2 * Testsuite for eBPF verifier
4 * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
11 #include <asm/types.h>
12 #include <linux/types.h>
23 #include <sys/capability.h>
24 #include <sys/resource.h>
26 #include <linux/unistd.h>
27 #include <linux/filter.h>
28 #include <linux/bpf_perf_event.h>
29 #include <linux/bpf.h>
34 # include "autoconf.h"
36 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
37 # define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
41 #include "../../../include/linux/filter.h"
44 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
51 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
52 #define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
56 struct bpf_insn insns[MAX_INSNS];
57 int fixup_map1[MAX_FIXUPS];
58 int fixup_map2[MAX_FIXUPS];
59 int fixup_prog[MAX_FIXUPS];
60 int fixup_map_in_map[MAX_FIXUPS];
62 const char *errstr_unpriv;
67 } result, result_unpriv;
68 enum bpf_prog_type prog_type;
72 /* Note we want this to be 64 bit aligned so that the end of our array is
73 * actually the end of the structure.
75 #define MAX_ENTRIES 11
82 static struct bpf_test tests[] = {
86 BPF_MOV64_IMM(BPF_REG_1, 1),
87 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
88 BPF_MOV64_IMM(BPF_REG_2, 3),
89 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
90 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
91 BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
92 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
103 .errstr = "unreachable",
109 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
110 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
113 .errstr = "unreachable",
119 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
122 .errstr = "jump out of range",
126 "out of range jump2",
128 BPF_JMP_IMM(BPF_JA, 0, 0, -2),
131 .errstr = "jump out of range",
137 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
138 BPF_LD_IMM64(BPF_REG_0, 0),
139 BPF_LD_IMM64(BPF_REG_0, 0),
140 BPF_LD_IMM64(BPF_REG_0, 1),
141 BPF_LD_IMM64(BPF_REG_0, 1),
142 BPF_MOV64_IMM(BPF_REG_0, 2),
145 .errstr = "invalid BPF_LD_IMM insn",
146 .errstr_unpriv = "R1 pointer comparison",
152 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
153 BPF_LD_IMM64(BPF_REG_0, 0),
154 BPF_LD_IMM64(BPF_REG_0, 0),
155 BPF_LD_IMM64(BPF_REG_0, 1),
156 BPF_LD_IMM64(BPF_REG_0, 1),
159 .errstr = "invalid BPF_LD_IMM insn",
160 .errstr_unpriv = "R1 pointer comparison",
166 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
167 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
168 BPF_LD_IMM64(BPF_REG_0, 0),
169 BPF_LD_IMM64(BPF_REG_0, 0),
170 BPF_LD_IMM64(BPF_REG_0, 1),
171 BPF_LD_IMM64(BPF_REG_0, 1),
174 .errstr = "invalid bpf_ld_imm64 insn",
180 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
183 .errstr = "invalid bpf_ld_imm64 insn",
189 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
191 .errstr = "invalid bpf_ld_imm64 insn",
197 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
198 BPF_RAW_INSN(0, 0, 0, 0, 0),
206 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
207 BPF_RAW_INSN(0, 0, 0, 0, 1),
215 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
216 BPF_RAW_INSN(0, 0, 0, 0, 1),
219 .errstr = "uses reserved fields",
225 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
226 BPF_RAW_INSN(0, 0, 0, 1, 1),
229 .errstr = "invalid bpf_ld_imm64 insn",
235 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
236 BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
239 .errstr = "invalid bpf_ld_imm64 insn",
245 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
246 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
249 .errstr = "invalid bpf_ld_imm64 insn",
255 BPF_MOV64_IMM(BPF_REG_1, 0),
256 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
257 BPF_RAW_INSN(0, 0, 0, 0, 1),
260 .errstr = "not pointing to valid bpf_map",
266 BPF_MOV64_IMM(BPF_REG_1, 0),
267 BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
268 BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
271 .errstr = "invalid bpf_ld_imm64 insn",
277 BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
279 .errstr = "jump out of range",
285 BPF_JMP_IMM(BPF_JA, 0, 0, -1),
288 .errstr = "back-edge",
294 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
295 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
296 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
297 BPF_JMP_IMM(BPF_JA, 0, 0, -4),
300 .errstr = "back-edge",
306 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
308 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
309 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
312 .errstr = "back-edge",
316 "read uninitialized register",
318 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
321 .errstr = "R2 !read_ok",
325 "read invalid register",
327 BPF_MOV64_REG(BPF_REG_0, -1),
330 .errstr = "R15 is invalid",
334 "program doesn't init R0 before exit",
336 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
339 .errstr = "R0 !read_ok",
343 "program doesn't init R0 before exit in all branches",
345 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
346 BPF_MOV64_IMM(BPF_REG_0, 1),
347 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
350 .errstr = "R0 !read_ok",
351 .errstr_unpriv = "R1 pointer comparison",
355 "stack out of bounds",
357 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
360 .errstr = "invalid stack",
364 "invalid call insn1",
366 BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
369 .errstr = "BPF_CALL uses reserved",
373 "invalid call insn2",
375 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
378 .errstr = "BPF_CALL uses reserved",
382 "invalid function call",
384 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
387 .errstr = "invalid func unknown#1234567",
391 "uninitialized stack1",
393 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
394 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
395 BPF_LD_MAP_FD(BPF_REG_1, 0),
396 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
397 BPF_FUNC_map_lookup_elem),
401 .errstr = "invalid indirect read from stack",
405 "uninitialized stack2",
407 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
408 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
411 .errstr = "invalid read from stack",
415 "invalid fp arithmetic",
416 /* If this gets ever changed, make sure JITs can deal with it. */
418 BPF_MOV64_IMM(BPF_REG_0, 0),
419 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
420 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
421 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
424 .errstr_unpriv = "R1 pointer arithmetic",
425 .result_unpriv = REJECT,
426 .errstr = "R1 invalid mem access",
430 "non-invalid fp arithmetic",
432 BPF_MOV64_IMM(BPF_REG_0, 0),
433 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
439 "invalid argument register",
441 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
442 BPF_FUNC_get_cgroup_classid),
443 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
444 BPF_FUNC_get_cgroup_classid),
447 .errstr = "R1 !read_ok",
449 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
452 "non-invalid argument register",
454 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
455 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
456 BPF_FUNC_get_cgroup_classid),
457 BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
458 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
459 BPF_FUNC_get_cgroup_classid),
463 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
466 "check valid spill/fill",
468 /* spill R1(ctx) into stack */
469 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
470 /* fill it back into R2 */
471 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
472 /* should be able to access R0 = *(R2 + 8) */
473 /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
474 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
477 .errstr_unpriv = "R0 leaks addr",
479 .result_unpriv = REJECT,
482 "check valid spill/fill, skb mark",
484 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
485 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
486 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
487 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
488 offsetof(struct __sk_buff, mark)),
492 .result_unpriv = ACCEPT,
495 "check corrupted spill/fill",
497 /* spill R1(ctx) into stack */
498 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
499 /* mess up with R1 pointer on stack */
500 BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
501 /* fill back into R0 should fail */
502 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
505 .errstr_unpriv = "attempt to corrupt spilled",
506 .errstr = "corrupted spill",
510 "invalid src register in STX",
512 BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
515 .errstr = "R15 is invalid",
519 "invalid dst register in STX",
521 BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
524 .errstr = "R14 is invalid",
528 "invalid dst register in ST",
530 BPF_ST_MEM(BPF_B, 14, -1, -1),
533 .errstr = "R14 is invalid",
537 "invalid src register in LDX",
539 BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
542 .errstr = "R12 is invalid",
546 "invalid dst register in LDX",
548 BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
551 .errstr = "R11 is invalid",
557 BPF_RAW_INSN(0, 0, 0, 0, 0),
560 .errstr = "invalid BPF_LD_IMM",
566 BPF_RAW_INSN(1, 0, 0, 0, 0),
569 .errstr = "BPF_LDX uses reserved fields",
575 BPF_RAW_INSN(-1, 0, 0, 0, 0),
578 .errstr = "invalid BPF_ALU opcode f0",
584 BPF_RAW_INSN(-1, -1, -1, -1, -1),
587 .errstr = "invalid BPF_ALU opcode f0",
593 BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
596 .errstr = "BPF_ALU uses reserved fields",
600 "misaligned read from stack",
602 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
603 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
606 .errstr = "misaligned access",
610 "invalid map_fd for function call",
612 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
613 BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
614 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
615 BPF_LD_MAP_FD(BPF_REG_1, 0),
616 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
617 BPF_FUNC_map_delete_elem),
620 .errstr = "fd 0 is not pointing to valid bpf_map",
624 "don't check return value before access",
626 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
627 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
628 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
629 BPF_LD_MAP_FD(BPF_REG_1, 0),
630 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
631 BPF_FUNC_map_lookup_elem),
632 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
636 .errstr = "R0 invalid mem access 'map_value_or_null'",
640 "access memory with incorrect alignment",
642 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
643 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
644 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
645 BPF_LD_MAP_FD(BPF_REG_1, 0),
646 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
647 BPF_FUNC_map_lookup_elem),
648 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
649 BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
653 .errstr = "misaligned access",
657 "sometimes access memory with incorrect alignment",
659 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
660 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
661 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
662 BPF_LD_MAP_FD(BPF_REG_1, 0),
663 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
664 BPF_FUNC_map_lookup_elem),
665 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
666 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
668 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
672 .errstr = "R0 invalid mem access",
673 .errstr_unpriv = "R0 leaks addr",
679 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
680 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
681 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
682 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
683 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
684 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
685 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
686 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
687 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
688 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
689 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
690 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
691 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
692 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
693 BPF_MOV64_IMM(BPF_REG_0, 0),
696 .errstr_unpriv = "R1 pointer comparison",
697 .result_unpriv = REJECT,
703 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
704 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
705 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
706 BPF_JMP_IMM(BPF_JA, 0, 0, 14),
707 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
708 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
709 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
710 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
711 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
712 BPF_JMP_IMM(BPF_JA, 0, 0, 8),
713 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
714 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
715 BPF_JMP_IMM(BPF_JA, 0, 0, 5),
716 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
717 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
718 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
719 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
720 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
721 BPF_MOV64_IMM(BPF_REG_0, 0),
724 .errstr_unpriv = "R1 pointer comparison",
725 .result_unpriv = REJECT,
731 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
732 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
733 BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
734 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
735 BPF_JMP_IMM(BPF_JA, 0, 0, 19),
736 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
737 BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
738 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
739 BPF_JMP_IMM(BPF_JA, 0, 0, 15),
740 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
741 BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
742 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
743 BPF_JMP_IMM(BPF_JA, 0, 0, 11),
744 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
745 BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
746 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
747 BPF_JMP_IMM(BPF_JA, 0, 0, 7),
748 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
749 BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
750 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
751 BPF_JMP_IMM(BPF_JA, 0, 0, 3),
752 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
753 BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
