0, 0),
140 BPF_LD_IMM64(BPF_REG_0, 1),
141 BPF_LD_IMM64(BPF_REG_0, 1),
142 BPF_MOV64_IMM(BPF_REG_0, 2),
143 BPF_EXIT_INSN(),
144 },
145 .errstr = "invalid BPF_LD_IMM insn",
146 .errstr_unpriv = "R1 pointer comparison",
147 .result = REJECT,
148 },
149 {
150 "test2 ld_imm64",
151 .insns = {
152 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
153 BPF_LD_IMM64(BPF_REG_0, 0),
154 BPF_LD_IMM64(BPF_REG_0, 0),
155 BPF_LD_IMM64(BPF_REG_0, 1),
156 BPF_LD_IMM64(BPF_REG_0, 1),
157 BPF_EXIT_INSN(),
158 },
159 .errstr = "invalid BPF_LD_IMM insn",
160 .errstr_unpriv = "R1 pointer comparison",
161 .result = REJECT,
162 },
163 {
164 "test3 ld_imm64",
165 .insns = {
166 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
167 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
168 BPF_LD_IMM64(BPF_REG_0, 0),
169 BPF_LD_IMM64(BPF_REG_0, 0),
170 BPF_LD_IMM64(BPF_REG_0, 1),
171 BPF_LD_IMM64(BPF_REG_0, 1),
172 BPF_EXIT_INSN(),
173 },
174 .errstr = "invalid bpf_ld_imm64 insn",
175 .result = REJECT,
176 },
177 {
178 "test4 ld_imm64",
179 .insns = {
180 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
181 BPF_EXIT_INSN(),
182 },
183 .errstr = "invalid bpf_ld_imm64 insn",
184 .result = REJECT,
185 },
186 {
187 "test5 ld_imm64",
188 .insns = {
189 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
190 },
191 .errstr = "invalid bpf_ld_imm64 insn",
192 .result = REJECT,
193 },
194 {
195 "test6 ld_imm64",
196 .insns = {
197 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
198 BPF_RAW_INSN(0, 0, 0, 0, 0),
199 BPF_EXIT_INSN(),
200 },
201 .result = ACCEPT,
202 },
203 {
204 "test7 ld_imm64",
205 .insns = {
206 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
207 BPF_RAW_INSN(0, 0, 0, 0, 1),
208 BPF_EXIT_INSN(),
209 },
210 .result = ACCEPT,
211 },
212 {
213 "test8 ld_imm64",
214 .insns = {
215 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
216 BPF_RAW_INSN(0, 0, 0, 0, 1),
217 BPF_EXIT_INSN(),
218 },
219 .errstr = "uses reserved fields",
220 .result = REJECT,
221 },
222 {
223 "test9 ld_imm64",
224 .insns = {
225 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
226 BPF_RAW_INSN(0, 0, 0, 1, 1),
227 BPF_EXIT_INSN(),
228 },
229 .errstr = "invalid bpf_ld_imm64 insn",
230 .result = REJECT,
231 },
232 {
233 "test10 ld_imm64",
234 .insns = {
235 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
236 BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
237 BPF_EXIT_INSN(),
238 },
239 .errstr = "invalid bpf_ld_imm64 insn",
240 .result = REJECT,
241 },
242 {
243 "test11 ld_imm64",
244 .insns = {
245 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
246 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
247 BPF_EXIT_INSN(),
248 },
249 .errstr = "invalid bpf_ld_imm64 insn",
250 .result = REJECT,
251 },
252 {
253 "test12 ld_imm64",
254 .insns = {
255 BPF_MOV64_IMM(BPF_REG_1, 0),
256 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
257 BPF_RAW_INSN(0, 0, 0, 0, 1),
258 BPF_EXIT_INSN(),
259 },
260 .errstr = "not pointing to valid bpf_map",
261 .result = REJECT,
262 },
263 {
264 "test13 ld_imm64",
265 .insns = {
266 BPF_MOV64_IMM(BPF_REG_1, 0),
267 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
268 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
269 BPF_EXIT_INSN(),
270 },
271 .errstr = "invalid bpf_ld_imm64 insn",
272 .result = REJECT,
273 },
274 {
275 "no bpf_exit",
276 .insns = {
277 BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
278 },
279 .errstr = "jump out of range",
280 .result = REJECT,
281 },
282 {
283 "loop (back-edge)",
284 .insns = {
285 BPF_JMP_IMM(BPF_JA, 0, 0, -1),
286 BPF_EXIT_INSN(),
287 },
288 .errstr = "back-edge",
289 .result = REJECT,
290 },
291 {
292 "loop2 (back-edge)",
293 .insns = {
294 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
295 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
296 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
297 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
298 BPF_EXIT_INSN(),
299 },
300 .errstr = "back-edge",
301 .result = REJECT,
302 },
303 {
304 "conditional loop",
305 .insns = {
306 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
308 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
309 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
310 BPF_EXIT_INSN(),
311 },
312 .errstr = "back-edge",
313 .result = REJECT,
314 },
315 {
316 "read uninitialized register",
317 .insns = {
318 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
319 BPF_EXIT_INSN(),
320 },
321 .errstr = "R2 !read_ok",
322 .result = REJECT,
323 },
324 {
325 "read invalid register",
326 .insns = {
327 BPF_MOV64_REG(BPF_REG_0, -1),
328 BPF_EXIT_INSN(),
329 },
330 .errstr = "R15 is invalid",
331 .result = REJECT,
332 },
333 {
334 "program doesn't init R0 before exit",
335 .insns = {
336 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
337 BPF_EXIT_INSN(),
338 },
339 .errstr = "R0 !read_ok",
340 .result = REJECT,
341 },
342 {
343 "program doesn't init R0 before exit in all branches",
344 .insns = {
345 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
346 BPF_MOV64_IMM(BPF_REG_0, 1),
347 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
348 BPF_EXIT_INSN(),
349 },
350 .errstr = "R0 !read_ok",
351 .errstr_unpriv = "R1 pointer comparison",
352 .result = REJECT,
353 },
354 {
355 "stack out of bounds",
356 .insns = {
357 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
358 BPF_EXIT_INSN(),
359 },
360 .errstr = "invalid stack",
361 .result = REJECT,
362 },
363 {
364 "invalid call insn1",
365 .insns = {
366 BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
367 BPF_EXIT_INSN(),
368 },
369 .errstr = "BPF_CALL uses reserved",
370 .result = REJECT,
371 },
372 {
373 "invalid call insn2",
374 .insns = {
375 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
376 BPF_EXIT_INSN(),
377 },
378 .errstr = "BPF_CALL uses reserved",
379 .result = REJECT,
380 },
381 {
382 "invalid function call",
383 .insns = {
384 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
385 BPF_EXIT_INSN(),
386 },
387 .errstr = "invalid func unknown#1234567",
388 .result = REJECT,
389 },
390 {
391 "uninitialized stack1",
392 .insns = {
393 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
394 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
395 BPF_LD_MAP_FD(BPF_REG_1, 0),
396 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
397 BPF_FUNC_map_lookup_elem),
398 BPF_EXIT_INSN(),
399 },
400 .fixup_map1 = { 2 },
401 .errstr = "invalid indirect read from stack",
402 .result = REJECT,
403 },
404 {
405 "uninitialized stack2",
406 .insns = {
407 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
408 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
409 BPF_EXIT_INSN(),
410 },
411 .errstr = "invalid read from stack",
412 .result = REJECT,
413 },
414 {
415 "invalid fp arithmetic",
416 /* If this gets ever changed, make sure JITs can deal with it. */
417 .insns = {
418 BPF_MOV64_IMM(BPF_REG_0, 0),
419 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
420 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
421 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
422 BPF_EXIT_INSN(),
423 },
424 .errstr_unpriv = "R1 pointer arithmetic",
425 .result_unpriv = REJECT,
426 .errstr = "R1 invalid mem access",
427 .result = REJECT,
428 },
429 {
430 "non-invalid fp arithmetic",
431 .insns = {
432 BPF_MOV64_IMM(BPF_REG_0, 0),
433 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
434 BPF_EXIT_INSN(),
435 },
436 .result = ACCEPT,
437 },
438 {
439 "invalid argument register",
440 .insns = {
441 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
442 BPF_FUNC_get_cgroup_classid),
443 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
444 BPF_FUNC_get_cgroup_classid),
445 BPF_EXIT_INSN(),
446 },
447 .errstr = "R1 !read_ok",
448 .result = REJECT,
449 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
450 },
451 {
452 "non-invalid argument register",
453 .insns = {
454 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
455 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
456 BPF_FUNC_get_cgroup_classid),
457 BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
458 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
459 BPF_FUNC_get_cgroup_classid),
460 BPF_EXIT_INSN(),
461 },
462 .result = ACCEPT,
463 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
464 },
465 {
466 "check valid spill/fill",
467 .insns = {
468 /* spill R1(ctx) into stack */
469 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
470 /* fill it back into R2 */
471 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
472 /* should be able to access R0 = *(R2 + 8) */
473 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
474 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
475 BPF_EXIT_INSN(),
476 },
477 .errstr_unpriv = "R0 leaks addr",
478 .result = ACCEPT,
479 .result_unpriv = REJECT,
480 },
481 {
482 "check valid spill/fill, skb mark",
483 .insns = {
484 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
485 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
486 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
487 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
488 offsetof(struct __sk_buff, mark)),
489 BPF_EXIT_INSN(),
490 },
491 .result = ACCEPT,
492 .result_unpriv = ACCEPT,
493 },
494 {
495 "check corrupted spill/fill",
496 .insns = {
497 /* spill R1(ctx) into stack */
498 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
499 /* mess up with R1 pointer on stack */
500 BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
501 /* fill back into R0 should fail */
502 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
503 BPF_EXIT_INSN(),
504 },
505 .errstr_unpriv = "attempt to corrupt spilled",
506 .errstr = "corrupted spill",
507 .result = REJECT,
508 },
509 {
510 "invalid src register in STX",
511 .insns = {
512 BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
513 BPF_EXIT_INSN(),
514 },
515 .errstr = "R15 is invalid",
516 .result = REJECT,
517 },
518 {
519 "invalid dst register in STX",
520 .insns = {
521 BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
522 BPF_EXIT_INSN(),
523 },
524 .errstr = "R14 is invalid",
525 .result = REJECT,
526 },
527 {
528 "invalid dst register in ST",
529 .insns = {
530 BPF_ST_MEM(BPF_B, 14, -1, -1),
531 BPF_EXIT_INSN(),
532 },
533 .errstr = "R14 is invalid",
534 .result = REJECT,
535 },
536 {
537 "invalid src register in LDX",
538 .insns = {
539 BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
540 BPF_EXIT_INSN(),
541 },
542 .errstr = "R12 is invalid",
543 .result = REJECT,
544 },
545 {
546 "invalid dst register in LDX",
547 .insns = {
548 BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
549 BPF_EXIT_INSN(),
550 },
551 .errstr = "R11 is invalid",
552 .result = REJECT,
553 },
554 {
555 "junk insn",
556 .insns = {
557 BPF_RAW_INSN(0, 0, 0, 0, 0),
558 BPF_EXIT_INSN(),
559 },
560 .errstr = "invalid BPF_LD_IMM",
561 .result = REJECT,
562 },
563 {
564 "junk insn2",
565 .insns = {
566 BPF_RAW_INSN(1, 0, 0, 0, 0),
567 BPF_EXIT_INSN(),
568 },
569 .errstr = "BPF_LDX uses reserved fields",
570 .result = REJECT,
571 },
572 {
573 "junk insn3",
574 .insns = {
575 BPF_RAW_INSN(-1, 0, 0, 0, 0),
576 BPF_EXIT_INSN(),
577 },
578 .errstr = "invalid BPF_ALU opcode f0",
579 .result = REJECT,
580 },
581 {
582 "junk insn4",
583 .insns = {
584 BPF_RAW_INSN(-1, -1, -1, -1, -1),
585 BPF_EXIT_INSN(),
586 },
587 .errstr = "invalid BPF_ALU opcode f0",
588 .result = REJECT,
589 },
590 {
591 "junk insn5",
592 .insns = {
593 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
594 BPF_EXIT_INSN(),
595 },
596 .errstr = "BPF_ALU uses reserved fields",
597 .result = REJECT,
598 },
599 {
600 "misaligned read from stack",
601 .insns = {
602 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
603 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
604 BPF_EXIT_INSN(),
605 },
606 .errstr = "misaligned access",
607 .result = REJECT,
608 },
609 {
610 "invalid map_fd for function call",
611 .insns = {
612 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
613 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
614 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
615 BPF_LD_MAP_FD(BPF_REG_1, 0),
616 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
617 BPF_FUNC_map_delete_elem),
618 BPF_EXIT_INSN(),
619 },
620 .errstr = "fd 0 is not pointing to valid bpf_map",
621 .result = REJECT,
622 },
623 {
624 "don't check return value before access",
625 .insns = {
626 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
627 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
628 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
629 BPF_LD_MAP_FD(BPF_REG_1, 0),
630 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
631 BPF_FUNC_map_lookup_elem),
632 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
633 BPF_EXIT_INSN(),
634 },
635 .fixup_map1 = { 3 },
636 .errstr = "R0 invalid mem access 'map_value_or_null'",
637 .result = REJECT,
638 },
639 {
640 "access memory with incorrect alignment",
641 .insns = {
642 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
643 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
644 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
645 BPF_LD_MAP_FD(BPF_REG_1, 0),
646 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
647 BPF_FUNC_map_lookup_elem),
648 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
649 BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
650 BPF_EXIT_INSN(),
651 },
652 .fixup_map1 = { 3 },
653 .errstr = "misaligned access",
654 .result = REJECT,
655 },
656 {
657 "sometimes access memory with incorrect alignment",
658 .insns = {
659 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
660 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
661 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
662 BPF_LD_MAP_FD(BPF_REG_1, 0),
663 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
664 BPF_FUNC_map_lookup_elem),
665 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
666 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
667 BPF_EXIT_INSN(),
668 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
669 BPF_EXIT_INSN(),
670 },
671 .fixup_map1 = { 3 },
672 .errstr = "R0 invalid mem access",
673 .errstr_unpriv = "R0 leaks addr",
674 .result = REJECT,
675 },
676 {
677 "jump test 1",
678 .insns = {
679 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
680 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
681 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
682 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
683 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
684 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
685 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
686 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
687 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
688 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
689 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
690 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
691 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
692 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
693 BPF_MOV64_IMM(BPF_REG_0, 0),
694 BPF_EXIT_INSN(),
695 },
696 .errstr_unpriv = "R1 pointer comparison",
697 .result_unpriv = REJECT,
698 .result = ACCEPT,
699 },
700 {
701 "jump test 2",
702 .insns = {
703 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
704 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
705 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
706 BPF_JMP_IMM(BPF_JA, 0, 0, 14),
707 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
708 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
709 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
710 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
711 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
712 BPF_JMP_IMM(BPF_JA, 0, 0, 8),
713 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
714 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
715 BPF_JMP_IMM(BPF_JA, 0, 0, 5),
716 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
717 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
718 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
719 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
720 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
721 BPF_MOV64_IMM(BPF_REG_0, 0),
722 BPF_EXIT_INSN(),
723 },
724 .errstr_unpriv = "R1 pointer comparison",
725 .result_unpriv = REJECT,
726 .result = ACCEPT,
727 },
728 {
729 "jump test 3",
730 .insns = {
731 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
732 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
733 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
734 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
735 BPF_JMP_IMM(BPF_JA, 0, 0, 19),
736 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
737 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
738 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
739 BPF_JMP_IMM(BPF_JA, 0, 0, 15),
740 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
741 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
742 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
743 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
744 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
745 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
746 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
747 BPF_JMP_IMM(BPF_JA, 0, 0, 7),
748 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
749 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
750 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
751 BPF_JMP_IMM(BPF_JA, 0, 0, 3),
752 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
753 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
755 BPF_LD_MAP_FD(BPF_REG_1, 0),
756 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
757 BPF_FUNC_map_delete_elem),
758 BPF_EXIT_INSN(),
759 },
760 .fixup_map1 = { 24 },
761 .errstr_unpriv = "R1 pointer comparison",
762 .result_unpriv = REJECT,
763 .result = ACCEPT,
764 },
765 {
766 "jump test 4",
767 .insns = {
768 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
769 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
770 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
771 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
772 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
773 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
774 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
775 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
776 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
777 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
778 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
779 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
780 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
781 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
782 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
783 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
784 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
785 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
786 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
787 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
788 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
789 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
790 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
791 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
792 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
793 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
794 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
796 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
798 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
799 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
800 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
801 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
802 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
803 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
804 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
805 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
806 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
807 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
808 BPF_MOV64_IMM(BPF_REG_0, 0),
809 BPF_EXIT_INSN(),
810 },
811 .errstr_unpriv = "R1 pointer comparison",
812 .result_unpriv = REJECT,
813 .result = ACCEPT,
814 },
815 {
816 "jump test 5",
817 .insns = {
818 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
819 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
820 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
821 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
822 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
823 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
824 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
825 BPF_MOV64_IMM(BPF_REG_0, 0),
826 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
827 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
828 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
829 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
830 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
831 BPF_MOV64_IMM(BPF_REG_0, 0),
832 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
833 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
834 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
835 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
836 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
837 BPF_MOV64_IMM(BPF_REG_0, 0),
838 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
839 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
840 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
841 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
842 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
843 BPF_MOV64_IMM(BPF_REG_0, 0),
844 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
845 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
846 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
847 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
848 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
849 BPF_MOV64_IMM(BPF_REG_0, 0),
850 BPF_EXIT_INSN(),
851 },
852 .errstr_unpriv = "R1 pointer comparison",
853 .result_unpriv = REJECT,
854 .result = ACCEPT,
855 },
856 {
857 "access skb fields ok",
858 .insns = {
859 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
860 offsetof(struct __sk_buff, len)),
861 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
862 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
863 offsetof(struct __sk_buff, mark)),
864 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
865 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
866 offsetof(struct __sk_buff, pkt_type)),
867 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
868 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
869 offsetof(struct __sk_buff, queue_mapping)),
870 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
871 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
872 offsetof(struct __sk_buff, protocol)),
873 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
874 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
875 offsetof(struct __sk_buff, vlan_present)),
876 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
877 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
878 offsetof(struct __sk_buff, vlan_tci)),
879 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
880 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
881 offsetof(struct __sk_buff, napi_id)),
882 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
883 BPF_EXIT_INSN(),
884 },
885 .result = ACCEPT,
886 },
887 {
888 "access skb fields bad1",
889 .insns = {
890 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
891 BPF_EXIT_INSN(),
892 },
893 .errstr = "invalid bpf_context access",
894 .result = REJECT,
895 },
896 {
897 "access skb fields bad2",
898 .insns = {
899 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
900 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
901 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
902 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
903 BPF_LD_MAP_FD(BPF_REG_1, 0),