754 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
755 BPF_LD_MAP_FD(BPF_REG_1, 0),
756 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
757 BPF_FUNC_map_delete_elem),
760 .fixup_map1 = { 24 },
761 .errstr_unpriv = "R1 pointer comparison",
762 .result_unpriv = REJECT,
768 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
769 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
770 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
771 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
772 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
773 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
774 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
775 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
776 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
777 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
778 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
779 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
780 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
781 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
782 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
783 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
784 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
785 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
786 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
787 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
788 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
789 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
790 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
791 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
792 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
793 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
794 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
796 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
798 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
799 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
800 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
801 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
802 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
803 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
804 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
805 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
806 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
807 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
808 BPF_MOV64_IMM(BPF_REG_0, 0),
811 .errstr_unpriv = "R1 pointer comparison",
812 .result_unpriv = REJECT,
818 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
819 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
820 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
821 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
822 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
823 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
824 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
825 BPF_MOV64_IMM(BPF_REG_0, 0),
826 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
827 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
828 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
829 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
830 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
831 BPF_MOV64_IMM(BPF_REG_0, 0),
832 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
833 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
834 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
835 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
836 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
837 BPF_MOV64_IMM(BPF_REG_0, 0),
838 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
839 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
840 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
841 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
842 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
843 BPF_MOV64_IMM(BPF_REG_0, 0),
844 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
845 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
846 BPF_JMP_IMM(BPF_JA, 0, 0, 2),
847 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
848 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
849 BPF_MOV64_IMM(BPF_REG_0, 0),
852 .errstr_unpriv = "R1 pointer comparison",
853 .result_unpriv = REJECT,
857 "access skb fields ok",
859 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
860 offsetof(struct __sk_buff, len)),
861 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
862 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
863 offsetof(struct __sk_buff, mark)),
864 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
865 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
866 offsetof(struct __sk_buff, pkt_type)),
867 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
868 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
869 offsetof(struct __sk_buff, queue_mapping)),
870 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
871 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
872 offsetof(struct __sk_buff, protocol)),
873 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
874 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
875 offsetof(struct __sk_buff, vlan_present)),
876 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
877 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
878 offsetof(struct __sk_buff, vlan_tci)),
879 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
880 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
881 offsetof(struct __sk_buff, napi_id)),
882 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
888 "access skb fields bad1",
890 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
893 .errstr = "invalid bpf_context access",
897 "access skb fields bad2",
899 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
900 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
901 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
902 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
903 BPF_LD_MAP_FD(BPF_REG_1, 0),
904 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
905 BPF_FUNC_map_lookup_elem),
906 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
908 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
909 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
910 offsetof(struct __sk_buff, pkt_type)),
914 .errstr = "different pointers",
915 .errstr_unpriv = "R1 pointer comparison",
919 "access skb fields bad3",
921 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
922 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
923 offsetof(struct __sk_buff, pkt_type)),
925 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
926 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
927 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
928 BPF_LD_MAP_FD(BPF_REG_1, 0),
929 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
930 BPF_FUNC_map_lookup_elem),
931 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
933 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
934 BPF_JMP_IMM(BPF_JA, 0, 0, -12),
937 .errstr = "different pointers",
938 .errstr_unpriv = "R1 pointer comparison",
942 "access skb fields bad4",
944 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
945 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
946 offsetof(struct __sk_buff, len)),
947 BPF_MOV64_IMM(BPF_REG_0, 0),
949 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
950 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
951 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
952 BPF_LD_MAP_FD(BPF_REG_1, 0),
953 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
954 BPF_FUNC_map_lookup_elem),
955 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
957 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
958 BPF_JMP_IMM(BPF_JA, 0, 0, -13),
961 .errstr = "different pointers",
962 .errstr_unpriv = "R1 pointer comparison",
966 "check skb->mark is not writeable by sockets",
968 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
969 offsetof(struct __sk_buff, mark)),
972 .errstr = "invalid bpf_context access",
973 .errstr_unpriv = "R1 leaks addr",
977 "check skb->tc_index is not writeable by sockets",
979 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
980 offsetof(struct __sk_buff, tc_index)),
983 .errstr = "invalid bpf_context access",
984 .errstr_unpriv = "R1 leaks addr",
988 "check cb access: byte",
990 BPF_MOV64_IMM(BPF_REG_0, 0),
991 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
992 offsetof(struct __sk_buff, cb[0])),
993 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
994 offsetof(struct __sk_buff, cb[0]) + 1),
995 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
996 offsetof(struct __sk_buff, cb[0]) + 2),
997 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
998 offsetof(struct __sk_buff, cb[0]) + 3),
999 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1000 offsetof(struct __sk_buff, cb[1])),
1001 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1002 offsetof(struct __sk_buff, cb[1]) + 1),
1003 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1004 offsetof(struct __sk_buff, cb[1]) + 2),
1005 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1006 offsetof(struct __sk_buff, cb[1]) + 3),
1007 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1008 offsetof(struct __sk_buff, cb[2])),
1009 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1010 offsetof(struct __sk_buff, cb[2]) + 1),
1011 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1012 offsetof(struct __sk_buff, cb[2]) + 2),
1013 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1014 offsetof(struct __sk_buff, cb[2]) + 3),
1015 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1016 offsetof(struct __sk_buff, cb[3])),
1017 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1018 offsetof(struct __sk_buff, cb[3]) + 1),
1019 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1020 offsetof(struct __sk_buff, cb[3]) + 2),
1021 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1022 offsetof(struct __sk_buff, cb[3]) + 3),
1023 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1024 offsetof(struct __sk_buff, cb[4])),
1025 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1026 offsetof(struct __sk_buff, cb[4]) + 1),
1027 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1028 offsetof(struct __sk_buff, cb[4]) + 2),
1029 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1030 offsetof(struct __sk_buff, cb[4]) + 3),
1031 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1032 offsetof(struct __sk_buff, cb[0])),
1033 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1034 offsetof(struct __sk_buff, cb[0]) + 1),
1035 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1036 offsetof(struct __sk_buff, cb[0]) + 2),
1037 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1038 offsetof(struct __sk_buff, cb[0]) + 3),
1039 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1040 offsetof(struct __sk_buff, cb[1])),
1041 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1042 offsetof(struct __sk_buff, cb[1]) + 1),
1043 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1044 offsetof(struct __sk_buff, cb[1]) + 2),
1045 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1046 offsetof(struct __sk_buff, cb[1]) + 3),
1047 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1048 offsetof(struct __sk_buff, cb[2])),
1049 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1050 offsetof(struct __sk_buff, cb[2]) + 1),
1051 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1052 offsetof(struct __sk_buff, cb[2]) + 2),
1053 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1054 offsetof(struct __sk_buff, cb[2]) + 3),
1055 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1056 offsetof(struct __sk_buff, cb[3])),
1057 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1058 offsetof(struct __sk_buff, cb[3]) + 1),
1059 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1060 offsetof(struct __sk_buff, cb[3]) + 2),
1061 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1062 offsetof(struct __sk_buff, cb[3]) + 3),
1063 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1064 offsetof(struct __sk_buff, cb[4])),
1065 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1066 offsetof(struct __sk_buff, cb[4]) + 1),
1067 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1068 offsetof(struct __sk_buff, cb[4]) + 2),
1069 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1070 offsetof(struct __sk_buff, cb[4]) + 3),
1076 "check cb access: byte, oob 1",
1078 BPF_MOV64_IMM(BPF_REG_0, 0),
1079 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1080 offsetof(struct __sk_buff, cb[4]) + 4),
1083 .errstr = "invalid bpf_context access",
1087 "check cb access: byte, oob 2",
1089 BPF_MOV64_IMM(BPF_REG_0, 0),
1090 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1091 offsetof(struct __sk_buff, cb[0]) - 1),
1094 .errstr = "invalid bpf_context access",
1098 "check cb access: byte, oob 3",
1100 BPF_MOV64_IMM(BPF_REG_0, 0),
1101 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1102 offsetof(struct __sk_buff, cb[4]) + 4),
1105 .errstr = "invalid bpf_context access",
1109 "check cb access: byte, oob 4",
1111 BPF_MOV64_IMM(BPF_REG_0, 0),
1112 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1113 offsetof(struct __sk_buff, cb[0]) - 1),
1116 .errstr = "invalid bpf_context access",
1120 "check cb access: byte, wrong type",
1122 BPF_MOV64_IMM(BPF_REG_0, 0),
1123 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1124 offsetof(struct __sk_buff, cb[0])),
1127 .errstr = "invalid bpf_context access",
1129 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1132 "check cb access: half",
1134 BPF_MOV64_IMM(BPF_REG_0, 0),
1135 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1136 offsetof(struct __sk_buff, cb[0])),
1137 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1138 offsetof(struct __sk_buff, cb[0]) + 2),
1139 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1140 offsetof(struct __sk_buff, cb[1])),
1141 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1142 offsetof(struct __sk_buff, cb[1]) + 2),
1143 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1144 offsetof(struct __sk_buff, cb[2])),
1145 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1146 offsetof(struct __sk_buff, cb[2]) + 2),
1147 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1148 offsetof(struct __sk_buff, cb[3])),
1149 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1150 offsetof(struct __sk_buff, cb[3]) + 2),
1151 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1152 offsetof(struct __sk_buff, cb[4])),
1153 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1154 offsetof(struct __sk_buff, cb[4]) + 2),
1155 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1156 offsetof(struct __sk_buff, cb[0])),
1157 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1158 offsetof(struct __sk_buff, cb[0]) + 2),
1159 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1160 offsetof(struct __sk_buff, cb[1])),
1161 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1162 offsetof(struct __sk_buff, cb[1]) + 2),
1163 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1164 offsetof(struct __sk_buff, cb[2])),
1165 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1166 offsetof(struct __sk_buff, cb[2]) + 2),
1167 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1168 offsetof(struct __sk_buff, cb[3])),
1169 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1170 offsetof(struct __sk_buff, cb[3]) + 2),
1171 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1172 offsetof(struct __sk_buff, cb[4])),
1173 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1174 offsetof(struct __sk_buff, cb[4]) + 2),
1180 "check cb access: half, unaligned",
1182 BPF_MOV64_IMM(BPF_REG_0, 0),
1183 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1184 offsetof(struct __sk_buff, cb[0]) + 1),
1187 .errstr = "misaligned access",
1191 "check cb access: half, oob 1",
1193 BPF_MOV64_IMM(BPF_REG_0, 0),
1194 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1195 offsetof(struct __sk_buff, cb[4]) + 4),
1198 .errstr = "invalid bpf_context access",
1202 "check cb access: half, oob 2",
1204 BPF_MOV64_IMM(BPF_REG_0, 0),
1205 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1206 offsetof(struct __sk_buff, cb[0]) - 2),
1209 .errstr = "invalid bpf_context access",
1213 "check cb access: half, oob 3",
1215 BPF_MOV64_IMM(BPF_REG_0, 0),
1216 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1217 offsetof(struct __sk_buff, cb[4]) + 4),
1220 .errstr = "invalid bpf_context access",
1224 "check cb access: half, oob 4",
1226 BPF_MOV64_IMM(BPF_REG_0, 0),
1227 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1228 offsetof(struct __sk_buff, cb[0]) - 2),
1231 .errstr = "invalid bpf_context access",
1235 "check cb access: half, wrong type",
1237 BPF_MOV64_IMM(BPF_REG_0, 0),
1238 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1239 offsetof(struct __sk_buff, cb[0])),
1242 .errstr = "invalid bpf_context access",
1244 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1247 "check cb access: word",
1249 BPF_MOV64_IMM(BPF_REG_0, 0),
1250 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1251 offsetof(struct __sk_buff, cb[0])),
1252 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1253 offsetof(struct __sk_buff, cb[1])),
1254 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1255 offsetof(struct __sk_buff, cb[2])),
1256 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1257 offsetof(struct __sk_buff, cb[3])),
1258 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1259 offsetof(struct __sk_buff, cb[4])),
1260 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1261 offsetof(struct __sk_buff, cb[0])),
1262 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1263 offsetof(struct __sk_buff, cb[1])),
1264 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1265 offsetof(struct __sk_buff, cb[2])),
1266 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1267 offsetof(struct __sk_buff, cb[3])),
1268 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1269 offsetof(struct __sk_buff, cb[4])),
1275 "check cb access: word, unaligned 1",
1277 BPF_MOV64_IMM(BPF_REG_0, 0),
1278 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1279 offsetof(struct __sk_buff, cb[0]) + 2),
1282 .errstr = "misaligned access",
1286 "check cb access: word, unaligned 2",
1288 BPF_MOV64_IMM(BPF_REG_0, 0),
1289 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1290 offsetof(struct __sk_buff, cb[4]) + 1),
1293 .errstr = "misaligned access",
1297 "check cb access: word, unaligned 3",
1299 BPF_MOV64_IMM(BPF_REG_0, 0),
1300 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1301 offsetof(struct __sk_buff, cb[4]) + 2),
1304 .errstr = "misaligned access",
1308 "check cb access: word, unaligned 4",
1310 BPF_MOV64_IMM(BPF_REG_0, 0),
1311 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1312 offsetof(struct __sk_buff, cb[4]) + 3),
1315 .errstr = "misaligned access",
1319 "check cb access: double",
1321 BPF_MOV64_IMM(BPF_REG_0, 0),
1322 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1323 offsetof(struct __sk_buff, cb[0])),
1324 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1325 offsetof(struct __sk_buff, cb[2])),
1326 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1327 offsetof(struct __sk_buff, cb[0])),
1328 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1329 offsetof(struct __sk_buff, cb[2])),
1335 "check cb access: double, unaligned 1",
1337 BPF_MOV64_IMM(BPF_REG_0, 0),
1338 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1339 offsetof(struct __sk_buff, cb[1])),
1342 .errstr = "misaligned access",
1346 "check cb access: double, unaligned 2",
1348 BPF_MOV64_IMM(BPF_REG_0, 0),
1349 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1350 offsetof(struct __sk_buff, cb[3])),
1353 .errstr = "misaligned access",
1357 "check cb access: double, oob 1",
1359 BPF_MOV64_IMM(BPF_REG_0, 0),
1360 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1361 offsetof(struct __sk_buff, cb[4])),
1364 .errstr = "invalid bpf_context access",
1368 "check cb access: double, oob 2",
1370 BPF_MOV64_IMM(BPF_REG_0, 0),
1371 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1372 offsetof(struct __sk_buff, cb[4]) + 8),
1375 .errstr = "invalid bpf_context access",
1379 "check cb access: double, oob 3",
1381 BPF_MOV64_IMM(BPF_REG_0, 0),
1382 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1383 offsetof(struct __sk_buff, cb[0]) - 8),
1386 .errstr = "invalid bpf_context access",
1390 "check cb access: double, oob 4",
1392 BPF_MOV64_IMM(BPF_REG_0, 0),
1393 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1394 offsetof(struct __sk_buff, cb[4])),
1397 .errstr = "invalid bpf_context access",
1401 "check cb access: double, oob 5",
1403 BPF_MOV64_IMM(BPF_REG_0, 0),
1404 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1405 offsetof(struct __sk_buff, cb[4]) + 8),
1408 .errstr = "invalid bpf_context access",
1412 "check cb access: double, oob 6",
1414 BPF_MOV64_IMM(BPF_REG_0, 0),
1415 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1416 offsetof(struct __sk_buff, cb[0]) - 8),
1419 .errstr = "invalid bpf_context access",
1423 "check cb access: double, wrong type",
1425 BPF_MOV64_IMM(BPF_REG_0, 0),
1426 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1427 offsetof(struct __sk_buff, cb[0])),
1430 .errstr = "invalid bpf_context access",
1432 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1435 "check out of range skb->cb access",
1437 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1438 offsetof(struct __sk_buff, cb[0]) + 256),
1441 .errstr = "invalid bpf_context access",
1442 .errstr_unpriv = "",
1444 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1447 "write skb fields from socket prog",
1449 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1450 offsetof(struct __sk_buff, cb[4])),
1451 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1452 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1453 offsetof(struct __sk_buff, mark)),
1454 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1455 offsetof(struct __sk_buff, tc_index)),
1456 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1457 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1458 offsetof(struct __sk_buff, cb[0])),
1459 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1460 offsetof(struct __sk_buff, cb[2])),
1464 .errstr_unpriv = "R1 leaks addr",
1465 .result_unpriv = REJECT,
1468 "write skb fields from tc_cls_act prog",
1470 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1471 offsetof(struct __sk_buff, cb[0])),
1472 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1473 offsetof(struct __sk_buff, mark)),
1474 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1475 offsetof(struct __sk_buff, tc_index)),
1476 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1477 offsetof(struct __sk_buff, tc_index)),
1478 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1479 offsetof(struct __sk_buff, cb[3])),
1482 .errstr_unpriv = "",
1483 .result_unpriv = REJECT,
1485 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1488 "PTR_TO_STACK store/load",
1490 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1492 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1493 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1499 "PTR_TO_STACK store/load - bad alignment on off",
1501 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1502 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1503 BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1504 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1508 .errstr = "misaligned access off -6 size 8",
1511 "PTR_TO_STACK store/load - bad alignment on reg",
1513 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1514 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1515 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1516 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1520 .errstr = "misaligned access off -2 size 8",
1523 "PTR_TO_STACK store/load - out of bounds low",
1525 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1526 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1527 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1528 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1532 .errstr = "invalid stack off=-79992 size=8",
1535 "PTR_TO_STACK store/load - out of bounds high",
1537 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1538 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1539 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1540 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1544 .errstr = "invalid stack off=0 size=8",
1547 "unpriv: return pointer",
1549 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1553 .result_unpriv = REJECT,
1554 .errstr_unpriv = "R0 leaks addr",
1557 "unpriv: add const to pointer",
1559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1560 BPF_MOV64_IMM(BPF_REG_0, 0),
1564 .result_unpriv = REJECT,
1565 .errstr_unpriv = "R1 pointer arithmetic",
1568 "unpriv: add pointer to pointer",
1570 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1571 BPF_MOV64_IMM(BPF_REG_0, 0),
1575 .result_unpriv = REJECT,
1576 .errstr_unpriv = "R1 pointer arithmetic",
1579 "unpriv: neg pointer",
1581 BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1582 BPF_MOV64_IMM(BPF_REG_0, 0),
1586 .result_unpriv = REJECT,
1587 .errstr_unpriv = "R1 pointer arithmetic",
1590 "unpriv: cmp pointer with const",
1592 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1593 BPF_MOV64_IMM(BPF_REG_0, 0),
1597 .result_unpriv = REJECT,
1598 .errstr_unpriv = "R1 pointer comparison",
1601 "unpriv: cmp pointer with pointer",
1603 BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1604 BPF_MOV64_IMM(BPF_REG_0, 0),
1608 .result_unpriv = REJECT,
1609 .errstr_unpriv = "R10 pointer comparison",
1612 "unpriv: check that printk is disallowed",
1614 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1615 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1616 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1617 BPF_MOV64_IMM(BPF_REG_2, 8),
1618 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1619 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1620 BPF_FUNC_trace_printk),
1621 BPF_MOV64_IMM(BPF_REG_0, 0),
1624 .errstr_unpriv = "unknown func bpf_trace_printk#6",
1625 .result_unpriv = REJECT,
1629 "unpriv: pass pointer to helper function",
1631 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1632 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1633 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1634 BPF_LD_MAP_FD(BPF_REG_1, 0),
1635 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1636 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
1637 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1638 BPF_FUNC_map_update_elem),
1639 BPF_MOV64_IMM(BPF_REG_0, 0),
1642 .fixup_map1 = { 3 },
1643 .errstr_unpriv = "R4 leaks addr",
1644 .result_unpriv = REJECT,
1648 "unpriv: indirectly pass pointer on stack to helper function",
1650 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1651 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1652 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1653 BPF_LD_MAP_FD(BPF_REG_1, 0),
1654 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1655 BPF_FUNC_map_lookup_elem),
1656 BPF_MOV64_IMM(BPF_REG_0, 0),
1659 .fixup_map1 = { 3 },
1660 .errstr = "invalid indirect read from stack off -8+0 size 8",
1664 "unpriv: mangle pointer on stack 1",
1666 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1667 BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1668 BPF_MOV64_IMM(BPF_REG_0, 0),
1671 .errstr_unpriv = "attempt to corrupt spilled",
1672 .result_unpriv = REJECT,
1676 "unpriv: mangle pointer on stack 2",
1678 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1679 BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
1680 BPF_MOV64_IMM(BPF_REG_0, 0),
1683 .errstr_unpriv = "attempt to corrupt spilled",
1684 .result_unpriv = REJECT,
1688 "unpriv: read pointer from stack in small chunks",
1690 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1691 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
1692 BPF_MOV64_IMM(BPF_REG_0, 0),
1695 .errstr = "invalid size",
1699 "unpriv: write pointer into ctx",
1701 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
1702 BPF_MOV64_IMM(BPF_REG_0, 0),
1705 .errstr_unpriv = "R1 leaks addr",
1706 .result_unpriv = REJECT,
1707 .errstr = "invalid bpf_context access",
1711 "unpriv: spill/fill of ctx",
1713 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1714 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1715 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1716 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1717 BPF_MOV64_IMM(BPF_REG_0, 0),
1723 "unpriv: spill/fill of ctx 2",
1725 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1727 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1728 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1729 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1730 BPF_FUNC_get_hash_recalc),
1734 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1737 "unpriv: spill/fill of ctx 3",
1739 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1740 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1741 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1742 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1743 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1744 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1745 BPF_FUNC_get_hash_recalc),
1749 .errstr = "R1 type=fp expected=ctx",
1750 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1753 "unpriv: spill/fill of ctx 4",
1755 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1756 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1757 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1758 BPF_MOV64_IMM(BPF_REG_0, 1),
1759 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