904 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
905 BPF_FUNC_map_lookup_elem),
906 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
907 BPF_EXIT_INSN(),
908 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
909 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
910 offsetof(struct __sk_buff, pkt_type)),
911 BPF_EXIT_INSN(),
912 },
913 .fixup_map1 = { 4 },
914 .errstr = "different pointers",
915 .errstr_unpriv = "R1 pointer comparison",
916 .result = REJECT,
917 },
918 {
919 "access skb fields bad3",
920 .insns = {
921 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
922 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
923 offsetof(struct __sk_buff, pkt_type)),
924 BPF_EXIT_INSN(),
925 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
926 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
927 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
928 BPF_LD_MAP_FD(BPF_REG_1, 0),
929 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
930 BPF_FUNC_map_lookup_elem),
931 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
932 BPF_EXIT_INSN(),
933 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
934 BPF_JMP_IMM(BPF_JA, 0, 0, -12),
935 },
936 .fixup_map1 = { 6 },
937 .errstr = "different pointers",
938 .errstr_unpriv = "R1 pointer comparison",
939 .result = REJECT,
940 },
941 {
942 "access skb fields bad4",
943 .insns = {
944 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
945 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
946 offsetof(struct __sk_buff, len)),
947 BPF_MOV64_IMM(BPF_REG_0, 0),
948 BPF_EXIT_INSN(),
949 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
950 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
951 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
952 BPF_LD_MAP_FD(BPF_REG_1, 0),
953 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
954 BPF_FUNC_map_lookup_elem),
955 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
956 BPF_EXIT_INSN(),
957 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
958 BPF_JMP_IMM(BPF_JA, 0, 0, -13),
959 },
960 .fixup_map1 = { 7 },
961 .errstr = "different pointers",
962 .errstr_unpriv = "R1 pointer comparison",
963 .result = REJECT,
964 },
965 {
966 "check skb->mark is not writeable by sockets",
967 .insns = {
968 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
969 offsetof(struct __sk_buff, mark)),
970 BPF_EXIT_INSN(),
971 },
972 .errstr = "invalid bpf_context access",
973 .errstr_unpriv = "R1 leaks addr",
974 .result = REJECT,
975 },
976 {
977 "check skb->tc_index is not writeable by sockets",
978 .insns = {
979 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
980 offsetof(struct __sk_buff, tc_index)),
981 BPF_EXIT_INSN(),
982 },
983 .errstr = "invalid bpf_context access",
984 .errstr_unpriv = "R1 leaks addr",
985 .result = REJECT,
986 },
987 {
988 "check cb access: byte",
989 .insns = {
990 BPF_MOV64_IMM(BPF_REG_0, 0),
991 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
992 offsetof(struct __sk_buff, cb[0])),
993 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
994 offsetof(struct __sk_buff, cb[0]) + 1),
995 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
996 offsetof(struct __sk_buff, cb[0]) + 2),
997 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
998 offsetof(struct __sk_buff, cb[0]) + 3),
999 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1000 offsetof(struct __sk_buff, cb[1])),
1001 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1002 offsetof(struct __sk_buff, cb[1]) + 1),
1003 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1004 offsetof(struct __sk_buff, cb[1]) + 2),
1005 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1006 offsetof(struct __sk_buff, cb[1]) + 3),
1007 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1008 offsetof(struct __sk_buff, cb[2])),
1009 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1010 offsetof(struct __sk_buff, cb[2]) + 1),
1011 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1012 offsetof(struct __sk_buff, cb[2]) + 2),
1013 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1014 offsetof(struct __sk_buff, cb[2]) + 3),
1015 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1016 offsetof(struct __sk_buff, cb[3])),
1017 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1018 offsetof(struct __sk_buff, cb[3]) + 1),
1019 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1020 offsetof(struct __sk_buff, cb[3]) + 2),
1021 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1022 offsetof(struct __sk_buff, cb[3]) + 3),
1023 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1024 offsetof(struct __sk_buff, cb[4])),
1025 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1026 offsetof(struct __sk_buff, cb[4]) + 1),
1027 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1028 offsetof(struct __sk_buff, cb[4]) + 2),
1029 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1030 offsetof(struct __sk_buff, cb[4]) + 3),
1031 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1032 offsetof(struct __sk_buff, cb[0])),
1033 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1034 offsetof(struct __sk_buff, cb[0]) + 1),
1035 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1036 offsetof(struct __sk_buff, cb[0]) + 2),
1037 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1038 offsetof(struct __sk_buff, cb[0]) + 3),
1039 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1040 offsetof(struct __sk_buff, cb[1])),
1041 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1042 offsetof(struct __sk_buff, cb[1]) + 1),
1043 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1044 offsetof(struct __sk_buff, cb[1]) + 2),
1045 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1046 offsetof(struct __sk_buff, cb[1]) + 3),
1047 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1048 offsetof(struct __sk_buff, cb[2])),
1049 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1050 offsetof(struct __sk_buff, cb[2]) + 1),
1051 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1052 offsetof(struct __sk_buff, cb[2]) + 2),
1053 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1054 offsetof(struct __sk_buff, cb[2]) + 3),
1055 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1056 offsetof(struct __sk_buff, cb[3])),
1057 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1058 offsetof(struct __sk_buff, cb[3]) + 1),
1059 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1060 offsetof(struct __sk_buff, cb[3]) + 2),
1061 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1062 offsetof(struct __sk_buff, cb[3]) + 3),
1063 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1064 offsetof(struct __sk_buff, cb[4])),
1065 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1066 offsetof(struct __sk_buff, cb[4]) + 1),
1067 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1068 offsetof(struct __sk_buff, cb[4]) + 2),
1069 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1070 offsetof(struct __sk_buff, cb[4]) + 3),
1071 BPF_EXIT_INSN(),
1072 },
1073 .result = ACCEPT,
1074 },
1075 {
1076 "check cb access: byte, oob 1",
1077 .insns = {
1078 BPF_MOV64_IMM(BPF_REG_0, 0),
1079 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1080 offsetof(struct __sk_buff, cb[4]) + 4),
1081 BPF_EXIT_INSN(),
1082 },
1083 .errstr = "invalid bpf_context access",
1084 .result = REJECT,
1085 },
1086 {
1087 "check cb access: byte, oob 2",
1088 .insns = {
1089 BPF_MOV64_IMM(BPF_REG_0, 0),
1090 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1091 offsetof(struct __sk_buff, cb[0]) - 1),
1092 BPF_EXIT_INSN(),
1093 },
1094 .errstr = "invalid bpf_context access",
1095 .result = REJECT,
1096 },
1097 {
1098 "check cb access: byte, oob 3",
1099 .insns = {
1100 BPF_MOV64_IMM(BPF_REG_0, 0),
1101 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1102 offsetof(struct __sk_buff, cb[4]) + 4),
1103 BPF_EXIT_INSN(),
1104 },
1105 .errstr = "invalid bpf_context access",
1106 .result = REJECT,
1107 },
1108 {
1109 "check cb access: byte, oob 4",
1110 .insns = {
1111 BPF_MOV64_IMM(BPF_REG_0, 0),
1112 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1113 offsetof(struct __sk_buff, cb[0]) - 1),
1114 BPF_EXIT_INSN(),
1115 },
1116 .errstr = "invalid bpf_context access",
1117 .result = REJECT,
1118 },
1119 {
1120 "check cb access: byte, wrong type",
1121 .insns = {
1122 BPF_MOV64_IMM(BPF_REG_0, 0),
1123 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1124 offsetof(struct __sk_buff, cb[0])),
1125 BPF_EXIT_INSN(),
1126 },
1127 .errstr = "invalid bpf_context access",
1128 .result = REJECT,
1129 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1130 },
1131 {
1132 "check cb access: half",
1133 .insns = {
1134 BPF_MOV64_IMM(BPF_REG_0, 0),
1135 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1136 offsetof(struct __sk_buff, cb[0])),
1137 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1138 offsetof(struct __sk_buff, cb[0]) + 2),
1139 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1140 offsetof(struct __sk_buff, cb[1])),
1141 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1142 offsetof(struct __sk_buff, cb[1]) + 2),
1143 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1144 offsetof(struct __sk_buff, cb[2])),
1145 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1146 offsetof(struct __sk_buff, cb[2]) + 2),
1147 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1148 offsetof(struct __sk_buff, cb[3])),
1149 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1150 offsetof(struct __sk_buff, cb[3]) + 2),
1151 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1152 offsetof(struct __sk_buff, cb[4])),
1153 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1154 offsetof(struct __sk_buff, cb[4]) + 2),
1155 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1156 offsetof(struct __sk_buff, cb[0])),
1157 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1158 offsetof(struct __sk_buff, cb[0]) + 2),
1159 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1160 offsetof(struct __sk_buff, cb[1])),
1161 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1162 offsetof(struct __sk_buff, cb[1]) + 2),
1163 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1164 offsetof(struct __sk_buff, cb[2])),
1165 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1166 offsetof(struct __sk_buff, cb[2]) + 2),
1167 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1168 offsetof(struct __sk_buff, cb[3])),
1169 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1170 offsetof(struct __sk_buff, cb[3]) + 2),
1171 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1172 offsetof(struct __sk_buff, cb[4])),
1173 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1174 offsetof(struct __sk_buff, cb[4]) + 2),
1175 BPF_EXIT_INSN(),
1176 },
1177 .result = ACCEPT,
1178 },
1179 {
1180 "check cb access: half, unaligned",
1181 .insns = {
1182 BPF_MOV64_IMM(BPF_REG_0, 0),
1183 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1184 offsetof(struct __sk_buff, cb[0]) + 1),
1185 BPF_EXIT_INSN(),
1186 },
1187 .errstr = "misaligned access",
1188 .result = REJECT,
1189 },
1190 {
1191 "check cb access: half, oob 1",
1192 .insns = {
1193 BPF_MOV64_IMM(BPF_REG_0, 0),
1194 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1195 offsetof(struct __sk_buff, cb[4]) + 4),
1196 BPF_EXIT_INSN(),
1197 },
1198 .errstr = "invalid bpf_context access",
1199 .result = REJECT,
1200 },
1201 {
1202 "check cb access: half, oob 2",
1203 .insns = {
1204 BPF_MOV64_IMM(BPF_REG_0, 0),
1205 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1206 offsetof(struct __sk_buff, cb[0]) - 2),
1207 BPF_EXIT_INSN(),
1208 },
1209 .errstr = "invalid bpf_context access",
1210 .result = REJECT,
1211 },
1212 {
1213 "check cb access: half, oob 3",
1214 .insns = {
1215 BPF_MOV64_IMM(BPF_REG_0, 0),
1216 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1217 offsetof(struct __sk_buff, cb[4]) + 4),
1218 BPF_EXIT_INSN(),
1219 },
1220 .errstr = "invalid bpf_context access",
1221 .result = REJECT,
1222 },
1223 {
1224 "check cb access: half, oob 4",
1225 .insns = {
1226 BPF_MOV64_IMM(BPF_REG_0, 0),
1227 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1228 offsetof(struct __sk_buff, cb[0]) - 2),
1229 BPF_EXIT_INSN(),
1230 },
1231 .errstr = "invalid bpf_context access",
1232 .result = REJECT,
1233 },
1234 {
1235 "check cb access: half, wrong type",
1236 .insns = {
1237 BPF_MOV64_IMM(BPF_REG_0, 0),
1238 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1239 offsetof(struct __sk_buff, cb[0])),
1240 BPF_EXIT_INSN(),
1241 },
1242 .errstr = "invalid bpf_context access",
1243 .result = REJECT,
1244 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1245 },
1246 {
1247 "check cb access: word",
1248 .insns = {
1249 BPF_MOV64_IMM(BPF_REG_0, 0),
1250 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1251 offsetof(struct __sk_buff, cb[0])),
1252 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1253 offsetof(struct __sk_buff, cb[1])),
1254 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1255 offsetof(struct __sk_buff, cb[2])),
1256 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1257 offsetof(struct __sk_buff, cb[3])),
1258 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1259 offsetof(struct __sk_buff, cb[4])),
1260 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1261 offsetof(struct __sk_buff, cb[0])),
1262 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1263 offsetof(struct __sk_buff, cb[1])),
1264 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1265 offsetof(struct __sk_buff, cb[2])),
1266 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1267 offsetof(struct __sk_buff, cb[3])),
1268 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1269 offsetof(struct __sk_buff, cb[4])),
1270 BPF_EXIT_INSN(),
1271 },
1272 .result = ACCEPT,
1273 },
1274 {
1275 "check cb access: word, unaligned 1",
1276 .insns = {
1277 BPF_MOV64_IMM(BPF_REG_0, 0),
1278 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1279 offsetof(struct __sk_buff, cb[0]) + 2),
1280 BPF_EXIT_INSN(),
1281 },
1282 .errstr = "misaligned access",
1283 .result = REJECT,
1284 },
1285 {
1286 "check cb access: word, unaligned 2",
1287 .insns = {
1288 BPF_MOV64_IMM(BPF_REG_0, 0),
1289 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1290 offsetof(struct __sk_buff, cb[4]) + 1),
1291 BPF_EXIT_INSN(),
1292 },
1293 .errstr = "misaligned access",
1294 .result = REJECT,
1295 },
1296 {
1297 "check cb access: word, unaligned 3",
1298 .insns = {
1299 BPF_MOV64_IMM(BPF_REG_0, 0),
1300 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1301 offsetof(struct __sk_buff, cb[4]) + 2),
1302 BPF_EXIT_INSN(),
1303 },
1304 .errstr = "misaligned access",
1305 .result = REJECT,
1306 },
1307 {
1308 "check cb access: word, unaligned 4",
1309 .insns = {
1310 BPF_MOV64_IMM(BPF_REG_0, 0),
1311 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1312 offsetof(struct __sk_buff, cb[4]) + 3),
1313 BPF_EXIT_INSN(),
1314 },
1315 .errstr = "misaligned access",
1316 .result = REJECT,
1317 },
1318 {
1319 "check cb access: double",
1320 .insns = {
1321 BPF_MOV64_IMM(BPF_REG_0, 0),
1322 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1323 offsetof(struct __sk_buff, cb[0])),
1324 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1325 offsetof(struct __sk_buff, cb[2])),
1326 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1327 offsetof(struct __sk_buff, cb[0])),
1328 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1329 offsetof(struct __sk_buff, cb[2])),
1330 BPF_EXIT_INSN(),
1331 },
1332 .result = ACCEPT,
1333 },
1334 {
1335 "check cb access: double, unaligned 1",
1336 .insns = {
1337 BPF_MOV64_IMM(BPF_REG_0, 0),
1338 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1339 offsetof(struct __sk_buff, cb[1])),
1340 BPF_EXIT_INSN(),
1341 },
1342 .errstr = "misaligned access",
1343 .result = REJECT,
1344 },
1345 {
1346 "check cb access: double, unaligned 2",
1347 .insns = {
1348 BPF_MOV64_IMM(BPF_REG_0, 0),
1349 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1350 offsetof(struct __sk_buff, cb[3])),
1351 BPF_EXIT_INSN(),
1352 },
1353 .errstr = "misaligned access",
1354 .result = REJECT,
1355 },
1356 {
1357 "check cb access: double, oob 1",
1358 .insns = {
1359 BPF_MOV64_IMM(BPF_REG_0, 0),
1360 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1361 offsetof(struct __sk_buff, cb[4])),
1362 BPF_EXIT_INSN(),
1363 },
1364 .errstr = "invalid bpf_context access",
1365 .result = REJECT,
1366 },
1367 {
1368 "check cb access: double, oob 2",
1369 .insns = {
1370 BPF_MOV64_IMM(BPF_REG_0, 0),
1371 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1372 offsetof(struct __sk_buff, cb[4]) + 8),
1373 BPF_EXIT_INSN(),
1374 },
1375 .errstr = "invalid bpf_context access",
1376 .result = REJECT,
1377 },
1378 {
1379 "check cb access: double, oob 3",
1380 .insns = {
1381 BPF_MOV64_IMM(BPF_REG_0, 0),
1382 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1383 offsetof(struct __sk_buff, cb[0]) - 8),
1384 BPF_EXIT_INSN(),
1385 },
1386 .errstr = "invalid bpf_context access",
1387 .result = REJECT,
1388 },
1389 {
1390 "check cb access: double, oob 4",
1391 .insns = {
1392 BPF_MOV64_IMM(BPF_REG_0, 0),
1393 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1394 offsetof(struct __sk_buff, cb[4])),
1395 BPF_EXIT_INSN(),
1396 },
1397 .errstr = "invalid bpf_context access",
1398 .result = REJECT,
1399 },
1400 {
1401 "check cb access: double, oob 5",
1402 .insns = {
1403 BPF_MOV64_IMM(BPF_REG_0, 0),
1404 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1405 offsetof(struct __sk_buff, cb[4]) + 8),
1406 BPF_EXIT_INSN(),
1407 },
1408 .errstr = "invalid bpf_context access",
1409 .result = REJECT,
1410 },
1411 {
1412 "check cb access: double, oob 6",
1413 .insns = {
1414 BPF_MOV64_IMM(BPF_REG_0, 0),
1415 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1416 offsetof(struct __sk_buff, cb[0]) - 8),
1417 BPF_EXIT_INSN(),
1418 },
1419 .errstr = "invalid bpf_context access",
1420 .result = REJECT,
1421 },
1422 {
1423 "check cb access: double, wrong type",
1424 .insns = {
1425 BPF_MOV64_IMM(BPF_REG_0, 0),
1426 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1427 offsetof(struct __sk_buff, cb[0])),
1428 BPF_EXIT_INSN(),
1429 },
1430 .errstr = "invalid bpf_context access",
1431 .result = REJECT,
1432 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1433 },
1434 {
1435 "check out of range skb->cb access",
1436 .insns = {
1437 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1438 offsetof(struct __sk_buff, cb[0]) + 256),
1439 BPF_EXIT_INSN(),
1440 },
1441 .errstr = "invalid bpf_context access",
1442 .errstr_unpriv = "",
1443 .result = REJECT,
1444 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1445 },
1446 {
1447 "write skb fields from socket prog",
1448 .insns = {
1449 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1450 offsetof(struct __sk_buff, cb[4])),
1451 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1452 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1453 offsetof(struct __sk_buff, mark)),
1454 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1455 offsetof(struct __sk_buff, tc_index)),
1456 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1457 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1458 offsetof(struct __sk_buff, cb[0])),
1459 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1460 offsetof(struct __sk_buff, cb[2])),
1461 BPF_EXIT_INSN(),
1462 },
1463 .result = ACCEPT,
1464 .errstr_unpriv = "R1 leaks addr",
1465 .result_unpriv = REJECT,
1466 },
1467 {
1468 "write skb fields from tc_cls_act prog",
1469 .insns = {
1470 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1471 offsetof(struct __sk_buff, cb[0])),
1472 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1473 offsetof(struct __sk_buff, mark)),
1474 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1475 offsetof(struct __sk_buff, tc_index)),
1476 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1477 offsetof(struct __sk_buff, tc_index)),
1478 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1479 offsetof(struct __sk_buff, cb[3])),
1480 BPF_EXIT_INSN(),
1481 },
1482 .errstr_unpriv = "",
1483 .result_unpriv = REJECT,
1484 .result = ACCEPT,
1485 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1486 },
1487 {
1488 "PTR_TO_STACK store/load",
1489 .insns = {
1490 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1492 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1493 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1494 BPF_EXIT_INSN(),
1495 },
1496 .result = ACCEPT,
1497 },
1498 {
1499 "PTR_TO_STACK store/load - bad alignment on off",
1500 .insns = {
1501 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1502 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1503 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1504 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1505 BPF_EXIT_INSN(),
1506 },
1507 .result = REJECT,
1508 .errstr = "misaligned access off -6 size 8",
1509 },
1510 {
1511 "PTR_TO_STACK store/load - bad alignment on reg",
1512 .insns = {
1513 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1514 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1515 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1516 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1517 BPF_EXIT_INSN(),
1518 },
1519 .result = REJECT,
1520 .errstr = "misaligned access off -2 size 8",
1521 },
1522 {
1523 "PTR_TO_STACK store/load - out of bounds low",
1524 .insns = {
1525 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1526 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1527 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1528 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1529 BPF_EXIT_INSN(),
1530 },
1531 .result = REJECT,
1532 .errstr = "invalid stack off=-79992 size=8",
1533 },
1534 {
1535 "PTR_TO_STACK store/load - out of bounds high",
1536 .insns = {
1537 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1538 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1539 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1540 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1541 BPF_EXIT_INSN(),
1542 },
1543 .result = REJECT,
1544 .errstr = "invalid stack off=0 size=8",
1545 },
1546 {
1547 "unpriv: return pointer",
1548 .insns = {
1549 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1550 BPF_EXIT_INSN(),
1551 },
1552 .result = ACCEPT,
1553 .result_unpriv = REJECT,
1554 .errstr_unpriv = "R0 leaks addr",
1555 },
1556 {
1557 "unpriv: add const to pointer",
1558 .insns = {
1559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1560 BPF_MOV64_IMM(BPF_REG_0, 0),
1561 BPF_EXIT_INSN(),
1562 },
1563 .result = ACCEPT,
1564 .result_unpriv = REJECT,
1565 .errstr_unpriv = "R1 pointer arithmetic",
1566 },
1567 {
1568 "unpriv: add pointer to pointer",
1569 .insns = {
1570 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1571 BPF_MOV64_IMM(BPF_REG_0, 0),
1572 BPF_EXIT_INSN(),
1573 },
1574 .result = ACCEPT,
1575 .result_unpriv = REJECT,
1576 .errstr_unpriv = "R1 pointer arithmetic",
1577 },
1578 {
1579 "unpriv: neg pointer",
1580 .insns = {
1581 BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1582 BPF_MOV64_IMM(BPF_REG_0, 0),
1583 BPF_EXIT_INSN(),
1584 },
1585 .result = ACCEPT,
1586 .result_unpriv = REJECT,
1587 .errstr_unpriv = "R1 pointer arithmetic",
1588 },
1589 {
1590 "unpriv: cmp pointer with const",
1591 .insns = {
1592 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1593 BPF_MOV64_IMM(BPF_REG_0, 0),
1594 BPF_EXIT_INSN(),
1595 },
1596 .result = ACCEPT,
1597 .result_unpriv = REJECT,
1598 .errstr_unpriv = "R1 pointer comparison",
1599 },
1600 {
1601 "unpriv: cmp pointer with pointer",
1602 .insns = {
1603 BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1604 BPF_MOV64_IMM(BPF_REG_0, 0),
1605 BPF_EXIT_INSN(),
1606 },
1607 .result = ACCEPT,
1608 .result_unpriv = REJECT,
1609 .errstr_unpriv = "R10 pointer comparison",
1610 },
1611 {
1612 "unpriv: check that printk is disallowed",
1613 .insns = {
1614 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1615 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1616 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1617 BPF_MOV64_IMM(BPF_REG_2, 8),