1761 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1762 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1763 BPF_FUNC_get_hash_recalc),
1767 .errstr = "R1 type=inv expected=ctx",
1768 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1771 "unpriv: spill/fill of different pointers stx",
1773 BPF_MOV64_IMM(BPF_REG_3, 42),
1774 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1775 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1776 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1777 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1778 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1779 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1780 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1781 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1782 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1783 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
1784 offsetof(struct __sk_buff, mark)),
1785 BPF_MOV64_IMM(BPF_REG_0, 0),
1789 .errstr = "same insn cannot be used with different pointers",
1790 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1793 "unpriv: spill/fill of different pointers ldx",
1795 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1796 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1798 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
1800 -(__s32)offsetof(struct bpf_perf_event_data,
1801 sample_period) - 8),
1802 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1803 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1804 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1805 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1806 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
1807 offsetof(struct bpf_perf_event_data,
1809 BPF_MOV64_IMM(BPF_REG_0, 0),
1813 .errstr = "same insn cannot be used with different pointers",
1814 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
1817 "unpriv: write pointer into map elem value",
1819 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1820 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1821 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1822 BPF_LD_MAP_FD(BPF_REG_1, 0),
1823 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1824 BPF_FUNC_map_lookup_elem),
1825 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1826 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
1829 .fixup_map1 = { 3 },
1830 .errstr_unpriv = "R0 leaks addr",
1831 .result_unpriv = REJECT,
1835 "unpriv: partial copy of pointer",
1837 BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
1838 BPF_MOV64_IMM(BPF_REG_0, 0),
1841 .errstr_unpriv = "R10 partial copy",
1842 .result_unpriv = REJECT,
1846 "unpriv: pass pointer to tail_call",
1848 BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1849 BPF_LD_MAP_FD(BPF_REG_2, 0),
1850 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1851 BPF_FUNC_tail_call),
1852 BPF_MOV64_IMM(BPF_REG_0, 0),
1855 .fixup_prog = { 1 },
1856 .errstr_unpriv = "R3 leaks addr into helper",
1857 .result_unpriv = REJECT,
1861 "unpriv: cmp map pointer with zero",
1863 BPF_MOV64_IMM(BPF_REG_1, 0),
1864 BPF_LD_MAP_FD(BPF_REG_1, 0),
1865 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1866 BPF_MOV64_IMM(BPF_REG_0, 0),
1869 .fixup_map1 = { 1 },
1870 .errstr_unpriv = "R1 pointer comparison",
1871 .result_unpriv = REJECT,
1875 "unpriv: write into frame pointer",
1877 BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
1878 BPF_MOV64_IMM(BPF_REG_0, 0),
1881 .errstr = "frame pointer is read only",
1885 "unpriv: spill/fill frame pointer",
1887 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1888 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1889 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1890 BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
1891 BPF_MOV64_IMM(BPF_REG_0, 0),
1894 .errstr = "frame pointer is read only",
1898 "unpriv: cmp of frame pointer",
1900 BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
1901 BPF_MOV64_IMM(BPF_REG_0, 0),
1904 .errstr_unpriv = "R10 pointer comparison",
1905 .result_unpriv = REJECT,
1909 "unpriv: adding of fp",
1911 BPF_MOV64_IMM(BPF_REG_0, 0),
1912 BPF_MOV64_IMM(BPF_REG_1, 0),
1913 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1914 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
1917 .errstr_unpriv = "pointer arithmetic prohibited",
1918 .result_unpriv = REJECT,
1919 .errstr = "R1 invalid mem access",
1923 "unpriv: cmp of stack pointer",
1925 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1926 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1927 BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
1928 BPF_MOV64_IMM(BPF_REG_0, 0),
1931 .errstr_unpriv = "R2 pointer comparison",
1932 .result_unpriv = REJECT,
1936 "stack pointer arithmetic",
1938 BPF_MOV64_IMM(BPF_REG_1, 4),
1939 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1940 BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
1941 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
1942 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
1943 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
1944 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
1945 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
1946 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
1947 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
1948 BPF_ST_MEM(0, BPF_REG_2, 4, 0),
1949 BPF_MOV64_IMM(BPF_REG_0, 0),
1955 "raw_stack: no skb_load_bytes",
1957 BPF_MOV64_IMM(BPF_REG_2, 4),
1958 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1959 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1960 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1961 BPF_MOV64_IMM(BPF_REG_4, 8),
1962 /* Call to skb_load_bytes() omitted. */
1963 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1967 .errstr = "invalid read from stack off -8+0 size 8",
1968 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1971 "raw_stack: skb_load_bytes, negative len",
1973 BPF_MOV64_IMM(BPF_REG_2, 4),
1974 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1975 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1976 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1977 BPF_MOV64_IMM(BPF_REG_4, -8),
1978 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1979 BPF_FUNC_skb_load_bytes),
1980 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1984 .errstr = "invalid stack type R3",
1985 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1988 "raw_stack: skb_load_bytes, negative len 2",
1990 BPF_MOV64_IMM(BPF_REG_2, 4),
1991 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1992 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1993 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1994 BPF_MOV64_IMM(BPF_REG_4, ~0),
1995 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1996 BPF_FUNC_skb_load_bytes),
1997 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2001 .errstr = "invalid stack type R3",
2002 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2005 "raw_stack: skb_load_bytes, zero len",
2007 BPF_MOV64_IMM(BPF_REG_2, 4),
2008 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2009 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2010 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2011 BPF_MOV64_IMM(BPF_REG_4, 0),
2012 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2013 BPF_FUNC_skb_load_bytes),
2014 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2018 .errstr = "invalid stack type R3",
2019 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2022 "raw_stack: skb_load_bytes, no init",
2024 BPF_MOV64_IMM(BPF_REG_2, 4),
2025 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2026 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2027 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2028 BPF_MOV64_IMM(BPF_REG_4, 8),
2029 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2030 BPF_FUNC_skb_load_bytes),
2031 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2035 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2038 "raw_stack: skb_load_bytes, init",
2040 BPF_MOV64_IMM(BPF_REG_2, 4),
2041 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2042 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2043 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2044 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2045 BPF_MOV64_IMM(BPF_REG_4, 8),
2046 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2047 BPF_FUNC_skb_load_bytes),
2048 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2052 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2055 "raw_stack: skb_load_bytes, spilled regs around bounds",
2057 BPF_MOV64_IMM(BPF_REG_2, 4),
2058 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2059 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2060 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2061 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2062 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2063 BPF_MOV64_IMM(BPF_REG_4, 8),
2064 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2065 BPF_FUNC_skb_load_bytes),
2066 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2067 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2068 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2069 offsetof(struct __sk_buff, mark)),
2070 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2071 offsetof(struct __sk_buff, priority)),
2072 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2076 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2079 "raw_stack: skb_load_bytes, spilled regs corruption",
2081 BPF_MOV64_IMM(BPF_REG_2, 4),
2082 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2083 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2084 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2085 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2086 BPF_MOV64_IMM(BPF_REG_4, 8),
2087 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2088 BPF_FUNC_skb_load_bytes),
2089 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2090 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2091 offsetof(struct __sk_buff, mark)),
2095 .errstr = "R0 invalid mem access 'inv'",
2096 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2099 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2101 BPF_MOV64_IMM(BPF_REG_2, 4),
2102 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2104 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2105 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2106 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2107 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2108 BPF_MOV64_IMM(BPF_REG_4, 8),
2109 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2110 BPF_FUNC_skb_load_bytes),
2111 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2112 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2113 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2114 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2115 offsetof(struct __sk_buff, mark)),
2116 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2117 offsetof(struct __sk_buff, priority)),
2118 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2119 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2120 offsetof(struct __sk_buff, pkt_type)),
2121 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2125 .errstr = "R3 invalid mem access 'inv'",
2126 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2129 "raw_stack: skb_load_bytes, spilled regs + data",
2131 BPF_MOV64_IMM(BPF_REG_2, 4),
2132 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2133 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2134 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2135 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2136 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
2137 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2138 BPF_MOV64_IMM(BPF_REG_4, 8),
2139 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2140 BPF_FUNC_skb_load_bytes),
2141 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2142 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 8),
2143 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, 0),
2144 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2145 offsetof(struct __sk_buff, mark)),
2146 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2147 offsetof(struct __sk_buff, priority)),
2148 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2149 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2153 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2156 "raw_stack: skb_load_bytes, invalid access 1",
2158 BPF_MOV64_IMM(BPF_REG_2, 4),
2159 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2161 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2162 BPF_MOV64_IMM(BPF_REG_4, 8),
2163 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2164 BPF_FUNC_skb_load_bytes),
2165 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2169 .errstr = "invalid stack type R3 off=-513 access_size=8",
2170 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2173 "raw_stack: skb_load_bytes, invalid access 2",
2175 BPF_MOV64_IMM(BPF_REG_2, 4),
2176 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2177 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2178 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2179 BPF_MOV64_IMM(BPF_REG_4, 8),
2180 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2181 BPF_FUNC_skb_load_bytes),
2182 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2186 .errstr = "invalid stack type R3 off=-1 access_size=8",
2187 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2190 "raw_stack: skb_load_bytes, invalid access 3",
2192 BPF_MOV64_IMM(BPF_REG_2, 4),
2193 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2194 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2195 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2196 BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2197 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2198 BPF_FUNC_skb_load_bytes),
2199 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2203 .errstr = "invalid stack type R3 off=-1 access_size=-1",
2204 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2207 "raw_stack: skb_load_bytes, invalid access 4",
2209 BPF_MOV64_IMM(BPF_REG_2, 4),
2210 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2211 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2212 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2213 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2214 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2215 BPF_FUNC_skb_load_bytes),
2216 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2220 .errstr = "invalid stack type R3 off=-1 access_size=2147483647",
2221 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2224 "raw_stack: skb_load_bytes, invalid access 5",
2226 BPF_MOV64_IMM(BPF_REG_2, 4),
2227 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2228 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2229 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2230 BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2231 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2232 BPF_FUNC_skb_load_bytes),
2233 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2237 .errstr = "invalid stack type R3 off=-512 access_size=2147483647",
2238 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2241 "raw_stack: skb_load_bytes, invalid access 6",
2243 BPF_MOV64_IMM(BPF_REG_2, 4),
2244 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2245 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2246 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2247 BPF_MOV64_IMM(BPF_REG_4, 0),
2248 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2249 BPF_FUNC_skb_load_bytes),
2250 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2254 .errstr = "invalid stack type R3 off=-512 access_size=0",
2255 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2258 "raw_stack: skb_load_bytes, large access",
2260 BPF_MOV64_IMM(BPF_REG_2, 4),
2261 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2262 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2263 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2264 BPF_MOV64_IMM(BPF_REG_4, 512),
2265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2266 BPF_FUNC_skb_load_bytes),
2267 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2271 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2274 "direct packet access: test1",
2276 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2277 offsetof(struct __sk_buff, data)),
2278 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2279 offsetof(struct __sk_buff, data_end)),
2280 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2282 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2283 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2284 BPF_MOV64_IMM(BPF_REG_0, 0),
2288 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2291 "direct packet access: test2",
2293 BPF_MOV64_IMM(BPF_REG_0, 1),
2294 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2295 offsetof(struct __sk_buff, data_end)),
2296 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2297 offsetof(struct __sk_buff, data)),
2298 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2299 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2300 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2301 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2302 BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2303 BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2304 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2305 offsetof(struct __sk_buff, data)),
2306 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2307 BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
2308 BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 48),
2309 BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 48),
2310 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2311 BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2312 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2313 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2314 offsetof(struct __sk_buff, data_end)),
2315 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2316 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2317 BPF_MOV64_IMM(BPF_REG_0, 0),
2321 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2324 "direct packet access: test3",
2326 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2327 offsetof(struct __sk_buff, data)),
2328 BPF_MOV64_IMM(BPF_REG_0, 0),
2331 .errstr = "invalid bpf_context access off=76",
2333 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2336 "direct packet access: test4 (write)",
2338 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2339 offsetof(struct __sk_buff, data)),
2340 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2341 offsetof(struct __sk_buff, data_end)),
2342 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2343 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2344 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2345 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2346 BPF_MOV64_IMM(BPF_REG_0, 0),
2350 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2353 "direct packet access: test5 (pkt_end >= reg, good access)",
2355 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2356 offsetof(struct __sk_buff, data)),
2357 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2358 offsetof(struct __sk_buff, data_end)),
2359 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2360 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2361 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2362 BPF_MOV64_IMM(BPF_REG_0, 1),
2364 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2365 BPF_MOV64_IMM(BPF_REG_0, 0),
2369 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2372 "direct packet access: test6 (pkt_end >= reg, bad access)",
2374 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2375 offsetof(struct __sk_buff, data)),
2376 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2377 offsetof(struct __sk_buff, data_end)),
2378 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2379 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2380 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2381 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2382 BPF_MOV64_IMM(BPF_REG_0, 1),
2384 BPF_MOV64_IMM(BPF_REG_0, 0),
2387 .errstr = "invalid access to packet",
2389 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2392 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2394 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2395 offsetof(struct __sk_buff, data)),
2396 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2397 offsetof(struct __sk_buff, data_end)),
2398 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2399 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2400 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2401 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2402 BPF_MOV64_IMM(BPF_REG_0, 1),
2404 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2405 BPF_MOV64_IMM(BPF_REG_0, 0),
2408 .errstr = "invalid access to packet",
2410 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2413 "direct packet access: test8 (double test, variant 1)",
2415 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2416 offsetof(struct __sk_buff, data)),
2417 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2418 offsetof(struct __sk_buff, data_end)),
2419 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2420 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2421 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2422 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2423 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2424 BPF_MOV64_IMM(BPF_REG_0, 1),
2426 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2427 BPF_MOV64_IMM(BPF_REG_0, 0),
2431 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2434 "direct packet access: test9 (double test, variant 2)",
2436 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2437 offsetof(struct __sk_buff, data)),
2438 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2439 offsetof(struct __sk_buff, data_end)),
2440 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2441 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2442 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2443 BPF_MOV64_IMM(BPF_REG_0, 1),
2445 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2446 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2447 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2448 BPF_MOV64_IMM(BPF_REG_0, 0),
2452 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2455 "direct packet access: test10 (write invalid)",
2457 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2458 offsetof(struct __sk_buff, data)),
2459 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2460 offsetof(struct __sk_buff, data_end)),
2461 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2462 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2463 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2464 BPF_MOV64_IMM(BPF_REG_0, 0),
2466 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2467 BPF_MOV64_IMM(BPF_REG_0, 0),
2470 .errstr = "invalid access to packet",
2472 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2475 "direct packet access: test11 (shift, good access)",
2477 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2478 offsetof(struct __sk_buff, data)),
2479 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2480 offsetof(struct __sk_buff, data_end)),
2481 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2482 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2483 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2484 BPF_MOV64_IMM(BPF_REG_3, 144),
2485 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2486 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2487 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
2488 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2489 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2490 BPF_MOV64_IMM(BPF_REG_0, 1),
2492 BPF_MOV64_IMM(BPF_REG_0, 0),
2496 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2499 "direct packet access: test12 (and, good access)",
2501 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2502 offsetof(struct __sk_buff, data)),
2503 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2504 offsetof(struct __sk_buff, data_end)),
2505 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2506 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2507 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2508 BPF_MOV64_IMM(BPF_REG_3, 144),
2509 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2510 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2511 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2512 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2513 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2514 BPF_MOV64_IMM(BPF_REG_0, 1),
2516 BPF_MOV64_IMM(BPF_REG_0, 0),
2520 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2523 "direct packet access: test13 (branches, good access)",
2525 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2526 offsetof(struct __sk_buff, data)),
2527 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2528 offsetof(struct __sk_buff, data_end)),
2529 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2530 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2531 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
2532 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2533 offsetof(struct __sk_buff, mark)),
2534 BPF_MOV64_IMM(BPF_REG_4, 1),
2535 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
2536 BPF_MOV64_IMM(BPF_REG_3, 14),
2537 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
2538 BPF_MOV64_IMM(BPF_REG_3, 24),
2539 BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2540 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2541 BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2542 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2543 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2544 BPF_MOV64_IMM(BPF_REG_0, 1),
2546 BPF_MOV64_IMM(BPF_REG_0, 0),
2550 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2553 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2555 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2556 offsetof(struct __sk_buff, data)),
2557 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2558 offsetof(struct __sk_buff, data_end)),
2559 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2560 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2561 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
2562 BPF_MOV64_IMM(BPF_REG_5, 12),
2563 BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
2564 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2565 BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2566 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
2567 BPF_MOV64_IMM(BPF_REG_0, 1),
2569 BPF_MOV64_IMM(BPF_REG_0, 0),
2573 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2576 "direct packet access: test15 (spill with xadd)",
2578 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2579 offsetof(struct __sk_buff, data)),
2580 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2581 offsetof(struct __sk_buff, data_end)),
2582 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2583 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2584 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2585 BPF_MOV64_IMM(BPF_REG_5, 4096),
2586 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
2587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
2588 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
2589 BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
2590 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
2591 BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
2592 BPF_MOV64_IMM(BPF_REG_0, 0),
2595 .errstr = "R2 invalid mem access 'inv'",
2597 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2600 "direct packet access: test16 (arith on data_end)",
2602 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2603 offsetof(struct __sk_buff, data)),
2604 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2605 offsetof(struct __sk_buff, data_end)),
2606 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2607 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2608 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
2609 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2610 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2611 BPF_MOV64_IMM(BPF_REG_0, 0),
2614 .errstr = "invalid access to packet",
2616 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2619 "direct packet access: test17 (pruning, alignment)",
2621 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2622 offsetof(struct __sk_buff, data)),
2623 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2624 offsetof(struct __sk_buff, data_end)),
2625 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2626 offsetof(struct __sk_buff, mark)),
2627 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2628 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
2629 BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
2630 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2631 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
2632 BPF_MOV64_IMM(BPF_REG_0, 0),
2634 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
2637 .errstr = "misaligned packet access off 2+15+-4 size 4",
2639 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2640 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2643 "helper access to packet: test1, valid packet_ptr range",
2645 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2646 offsetof(struct xdp_md, data)),
2647 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2648 offsetof(struct xdp_md, data_end)),
2649 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2650 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2651 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2652 BPF_LD_MAP_FD(BPF_REG_1, 0),