1618 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1619 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1620 BPF_FUNC_trace_printk),
1621 BPF_MOV64_IMM(BPF_REG_0, 0),
1622 BPF_EXIT_INSN(),
1623 },
1624 .errstr_unpriv = "unknown func bpf_trace_printk#6",
1625 .result_unpriv = REJECT,
1626 .result = ACCEPT,
1627 },
1628 {
1629 "unpriv: pass pointer to helper function",
1630 .insns = {
1631 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1632 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1633 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1634 BPF_LD_MAP_FD(BPF_REG_1, 0),
1635 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1636 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
1637 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1638 BPF_FUNC_map_update_elem),
1639 BPF_MOV64_IMM(BPF_REG_0, 0),
1640 BPF_EXIT_INSN(),
1641 },
1642 .fixup_map1 = { 3 },
1643 .errstr_unpriv = "R4 leaks addr",
1644 .result_unpriv = REJECT,
1645 .result = ACCEPT,
1646 },
1647 {
1648 "unpriv: indirectly pass pointer on stack to helper function",
1649 .insns = {
1650 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1651 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1652 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1653 BPF_LD_MAP_FD(BPF_REG_1, 0),
1654 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1655 BPF_FUNC_map_lookup_elem),
1656 BPF_MOV64_IMM(BPF_REG_0, 0),
1657 BPF_EXIT_INSN(),
1658 },
1659 .fixup_map1 = { 3 },
1660 .errstr = "invalid indirect read from stack off -8+0 size 8",
1661 .result = REJECT,
1662 },
1663 {
1664 "unpriv: mangle pointer on stack 1",
1665 .insns = {
1666 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1667 BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1668 BPF_MOV64_IMM(BPF_REG_0, 0),
1669 BPF_EXIT_INSN(),
1670 },
1671 .errstr_unpriv = "attempt to corrupt spilled",
1672 .result_unpriv = REJECT,
1673 .result = ACCEPT,
1674 },
1675 {
1676 "unpriv: mangle pointer on stack 2",
1677 .insns = {
1678 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1679 BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
1680 BPF_MOV64_IMM(BPF_REG_0, 0),
1681 BPF_EXIT_INSN(),
1682 },
1683 .errstr_unpriv = "attempt to corrupt spilled",
1684 .result_unpriv = REJECT,
1685 .result = ACCEPT,
1686 },
1687 {
1688 "unpriv: read pointer from stack in small chunks",
1689 .insns = {
1690 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1691 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
1692 BPF_MOV64_IMM(BPF_REG_0, 0),
1693 BPF_EXIT_INSN(),
1694 },
1695 .errstr = "invalid size",
1696 .result = REJECT,
1697 },
1698 {
1699 "unpriv: write pointer into ctx",
1700 .insns = {
1701 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
1702 BPF_MOV64_IMM(BPF_REG_0, 0),
1703 BPF_EXIT_INSN(),
1704 },
1705 .errstr_unpriv = "R1 leaks addr",
1706 .result_unpriv = REJECT,
1707 .errstr = "invalid bpf_context access",
1708 .result = REJECT,
1709 },
1710 {
1711 "unpriv: spill/fill of ctx",
1712 .insns = {
1713 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1714 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1715 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1716 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1717 BPF_MOV64_IMM(BPF_REG_0, 0),
1718 BPF_EXIT_INSN(),
1719 },
1720 .result = ACCEPT,
1721 },
1722 {
1723 "unpriv: spill/fill of ctx 2",
1724 .insns = {
1725 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1727 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1728 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1729 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1730 BPF_FUNC_get_hash_recalc),
1731 BPF_EXIT_INSN(),
1732 },
1733 .result = ACCEPT,
1734 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1735 },
1736 {
1737 "unpriv: spill/fill of ctx 3",
1738 .insns = {
1739 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1740 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1741 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1742 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1743 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1744 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1745 BPF_FUNC_get_hash_recalc),
1746 BPF_EXIT_INSN(),
1747 },
1748 .result = REJECT,
1749 .errstr = "R1 type=fp expected=ctx",
1750 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1751 },
1752 {
1753 "unpriv: spill/fill of ctx 4",
1754 .insns = {
1755 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1756 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1757 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1758 BPF_MOV64_IMM(BPF_REG_0, 1),
1759 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
1760 BPF_REG_0, -8, 0),
1761 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1762 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1763 BPF_FUNC_get_hash_recalc),
1764 BPF_EXIT_INSN(),
1765 },
1766 .result = REJECT,
1767 .errstr = "R1 type=inv expected=ctx",
1768 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1769 },
1770 {
1771 "unpriv: spill/fill of different pointers stx",
1772 .insns = {
1773 BPF_MOV64_IMM(BPF_REG_3, 42),
1774 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1775 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1776 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1777 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1778 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1779 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1780 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1781 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1782 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1783 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
1784 offsetof(struct __sk_buff, mark)),
1785 BPF_MOV64_IMM(BPF_REG_0, 0),
1786 BPF_EXIT_INSN(),
1787 },
1788 .result = REJECT,
1789 .errstr = "same insn cannot be used with different pointers",
1790 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1791 },
1792 {
1793 "unpriv: spill/fill of different pointers ldx",
1794 .insns = {
1795 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1796 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1798 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
1800 -(__s32)offsetof(struct bpf_perf_event_data,
1801 sample_period) - 8),
1802 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1803 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1804 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1805 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1806 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
1807 offsetof(struct bpf_perf_event_data,
1808 sample_period)),
1809 BPF_MOV64_IMM(BPF_REG_0, 0),
1810 BPF_EXIT_INSN(),
1811 },
1812 .result = REJECT,
1813 .errstr = "same insn cannot be used with different pointers",
1814 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
1815 },
1816 {
1817 "unpriv: write pointer into map elem value",
1818 .insns = {
1819 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1820 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1821 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1822 BPF_LD_MAP_FD(BPF_REG_1, 0),
1823 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1824 BPF_FUNC_map_lookup_elem),
1825 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1826 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
1827 BPF_EXIT_INSN(),
1828 },
1829 .fixup_map1 = { 3 },
1830 .errstr_unpriv = "R0 leaks addr",
1831 .result_unpriv = REJECT,
1832 .result = ACCEPT,
1833 },
1834 {
1835 "unpriv: partial copy of pointer",
1836 .insns = {
1837 BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
1838 BPF_MOV64_IMM(BPF_REG_0, 0),
1839 BPF_EXIT_INSN(),
1840 },
1841 .errstr_unpriv = "R10 partial copy",
1842 .result_unpriv = REJECT,
1843 .result = ACCEPT,
1844 },
1845 {
1846 "unpriv: pass pointer to tail_call",
1847 .insns = {
1848 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1849 BPF_LD_MAP_FD(BPF_REG_2, 0),
1850 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1851 BPF_FUNC_tail_call),
1852 BPF_MOV64_IMM(BPF_REG_0, 0),
1853 BPF_EXIT_INSN(),
1854 },
1855 .fixup_prog = { 1 },
1856 .errstr_unpriv = "R3 leaks addr into helper",
1857 .result_unpriv = REJECT,
1858 .result = ACCEPT,
1859 },
1860 {
1861 "unpriv: cmp map pointer with zero",
1862 .insns = {
1863 BPF_MOV64_IMM(BPF_REG_1, 0),
1864 BPF_LD_MAP_FD(BPF_REG_1, 0),
1865 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1866 BPF_MOV64_IMM(BPF_REG_0, 0),
1867 BPF_EXIT_INSN(),
1868 },
1869 .fixup_map1 = { 1 },
1870 .errstr_unpriv = "R1 pointer comparison",
1871 .result_unpriv = REJECT,
1872 .result = ACCEPT,
1873 },
1874 {
1875 "unpriv: write into frame pointer",
1876 .insns = {
1877 BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
1878 BPF_MOV64_IMM(BPF_REG_0, 0),
1879 BPF_EXIT_INSN(),
1880 },
1881 .errstr = "frame pointer is read only",
1882 .result = REJECT,
1883 },
1884 {
1885 "unpriv: spill/fill frame pointer",
1886 .insns = {
1887 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1888 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1889 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1890 BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
1891 BPF_MOV64_IMM(BPF_REG_0, 0),
1892 BPF_EXIT_INSN(),
1893 },
1894 .errstr = "frame pointer is read only",
1895 .result = REJECT,
1896 },
1897 {
1898 "unpriv: cmp of frame pointer",
1899 .insns = {
1900 BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
1901 BPF_MOV64_IMM(BPF_REG_0, 0),
1902 BPF_EXIT_INSN(),
1903 },
1904 .errstr_unpriv = "R10 pointer comparison",
1905 .result_unpriv = REJECT,
1906 .result = ACCEPT,
1907 },
1908 {
1909 "unpriv: adding of fp",
1910 .insns = {
1911 BPF_MOV64_IMM(BPF_REG_0, 0),
1912 BPF_MOV64_IMM(BPF_REG_1, 0),
1913 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1914 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
1915 BPF_EXIT_INSN(),
1916 },
1917 .errstr_unpriv = "pointer arithmetic prohibited",
1918 .result_unpriv = REJECT,
1919 .errstr = "R1 invalid mem access",
1920 .result = REJECT,
1921 },
1922 {
1923 "unpriv: cmp of stack pointer",
1924 .insns = {
1925 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1926 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1927 BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
1928 BPF_MOV64_IMM(BPF_REG_0, 0),
1929 BPF_EXIT_INSN(),
1930 },
1931 .errstr_unpriv = "R2 pointer comparison",
1932 .result_unpriv = REJECT,
1933 .result = ACCEPT,
1934 },
1935 {
1936 "stack pointer arithmetic",
1937 .insns = {
1938 BPF_MOV64_IMM(BPF_REG_1, 4),
1939 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1940 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
1941 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
1942 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
1943 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
1944 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
1945 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
1946 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
1947 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
1948 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
1949 BPF_MOV64_IMM(BPF_REG_0, 0),
1950 BPF_EXIT_INSN(),
1951 },
1952 .result = ACCEPT,
1953 },
1954 {
1955 "raw_stack: no skb_load_bytes",
1956 .insns = {
1957 BPF_MOV64_IMM(BPF_REG_2, 4),
1958 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1959 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1960 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1961 BPF_MOV64_IMM(BPF_REG_4, 8),
1962 /* Call to skb_load_bytes() omitted. */
1963 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1964 BPF_EXIT_INSN(),
1965 },
1966 .result = REJECT,
1967 .errstr = "invalid read from stack off -8+0 size 8",
1968 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1969 },
1970 {
1971 "raw_stack: skb_load_bytes, negative len",
1972 .insns = {
1973 BPF_MOV64_IMM(BPF_REG_2, 4),
1974 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1975 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1976 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1977 BPF_MOV64_IMM(BPF_REG_4, -8),
1978 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1979 BPF_FUNC_skb_load_bytes),
1980 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1981 BPF_EXIT_INSN(),
1982 },
1983 .result = REJECT,
1984 .errstr = "invalid stack type R3",
1985 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1986 },
1987 {
1988 "raw_stack: skb_load_bytes, negative len 2",
1989 .insns = {
1990 BPF_MOV64_IMM(BPF_REG_2, 4),
1991 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1992 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1993 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1994 BPF_MOV64_IMM(BPF_REG_4, ~0),
1995 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1996 BPF_FUNC_skb_load_bytes),
1997 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1998 BPF_EXIT_INSN(),
1999 },
2000 .result = REJECT,
2001 .errstr = "invalid stack type R3",
2002 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2003 },
2004 {
2005 "raw_stack: skb_load_bytes, zero len",
2006 .insns = {
2007 BPF_MOV64_IMM(BPF_REG_2, 4),
2008 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2009 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2010 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2011 BPF_MOV64_IMM(BPF_REG_4, 0),
2012 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2013 BPF_FUNC_skb_load_bytes),
2014 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2015 BPF_EXIT_INSN(),
2016 },
2017 .result = REJECT,
2018 .errstr = "invalid stack type R3",
2019 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2020 },
2021 {
2022 "raw_stack: skb_load_bytes, no init",
2023 .insns = {
2024 BPF_MOV64_IMM(BPF_REG_2, 4),
2025 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2026 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2027 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2028 BPF_MOV64_IMM(BPF_REG_4, 8),
2029 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2030 BPF_FUNC_skb_load_bytes),
2031 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2032 BPF_EXIT_INSN(),
2033 },
2034 .result = ACCEPT,
2035 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2036 },
2037 {
2038 "raw_stack: skb_load_bytes, init",
2039 .insns = {
2040 BPF_MOV64_IMM(BPF_REG_2, 4),
2041 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2042 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2043 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2044 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2045 BPF_MOV64_IMM(BPF_REG_4, 8),
2046 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2047 BPF_FUNC_skb_load_bytes),
2048 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2049 BPF_EXIT_INSN(),
2050 },
2051 .result = ACCEPT,
2052 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2053 },
2054 {
2055 "raw_stack: skb_load_bytes, spilled regs around bounds",
2056 .insns = {
2057 BPF_MOV64_IMM(BPF_REG_2, 4),
2058 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2059 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2060 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2061 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2062 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2063 BPF_MOV64_IMM(BPF_REG_4, 8),
2064 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2065 BPF_FUNC_skb_load_bytes),
2066 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2067 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2068 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2069 offsetof(struct __sk_buff, mark)),
2070 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2071 offsetof(struct __sk_buff, priority)),
2072 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2073 BPF_EXIT_INSN(),
2074 },
2075 .result = ACCEPT,
2076 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2077 },
2078 {
2079 "raw_stack: skb_load_bytes, spilled regs corruption",
2080 .insns = {
2081 BPF_MOV64_IMM(BPF_REG_2, 4),
2082 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2083 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2084 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2085 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2086 BPF_MOV64_IMM(BPF_REG_4, 8),
2087 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2088 BPF_FUNC_skb_load_bytes),
2089 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2090 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2091 offsetof(struct __sk_buff, mark)),
2092 BPF_EXIT_INSN(),
2093 },
2094 .result = REJECT,
2095 .errstr = "R0 invalid mem access 'inv'",
2096 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2097 },
2098 {
2099 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2100 .insns = {
2101 BPF_MOV64_IMM(BPF_REG_2, 4),
2102 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2104 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2105 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2106 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2107 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2108 BPF_MOV64_IMM(BPF_REG_4, 8),
2109 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2110 BPF_FUNC_skb_load_bytes),
2111 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2112 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2113 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2114 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2115 offsetof(struct __sk_buff, mark)),
2116 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2117 offsetof(struct __sk_buff, priority)),
2118 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2119 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2120 offsetof(struct __sk_buff, pkt_type)),
2121 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2122 BPF_EXIT_INSN(),
2123 },
2124 .result = REJECT,
2125 .errstr = "R3 invalid mem access 'inv'",
2126 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2127 },
2128 {
2129 "raw_stack: skb_load_bytes, spilled regs + data",
2130 .insns = {
2131 BPF_MOV64_IMM(BPF_REG_2, 4),
2132 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2133 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2134 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2135 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2136 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2137 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2138 BPF_MOV64_IMM(BPF_REG_4, 8),
2139 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2140 BPF_FUNC_skb_load_bytes),
2141 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2142 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2143 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2144 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2145 offsetof(struct __sk_buff, mark)),
2146 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2147 offsetof(struct __sk_buff, priority)),
2148 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2149 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2150 BPF_EXIT_INSN(),
2151 },
2152 .result = ACCEPT,
2153 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2154 },
2155 {
2156 "raw_stack: skb_load_bytes, invalid access 1",
2157 .insns = {
2158 BPF_MOV64_IMM(BPF_REG_2, 4),
2159 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2161 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2162 BPF_MOV64_IMM(BPF_REG_4, 8),
2163 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2164 BPF_FUNC_skb_load_bytes),
2165 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2166 BPF_EXIT_INSN(),
2167 },
2168 .result = REJECT,
2169 .errstr = "invalid stack type R3 off=-513 access_size=8",
2170 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2171 },
2172 {
2173 "raw_stack: skb_load_bytes, invalid access 2",
2174 .insns = {
2175 BPF_MOV64_IMM(BPF_REG_2, 4),
2176 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2177 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2178 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2179 BPF_MOV64_IMM(BPF_REG_4, 8),
2180 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2181 BPF_FUNC_skb_load_bytes),
2182 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2183 BPF_EXIT_INSN(),
2184 },
2185 .result = REJECT,
2186 .errstr = "invalid stack type R3 off=-1 access_size=8",
2187 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2188 },
2189 {
2190 "raw_stack: skb_load_bytes, invalid access 3",
2191 .insns = {
2192 BPF_MOV64_IMM(BPF_REG_2, 4),
2193 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2194 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2195 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2196 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2197 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2198 BPF_FUNC_skb_load_bytes),
2199 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2200 BPF_EXIT_INSN(),
2201 },
2202 .result = REJECT,
2203 .errstr = "invalid stack type R3 off=-1 access_size=-1",
2204 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2205 },
2206 {
2207 "raw_stack: skb_load_bytes, invalid access 4",
2208 .insns = {
2209 BPF_MOV64_IMM(BPF_REG_2, 4),
2210 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2211 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2212 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2213 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2214 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2215 BPF_FUNC_skb_load_bytes),
2216 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2217 BPF_EXIT_INSN(),
2218 },
2219 .result = REJECT,
2220 .errstr = "invalid stack type R3 off=-1 access_size=2147483647",
2221 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2222 },
2223 {
2224 "raw_stack: skb_load_bytes, invalid access 5",
2225 .insns = {
2226 BPF_MOV64_IMM(BPF_REG_2, 4),
2227 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2228 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2229 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2230 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2231 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2232 BPF_FUNC_skb_load_bytes),
2233 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2234 BPF_EXIT_INSN(),
2235 },
2236 .result = REJECT,
2237 .errstr = "invalid stack type R3 off=-512 access_size=2147483647",
2238 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2239 },
2240 {
2241 "raw_stack: skb_load_bytes, invalid access 6",
2242 .insns = {
2243 BPF_MOV64_IMM(BPF_REG_2, 4),
2244 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2245 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2246 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2247 BPF_MOV64_IMM(BPF_REG_4, 0),
2248 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2249 BPF_FUNC_skb_load_bytes),
2250 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2251 BPF_EXIT_INSN(),
2252 },
2253 .result = REJECT,
2254 .errstr = "invalid stack type R3 off=-512 access_size=0",
2255 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2256 },
2257 {
2258 "raw_stack: skb_load_bytes, large access",
2259 .insns = {
2260 BPF_MOV64_IMM(BPF_REG_2, 4),
2261 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2262 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2263 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2264 BPF_MOV64_IMM(BPF_REG_4, 512),
2265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2266 BPF_FUNC_skb_load_bytes),
2267 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2268 BPF_EXIT_INSN(),
2269 },
2270 .result = ACCEPT,
2271 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2272 },
2273 {
2274 "direct packet access: test1",
2275 .insns = {
2276 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2277 offsetof(struct __sk_buff, data)),
2278 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2279 offsetof(struct __sk_buff, data_end)),
2280 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2282 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2283 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2284 BPF_MOV64_IMM(BPF_REG_0, 0),
2285 BPF_EXIT_INSN(),
2286 },
2287 .result = ACCEPT,
2288 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2289 },
2290 {
2291 "direct packet access: test2",
2292 .insns = {
2293 BPF_MOV64_IMM(BPF_REG_0, 1),
2294 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2295 offsetof(struct __sk_buff, data_end)),
2296 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2297 offsetof(struct __sk_buff, data)),
2298 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2299 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2300 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2301 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2302 BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2303 BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2304 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2305 offsetof(struct __sk_buff, data)),
2306 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
2308 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 48),
2309 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 48),
2310 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2311 BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2312 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2313 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2314 offsetof(struct __sk_buff, data_end)),
2315 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2316 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2317 BPF_MOV64_IMM(BPF_REG_0, 0),
2318 BPF_EXIT_INSN(),
2319 },
2320 .result = ACCEPT,
2321 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2322 },
2323 {
2324 "direct packet access: test3",
2325 .insns = {
2326 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2327 offsetof(struct __sk_buff, data)),
2328 BPF_MOV64_IMM(BPF_REG_0, 0),
2329 BPF_EXIT_INSN(),
2330 },
2331 .errstr = "invalid bpf_context access off=76",
2332 .result = REJECT,
2333 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2334 },
2335 {
2336 "direct packet access: test4 (write)",
2337 .insns = {
2338 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2339 offsetof(struct __sk_buff, data)),
2340 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2341 offsetof(struct __sk_buff, data_end)),
2342 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2343 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2344 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2345 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2346 BPF_MOV64_IMM(BPF_REG_0, 0),
2347 BPF_EXIT_INSN(),
2348 },
2349 .result = ACCEPT,
2350 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2351 },
2352 {
2353 "direct packet access: test5 (pkt_end >= reg, good access)",
2354 .insns = {
2355 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2356 offsetof(struct __sk_buff, data)),
2357 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2358 offsetof(struct __sk_buff, data_end)),
2359 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2360 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2361 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2362 BPF_MOV64_IMM(BPF_REG_0, 1),
2363 BPF_EXIT_INSN(),
2364 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2365 BPF_MOV64_IMM(BPF_REG_0, 0),
2366 BPF_EXIT_INSN(),
2367 },
2368 .result = ACCEPT,
2369 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2370 },
2371 {
2372 "direct packet access: test6 (pkt_end >= reg, bad access)",
2373 .insns = {
2374 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2375 offsetof(struct __sk_buff, data)),
2376 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2377 offsetof(struct __sk_buff, data_end)),
2378 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2379 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2380 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2381 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2382 BPF_MOV64_IMM(BPF_REG_0, 1),
2383 BPF_EXIT_INSN(),
2384 BPF_MOV64_IMM(BPF_REG_0, 0),
2385 BPF_EXIT_INSN(),
2386 },
2387 .errstr = "invalid access to packet",
2388 .result = REJECT,
2389 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2390 },
2391 {
2392 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2393 .insns = {
2394 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2395 offsetof(struct __sk_buff, data)),
2396 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2397 offsetof(struct __sk_buff, data_end)),
2398 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2399 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2400 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2401 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2402 BPF_MOV64_IMM(BPF_REG_0, 1),
2403 BPF_EXIT_INSN(),
2404 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2405 BPF_MOV64_IMM(BPF_REG_0, 0),
2406 BPF_EXIT_INSN(),
2407 },
2408 .errstr = "invalid access to packet",
2409 .result = REJECT,
2410 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2411 },
2412 {
2413 "direct packet access: test8 (double test, variant 1)",
2414 .insns = {
2415 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2416 offsetof(struct __sk_buff, data)),
2417 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2418 offsetof(struct __sk_buff, data_end)),
2419 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2420 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2421 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2422 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2423 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2424 BPF_MOV64_IMM(BPF_REG_0, 1),
2425 BPF_EXIT_INSN(),
2426 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2427 BPF_MOV64_IMM(BPF_REG_0, 0),
2428 BPF_EXIT_INSN(),
2429 },
2430 .result = ACCEPT,
2431 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2432 },
2433 {
2434 "direct packet access: test9 (double test, variant 2)",
2435 .insns = {
2436 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2437 offsetof(struct __sk_buff, data)),
2438 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2439 offsetof(struct __sk_buff, data_end)),
2440 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2441 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2442 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2443 BPF_MOV64_IMM(BPF_REG_0, 1),
2444 BPF_EXIT_INSN(),
2445 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2446 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2447 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2448 BPF_MOV64_IMM(BPF_REG_0, 0),
2449 BPF_EXIT_INSN(),
2450 },
2451 .result = ACCEPT,
2452 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2453 },
2454 {
2455 "direct packet access: test10 (write invalid)",
2456 .insns = {
2457 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2458 offsetof(struct __sk_buff, data)),
2459 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2460 offsetof(struct __sk_buff, data_end)),
2461 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2462 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2463 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2464 BPF_MOV64_IMM(BPF_REG_0, 0),
2465 BPF_EXIT_INSN(),
2466 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2467 BPF_MOV64_IMM(BPF_REG_0, 0),
2468 BPF_EXIT_INSN(),
2469 },
2470 .errstr = "invalid access to packet",
2471 .result = REJECT,
2472 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2473 },
2474 {
2475 "direct packet access: test11 (shift, good access)",
2476 .insns = {
2477 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2478 offsetof(struct __sk_buff, data)),
2479 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2480 offsetof(struct __sk_buff, data_end)),
2481 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2482 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2483 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2484 BPF_MOV64_IMM(BPF_REG_3, 144),
2485 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2486 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2487 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
2488 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2489 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2490 BPF_MOV64_IMM(BPF_REG_0, 1),
2491 BPF_EXIT_INSN(),
2492 BPF_MOV64_IMM(BPF_REG_0, 0),
2493 BPF_EXIT_INSN(),
2494 },
2495 .result = ACCEPT,
2496 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2497 },
2498 {
2499 "direct packet access: test12 (and, good access)",
2500 .insns = {
2501 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2502 offsetof(struct __sk_buff, data)),
2503 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2504 offsetof(struct __sk_buff, data_end)),
2505 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2506 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2507 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2508 BPF_MOV64_IMM(BPF_REG_3, 144),
2509 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2510 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2511 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2512 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2513 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2514 BPF_MOV64_IMM(BPF_REG_0, 1),
2515 BPF_EXIT_INSN(),
2516 BPF_MOV64_IMM(BPF_REG_0, 0),
2517 BPF_EXIT_INSN(),
2518 },
2519 .result = ACCEPT,
2520 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2521 },
2522 {
2523 "direct packet access: test13 (branches, good access)",
2524 .insns = {
2525 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2526 offsetof(struct __sk_buff, data)),
2527 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2528 offsetof(struct __sk_buff, data_end)),
2529 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2530 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2531 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
2532 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2533 offsetof(struct __sk_buff, mark)),
2534 BPF_MOV64_IMM(BPF_REG_4, 1),
2535 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
2536 BPF_MOV64_IMM(BPF_REG_3, 14),
2537 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
2538 BPF_MOV64_IMM(BPF_REG_3, 24),
2539 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2540 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2541 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2542 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2543 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2544 BPF_MOV64_IMM(BPF_REG_0, 1),
2545 BPF_EXIT_INSN(),
2546 BPF_MOV64_IMM(BPF_REG_0, 0),
2547 BPF_EXIT_INSN(),
2548 },
2549 .result = ACCEPT,
2550 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2551 },
2552 {
2553 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2554 .insns = {
2555 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2556 offsetof(struct __sk_buff, data)),
2557 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2558 offsetof(struct __sk_buff, data_end)),
2559 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2560 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2561 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
2562 BPF_MOV64_IMM(BPF_REG_5, 12),
2563 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
2564 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2565 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2566 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
2567 BPF_MOV64_IMM(BPF_REG_0, 1),
2568 BPF_EXIT_INSN(),
2569 BPF_MOV64_IMM(BPF_REG_0, 0),
2570 BPF_EXIT_INSN(),
2571 },
2572 .result = ACCEPT,
2573 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2574 },
2575 {
2576 "direct packet access: test15 (spill with xadd)",
2577 .insns = {
2578 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2579 offsetof(struct __sk_buff, data)),
2580 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2581 offsetof(struct __sk_buff, data_end)),
2582 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2583 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2584 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2585 BPF_MOV64_IMM(BPF_REG_5, 4096),
2586 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
2587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
2588 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
2589 BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
2590 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
2591 BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
2592 BPF_MOV64_IMM(BPF_REG_0, 0),
2593 BPF_EXIT_INSN(),
2594 },
2595 .errstr = "R2 invalid mem access 'inv'",
2596 .result = REJECT,
2597 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2598 },
2599 {
2600 "direct packet access: test16 (arith on data_end)",
2601 .insns = {
2602 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2603 offsetof(struct __sk_buff, data)),
2604 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2605 offsetof(struct __sk_buff, data_end)),
2606 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2607 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2608 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
2609 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2610 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2611 BPF_MOV64_IMM(BPF_REG_0, 0),
2612 BPF_EXIT_INSN(),
2613 },
2614 .errstr = "invalid access to packet",
2615 .result = REJECT,
2616 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2617 },
2618 {
2619 "direct packet access: test17 (pruning, alignment)",
2620 .insns = {
2621 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2622 offsetof(struct __sk_buff, data)),
2623 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2624 offsetof(struct __sk_buff, data_end)),
2625 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2626 offsetof(struct __sk_buff, mark)),
2627 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2628 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
2629 BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
2630 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2631 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
2632 BPF_MOV64_IMM(BPF_REG_0, 0),
2633 BPF_EXIT_INSN(),
2634 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
2635 BPF_JMP_A(-6),
2636 },
2637 .errstr = "misaligned packet access off 2+15+-4 size 4",
2638 .result = REJECT,
2639 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2640 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2641 },
2642 {
2643 "helper access to packet: test1, valid packet_ptr range",
2644 .insns = {
2645 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2646 offsetof(struct xdp_md, data)),
2647 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2648 offsetof(struct xdp_md, data_end)),
2649 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2650 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2651 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2652 BPF_LD_MAP_FD(BPF_REG_1, 0),
2653 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2654 BPF_MOV64_IMM(BPF_REG_4, 0),
2655 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2656 BPF_FUNC_map_update_elem),
2657 BPF_MOV64_IMM(BPF_REG_0, 0),
2658 BPF_EXIT_INSN(),
2659 },
2660 .fixup_map1 = { 5 },
2661 .result_unpriv = ACCEPT,
2662 .result = ACCEPT,
2663 .prog_type = BPF_PROG_TYPE_XDP,
2664 },
2665 {
2666 "helper access to packet: test2, unchecked packet_ptr",
2667 .insns = {
2668 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2669 offsetof(struct xdp_md, data)),
2670 BPF_LD_MAP_FD(BPF_REG_1, 0),
2671 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2672 BPF_FUNC_map_lookup_elem),
2673 BPF_MOV64_IMM(BPF_REG_0, 0),
2674 BPF_EXIT_INSN(),
2675 },
2676 .fixup_map1 = { 1 },
2677 .result = REJECT,
2678 .errstr = "invalid access to packet",
2679 .prog_type = BPF_PROG_TYPE_XDP,
2680 },
2681 {
2682 "helper access to packet: test3, variable add",
2683 .insns = {
2684 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2685 offsetof(struct xdp_md, data)),
2686 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2687 offsetof(struct xdp_md, data_end)),
2688 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2689 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2690 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2691 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2692 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2693 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2694 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2695 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2696 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2697 BPF_LD_MAP_FD(BPF_REG_1, 0),
2698 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2699 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2700 BPF_FUNC_map_lookup_elem),
2701 BPF_MOV64_IMM(BPF_REG_0, 0),
2702 BPF_EXIT_INSN(),
2703 },
2704 .fixup_map1 = { 11 },
2705 .result = ACCEPT,
2706 .prog_type = BPF_PROG_TYPE_XDP,
2707 },
2708 {
2709 "helper access to packet: test4, packet_ptr with bad range",
2710 .insns = {
2711 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2712 offsetof(struct xdp_md, data)),
2713 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2714 offsetof(struct xdp_md, data_end)),
2715 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2716 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2717 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2718 BPF_MOV64_IMM(BPF_REG_0, 0),
2719 BPF_EXIT_INSN(),
2720 BPF_LD_MAP_FD(BPF_REG_1, 0),
2721 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2722 BPF_FUNC_map_lookup_elem),
2723 BPF_MOV64_IMM(BPF_REG_0, 0),
2724 BPF_EXIT_INSN(),
2725 },
2726 .fixup_map1 = { 7 },
2727 .result = REJECT,
2728 .errstr = "invalid access to packet",
2729 .prog_type = BPF_PROG_TYPE_XDP,
2730 },
2731 {
2732 "helper access to packet: test5, packet_ptr with too short range",
2733 .insns = {
2734 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2735 offsetof(struct xdp_md, data)),
2736 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2737 offsetof(struct xdp_md, data_end)),
2738 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2739 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2740 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2741 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2742 BPF_LD_MAP_FD(BPF_REG_1, 0),
2743 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2744 BPF_FUNC_map_lookup_elem),
2745 BPF_MOV64_IMM(BPF_REG_0, 0),
2746 BPF_EXIT_INSN(),
2747 },
2748 .fixup_map1 = { 6 },
2749 .result = REJECT,
2750 .errstr = "invalid access to packet",
2751 .prog_type = BPF_PROG_TYPE_XDP,
2752 },
2753 {
2754 "helper access to packet: test6, cls valid packet_ptr range",
2755 .insns = {
2756 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2757 offsetof(struct __sk_buff, data)),
2758 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2759 offsetof(struct __sk_buff, data_end)),
2760 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2761 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2762 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2763 BPF_LD_MAP_FD(BPF_REG_1, 0),
2764 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2765 BPF_MOV64_IMM(BPF_REG_4, 0),
2766 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2767 BPF_FUNC_map_update_elem),
2768 BPF_MOV64_IMM(BPF_REG_0, 0),
2769 BPF_EXIT_INSN(),
2770 },
2771 .fixup_map1 = { 5 },
2772 .result = ACCEPT,
2773 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2774 },
2775 {
2776 "helper access to packet: test7, cls unchecked packet_ptr",
2777 .insns = {
2778 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2779 offsetof(struct __sk_buff, data)),
2780 BPF_LD_MAP_FD(BPF_REG_1, 0),
2781 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2782 BPF_FUNC_map_lookup_elem),
2783 BPF_MOV64_IMM(BPF_REG_0, 0),
2784 BPF_EXIT_INSN(),
2785 },
2786 .fixup_map1 = { 1 },
2787 .result = REJECT,
2788 .errstr = "invalid access to packet",
2789 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2790 },
2791 {
2792 "helper access to packet: test8, cls variable add",
2793 .insns = {
2794 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2795 offsetof(struct __sk_buff, data)),
2796 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2797 offsetof(struct __sk_buff, data_end)),
2798 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2800 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2801 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2802 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2803 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2804 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2805 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2806 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2807 BPF_LD_MAP_FD(BPF_REG_1, 0),
2808 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2809 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2810 BPF_FUNC_map_lookup_elem),
2811 BPF_MOV64_IMM(BPF_REG_0, 0),
2812 BPF_EXIT_INSN(),
2813 },
2814 .fixup_map1 = { 11 },
2815 .result = ACCEPT,
2816 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2817 },
2818 {
2819 "helper access to packet: test9, cls packet_ptr with bad range",
2820 .insns = {
2821 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2822 offsetof(struct __sk_buff, data)),
2823 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2824 offsetof(struct __sk_buff, data_end)),
2825 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2826 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2827 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2828 BPF_MOV64_IMM(BPF_REG_0, 0),
2829 BPF_EXIT_INSN(),
2830 BPF_LD_MAP_FD(BPF_REG_1, 0),
2831 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2832 BPF_FUNC_map_lookup_elem),
2833 BPF_MOV64_IMM(BPF_REG_0, 0),
2834 BPF_EXIT_INSN(),
2835 },
2836 .fixup_map1 = { 7 },
2837 .result = REJECT,
2838 .errstr = "invalid access to packet",
2839 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2840 },
2841 {
2842 "helper access to packet: test10, cls packet_ptr with too short range",
2843 .insns = {
2844 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2845 offsetof(struct __sk_buff, data)),
2846 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2847 offsetof(struct __sk_buff, data_end)),
2848 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2849 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2850 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2851 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2852 BPF_LD_MAP_FD(BPF_REG_1, 0),
2853 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2854 BPF_FUNC_map_lookup_elem),
2855 BPF_MOV64_IMM(BPF_REG_0, 0),
2856 BPF_EXIT_INSN(),
2857 },
2858 .fixup_map1 = { 6 },
2859 .result = REJECT,
2860 .errstr = "invalid access to packet",
2861 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2862 },
2863 {
2864 "helper access to packet: test11, cls unsuitable helper 1",
2865 .insns = {
2866 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2867 offsetof(struct __sk_buff, data)),
2868 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2869 offsetof(struct __sk_buff, data_end)),
2870 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2871 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
2873 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
2874 BPF_MOV64_IMM(BPF_REG_2, 0),
2875 BPF_MOV64_IMM(BPF_REG_4, 42),
2876 BPF_MOV64_IMM(BPF_REG_5, 0),
2877 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2878 BPF_FUNC_skb_store_bytes),
2879 BPF_MOV64_IMM(BPF_REG_0, 0),
2880 BPF_EXIT_INSN(),
2881 },
2882 .result = REJECT,
2883 .errstr = "helper access to the packet",
2884 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2885 },
2886 {
2887 "helper access to packet: test12, cls unsuitable helper 2",
2888 .insns = {
2889 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2890 offsetof(struct __sk_buff, data)),
2891 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2892 offsetof(struct __sk_buff, data_end)),
2893 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2894 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
2895 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
2896 BPF_MOV64_IMM(BPF_REG_2, 0),
2897 BPF_MOV64_IMM(BPF_REG_4, 4),
2898 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2899 BPF_FUNC_skb_load_bytes),
2900 BPF_MOV64_IMM(BPF_REG_0, 0),
2901 BPF_EXIT_INSN(),