2653 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2654 BPF_MOV64_IMM(BPF_REG_4, 0),
2655 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2656 BPF_FUNC_map_update_elem),
2657 BPF_MOV64_IMM(BPF_REG_0, 0),
2660 .fixup_map1 = { 5 },
2661 .result_unpriv = ACCEPT,
2663 .prog_type = BPF_PROG_TYPE_XDP,
2666 "helper access to packet: test2, unchecked packet_ptr",
2668 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2669 offsetof(struct xdp_md, data)),
2670 BPF_LD_MAP_FD(BPF_REG_1, 0),
2671 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2672 BPF_FUNC_map_lookup_elem),
2673 BPF_MOV64_IMM(BPF_REG_0, 0),
2676 .fixup_map1 = { 1 },
2678 .errstr = "invalid access to packet",
2679 .prog_type = BPF_PROG_TYPE_XDP,
2682 "helper access to packet: test3, variable add",
2684 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2685 offsetof(struct xdp_md, data)),
2686 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2687 offsetof(struct xdp_md, data_end)),
2688 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2689 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2690 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2691 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2692 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2693 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2694 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2695 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2696 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2697 BPF_LD_MAP_FD(BPF_REG_1, 0),
2698 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2699 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2700 BPF_FUNC_map_lookup_elem),
2701 BPF_MOV64_IMM(BPF_REG_0, 0),
2704 .fixup_map1 = { 11 },
2706 .prog_type = BPF_PROG_TYPE_XDP,
2709 "helper access to packet: test4, packet_ptr with bad range",
2711 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2712 offsetof(struct xdp_md, data)),
2713 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2714 offsetof(struct xdp_md, data_end)),
2715 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2716 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2717 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2718 BPF_MOV64_IMM(BPF_REG_0, 0),
2720 BPF_LD_MAP_FD(BPF_REG_1, 0),
2721 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2722 BPF_FUNC_map_lookup_elem),
2723 BPF_MOV64_IMM(BPF_REG_0, 0),
2726 .fixup_map1 = { 7 },
2728 .errstr = "invalid access to packet",
2729 .prog_type = BPF_PROG_TYPE_XDP,
2732 "helper access to packet: test5, packet_ptr with too short range",
2734 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2735 offsetof(struct xdp_md, data)),
2736 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2737 offsetof(struct xdp_md, data_end)),
2738 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2739 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2740 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2741 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2742 BPF_LD_MAP_FD(BPF_REG_1, 0),
2743 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2744 BPF_FUNC_map_lookup_elem),
2745 BPF_MOV64_IMM(BPF_REG_0, 0),
2748 .fixup_map1 = { 6 },
2750 .errstr = "invalid access to packet",
2751 .prog_type = BPF_PROG_TYPE_XDP,
2754 "helper access to packet: test6, cls valid packet_ptr range",
2756 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2757 offsetof(struct __sk_buff, data)),
2758 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2759 offsetof(struct __sk_buff, data_end)),
2760 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2761 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2762 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2763 BPF_LD_MAP_FD(BPF_REG_1, 0),
2764 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2765 BPF_MOV64_IMM(BPF_REG_4, 0),
2766 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2767 BPF_FUNC_map_update_elem),
2768 BPF_MOV64_IMM(BPF_REG_0, 0),
2771 .fixup_map1 = { 5 },
2773 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2776 "helper access to packet: test7, cls unchecked packet_ptr",
2778 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2779 offsetof(struct __sk_buff, data)),
2780 BPF_LD_MAP_FD(BPF_REG_1, 0),
2781 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2782 BPF_FUNC_map_lookup_elem),
2783 BPF_MOV64_IMM(BPF_REG_0, 0),
2786 .fixup_map1 = { 1 },
2788 .errstr = "invalid access to packet",
2789 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2792 "helper access to packet: test8, cls variable add",
2794 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2795 offsetof(struct __sk_buff, data)),
2796 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2797 offsetof(struct __sk_buff, data_end)),
2798 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2799 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2800 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2801 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2802 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2803 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2804 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2805 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2806 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2807 BPF_LD_MAP_FD(BPF_REG_1, 0),
2808 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2809 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2810 BPF_FUNC_map_lookup_elem),
2811 BPF_MOV64_IMM(BPF_REG_0, 0),
2814 .fixup_map1 = { 11 },
2816 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2819 "helper access to packet: test9, cls packet_ptr with bad range",
2821 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2822 offsetof(struct __sk_buff, data)),
2823 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2824 offsetof(struct __sk_buff, data_end)),
2825 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2826 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2827 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2828 BPF_MOV64_IMM(BPF_REG_0, 0),
2830 BPF_LD_MAP_FD(BPF_REG_1, 0),
2831 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2832 BPF_FUNC_map_lookup_elem),
2833 BPF_MOV64_IMM(BPF_REG_0, 0),
2836 .fixup_map1 = { 7 },
2838 .errstr = "invalid access to packet",
2839 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2842 "helper access to packet: test10, cls packet_ptr with too short range",
2844 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2845 offsetof(struct __sk_buff, data)),
2846 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2847 offsetof(struct __sk_buff, data_end)),
2848 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2849 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2850 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2851 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2852 BPF_LD_MAP_FD(BPF_REG_1, 0),
2853 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2854 BPF_FUNC_map_lookup_elem),
2855 BPF_MOV64_IMM(BPF_REG_0, 0),
2858 .fixup_map1 = { 6 },
2860 .errstr = "invalid access to packet",
2861 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2864 "helper access to packet: test11, cls unsuitable helper 1",
2866 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2867 offsetof(struct __sk_buff, data)),
2868 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2869 offsetof(struct __sk_buff, data_end)),
2870 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2871 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
2873 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
2874 BPF_MOV64_IMM(BPF_REG_2, 0),
2875 BPF_MOV64_IMM(BPF_REG_4, 42),
2876 BPF_MOV64_IMM(BPF_REG_5, 0),
2877 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2878 BPF_FUNC_skb_store_bytes),
2879 BPF_MOV64_IMM(BPF_REG_0, 0),
2883 .errstr = "helper access to the packet",
2884 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2887 "helper access to packet: test12, cls unsuitable helper 2",
2889 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2890 offsetof(struct __sk_buff, data)),
2891 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2892 offsetof(struct __sk_buff, data_end)),
2893 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2894 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
2895 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
2896 BPF_MOV64_IMM(BPF_REG_2, 0),
2897 BPF_MOV64_IMM(BPF_REG_4, 4),
2898 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2899 BPF_FUNC_skb_load_bytes),
2900 BPF_MOV64_IMM(BPF_REG_0, 0),
2904 .errstr = "helper access to the packet",
2905 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2908 "helper access to packet: test13, cls helper ok",
2910 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2911 offsetof(struct __sk_buff, data)),
2912 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2913 offsetof(struct __sk_buff, data_end)),
2914 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2915 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2916 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2917 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2918 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2919 BPF_MOV64_IMM(BPF_REG_2, 4),
2920 BPF_MOV64_IMM(BPF_REG_3, 0),
2921 BPF_MOV64_IMM(BPF_REG_4, 0),
2922 BPF_MOV64_IMM(BPF_REG_5, 0),
2923 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2924 BPF_FUNC_csum_diff),
2925 BPF_MOV64_IMM(BPF_REG_0, 0),
2929 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2932 "helper access to packet: test14, cls helper fail sub",
2934 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2935 offsetof(struct __sk_buff, data)),
2936 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2937 offsetof(struct __sk_buff, data_end)),
2938 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2939 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2940 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2941 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2942 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
2943 BPF_MOV64_IMM(BPF_REG_2, 4),
2944 BPF_MOV64_IMM(BPF_REG_3, 0),
2945 BPF_MOV64_IMM(BPF_REG_4, 0),
2946 BPF_MOV64_IMM(BPF_REG_5, 0),
2947 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2948 BPF_FUNC_csum_diff),
2949 BPF_MOV64_IMM(BPF_REG_0, 0),
2953 .errstr = "type=inv expected=fp",
2954 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2957 "helper access to packet: test15, cls helper fail range 1",
2959 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2960 offsetof(struct __sk_buff, data)),
2961 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2962 offsetof(struct __sk_buff, data_end)),
2963 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2964 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2965 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2966 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2967 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2968 BPF_MOV64_IMM(BPF_REG_2, 8),
2969 BPF_MOV64_IMM(BPF_REG_3, 0),
2970 BPF_MOV64_IMM(BPF_REG_4, 0),
2971 BPF_MOV64_IMM(BPF_REG_5, 0),
2972 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2973 BPF_FUNC_csum_diff),
2974 BPF_MOV64_IMM(BPF_REG_0, 0),
2978 .errstr = "invalid access to packet",
2979 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2982 "helper access to packet: test16, cls helper fail range 2",
2984 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2985 offsetof(struct __sk_buff, data)),
2986 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2987 offsetof(struct __sk_buff, data_end)),
2988 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2989 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2990 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2991 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2992 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2993 BPF_MOV64_IMM(BPF_REG_2, -9),
2994 BPF_MOV64_IMM(BPF_REG_3, 0),
2995 BPF_MOV64_IMM(BPF_REG_4, 0),
2996 BPF_MOV64_IMM(BPF_REG_5, 0),
2997 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2998 BPF_FUNC_csum_diff),
2999 BPF_MOV64_IMM(BPF_REG_0, 0),
3003 .errstr = "invalid access to packet",
3004 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3007 "helper access to packet: test17, cls helper fail range 3",
3009 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3010 offsetof(struct __sk_buff, data)),
3011 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3012 offsetof(struct __sk_buff, data_end)),
3013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3014 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3015 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3016 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3017 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3018 BPF_MOV64_IMM(BPF_REG_2, ~0),
3019 BPF_MOV64_IMM(BPF_REG_3, 0),
3020 BPF_MOV64_IMM(BPF_REG_4, 0),
3021 BPF_MOV64_IMM(BPF_REG_5, 0),
3022 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3023 BPF_FUNC_csum_diff),
3024 BPF_MOV64_IMM(BPF_REG_0, 0),
3028 .errstr = "invalid access to packet",
3029 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3032 "helper access to packet: test18, cls helper fail range zero",
3034 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3035 offsetof(struct __sk_buff, data)),
3036 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3037 offsetof(struct __sk_buff, data_end)),
3038 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3039 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3040 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3041 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3042 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3043 BPF_MOV64_IMM(BPF_REG_2, 0),
3044 BPF_MOV64_IMM(BPF_REG_3, 0),
3045 BPF_MOV64_IMM(BPF_REG_4, 0),
3046 BPF_MOV64_IMM(BPF_REG_5, 0),
3047 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3048 BPF_FUNC_csum_diff),
3049 BPF_MOV64_IMM(BPF_REG_0, 0),
3053 .errstr = "invalid access to packet",
3054 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3057 "helper access to packet: test19, pkt end as input",
3059 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3060 offsetof(struct __sk_buff, data)),
3061 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3062 offsetof(struct __sk_buff, data_end)),
3063 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3064 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3066 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3067 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
3068 BPF_MOV64_IMM(BPF_REG_2, 4),
3069 BPF_MOV64_IMM(BPF_REG_3, 0),
3070 BPF_MOV64_IMM(BPF_REG_4, 0),
3071 BPF_MOV64_IMM(BPF_REG_5, 0),
3072 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3073 BPF_FUNC_csum_diff),
3074 BPF_MOV64_IMM(BPF_REG_0, 0),
3078 .errstr = "R1 type=pkt_end expected=fp",
3079 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3082 "helper access to packet: test20, wrong reg",
3084 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3085 offsetof(struct __sk_buff, data)),