2902 },
2903 .result = REJECT,
2904 .errstr = "helper access to the packet",
2905 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2906 },
2907 {
2908 "helper access to packet: test13, cls helper ok",
2909 .insns = {
2910 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2911 offsetof(struct __sk_buff, data)),
2912 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2913 offsetof(struct __sk_buff, data_end)),
2914 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2915 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2916 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2917 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2918 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2919 BPF_MOV64_IMM(BPF_REG_2, 4),
2920 BPF_MOV64_IMM(BPF_REG_3, 0),
2921 BPF_MOV64_IMM(BPF_REG_4, 0),
2922 BPF_MOV64_IMM(BPF_REG_5, 0),
2923 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2924 BPF_FUNC_csum_diff),
2925 BPF_MOV64_IMM(BPF_REG_0, 0),
2926 BPF_EXIT_INSN(),
2927 },
2928 .result = ACCEPT,
2929 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2930 },
2931 {
2932 "helper access to packet: test14, cls helper fail sub",
2933 .insns = {
2934 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2935 offsetof(struct __sk_buff, data)),
2936 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2937 offsetof(struct __sk_buff, data_end)),
2938 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2939 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2940 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2941 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2942 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
2943 BPF_MOV64_IMM(BPF_REG_2, 4),
2944 BPF_MOV64_IMM(BPF_REG_3, 0),
2945 BPF_MOV64_IMM(BPF_REG_4, 0),
2946 BPF_MOV64_IMM(BPF_REG_5, 0),
2947 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2948 BPF_FUNC_csum_diff),
2949 BPF_MOV64_IMM(BPF_REG_0, 0),
2950 BPF_EXIT_INSN(),
2951 },
2952 .result = REJECT,
2953 .errstr = "type=inv expected=fp",
2954 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2955 },
2956 {
2957 "helper access to packet: test15, cls helper fail range 1",
2958 .insns = {
2959 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2960 offsetof(struct __sk_buff, data)),
2961 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2962 offsetof(struct __sk_buff, data_end)),
2963 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2964 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2965 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2966 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2967 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2968 BPF_MOV64_IMM(BPF_REG_2, 8),
2969 BPF_MOV64_IMM(BPF_REG_3, 0),
2970 BPF_MOV64_IMM(BPF_REG_4, 0),
2971 BPF_MOV64_IMM(BPF_REG_5, 0),
2972 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2973 BPF_FUNC_csum_diff),
2974 BPF_MOV64_IMM(BPF_REG_0, 0),
2975 BPF_EXIT_INSN(),
2976 },
2977 .result = REJECT,
2978 .errstr = "invalid access to packet",
2979 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2980 },
2981 {
2982 "helper access to packet: test16, cls helper fail range 2",
2983 .insns = {
2984 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2985 offsetof(struct __sk_buff, data)),
2986 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2987 offsetof(struct __sk_buff, data_end)),
2988 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2989 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2990 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2991 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2992 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2993 BPF_MOV64_IMM(BPF_REG_2, -9),
2994 BPF_MOV64_IMM(BPF_REG_3, 0),
2995 BPF_MOV64_IMM(BPF_REG_4, 0),
2996 BPF_MOV64_IMM(BPF_REG_5, 0),
2997 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2998 BPF_FUNC_csum_diff),
2999 BPF_MOV64_IMM(BPF_REG_0, 0),
3000 BPF_EXIT_INSN(),
3001 },
3002 .result = REJECT,
3003 .errstr = "invalid access to packet",
3004 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3005 },
3006 {
3007 "helper access to packet: test17, cls helper fail range 3",
3008 .insns = {
3009 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3010 offsetof(struct __sk_buff, data)),
3011 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3012 offsetof(struct __sk_buff, data_end)),
3013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3014 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3015 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3016 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3017 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3018 BPF_MOV64_IMM(BPF_REG_2, ~0),
3019 BPF_MOV64_IMM(BPF_REG_3, 0),
3020 BPF_MOV64_IMM(BPF_REG_4, 0),
3021 BPF_MOV64_IMM(BPF_REG_5, 0),
3022 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3023 BPF_FUNC_csum_diff),
3024 BPF_MOV64_IMM(BPF_REG_0, 0),
3025 BPF_EXIT_INSN(),
3026 },
3027 .result = REJECT,
3028 .errstr = "invalid access to packet",
3029 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3030 },
3031 {
3032 "helper access to packet: test18, cls helper fail range zero",
3033 .insns = {
3034 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3035 offsetof(struct __sk_buff, data)),
3036 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3037 offsetof(struct __sk_buff, data_end)),
3038 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3039 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3040 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3041 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3042 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3043 BPF_MOV64_IMM(BPF_REG_2, 0),
3044 BPF_MOV64_IMM(BPF_REG_3, 0),
3045 BPF_MOV64_IMM(BPF_REG_4, 0),
3046 BPF_MOV64_IMM(BPF_REG_5, 0),
3047 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3048 BPF_FUNC_csum_diff),
3049 BPF_MOV64_IMM(BPF_REG_0, 0),
3050 BPF_EXIT_INSN(),
3051 },
3052 .result = REJECT,
3053 .errstr = "invalid access to packet",
3054 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3055 },
3056 {
3057 "helper access to packet: test19, pkt end as input",
3058 .insns = {
3059 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3060 offsetof(struct __sk_buff, data)),
3061 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3062 offsetof(struct __sk_buff, data_end)),
3063 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3064 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3066 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3067 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
3068 BPF_MOV64_IMM(BPF_REG_2, 4),
3069 BPF_MOV64_IMM(BPF_REG_3, 0),
3070 BPF_MOV64_IMM(BPF_REG_4, 0),
3071 BPF_MOV64_IMM(BPF_REG_5, 0),
3072 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3073 BPF_FUNC_csum_diff),
3074 BPF_MOV64_IMM(BPF_REG_0, 0),
3075 BPF_EXIT_INSN(),
3076 },
3077 .result = REJECT,
3078 .errstr = "R1 type=pkt_end expected=fp",
3079 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3080 },
3081 {
3082 "helper access to packet: test20, wrong reg",
3083 .insns = {
3084 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3085 offsetof(struct __sk_buff, data)),
3086 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3087 offsetof(struct __sk_buff, data_end)),
3088 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3089 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3090 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3091 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3092 BPF_MOV64_IMM(BPF_REG_2, 4),
3093 BPF_MOV64_IMM(BPF_REG_3, 0),
3094 BPF_MOV64_IMM(BPF_REG_4, 0),
3095 BPF_MOV64_IMM(BPF_REG_5, 0),
3096 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3097 BPF_FUNC_csum_diff),
3098 BPF_MOV64_IMM(BPF_REG_0, 0),
3099 BPF_EXIT_INSN(),
3100 },
3101 .result = REJECT,
3102 .errstr = "invalid access to packet",
3103 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3104 },
3105 {
3106 "valid map access into an array with a constant",
3107 .insns = {
3108 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3109 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3111 BPF_LD_MAP_FD(BPF_REG_1, 0),
3112 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3113 BPF_FUNC_map_lookup_elem),
3114 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3115 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3116 offsetof(struct test_val, foo)),
3117 BPF_EXIT_INSN(),
3118 },
3119 .fixup_map2 = { 3 },
3120 .errstr_unpriv = "R0 leaks addr",
3121 .result_unpriv = REJECT,
3122 .result = ACCEPT,
3123 },
3124 {
3125 "valid map access into an array with a register",
3126 .insns = {
3127 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3128 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3129 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3130 BPF_LD_MAP_FD(BPF_REG_1, 0),
3131 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3132 BPF_FUNC_map_lookup_elem),
3133 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3134 BPF_MOV64_IMM(BPF_REG_1, 4),
3135 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3136 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3137 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3138 offsetof(struct test_val, foo)),
3139 BPF_EXIT_INSN(),
3140 },
3141 .fixup_map2 = { 3 },
3142 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3143 .result_unpriv = REJECT,
3144 .result = ACCEPT,
3145 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3146 },
3147 {
3148 "valid map access into an array with a variable",
3149 .insns = {
3150 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3151 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3153 BPF_LD_MAP_FD(BPF_REG_1, 0),
3154 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3155 BPF_FUNC_map_lookup_elem),
3156 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3157 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3158 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
3159 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3160 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3161 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3162 offsetof(struct test_val, foo)),
3163 BPF_EXIT_INSN(),
3164 },
3165 .fixup_map2 = { 3 },
3166 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3167 .result_unpriv = REJECT,
3168 .result = ACCEPT,
3169 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3170 },
3171 {
3172 "valid map access into an array with a signed variable",
3173 .insns = {
3174 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3175 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3176 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3177 BPF_LD_MAP_FD(BPF_REG_1, 0),
3178 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3179 BPF_FUNC_map_lookup_elem),
3180 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
3181 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3182 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
3183 BPF_MOV32_IMM(BPF_REG_1, 0),
3184 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3185 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3186 BPF_MOV32_IMM(BPF_REG_1, 0),
3187 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3188 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3189 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3190 offsetof(struct test_val, foo)),
3191 BPF_EXIT_INSN(),
3192 },
3193 .fixup_map2 = { 3 },
3194 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3195 .result_unpriv = REJECT,
3196 .result = ACCEPT,
3197 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3198 },
3199 {
3200 "invalid map access into an array with a constant",
3201 .insns = {
3202 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3203 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3204 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3205 BPF_LD_MAP_FD(BPF_REG_1, 0),
3206 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3207 BPF_FUNC_map_lookup_elem),
3208 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3209 BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
3210 offsetof(struct test_val, foo)),
3211 BPF_EXIT_INSN(),
3212 },
3213 .fixup_map2 = { 3 },
3214 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
3215 .result = REJECT,
3216 },
3217 {
3218 "invalid map access into an array with a register",
3219 .insns = {
3220 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3221 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3222 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3223 BPF_LD_MAP_FD(BPF_REG_1, 0),
3224 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3225 BPF_FUNC_map_lookup_elem),
3226 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3227 BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
3228 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3229 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3230 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3231 offsetof(struct test_val, foo)),
3232 BPF_EXIT_INSN(),
3233 },
3234 .fixup_map2 = { 3 },
3235 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3236 .errstr = "R0 min value is outside of the array range",
3237 .result_unpriv = REJECT,
3238 .result = REJECT,
3239 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3240 },
3241 {
3242 "invalid map access into an array with a variable",
3243 .insns = {
3244 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3247 BPF_LD_MAP_FD(BPF_REG_1, 0),
3248 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3249 BPF_FUNC_map_lookup_elem),
3250 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3251 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3252 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3253 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3254 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3255 offsetof(struct test_val, foo)),
3256 BPF_EXIT_INSN(),
3257 },
3258 .fixup_map2 = { 3 },
3259 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3260 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3261 .result_unpriv = REJECT,
3262 .result = REJECT,
3263 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3264 },
3265 {
3266 "invalid map access into an array with no floor check",
3267 .insns = {
3268 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3269 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3270 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3271 BPF_LD_MAP_FD(BPF_REG_1, 0),
3272 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3273 BPF_FUNC_map_lookup_elem),
3274 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3275 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3276 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3277 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3278 BPF_MOV32_IMM(BPF_REG_1, 0),
3279 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3280 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3281 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3282 offsetof(struct test_val, foo)),
3283 BPF_EXIT_INSN(),
3284 },
3285 .fixup_map2 = { 3 },
3286 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3287 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3288 .result_unpriv = REJECT,
3289 .result = REJECT,
3290 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3291 },
3292 {
3293 "invalid map access into an array with a invalid max check",
3294 .insns = {
3295 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3296 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3298 BPF_LD_MAP_FD(BPF_REG_1, 0),
3299 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3300 BPF_FUNC_map_lookup_elem),
3301 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3302 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3303 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
3304 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3305 BPF_MOV32_IMM(BPF_REG_1, 0),
3306 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3307 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3308 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3309 offsetof(struct test_val, foo)),
3310 BPF_EXIT_INSN(),
3311 },
3312 .fixup_map2 = { 3 },
3313 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3314 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
3315 .result_unpriv = REJECT,
3316 .result = REJECT,
3317 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3318 },
3319 {
3320 "invalid map access into an array with a invalid max check",
3321 .insns = {
3322 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3323 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3324 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3325 BPF_LD_MAP_FD(BPF_REG_1, 0),
3326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3327 BPF_FUNC_map_lookup_elem),
3328 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3329 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3330 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3331 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3332 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3333 BPF_LD_MAP_FD(BPF_REG_1, 0),
3334 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3335 BPF_FUNC_map_lookup_elem),
3336 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3337 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
3338 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3339 offsetof(struct test_val, foo)),
3340 BPF_EXIT_INSN(),
3341 },
3342 .fixup_map2 = { 3, 11 },
3343 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3344 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3345 .result_unpriv = REJECT,
3346 .result = REJECT,
3347 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3348 },
3349 {
3350 "multiple registers share map_lookup_elem result",
3351 .insns = {
3352 BPF_MOV64_IMM(BPF_REG_1, 10),
3353 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3354 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3355 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3356 BPF_LD_MAP_FD(BPF_REG_1, 0),
3357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3358 BPF_FUNC_map_lookup_elem),
3359 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3360 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3361 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3362 BPF_EXIT_INSN(),
3363 },
3364 .fixup_map1 = { 4 },
3365 .result = ACCEPT,
3366 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3367 },
3368 {
3369 "alu ops on ptr_to_map_value_or_null, 1",
3370 .insns = {
3371 BPF_MOV64_IMM(BPF_REG_1, 10),
3372 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3373 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3375 BPF_LD_MAP_FD(BPF_REG_1, 0),
3376 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3377 BPF_FUNC_map_lookup_elem),
3378 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3379 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
3380 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
3381 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3382 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3383 BPF_EXIT_INSN(),
3384 },
3385 .fixup_map1 = { 4 },
3386 .errstr = "R4 invalid mem access",
3387 .result = REJECT,
3388 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3389 },
3390 {
3391 "alu ops on ptr_to_map_value_or_null, 2",
3392 .insns = {
3393 BPF_MOV64_IMM(BPF_REG_1, 10),
3394 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3395 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3396 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3397 BPF_LD_MAP_FD(BPF_REG_1, 0),
3398 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3399 BPF_FUNC_map_lookup_elem),
3400 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3401 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
3402 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3403 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3404 BPF_EXIT_INSN(),
3405 },
3406 .fixup_map1 = { 4 },
3407 .errstr = "R4 invalid mem access",
3408 .result = REJECT,
3409 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3410 },
3411 {
3412 "alu ops on ptr_to_map_value_or_null, 3",
3413 .insns = {
3414 BPF_MOV64_IMM(BPF_REG_1, 10),
3415 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3416 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3417 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3418 BPF_LD_MAP_FD(BPF_REG_1, 0),
3419 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3420 BPF_FUNC_map_lookup_elem),
3421 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3422 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
3423 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3424 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3425 BPF_EXIT_INSN(),
3426 },
3427 .fixup_map1 = { 4 },
3428 .errstr = "R4 invalid mem access",
3429 .result = REJECT,
3430 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3431 },
3432 {
3433 "invalid memory access with multiple map_lookup_elem calls",
3434 .insns = {
3435 BPF_MOV64_IMM(BPF_REG_1, 10),
3436 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3437 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3438 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3439 BPF_LD_MAP_FD(BPF_REG_1, 0),
3440 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3441 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3442 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3443 BPF_FUNC_map_lookup_elem),
3444 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3445 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3446 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3447 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3448 BPF_FUNC_map_lookup_elem),
3449 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3450 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3451 BPF_EXIT_INSN(),
3452 },
3453 .fixup_map1 = { 4 },
3454 .result = REJECT,
3455 .errstr = "R4 !read_ok",
3456 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3457 },
3458 {
3459 "valid indirect map_lookup_elem access with 2nd lookup in branch",
3460 .insns = {
3461 BPF_MOV64_IMM(BPF_REG_1, 10),
3462 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3463 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3464 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3465 BPF_LD_MAP_FD(BPF_REG_1, 0),
3466 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3467 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3468 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3469 BPF_FUNC_map_lookup_elem),
3470 BPF_MOV64_IMM(BPF_REG_2, 10),
3471 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
3472 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3473 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3474 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3475 BPF_FUNC_map_lookup_elem),
3476 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3477 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3478 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3479 BPF_EXIT_INSN(),
3480 },
3481 .fixup_map1 = { 4 },
3482 .result = ACCEPT,
3483 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3484 },
3485 {
3486 "multiple registers share map_lookup_elem bad reg type",
3487 .insns = {
3488 BPF_MOV64_IMM(BPF_REG_1, 10),
3489 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3490 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3492 BPF_LD_MAP_FD(BPF_REG_1, 0),
3493 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3494 BPF_FUNC_map_lookup_elem),
3495 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
3496 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
3497 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3498 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3499 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3500 BPF_MOV64_IMM(BPF_REG_1, 1),
3501 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3502 BPF_MOV64_IMM(BPF_REG_1, 2),
3503 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
3504 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
3505 BPF_MOV64_IMM(BPF_REG_1, 3),
3506 BPF_EXIT_INSN(),
3507 },
3508 .fixup_map1 = { 4 },
3509 .result = REJECT,
3510 .errstr = "R3 invalid mem access 'inv'",
3511 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3512 },
3513 {
3514 "invalid map access from else condition",
3515 .insns = {
3516 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3517 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3518 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3519 BPF_LD_MAP_FD(BPF_REG_1, 0),
3520 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
3521 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3522 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3523 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
3524 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
3525 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3526 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3527 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
3528 BPF_EXIT_INSN(),
3529 },
3530 .fixup_map2 = { 3 },
3531 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
3532 .result = REJECT,
3533 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3534 .result_unpriv = REJECT,
3535 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3536 },
3537 {
3538 "constant register |= constant should keep constant type",
3539 .insns = {
3540 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3541 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3542 BPF_MOV64_IMM(BPF_REG_2, 34),
3543 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
3544 BPF_MOV64_IMM(BPF_REG_3, 0),
3545 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3546 BPF_EXIT_INSN(),
3547 },
3548 .result = ACCEPT,
3549 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3550 },
3551 {
3552 "constant register |= constant should not bypass stack boundary checks",
3553 .insns = {
3554 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3555 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3556 BPF_MOV64_IMM(BPF_REG_2, 34),
3557 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
3558 BPF_MOV64_IMM(BPF_REG_3, 0),
3559 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3560 BPF_EXIT_INSN(),
3561 },
3562 .errstr = "invalid stack type R1 off=-48 access_size=58",
3563 .result = REJECT,
3564 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3565 },
3566 {
3567 "constant register |= constant register should keep constant type",
3568 .insns = {
3569 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3570 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3571 BPF_MOV64_IMM(BPF_REG_2, 34),
3572 BPF_MOV64_IMM(BPF_REG_4, 13),
3573 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3574 BPF_MOV64_IMM(BPF_REG_3, 0),
3575 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3576 BPF_EXIT_INSN(),
3577 },
3578 .result = ACCEPT,
3579 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3580 },
3581 {
3582 "constant register |= constant register should not bypass stack boundary checks",
3583 .insns = {
3584 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3585 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3586 BPF_MOV64_IMM(BPF_REG_2, 34),
3587 BPF_MOV64_IMM(BPF_REG_4, 24),
3588 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3589 BPF_MOV64_IMM(BPF_REG_3, 0),
3590 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3591 BPF_EXIT_INSN(),
3592 },
3593 .errstr = "invalid stack type R1 off=-48 access_size=58",
3594 .result = REJECT,
3595 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3596 },
3597 {
3598 "invalid direct packet write for LWT_IN",
3599 .insns = {
3600 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3601 offsetof(struct __sk_buff, data)),
3602 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3603 offsetof(struct __sk_buff, data_end)),
3604 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3605 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3606 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3607 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3608 BPF_MOV64_IMM(BPF_REG_0, 0),
3609 BPF_EXIT_INSN(),
3610 },
3611 .errstr = "cannot write into packet",
3612 .result = REJECT,
3613 .prog_type = BPF_PROG_TYPE_LWT_IN,
3614 },
3615 {
3616 "invalid direct packet write for LWT_OUT",
3617 .insns = {
3618 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3619 offsetof(struct __sk_buff, data)),
3620 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3621 offsetof(struct __sk_buff, data_end)),
3622 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3623 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3624 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3625 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3626 BPF_MOV64_IMM(BPF_REG_0, 0),
3627 BPF_EXIT_INSN(),
3628 },
3629 .errstr = "cannot write into packet",
3630 .result = REJECT,
3631 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3632 },
3633 {
3634 "direct packet write for LWT_XMIT",
3635 .insns = {
3636 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3637 offsetof(struct __sk_buff, data)),
3638 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3639 offsetof(struct __sk_buff, data_end)),
3640 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3641 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3642 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3643 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3644 BPF_MOV64_IMM(BPF_REG_0, 0),
3645 BPF_EXIT_INSN(),
3646 },
3647 .result = ACCEPT,
3648 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3649 },
3650 {
3651 "direct packet read for LWT_IN",
3652 .insns = {
3653 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3654 offsetof(struct __sk_buff, data)),
3655 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3656 offsetof(struct __sk_buff, data_end)),
3657 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3658 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3659 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3660 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3661 BPF_MOV64_IMM(BPF_REG_0, 0),
3662 BPF_EXIT_INSN(),
3663 },
3664 .result = ACCEPT,
3665 .prog_type = BPF_PROG_TYPE_LWT_IN,
3666 },
3667 {
3668 "direct packet read for LWT_OUT",
3669 .insns = {
3670 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3671 offsetof(struct __sk_buff, data)),
3672 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3673 offsetof(struct __sk_buff, data_end)),
3674 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3675 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3676 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3677 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3678 BPF_MOV64_IMM(BPF_REG_0, 0),
3679 BPF_EXIT_INSN(),
3680 },
3681 .result = ACCEPT,
3682 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3683 },
3684 {
3685 "direct packet read for LWT_XMIT",
3686 .insns = {
3687 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3688 offsetof(struct __sk_buff, data)),
3689 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3690 offsetof(struct __sk_buff, data_end)),
3691 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3692 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3693 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3694 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3695 BPF_MOV64_IMM(BPF_REG_0, 0),
3696 BPF_EXIT_INSN(),
3697 },
3698 .result = ACCEPT,
3699 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3700 },
3701 {
3702 "overlapping checks for direct packet access",
3703 .insns = {
3704 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3705 offsetof(struct __sk_buff, data)),
3706 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3707 offsetof(struct __sk_buff, data_end)),
3708 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3709 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3710 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
3711 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3712 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
3713 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
3714 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
3715 BPF_MOV64_IMM(BPF_REG_0, 0),
3716 BPF_EXIT_INSN(),
3717 },
3718 .result = ACCEPT,
3719 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3720 },
3721 {
3722 "invalid access of tc_classid for LWT_IN",
3723 .insns = {
3724 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3725 offsetof(struct __sk_buff, tc_classid)),
3726 BPF_EXIT_INSN(),
3727 },
3728 .result = REJECT,
3729 .errstr = "invalid bpf_context access",
3730 },
3731 {
3732 "invalid access of tc_classid for LWT_OUT",
3733 .insns = {
3734 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3735 offsetof(struct __sk_buff, tc_classid)),
3736 BPF_EXIT_INSN(),
3737 },
3738 .result = REJECT,
3739 .errstr = "invalid bpf_context access",
3740 },
3741 {
3742 "invalid access of tc_classid for LWT_XMIT",
3743 .insns = {
3744 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3745 offsetof(struct __sk_buff, tc_classid)),
3746 BPF_EXIT_INSN(),
3747 },
3748 .result = REJECT,
3749 .errstr = "invalid bpf_context access",
3750 },
3751 {
3752 "helper access to map: full range",
3753 .insns = {
3754 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3755 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3756 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3757 BPF_LD_MAP_FD(BPF_REG_1, 0),
3758 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3759 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3760 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3761 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
3762 BPF_MOV64_IMM(BPF_REG_3, 0),
3763 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3764 BPF_EXIT_INSN(),
3765 },
3766 .fixup_map2 = { 3 },
3767 .result = ACCEPT,
3768 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3769 },
3770 {
3771 "helper access to map: partial range",
3772 .insns = {
3773 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3774 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3775 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3776 BPF_LD_MAP_FD(BPF_REG_1, 0),
3777 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3778 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3779 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3780 BPF_MOV64_IMM(BPF_REG_2, 8),
3781 BPF_MOV64_IMM(BPF_REG_3, 0),
3782 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3783 BPF_EXIT_INSN(),
3784 },
3785 .fixup_map2 = { 3 },
3786 .result = ACCEPT,
3787 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3788 },
3789 {
3790 "helper access to map: empty range",
3791 .insns = {
3792 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3793 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3794 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3795 BPF_LD_MAP_FD(BPF_REG_1, 0),
3796 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3798 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3799 BPF_MOV64_IMM(BPF_REG_2, 0),
3800 BPF_MOV64_IMM(BPF_REG_3, 0),
3801 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3802 BPF_EXIT_INSN(),
3803 },
3804 .fixup_map2 = { 3 },
3805 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
3806 .result = REJECT,
3807 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3808 },
3809 {
3810 "helper access to map: out-of-bound range",
3811 .insns = {
3812 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3814 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3815 BPF_LD_MAP_FD(BPF_REG_1, 0),
3816 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3817 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3818 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3819 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
3820 BPF_MOV64_IMM(BPF_REG_3, 0),
3821 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3822 BPF_EXIT_INSN(),
3823 },
3824 .fixup_map2 = { 3 },
3825 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
3826 .result = REJECT,
3827 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3828 },
3829 {
3830 "helper access to map: negative range",
3831 .insns = {
3832 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3833 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3834 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3835 BPF_LD_MAP_FD(BPF_REG_1, 0),
3836 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3837 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3838 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3839 BPF_MOV64_IMM(BPF_REG_2, -8),
3840 BPF_MOV64_IMM(BPF_REG_3, 0),
3841 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3842 BPF_EXIT_INSN(),
3843 },
3844 .fixup_map2 = { 3 },
3845 .errstr = "invalid access to map value, value_size=48 off=0 size=-8",
3846 .result = REJECT,
3847 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3848 },
3849 {
3850 "helper access to adjusted map (via const imm): full range",
3851 .insns = {
3852 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3853 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3854 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3855 BPF_LD_MAP_FD(BPF_REG_1, 0),
3856 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3857 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3858 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3859 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3860 offsetof(struct test_val, foo)),
3861 BPF_MOV64_IMM(BPF_REG_2,
3862 sizeof(struct test_val) -
3863 offsetof(struct test_val, foo)),
3864 BPF_MOV64_IMM(BPF_REG_3, 0),
3865 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3866 BPF_EXIT_INSN(),
3867 },
3868 .fixup_map2 = { 3 },
3869 .result = ACCEPT,
3870 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3871 },
3872 {
3873 "helper access to adjusted map (via const imm): partial range",
3874 .insns = {
3875 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3876 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3877 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3878 BPF_LD_MAP_FD(BPF_REG_1, 0),
3879 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3880 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3881 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3882 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3883 offsetof(struct test_val, foo)),
3884 BPF_MOV64_IMM(BPF_REG_2, 8),
3885 BPF_MOV64_IMM(BPF_REG_3, 0),
3886 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3887 BPF_EXIT_INSN(),
3888 },
3889 .fixup_map2 = { 3 },
3890 .result = ACCEPT,
3891 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3892 },
3893 {
3894 "helper access to adjusted map (via const imm): empty range",
3895 .insns = {
3896 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3897 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3898 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3899 BPF_LD_MAP_FD(BPF_REG_1, 0),
3900 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3901 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3902 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3903 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3904 offsetof(struct test_val, foo)),
3905 BPF_MOV64_IMM(BPF_REG_2, 0),
3906 BPF_MOV64_IMM(BPF_REG_3, 0),
3907 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3908 BPF_EXIT_INSN(),
3909 },
3910 .fixup_map2 = { 3 },
3911 .errstr = "R1 min value is outside of the array range",
3912 .result = REJECT,
3913 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3914 },
3915 {
3916 "helper access to adjusted map (via const imm): out-of-bound range",
3917 .insns = {
3918 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3919 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3920 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3921 BPF_LD_MAP_FD(BPF_REG_1, 0),
3922 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3923 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3924 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3925 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3926 offsetof(struct test_val, foo)),
3927 BPF_MOV64_IMM(BPF_REG_2,
3928 sizeof(struct test_val) -
3929 offsetof(struct test_val, foo) + 8),
3930 BPF_MOV64_IMM(BPF_REG_3, 0),
3931 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3932 BPF_EXIT_INSN(),
3933 },
3934 .fixup_map2 = { 3 },
3935 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3936 .result = REJECT,
3937 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3938 },
3939 {
3940 "helper access to adjusted map (via const imm): negative range (> adjustment)",
3941 .insns = {
3942 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3943 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3944 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3945 BPF_LD_MAP_FD(BPF_REG_1, 0),
3946 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3947 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3948 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3949 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3950 offsetof(struct test_val, foo)),
3951 BPF_MOV64_IMM(BPF_REG_2, -8),
3952 BPF_MOV64_IMM(BPF_REG_3, 0),
3953 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3954 BPF_EXIT_INSN(),
3955 },
3956 .fixup_map2 = { 3 },
3957 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
3958 .result = REJECT,
3959 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3960 },
3961 {
3962 "helper access to adjusted map (via const imm): negative range (< adjustment)",
3963 .insns = {
3964 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3965 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3966 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3967 BPF_LD_MAP_FD(BPF_REG_1, 0),
3968 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3969 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3970 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3971 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3972 offsetof(struct test_val, foo)),
3973 BPF_MOV64_IMM(BPF_REG_2, -1),
3974 BPF_MOV64_IMM(BPF_REG_3, 0),
3975 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3976 BPF_EXIT_INSN(),
3977 },
3978 .fixup_map2 = { 3 },
3979 .errstr = "R1 min value is outside of the array range",
3980 .result = REJECT,
3981 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3982 },
3983 {
3984 "helper access to adjusted map (via const reg): full range",
3985 .insns = {
3986 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3987 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3988 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3989 BPF_LD_MAP_FD(BPF_REG_1, 0),
3990 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3991 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3992 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3993 BPF_MOV64_IMM(BPF_REG_3,
3994 offsetof(struct test_val, foo)),
3995 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3996 BPF_MOV64_IMM(BPF_REG_2,
3997 sizeof(struct test_val) -
3998 offsetof(struct test_val, foo)),
3999 BPF_MOV64_IMM(BPF_REG_3, 0),
4000 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4001 BPF_EXIT_INSN(),
4002 },
4003 .fixup_map2 = { 3 },
4004 .result = ACCEPT,
4005 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4006 },
4007 {
4008 "helper access to adjusted map (via const reg): partial range",
4009 .insns = {
4010 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4012 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4013 BPF_LD_MAP_FD(BPF_REG_1, 0),
4014 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4015 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4016 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4017 BPF_MOV64_IMM(BPF_REG_3,
4018 offsetof(struct test_val, foo)),
4019 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4020 BPF_MOV64_IMM(BPF_REG_2, 8),
4021 BPF_MOV64_IMM(BPF_REG_3, 0),
4022 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4023 BPF_EXIT_INSN(),
4024 },
4025 .fixup_map2 = { 3 },
4026 .result = ACCEPT,
4027 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4028 },
4029 {
4030 "helper access to adjusted map (via const reg): empty range",
4031 .insns = {
4032 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4033 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4034 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4035 BPF_LD_MAP_FD(BPF_REG_1, 0),
4036 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4037 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4038 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4039 BPF_MOV64_IMM(BPF_REG_3, 0),
4040 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4041 BPF_MOV64_IMM(BPF_REG_2, 0),
4042 BPF_MOV64_IMM(BPF_REG_3, 0),
4043 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4044 BPF_EXIT_INSN(),
4045 },
4046 .fixup_map2 = { 3 },
4047 .errstr = "R1 min value is outside of the array range",
4048 .result = REJECT,
4049 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4050 },
4051 {
4052 "helper access to adjusted map (via const reg): out-of-bound range",
4053 .insns = {
4054 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4055 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4056 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4057 BPF_LD_MAP_FD(BPF_REG_1, 0),
4058 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4059 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4060 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4061 BPF_MOV64_IMM(BPF_REG_3,
4062 offsetof(struct test_val, foo)),
4063 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4064 BPF_MOV64_IMM(BPF_REG_2,
4065 sizeof(struct test_val) -
4066 offsetof(struct test_val, foo) + 8),
4067 BPF_MOV64_IMM(BPF_REG_3, 0),
4068 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4069 BPF_EXIT_INSN(),
4070 },
4071 .fixup_map2 = { 3 },
4072 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4073 .result = REJECT,
4074 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4075 },
4076 {
4077 "helper access to adjusted map (via const reg): negative range (> adjustment)",
4078 .insns = {
4079 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4080 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4081 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4082 BPF_LD_MAP_FD(BPF_REG_1, 0),
4083 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4084 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4085 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4086 BPF_MOV64_IMM(BPF_REG_3,
4087 offsetof(struct test_val, foo)),
4088 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4089 BPF_MOV64_IMM(BPF_REG_2, -8),
4090 BPF_MOV64_IMM(BPF_REG_3, 0),
4091 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4092 BPF_EXIT_INSN(),
4093 },
4094 .fixup_map2 = { 3 },
4095 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
4096 .result = REJECT,
4097 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4098 },
4099 {
4100 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4101 .insns = {
4102 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4104 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4105 BPF_LD_MAP_FD(BPF_REG_1, 0),
4106 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4107 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4108 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4109 BPF_MOV64_IMM(BPF_REG_3,
4110 offsetof(struct test_val, foo)),
4111 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4112 BPF_MOV64_IMM(BPF_REG_2, -1),
4113 BPF_MOV64_IMM(BPF_REG_3, 0),
4114 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4115 BPF_EXIT_INSN(),
4116 },
4117 .fixup_map2 = { 3 },
4118 .errstr = "R1 min value is outside of the array range",
4119 .result = REJECT,
4120 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4121 },
4122 {
4123 "helper access to adjusted map (via variable): full range",
4124 .insns = {
4125 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4126 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4127 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4128 BPF_LD_MAP_FD(BPF_REG_1, 0),
4129 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4130 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4131 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4132 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4133 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4134 offsetof(struct test_val, foo), 4),