3086 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3087 offsetof(struct __sk_buff, data_end)),
3088 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3089 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3090 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3091 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3092 BPF_MOV64_IMM(BPF_REG_2, 4),
3093 BPF_MOV64_IMM(BPF_REG_3, 0),
3094 BPF_MOV64_IMM(BPF_REG_4, 0),
3095 BPF_MOV64_IMM(BPF_REG_5, 0),
3096 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3097 BPF_FUNC_csum_diff),
3098 BPF_MOV64_IMM(BPF_REG_0, 0),
3102 .errstr = "invalid access to packet",
3103 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3106 "valid map access into an array with a constant",
3108 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3109 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3111 BPF_LD_MAP_FD(BPF_REG_1, 0),
3112 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3113 BPF_FUNC_map_lookup_elem),
3114 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3115 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3116 offsetof(struct test_val, foo)),
3119 .fixup_map2 = { 3 },
3120 .errstr_unpriv = "R0 leaks addr",
3121 .result_unpriv = REJECT,
3125 "valid map access into an array with a register",
3127 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3128 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3129 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3130 BPF_LD_MAP_FD(BPF_REG_1, 0),
3131 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3132 BPF_FUNC_map_lookup_elem),
3133 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3134 BPF_MOV64_IMM(BPF_REG_1, 4),
3135 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3136 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3137 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3138 offsetof(struct test_val, foo)),
3141 .fixup_map2 = { 3 },
3142 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3143 .result_unpriv = REJECT,
3145 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3148 "valid map access into an array with a variable",
3150 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3151 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3153 BPF_LD_MAP_FD(BPF_REG_1, 0),
3154 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3155 BPF_FUNC_map_lookup_elem),
3156 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3157 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3158 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
3159 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3160 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3161 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3162 offsetof(struct test_val, foo)),
3165 .fixup_map2 = { 3 },
3166 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3167 .result_unpriv = REJECT,
3169 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3172 "valid map access into an array with a signed variable",
3174 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3175 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3176 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3177 BPF_LD_MAP_FD(BPF_REG_1, 0),
3178 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3179 BPF_FUNC_map_lookup_elem),
3180 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
3181 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3182 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
3183 BPF_MOV32_IMM(BPF_REG_1, 0),
3184 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3185 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3186 BPF_MOV32_IMM(BPF_REG_1, 0),
3187 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3188 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3189 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3190 offsetof(struct test_val, foo)),
3193 .fixup_map2 = { 3 },
3194 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3195 .result_unpriv = REJECT,
3197 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3200 "invalid map access into an array with a constant",
3202 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3203 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3204 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3205 BPF_LD_MAP_FD(BPF_REG_1, 0),
3206 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3207 BPF_FUNC_map_lookup_elem),
3208 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3209 BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
3210 offsetof(struct test_val, foo)),
3213 .fixup_map2 = { 3 },
3214 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
3218 "invalid map access into an array with a register",
3220 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3221 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3222 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3223 BPF_LD_MAP_FD(BPF_REG_1, 0),
3224 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3225 BPF_FUNC_map_lookup_elem),
3226 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3227 BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
3228 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3229 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3230 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3231 offsetof(struct test_val, foo)),
3234 .fixup_map2 = { 3 },
3235 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3236 .errstr = "R0 min value is outside of the array range",
3237 .result_unpriv = REJECT,
3239 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3242 "invalid map access into an array with a variable",
3244 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3247 BPF_LD_MAP_FD(BPF_REG_1, 0),
3248 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3249 BPF_FUNC_map_lookup_elem),
3250 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3251 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3252 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3253 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3254 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3255 offsetof(struct test_val, foo)),
3258 .fixup_map2 = { 3 },
3259 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3260 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3261 .result_unpriv = REJECT,
3263 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3266 "invalid map access into an array with no floor check",
3268 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3269 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3270 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3271 BPF_LD_MAP_FD(BPF_REG_1, 0),
3272 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3273 BPF_FUNC_map_lookup_elem),
3274 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3275 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3276 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3277 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3278 BPF_MOV32_IMM(BPF_REG_1, 0),
3279 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3280 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3281 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3282 offsetof(struct test_val, foo)),
3285 .fixup_map2 = { 3 },
3286 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3287 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3288 .result_unpriv = REJECT,
3290 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3293 "invalid map access into an array with a invalid max check",
3295 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3296 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3298 BPF_LD_MAP_FD(BPF_REG_1, 0),
3299 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3300 BPF_FUNC_map_lookup_elem),
3301 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3302 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3303 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
3304 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3305 BPF_MOV32_IMM(BPF_REG_1, 0),
3306 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3307 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3308 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3309 offsetof(struct test_val, foo)),
3312 .fixup_map2 = { 3 },
3313 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3314 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
3315 .result_unpriv = REJECT,
3317 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3320 "invalid map access into an array with a invalid max check",
3322 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3323 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3324 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3325 BPF_LD_MAP_FD(BPF_REG_1, 0),
3326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3327 BPF_FUNC_map_lookup_elem),
3328 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3329 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3330 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3331 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3332 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3333 BPF_LD_MAP_FD(BPF_REG_1, 0),
3334 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3335 BPF_FUNC_map_lookup_elem),
3336 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3337 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
3338 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3339 offsetof(struct test_val, foo)),
3342 .fixup_map2 = { 3, 11 },
3343 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3344 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3345 .result_unpriv = REJECT,
3347 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3350 "multiple registers share map_lookup_elem result",
3352 BPF_MOV64_IMM(BPF_REG_1, 10),
3353 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3354 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3355 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3356 BPF_LD_MAP_FD(BPF_REG_1, 0),
3357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3358 BPF_FUNC_map_lookup_elem),
3359 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3360 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3361 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3364 .fixup_map1 = { 4 },
3366 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3369 "alu ops on ptr_to_map_value_or_null, 1",
3371 BPF_MOV64_IMM(BPF_REG_1, 10),
3372 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3373 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3375 BPF_LD_MAP_FD(BPF_REG_1, 0),
3376 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3377 BPF_FUNC_map_lookup_elem),
3378 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3379 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
3380 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
3381 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3382 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3385 .fixup_map1 = { 4 },
3386 .errstr = "R4 invalid mem access",
3388 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3391 "alu ops on ptr_to_map_value_or_null, 2",
3393 BPF_MOV64_IMM(BPF_REG_1, 10),
3394 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3395 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3396 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3397 BPF_LD_MAP_FD(BPF_REG_1, 0),
3398 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3399 BPF_FUNC_map_lookup_elem),
3400 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3401 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
3402 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3403 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3406 .fixup_map1 = { 4 },
3407 .errstr = "R4 invalid mem access",
3409 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3412 "alu ops on ptr_to_map_value_or_null, 3",
3414 BPF_MOV64_IMM(BPF_REG_1, 10),
3415 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3416 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3417 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3418 BPF_LD_MAP_FD(BPF_REG_1, 0),
3419 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3420 BPF_FUNC_map_lookup_elem),
3421 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3422 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
3423 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3424 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3427 .fixup_map1 = { 4 },
3428 .errstr = "R4 invalid mem access",
3430 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3433 "invalid memory access with multiple map_lookup_elem calls",
3435 BPF_MOV64_IMM(BPF_REG_1, 10),
3436 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3437 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3438 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3439 BPF_LD_MAP_FD(BPF_REG_1, 0),
3440 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3441 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3442 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3443 BPF_FUNC_map_lookup_elem),
3444 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3445 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3446 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3447 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3448 BPF_FUNC_map_lookup_elem),
3449 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3450 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3453 .fixup_map1 = { 4 },
3455 .errstr = "R4 !read_ok",
3456 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3459 "valid indirect map_lookup_elem access with 2nd lookup in branch",
3461 BPF_MOV64_IMM(BPF_REG_1, 10),
3462 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3463 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3464 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3465 BPF_LD_MAP_FD(BPF_REG_1, 0),
3466 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3467 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3468 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3469 BPF_FUNC_map_lookup_elem),
3470 BPF_MOV64_IMM(BPF_REG_2, 10),
3471 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
3472 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3473 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3474 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3475 BPF_FUNC_map_lookup_elem),
3476 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3477 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3478 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3481 .fixup_map1 = { 4 },
3483 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3486 "multiple registers share map_lookup_elem bad reg type",
3488 BPF_MOV64_IMM(BPF_REG_1, 10),
3489 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3490 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3491 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3492 BPF_LD_MAP_FD(BPF_REG_1, 0),
3493 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3494 BPF_FUNC_map_lookup_elem),
3495 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
3496 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