4135 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4136 BPF_MOV64_IMM(BPF_REG_2,
4137 sizeof(struct test_val) -
4138 offsetof(struct test_val, foo)),
4139 BPF_MOV64_IMM(BPF_REG_3, 0),
4140 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4141 BPF_EXIT_INSN(),
4142 },
4143 .fixup_map2 = { 3 },
4144 .result = ACCEPT,
4145 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4146 },
4147 {
4148 "helper access to adjusted map (via variable): partial range",
4149 .insns = {
4150 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4151 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4152 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4153 BPF_LD_MAP_FD(BPF_REG_1, 0),
4154 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4155 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4156 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4157 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4158 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4159 offsetof(struct test_val, foo), 4),
4160 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4161 BPF_MOV64_IMM(BPF_REG_2, 8),
4162 BPF_MOV64_IMM(BPF_REG_3, 0),
4163 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4164 BPF_EXIT_INSN(),
4165 },
4166 .fixup_map2 = { 3 },
4167 .result = ACCEPT,
4168 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4169 },
4170 {
4171 "helper access to adjusted map (via variable): empty range",
4172 .insns = {
4173 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4174 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4175 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4176 BPF_LD_MAP_FD(BPF_REG_1, 0),
4177 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4178 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4179 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4180 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4181 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4182 offsetof(struct test_val, foo), 4),
4183 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4184 BPF_MOV64_IMM(BPF_REG_2, 0),
4185 BPF_MOV64_IMM(BPF_REG_3, 0),
4186 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4187 BPF_EXIT_INSN(),
4188 },
4189 .fixup_map2 = { 3 },
4190 .errstr = "R1 min value is outside of the array range",
4191 .result = REJECT,
4192 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4193 },
4194 {
4195 "helper access to adjusted map (via variable): no max check",
4196 .insns = {
4197 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4198 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4199 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4200 BPF_LD_MAP_FD(BPF_REG_1, 0),
4201 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4202 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4203 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4204 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4205 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4206 BPF_MOV64_IMM(BPF_REG_2, 0),
4207 BPF_MOV64_IMM(BPF_REG_3, 0),
4208 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4209 BPF_EXIT_INSN(),
4210 },
4211 .fixup_map2 = { 3 },
4212 .errstr = "R1 min value is negative, either use unsigned index or do a if (index >=0) check",
4213 .result = REJECT,
4214 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4215 },
4216 {
4217 "helper access to adjusted map (via variable): wrong max check",
4218 .insns = {
4219 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4220 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4221 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4222 BPF_LD_MAP_FD(BPF_REG_1, 0),
4223 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4224 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4225 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4226 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4227 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4228 offsetof(struct test_val, foo), 4),
4229 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4230 BPF_MOV64_IMM(BPF_REG_2,
4231 sizeof(struct test_val) -
4232 offsetof(struct test_val, foo) + 1),
4233 BPF_MOV64_IMM(BPF_REG_3, 0),
4234 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4235 BPF_EXIT_INSN(),
4236 },
4237 .fixup_map2 = { 3 },
4238 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
4239 .result = REJECT,
4240 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4241 },
4242 {
4243 "map element value is preserved across register spilling",
4244 .insns = {
4245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4247 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4248 BPF_LD_MAP_FD(BPF_REG_1, 0),
4249 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4250 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4251 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4252 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4254 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4255 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4256 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4257 BPF_EXIT_INSN(),
4258 },
4259 .fixup_map2 = { 3 },
4260 .errstr_unpriv = "R0 leaks addr",
4261 .result = ACCEPT,
4262 .result_unpriv = REJECT,
4263 },
4264 {
4265 "map element value or null is marked on register spilling",
4266 .insns = {
4267 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4268 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4269 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4270 BPF_LD_MAP_FD(BPF_REG_1, 0),
4271 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4272 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4273 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
4274 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4275 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4276 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4277 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4278 BPF_EXIT_INSN(),
4279 },
4280 .fixup_map2 = { 3 },
4281 .errstr_unpriv = "R0 leaks addr",
4282 .result = ACCEPT,
4283 .result_unpriv = REJECT,
4284 },
4285 {
4286 "map element value store of cleared call register",
4287 .insns = {
4288 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4289 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4290 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4291 BPF_LD_MAP_FD(BPF_REG_1, 0),
4292 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4293 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4294 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
4295 BPF_EXIT_INSN(),
4296 },
4297 .fixup_map2 = { 3 },
4298 .errstr_unpriv = "R1 !read_ok",
4299 .errstr = "R1 !read_ok",
4300 .result = REJECT,
4301 .result_unpriv = REJECT,
4302 },
4303 {
4304 "map element value with unaligned store",
4305 .insns = {
4306 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4307 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4308 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4309 BPF_LD_MAP_FD(BPF_REG_1, 0),
4310 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4311 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
4312 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4313 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4314 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
4315 BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
4316 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4317 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
4318 BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
4319 BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
4320 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
4321 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
4322 BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
4323 BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
4324 BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
4325 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
4326 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
4327 BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
4328 BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
4329 BPF_EXIT_INSN(),
4330 },
4331 .fixup_map2 = { 3 },
4332 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4333 .result = ACCEPT,
4334 .result_unpriv = REJECT,
4335 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4336 },
4337 {
4338 "map element value with unaligned load",
4339 .insns = {
4340 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4341 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4342 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4343 BPF_LD_MAP_FD(BPF_REG_1, 0),
4344 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4345 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4346 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4347 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
4348 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4349 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4350 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
4351 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4352 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
4353 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
4354 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
4355 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4356 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
4357 BPF_EXIT_INSN(),
4358 },
4359 .fixup_map2 = { 3 },
4360 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4361 .result = ACCEPT,
4362 .result_unpriv = REJECT,
4363 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4364 },
4365 {
4366 "map element value illegal alu op, 1",
4367 .insns = {
4368 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4369 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4370 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4371 BPF_LD_MAP_FD(BPF_REG_1, 0),
4372 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4373 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4374 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
4375 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4376 BPF_EXIT_INSN(),
4377 },
4378 .fixup_map2 = { 3 },
4379 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4380 .errstr = "invalid mem access 'inv'",
4381 .result = REJECT,
4382 .result_unpriv = REJECT,
4383 },
4384 {
4385 "map element value illegal alu op, 2",
4386 .insns = {
4387 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4388 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4389 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4390 BPF_LD_MAP_FD(BPF_REG_1, 0),
4391 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4392 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4393 BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
4394 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4395 BPF_EXIT_INSN(),
4396 },
4397 .fixup_map2 = { 3 },
4398 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4399 .errstr = "invalid mem access 'inv'",
4400 .result = REJECT,
4401 .result_unpriv = REJECT,
4402 },
4403 {
4404 "map element value illegal alu op, 3",
4405 .insns = {
4406 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4407 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4408 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4409 BPF_LD_MAP_FD(BPF_REG_1, 0),
4410 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4411 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4412 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
4413 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4414 BPF_EXIT_INSN(),
4415 },
4416 .fixup_map2 = { 3 },
4417 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4418 .errstr = "invalid mem access 'inv'",
4419 .result = REJECT,
4420 .result_unpriv = REJECT,
4421 },
4422 {
4423 "map element value illegal alu op, 4",
4424 .insns = {
4425 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4426 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4427 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4428 BPF_LD_MAP_FD(BPF_REG_1, 0),
4429 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4430 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4431 BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
4432 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4433 BPF_EXIT_INSN(),
4434 },
4435 .fixup_map2 = { 3 },
4436 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4437 .errstr = "invalid mem access 'inv'",
4438 .result = REJECT,
4439 .result_unpriv = REJECT,
4440 },
4441 {
4442 "map element value illegal alu op, 5",
4443 .insns = {
4444 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4445 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4446 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4447 BPF_LD_MAP_FD(BPF_REG_1, 0),
4448 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4449 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4450 BPF_MOV64_IMM(BPF_REG_3, 4096),
4451 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4452 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4453 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
4454 BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
4455 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
4456 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4457 BPF_EXIT_INSN(),
4458 },
4459 .fixup_map2 = { 3 },
4460 .errstr_unpriv = "R0 invalid mem access 'inv'",
4461 .errstr = "R0 invalid mem access 'inv'",
4462 .result = REJECT,
4463 .result_unpriv = REJECT,
4464 },
4465 {
4466 "map element value is preserved across register spilling",
4467 .insns = {
4468 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4469 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4470 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4471 BPF_LD_MAP_FD(BPF_REG_1, 0),
4472 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4473 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4474 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
4475 offsetof(struct test_val, foo)),
4476 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4477 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4478 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4479 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4480 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4481 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4482 BPF_EXIT_INSN(),
4483 },
4484 .fixup_map2 = { 3 },
4485 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4486 .result = ACCEPT,
4487 .result_unpriv = REJECT,
4488 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4489 },
4490 {
4491 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
4492 .insns = {
4493 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4494 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4495 BPF_MOV64_IMM(BPF_REG_0, 0),
4496 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4497 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4498 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4499 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4500 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4501 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4502 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4503 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4504 BPF_MOV64_IMM(BPF_REG_2, 16),
4505 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4506 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4507 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4508 BPF_MOV64_IMM(BPF_REG_4, 0),
4509 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4510 BPF_MOV64_IMM(BPF_REG_3, 0),
4511 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4512 BPF_MOV64_IMM(BPF_REG_0, 0),
4513 BPF_EXIT_INSN(),
4514 },
4515 .result = ACCEPT,
4516 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4517 },
4518 {
4519 "helper access to variable memory: stack, bitwise AND, zero included",
4520 .insns = {
4521 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4522 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4523 BPF_MOV64_IMM(BPF_REG_2, 16),
4524 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4525 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4526 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4527 BPF_MOV64_IMM(BPF_REG_3, 0),
4528 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4529 BPF_EXIT_INSN(),
4530 },
4531 .errstr = "invalid stack type R1 off=-64 access_size=0",
4532 .result = REJECT,
4533 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4534 },
4535 {
4536 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
4537 .insns = {
4538 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4539 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4540 BPF_MOV64_IMM(BPF_REG_2, 16),
4541 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4542 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4543 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
4544 BPF_MOV64_IMM(BPF_REG_4, 0),
4545 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4546 BPF_MOV64_IMM(BPF_REG_3, 0),
4547 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4548 BPF_MOV64_IMM(BPF_REG_0, 0),
4549 BPF_EXIT_INSN(),
4550 },
4551 .errstr = "invalid stack type R1 off=-64 access_size=65",
4552 .result = REJECT,
4553 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4554 },
4555 {
4556 "helper access to variable memory: stack, JMP, correct bounds",
4557 .insns = {
4558 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4560 BPF_MOV64_IMM(BPF_REG_0, 0),
4561 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4562 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4563 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4564 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4565 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4566 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4567 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4568 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4569 BPF_MOV64_IMM(BPF_REG_2, 16),
4570 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4571 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4572 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
4573 BPF_MOV64_IMM(BPF_REG_4, 0),
4574 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4575 BPF_MOV64_IMM(BPF_REG_3, 0),
4576 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4577 BPF_MOV64_IMM(BPF_REG_0, 0),
4578 BPF_EXIT_INSN(),
4579 },
4580 .result = ACCEPT,
4581 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4582 },
4583 {
4584 "helper access to variable memory: stack, JMP (signed), correct bounds",
4585 .insns = {
4586 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4588 BPF_MOV64_IMM(BPF_REG_0, 0),
4589 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4590 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4591 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4592 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4593 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4594 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4595 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4596 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4597 BPF_MOV64_IMM(BPF_REG_2, 16),
4598 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4599 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4600 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
4601 BPF_MOV64_IMM(BPF_REG_4, 0),
4602 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
4603 BPF_MOV64_IMM(BPF_REG_3, 0),
4604 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4605 BPF_MOV64_IMM(BPF_REG_0, 0),
4606 BPF_EXIT_INSN(),
4607 },
4608 .result = ACCEPT,
4609 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4610 },
4611 {
4612 "helper access to variable memory: stack, JMP, bounds + offset",
4613 .insns = {
4614 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4615 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4616 BPF_MOV64_IMM(BPF_REG_2, 16),
4617 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4618 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4619 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
4620 BPF_MOV64_IMM(BPF_REG_4, 0),
4621 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
4622 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4623 BPF_MOV64_IMM(BPF_REG_3, 0),
4624 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4625 BPF_MOV64_IMM(BPF_REG_0, 0),
4626 BPF_EXIT_INSN(),
4627 },
4628 .errstr = "invalid stack type R1 off=-64 access_size=65",
4629 .result = REJECT,
4630 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4631 },
4632 {
4633 "helper access to variable memory: stack, JMP, wrong max",
4634 .insns = {
4635 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4636 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4637 BPF_MOV64_IMM(BPF_REG_2, 16),
4638 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4639 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4640 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
4641 BPF_MOV64_IMM(BPF_REG_4, 0),
4642 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4643 BPF_MOV64_IMM(BPF_REG_3, 0),
4644 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4645 BPF_MOV64_IMM(BPF_REG_0, 0),
4646 BPF_EXIT_INSN(),
4647 },
4648 .errstr = "invalid stack type R1 off=-64 access_size=65",
4649 .result = REJECT,
4650 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4651 },
4652 {
4653 "helper access to variable memory: stack, JMP, no max check",
4654 .insns = {
4655 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4656 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4657 BPF_MOV64_IMM(BPF_REG_2, 16),
4658 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4659 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4660 BPF_MOV64_IMM(BPF_REG_4, 0),
4661 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4662 BPF_MOV64_IMM(BPF_REG_3, 0),
4663 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4664 BPF_MOV64_IMM(BPF_REG_0, 0),
4665 BPF_EXIT_INSN(),
4666 },
4667 .errstr = "R2 unbounded memory access",
4668 .result = REJECT,
4669 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4670 },
4671 {
4672 "helper access to variable memory: stack, JMP, no min check",
4673 .insns = {
4674 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4675 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4676 BPF_MOV64_IMM(BPF_REG_2, 16),
4677 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4678 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4679 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
4680 BPF_MOV64_IMM(BPF_REG_3, 0),
4681 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4682 BPF_MOV64_IMM(BPF_REG_0, 0),
4683 BPF_EXIT_INSN(),
4684 },
4685 .errstr = "invalid stack type R1 off=-64 access_size=0",
4686 .result = REJECT,
4687 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4688 },
4689 {
4690 "helper access to variable memory: stack, JMP (signed), no min check",
4691 .insns = {
4692 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4693 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4694 BPF_MOV64_IMM(BPF_REG_2, 16),
4695 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4696 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4697 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
4698 BPF_MOV64_IMM(BPF_REG_3, 0),
4699 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4700 BPF_MOV64_IMM(BPF_REG_0, 0),
4701 BPF_EXIT_INSN(),
4702 },
4703 .errstr = "R2 min value is negative",
4704 .result = REJECT,
4705 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4706 },
4707 {
4708 "helper access to variable memory: map, JMP, correct bounds",
4709 .insns = {
4710 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4711 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4712 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4713 BPF_LD_MAP_FD(BPF_REG_1, 0),
4714 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4715 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4716 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4717 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4718 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4719 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4720 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4721 sizeof(struct test_val), 4),
4722 BPF_MOV64_IMM(BPF_REG_4, 0),
4723 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4724 BPF_MOV64_IMM(BPF_REG_3, 0),
4725 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4726 BPF_MOV64_IMM(BPF_REG_0, 0),
4727 BPF_EXIT_INSN(),
4728 },
4729 .fixup_map2 = { 3 },
4730 .result = ACCEPT,
4731 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4732 },
4733 {
4734 "helper access to variable memory: map, JMP, wrong max",
4735 .insns = {
4736 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4737 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4738 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4739 BPF_LD_MAP_FD(BPF_REG_1, 0),
4740 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4741 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4742 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4743 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4744 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4745 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4746 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4747 sizeof(struct test_val) + 1, 4),
4748 BPF_MOV64_IMM(BPF_REG_4, 0),
4749 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4750 BPF_MOV64_IMM(BPF_REG_3, 0),
4751 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4752 BPF_MOV64_IMM(BPF_REG_0, 0),
4753 BPF_EXIT_INSN(),
4754 },
4755 .fixup_map2 = { 3 },
4756 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
4757 .result = REJECT,
4758 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4759 },
4760 {
4761 "helper access to variable memory: map adjusted, JMP, correct bounds",
4762 .insns = {
4763 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4764 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4765 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4766 BPF_LD_MAP_FD(BPF_REG_1, 0),
4767 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4768 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4769 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4771 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4772 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4773 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4774 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4775 sizeof(struct test_val) - 20, 4),
4776 BPF_MOV64_IMM(BPF_REG_4, 0),
4777 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4778 BPF_MOV64_IMM(BPF_REG_3, 0),
4779 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4780 BPF_MOV64_IMM(BPF_REG_0, 0),
4781 BPF_EXIT_INSN(),
4782 },
4783 .fixup_map2 = { 3 },
4784 .result = ACCEPT,
4785 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4786 },
4787 {
4788 "helper access to variable memory: map adjusted, JMP, wrong max",
4789 .insns = {
4790 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4792 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4793 BPF_LD_MAP_FD(BPF_REG_1, 0),
4794 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4796 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4797 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4798 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4799 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4800 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4801 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4802 sizeof(struct test_val) - 19, 4),
4803 BPF_MOV64_IMM(BPF_REG_4, 0),
4804 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4805 BPF_MOV64_IMM(BPF_REG_3, 0),
4806 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4807 BPF_MOV64_IMM(BPF_REG_0, 0),
4808 BPF_EXIT_INSN(),
4809 },
4810 .fixup_map2 = { 3 },
4811 .errstr = "R1 min value is outside of the array range",
4812 .result = REJECT,
4813 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4814 },
4815 {
4816 "helper access to variable memory: size > 0 not allowed on NULL",
4817 .insns = {
4818 BPF_MOV64_IMM(BPF_REG_1, 0),
4819 BPF_MOV64_IMM(BPF_REG_2, 0),
4820 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4821 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4822 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4823 BPF_MOV64_IMM(BPF_REG_3, 0),
4824 BPF_MOV64_IMM(BPF_REG_4, 0),
4825 BPF_MOV64_IMM(BPF_REG_5, 0),
4826 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4827 BPF_EXIT_INSN(),
4828 },
4829 .errstr = "R1 type=imm expected=fp",
4830 .result = REJECT,
4831 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4832 },
4833 {
4834 "helper access to variable memory: size = 0 not allowed on != NULL",
4835 .insns = {
4836 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4837 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
4838 BPF_MOV64_IMM(BPF_REG_2, 0),
4839 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
4840 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
4841 BPF_MOV64_IMM(BPF_REG_3, 0),
4842 BPF_MOV64_IMM(BPF_REG_4, 0),
4843 BPF_MOV64_IMM(BPF_REG_5, 0),
4844 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4845 BPF_EXIT_INSN(),
4846 },
4847 .errstr = "invalid stack type R1 off=-8 access_size=0",
4848 .result = REJECT,
4849 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4850 },
4851 {
4852 "helper access to variable memory: 8 bytes leak",
4853 .insns = {
4854 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4855 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4856 BPF_MOV64_IMM(BPF_REG_0, 0),
4857 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4858 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4859 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4860 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4861 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4862 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4863 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4864 BPF_MOV64_IMM(BPF_REG_2, 0),
4865 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4866 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4867 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
4868 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4869 BPF_MOV64_IMM(BPF_REG_3, 0),
4870 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4871 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4872 BPF_EXIT_INSN(),
4873 },
4874 .errstr = "invalid indirect read from stack off -64+32 size 64",
4875 .result = REJECT,
4876 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4877 },
4878 {
4879 "helper access to variable memory: 8 bytes no leak (init memory)",
4880 .insns = {
4881 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4882 BPF_MOV64_IMM(BPF_REG_0, 0),
4883 BPF_MOV64_IMM(BPF_REG_0, 0),
4884 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4885 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4886 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4887 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4888 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4889 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4890 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4891 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4892 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4893 BPF_MOV64_IMM(BPF_REG_2, 0),
4894 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
4895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
4896 BPF_MOV64_IMM(BPF_REG_3, 0),
4897 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4898 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4899 BPF_EXIT_INSN(),
4900 },
4901 .result = ACCEPT,
4902 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4903 },
4904 {
4905 "invalid and of negative number",
4906 .insns = {
4907 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4908 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4909 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4910 BPF_LD_MAP_FD(BPF_REG_1, 0),
4911 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4912 BPF_FUNC_map_lookup_elem),
4913 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4914 BPF_MOV64_IMM(BPF_REG_1, 6),
4915 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
4916 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4917 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4918 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4919 offsetof(struct test_val, foo)),
4920 BPF_EXIT_INSN(),
4921 },
4922 .fixup_map2 = { 3 },
4923 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4924 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4925 .result = REJECT,
4926 .result_unpriv = REJECT,
4927 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4928 },
4929 {
4930 "invalid range check",
4931 .insns = {
4932 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4933 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4934 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4935 BPF_LD_MAP_FD(BPF_REG_1, 0),
4936 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4937 BPF_FUNC_map_lookup_elem),
4938 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
4939 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4940 BPF_MOV64_IMM(BPF_REG_9, 1),
4941 BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
4942 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
4943 BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
4944 BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
4945 BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
4946 BPF_MOV32_IMM(BPF_REG_3, 1),
4947 BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
4948 BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
4949 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
4950 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
4951 BPF_MOV64_REG(BPF_REG_0, 0),
4952 BPF_EXIT_INSN(),
4953 },
4954 .fixup_map2 = { 3 },
4955 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4956 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4957 .result = REJECT,
4958 .result_unpriv = REJECT,
4959 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4960 },
4961 {
4962 "map in map access",
4963 .insns = {
4964 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4965 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4966 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4967 BPF_LD_MAP_FD(BPF_REG_1, 0),
4968 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4969 BPF_FUNC_map_lookup_elem),
4970 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4971 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4972 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4973 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4974 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4975 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4976 BPF_FUNC_map_lookup_elem),
4977 BPF_MOV64_REG(BPF_REG_0, 0),
4978 BPF_EXIT_INSN(),
4979 },
4980 .fixup_map_in_map = { 3 },
4981 .result = ACCEPT,
4982 },
4983 {
4984 "invalid inner map pointer",
4985 .insns = {
4986 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4987 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4988 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4989 BPF_LD_MAP_FD(BPF_REG_1, 0),
4990 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4991 BPF_FUNC_map_lookup_elem),
4992 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4993 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4994 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4995 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4996 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4998 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4999 BPF_FUNC_map_lookup_elem),
5000 BPF_MOV64_REG(BPF_REG_0, 0),
5001 BPF_EXIT_INSN(),
5002 },
5003 .fixup_map_in_map = { 3 },
5004 .errstr = "R1 type=inv expected=map_ptr",
5005 .errstr_unpriv = "R1 pointer arithmetic prohibited",
5006 .result = REJECT,
5007 },
5008 {
5009 "forgot null checking on the inner map pointer",
5010 .insns = {
5011 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5012 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5014 BPF_LD_MAP_FD(BPF_REG_1, 0),
5015 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5016 BPF_FUNC_map_lookup_elem),
5017 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5018 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5019 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5020 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5021 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5022 BPF_FUNC_map_lookup_elem),
5023 BPF_MOV64_REG(BPF_REG_0, 0),
5024 BPF_EXIT_INSN(),
5025 },
5026 .fixup_map_in_map = { 3 },
5027 .errstr = "R1 type=map_value_or_null expected=map_ptr",
5028 .result = REJECT,
5029 },
5030 {
5031 "ld_abs: check calling conv, r1",
5032 .insns = {
5033 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5034 BPF_MOV64_IMM(BPF_REG_1, 0),
5035 BPF_LD_ABS(BPF_W, -0x200000),
5036 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5037 BPF_EXIT_INSN(),
5038 },
5039 .errstr = "R1 !read_ok",
5040 .result = REJECT,
5041 },
5042 {
5043 "ld_abs: check calling conv, r2",
5044 .insns = {
5045 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5046 BPF_MOV64_IMM(BPF_REG_2, 0),
5047 BPF_LD_ABS(BPF_W, -0x200000),
5048 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5049 BPF_EXIT_INSN(),
5050 },
5051 .errstr = "R2 !read_ok",
5052 .result = REJECT,
5053 },
5054 {
5055 "ld_abs: check calling conv, r3",
5056 .insns = {
5057 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5058 BPF_MOV64_IMM(BPF_REG_3, 0),
5059 BPF_LD_ABS(BPF_W, -0x200000),
5060 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5061 BPF_EXIT_INSN(),
5062 },
5063 .errstr = "R3 !read_ok",
5064 .result = REJECT,
5065 },
5066 {
5067 "ld_abs: check calling conv, r4",
5068 .insns = {
5069 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5070 BPF_MOV64_IMM(BPF_REG_4, 0),
5071 BPF_LD_ABS(BPF_W, -0x200000),
5072 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5073 BPF_EXIT_INSN(),
5074 },
5075 .errstr = "R4 !read_ok",
5076 .result = REJECT,
5077 },
5078 {
5079 "ld_abs: check calling conv, r5",
5080 .insns = {
5081 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5082 BPF_MOV64_IMM(BPF_REG_5, 0),
5083 BPF_LD_ABS(BPF_W, -0x200000),
5084 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
5085 BPF_EXIT_INSN(),
5086 },
5087 .errstr = "R5 !read_ok",
5088 .result = REJECT,
5089 },
5090 {
5091 "ld_abs: check calling conv, r7",
5092 .insns = {
5093 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5094 BPF_MOV64_IMM(BPF_REG_7, 0),
5095 BPF_LD_ABS(BPF_W, -0x200000),
5096 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
5097 BPF_EXIT_INSN(),
5098 },
5099 .result = ACCEPT,
5100 },
5101 {
5102 "ld_ind: check calling conv, r1",
5103 .insns = {
5104 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5105 BPF_MOV64_IMM(BPF_REG_1, 1),
5106 BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
5107 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5108 BPF_EXIT_INSN(),
5109 },
5110 .errstr = "R1 !read_ok",
5111 .result = REJECT,
5112 },
5113 {
5114 "ld_ind: check calling conv, r2",
5115 .insns = {
5116 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5117 BPF_MOV64_IMM(BPF_REG_2, 1),
5118 BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
5119 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5120 BPF_EXIT_INSN(),
5121 },
5122 .errstr = "R2 !read_ok",
5123 .result = REJECT,
5124 },
5125 {
5126 "ld_ind: check calling conv, r3",
5127 .insns = {
5128 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5129 BPF_MOV64_IMM(BPF_REG_3, 1),
5130 BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
5131 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5132 BPF_EXIT_INSN(),
5133 },
5134 .errstr = "R3 !read_ok",
5135 .result = REJECT,
5136 },
5137 {
5138 "ld_ind: check calling conv, r4",
5139 .insns = {
5140 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5141 BPF_MOV64_IMM(BPF_REG_4, 1),
5142 BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
5143 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5144 BPF_EXIT_INSN(),
5145 },
5146 .errstr = "R4 !read_ok",
5147 .result = REJECT,
5148 },
5149 {
5150 "ld_ind: check calling conv, r5",
5151 .insns = {
5152 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5153 BPF_MOV64_IMM(BPF_REG_5, 1),
5154 BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
5155 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
5156 BPF_EXIT_INSN(),
5157 },
5158 .errstr = "R5 !read_ok",
5159 .result = REJECT,
5160 },
5161 {
5162 "ld_ind: check calling conv, r7",
5163 .insns = {
5164 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5165 BPF_MOV64_IMM(BPF_REG_7, 1),
5166 BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
5167 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
5168 BPF_EXIT_INSN(),
5169 },
5170 .result = ACCEPT,
5171 },
5172 };
5173
5174 static int probe_filter_length(const struct bpf_insn *fp)
5175 {
5176 int len;
5177
5178 for (len = MAX_INSNS - 1; len > 0; --len)
5179 if (fp[len].code != 0 || fp[len].imm != 0)
5180 break;
5181 return len + 1;
5182 }
5183
5184 static int create_map(uint32_t size_value, uint32_t max_elem)
5185 {
5186 int fd;
5187
5188 fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
5189 size_value, max_elem, BPF_F_NO_PREALLOC);
5190 if (fd < 0)
5191 printf("Failed to create hash map '%s'!\n", strerror(errno));
5192
5193 return fd;
5194 }
5195
5196 static int create_prog_array(void)
5197 {
5198 int fd;
5199
5200 fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
5201 sizeof(int), 4, 0);
5202 if (fd < 0)
5203 printf("Failed to create prog array '%s'!\n", strerror(errno));
5204
5205 return fd;
5206 }
5207
5208 static int create_map_in_map(void)
5209 {
5210 int inner_map_fd, outer_map_fd;
5211
5212 inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
5213 sizeof(int), 1, 0);
5214 if (inner_map_fd < 0) {
5215 printf("Failed to create array '%s'!\n", strerror(errno));
5216 return inner_map_fd;
5217 }
5218
5219 outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS,
5220 sizeof(int), inner_map_fd, 1, 0);
5221 if (outer_map_fd < 0)
5222 printf("Failed to create array of maps '%s'!\n",
5223 strerror(errno));
5224
5225 close(inner_map_fd);
5226
5227 return outer_map_fd;
5228 }
5229
5230 static char bpf_vlog[32768];
5231
5232 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
5233 int *map_fds)
5234 {
5235 int *fixup_map1 = test->fixup_map1;
5236 int *fixup_map2 = test->fixup_map2;
5237 int *fixup_prog = test->fixup_prog;
5238 int *fixup_map_in_map = test->fixup_map_in_map;
5239
5240 /* Allocating HTs with 1 elem is fine here, since we only test
5241 * for verifier and not do a runtime lookup, so the only thing
5242 * that really matters is value size in this case.
5243 */
5244 if (*fixup_map1) {
5245 map_fds[0] = create_map(sizeof(long long), 1);
5246 do {
5247 prog[*fixup_map1].imm = map_fds[0];
5248 fixup_map1++;
5249 } while (*fixup_map1);
5250 }
5251
5252 if (*fixup_map2) {
5253 map_fds[1] = create_map(sizeof(struct test_val), 1);
5254 do {
5255 prog[*fixup_map2].imm = map_fds[1];
5256 fixup_map2++;
5257 } while (*fixup_map2);
5258 }
5259
5260 if (*fixup_prog) {
5261 map_fds[2] = create_prog_array();
5262 do {
5263 prog[*fixup_prog].imm = map_fds[2];
5264 fixup_prog++;
5265 } while (*fixup_prog);
5266 }
5267
5268 if (*fixup_map_in_map) {
5269 map_fds[3] = create_map_in_map();
5270 do {
5271 prog[*fixup_map_in_map].imm = map_fds[3];
5272 fixup_map_in_map++;
5273 } while (*fixup_map_in_map);
5274 }
5275 }
5276
5277 static void do_test_single(struct bpf_test *test, bool unpriv,
5278 int *passes, int *errors)
5279 {
5280 int fd_prog, expected_ret, reject_from_alignment;
5281 struct bpf_insn *prog = test->insns;
5282 int prog_len = probe_filter_length(prog);
5283 int prog_type = test->prog_type;
5284 int map_fds[MAX_NR_MAPS];
5285 const char *expected_err;
5286 int i;
5287
5288 for (i = 0; i < MAX_NR_MAPS; i++)
5289 map_fds[i] = -1;
5290
5291 do_test_fixup(test, prog, map_fds);
5292
5293 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
5294 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
5295 "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
5296
5297 expected_ret = unpriv && test->result_unpriv != UNDEF ?
5298 test->result_unpriv : test->result;
5299 expected_err = unpriv && test->errstr_unpriv ?
5300 test->errstr_unpriv : test->errstr;
5301
5302 reject_from_alignment = fd_prog < 0 &&
5303 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
5304 strstr(bpf_vlog, "Unknown alignment.");
5305 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
5306 if (reject_from_alignment) {
5307 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
5308 strerror(errno));
5309 goto fail_log;
5310 }
5311 #endif
5312 if (expected_ret == ACCEPT) {
5313 if (fd_prog < 0 && !reject_from_alignment) {
5314 printf("FAIL\nFailed to load prog '%s'!\n",
5315 strerror(errno));
5316 goto fail_log;
5317 }
5318 } else {
5319 if (fd_prog >= 0) {
5320 printf("FAIL\nUnexpected success to load!\n");
5321 goto fail_log;
5322 }
5323 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
5324 printf("FAIL\nUnexpected error message!\n");
5325 goto fail_log;
5326 }
5327 }
5328
5329 (*passes)++;
5330 printf("OK%s\n", reject_from_alignment ?
5331 " (NOTE: reject due to unknown alignment)" : "");
5332 close_fds:
5333 close(fd_prog);
5334 for (i = 0; i < MAX_NR_MAPS; i++)
5335 close(map_fds[i]);
5336 sched_yield();
5337 return;
5338 fail_log:
5339 (*errors)++;
5340 printf("%s", bpf_vlog);
5341 goto close_fds;
5342 }
5343
5344 static bool is_admin(void)
5345 {
5346 cap_t caps;
5347 cap_flag_value_t sysadmin = CAP_CLEAR;
5348 const cap_value_t cap_val = CAP_SYS_ADMIN;
5349
5350 #ifdef CAP_IS_SUPPORTED
5351 if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
5352 perror("cap_get_flag");
5353 return false;
5354 }
5355 #endif
5356 caps = cap_get_proc();
5357 if (!caps) {
5358 perror("cap_get_proc");
5359 return false;
5360 }
5361 if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
5362 perror("cap_get_flag");
5363 if (cap_free(caps))
5364 perror("cap_free");
5365 return (sysadmin == CAP_SET);
5366 }
5367
5368 static int set_admin(bool admin)
5369 {
5370 cap_t caps;
5371 const cap_value_t cap_val = CAP_SYS_ADMIN;
5372 int ret = -1;
5373
5374 caps = cap_get_proc();
5375 if (!caps) {
5376 perror("cap_get_proc");
5377 return -1;
5378 }
5379 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
5380 admin ? CAP_SET : CAP_CLEAR)) {
5381 perror("cap_set_flag");
5382 goto out;
5383 }
5384 if (cap_set_proc(caps)) {
5385 perror("cap_set_proc");
5386 goto out;
5387 }
5388 ret = 0;
5389 out:
5390 if (cap_free(caps))
5391 perror("cap_free");
5392 return ret;
5393 }
5394
5395 static int do_test(bool unpriv, unsigned int from, unsigned int to)
5396 {
5397 int i, passes = 0, errors = 0;
5398
5399 for (i = from; i < to; i++) {
5400 struct bpf_test *test = &tests[i];
5401
5402 /* Program types that are not supported by non-root we
5403 * skip right away.
5404 */
5405 if (!test->prog_type) {
5406 if (!unpriv)
5407 set_admin(false);
5408 printf("#%d/u %s ", i, test->descr);
5409 do_test_single(test, true, &passes, &errors);
5410 if (!unpriv)
5411 set_admin(true);
5412 }
5413
5414 if (!unpriv) {
5415 printf("#%d/p %s ", i, test->descr);
5416 do_test_single(test, false, &passes, &errors);
5417 }
5418 }
5419
5420 printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
5421 return errors ? -errors : 0;
5422 }
5423
5424 int main(int argc, char **argv)
5425 {
5426 struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
5427 struct rlimit rlim = { 1 << 20, 1 << 20 };
5428 unsigned int from = 0, to = ARRAY_SIZE(tests);
5429 bool unpriv = !is_admin();
5430
5431 if (argc == 3) {
5432 unsigned int l = atoi(argv[argc - 2]);
5433 unsigned int u = atoi(argv[argc - 1]);
5434
5435 if (l < to && u < to) {
5436 from = l;
5437 to = u + 1;
5438 }
5439 } else if (argc == 2) {
5440 unsigned int t = atoi(argv[argc - 1]);
5441
5442 if (t < to) {
5443 from = t;
5444 to = t + 1;
5445 }
5446 }
5447
5448 setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
5449 return do_test(unpriv, from, to);
5450 }
Ubuntu Artful kernel mirror