3497 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3498 BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3499 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3500 BPF_MOV64_IMM(BPF_REG_1, 1),
3501 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3502 BPF_MOV64_IMM(BPF_REG_1, 2),
3503 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
3504 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
3505 BPF_MOV64_IMM(BPF_REG_1, 3),
3508 .fixup_map1 = { 4 },
3510 .errstr = "R3 invalid mem access 'inv'",
3511 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3514 "invalid map access from else condition",
3516 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3517 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3518 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3519 BPF_LD_MAP_FD(BPF_REG_1, 0),
3520 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
3521 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3522 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3523 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
3524 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
3525 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3526 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3527 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
3530 .fixup_map2 = { 3 },
3531 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
3533 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3534 .result_unpriv = REJECT,
3535 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3538 "constant register |= constant should keep constant type",
3540 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3541 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3542 BPF_MOV64_IMM(BPF_REG_2, 34),
3543 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
3544 BPF_MOV64_IMM(BPF_REG_3, 0),
3545 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3549 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3552 "constant register |= constant should not bypass stack boundary checks",
3554 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3555 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3556 BPF_MOV64_IMM(BPF_REG_2, 34),
3557 BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
3558 BPF_MOV64_IMM(BPF_REG_3, 0),
3559 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3562 .errstr = "invalid stack type R1 off=-48 access_size=58",
3564 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3567 "constant register |= constant register should keep constant type",
3569 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3570 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3571 BPF_MOV64_IMM(BPF_REG_2, 34),
3572 BPF_MOV64_IMM(BPF_REG_4, 13),
3573 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3574 BPF_MOV64_IMM(BPF_REG_3, 0),
3575 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3579 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3582 "constant register |= constant register should not bypass stack boundary checks",
3584 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3585 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3586 BPF_MOV64_IMM(BPF_REG_2, 34),
3587 BPF_MOV64_IMM(BPF_REG_4, 24),
3588 BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3589 BPF_MOV64_IMM(BPF_REG_3, 0),
3590 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3593 .errstr = "invalid stack type R1 off=-48 access_size=58",
3595 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3598 "invalid direct packet write for LWT_IN",
3600 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3601 offsetof(struct __sk_buff, data)),
3602 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3603 offsetof(struct __sk_buff, data_end)),
3604 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3605 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3606 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3607 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3608 BPF_MOV64_IMM(BPF_REG_0, 0),
3611 .errstr = "cannot write into packet",
3613 .prog_type = BPF_PROG_TYPE_LWT_IN,
3616 "invalid direct packet write for LWT_OUT",
3618 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3619 offsetof(struct __sk_buff, data)),
3620 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3621 offsetof(struct __sk_buff, data_end)),
3622 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3623 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3624 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3625 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3626 BPF_MOV64_IMM(BPF_REG_0, 0),
3629 .errstr = "cannot write into packet",
3631 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3634 "direct packet write for LWT_XMIT",
3636 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3637 offsetof(struct __sk_buff, data)),
3638 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3639 offsetof(struct __sk_buff, data_end)),
3640 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3641 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3642 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3643 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3644 BPF_MOV64_IMM(BPF_REG_0, 0),
3648 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3651 "direct packet read for LWT_IN",
3653 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3654 offsetof(struct __sk_buff, data)),
3655 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3656 offsetof(struct __sk_buff, data_end)),
3657 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3658 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3659 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3660 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3661 BPF_MOV64_IMM(BPF_REG_0, 0),
3665 .prog_type = BPF_PROG_TYPE_LWT_IN,
3668 "direct packet read for LWT_OUT",
3670 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3671 offsetof(struct __sk_buff, data)),
3672 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3673 offsetof(struct __sk_buff, data_end)),
3674 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3675 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3676 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3677 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3678 BPF_MOV64_IMM(BPF_REG_0, 0),
3682 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3685 "direct packet read for LWT_XMIT",
3687 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3688 offsetof(struct __sk_buff, data)),
3689 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3690 offsetof(struct __sk_buff, data_end)),
3691 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3692 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3693 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3694 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3695 BPF_MOV64_IMM(BPF_REG_0, 0),
3699 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3702 "overlapping checks for direct packet access",
3704 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3705 offsetof(struct __sk_buff, data)),
3706 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3707 offsetof(struct __sk_buff, data_end)),
3708 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3709 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3710 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
3711 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3712 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
3713 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
3714 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
3715 BPF_MOV64_IMM(BPF_REG_0, 0),
3719 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3722 "invalid access of tc_classid for LWT_IN",
3724 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3725 offsetof(struct __sk_buff, tc_classid)),
3729 .errstr = "invalid bpf_context access",
3732 "invalid access of tc_classid for LWT_OUT",
3734 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3735 offsetof(struct __sk_buff, tc_classid)),
3739 .errstr = "invalid bpf_context access",
3742 "invalid access of tc_classid for LWT_XMIT",
3744 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3745 offsetof(struct __sk_buff, tc_classid)),
3749 .errstr = "invalid bpf_context access",
3752 "helper access to map: full range",
3754 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3755 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3756 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3757 BPF_LD_MAP_FD(BPF_REG_1, 0),
3758 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3759 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3760 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3761 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
3762 BPF_MOV64_IMM(BPF_REG_3, 0),
3763 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3766 .fixup_map2 = { 3 },
3768 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3771 "helper access to map: partial range",
3773 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3774 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3775 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3776 BPF_LD_MAP_FD(BPF_REG_1, 0),
3777 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3778 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3779 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3780 BPF_MOV64_IMM(BPF_REG_2, 8),
3781 BPF_MOV64_IMM(BPF_REG_3, 0),
3782 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3785 .fixup_map2 = { 3 },
3787 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3790 "helper access to map: empty range",
3792 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3793 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3794 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3795 BPF_LD_MAP_FD(BPF_REG_1, 0),
3796 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3797 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3798 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3799 BPF_MOV64_IMM(BPF_REG_2, 0),
3800 BPF_MOV64_IMM(BPF_REG_3, 0),
3801 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3804 .fixup_map2 = { 3 },
3805 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
3807 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3810 "helper access to map: out-of-bound range",
3812 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3814 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3815 BPF_LD_MAP_FD(BPF_REG_1, 0),
3816 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3817 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3818 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3819 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
3820 BPF_MOV64_IMM(BPF_REG_3, 0),
3821 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3824 .fixup_map2 = { 3 },
3825 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
3827 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3830 "helper access to map: negative range",
3832 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3833 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3834 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3835 BPF_LD_MAP_FD(BPF_REG_1, 0),
3836 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3837 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3838 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3839 BPF_MOV64_IMM(BPF_REG_2, -8),
3840 BPF_MOV64_IMM(BPF_REG_3, 0),
3841 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3844 .fixup_map2 = { 3 },
3845 .errstr = "invalid access to map value, value_size=48 off=0 size=-8",
3847 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3850 "helper access to adjusted map (via const imm): full range",
3852 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3853 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3854 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3855 BPF_LD_MAP_FD(BPF_REG_1, 0),
3856 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3857 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3858 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3859 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3860 offsetof(struct test_val, foo)),
3861 BPF_MOV64_IMM(BPF_REG_2,
3862 sizeof(struct test_val) -
3863 offsetof(struct test_val, foo)),
3864 BPF_MOV64_IMM(BPF_REG_3, 0),
3865 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3868 .fixup_map2 = { 3 },
3870 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3873 "helper access to adjusted map (via const imm): partial range",
3875 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3876 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3877 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3878 BPF_LD_MAP_FD(BPF_REG_1, 0),
3879 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3880 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3881 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3882 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3883 offsetof(struct test_val, foo)),
3884 BPF_MOV64_IMM(BPF_REG_2, 8),
3885 BPF_MOV64_IMM(BPF_REG_3, 0),
3886 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3889 .fixup_map2 = { 3 },
3891 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3894 "helper access to adjusted map (via const imm): empty range",
3896 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3897 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3898 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3899 BPF_LD_MAP_FD(BPF_REG_1, 0),
3900 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3901 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3902 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3903 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3904 offsetof(struct test_val, foo)),
3905 BPF_MOV64_IMM(BPF_REG_2, 0),
3906 BPF_MOV64_IMM(BPF_REG_3, 0),
3907 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3910 .fixup_map2 = { 3 },
3911 .errstr = "R1 min value is outside of the array range",
3913 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3916 "helper access to adjusted map (via const imm): out-of-bound range",
3918 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3919 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3920 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3921 BPF_LD_MAP_FD(BPF_REG_1, 0),
3922 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3923 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3924 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3925 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3926 offsetof(struct test_val, foo)),
3927 BPF_MOV64_IMM(BPF_REG_2,
3928 sizeof(struct test_val) -
3929 offsetof(struct test_val, foo) + 8),
3930 BPF_MOV64_IMM(BPF_REG_3, 0),
3931 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3934 .fixup_map2 = { 3 },
3935 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3937 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3940 "helper access to adjusted map (via const imm): negative range (> adjustment)",
3942 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3943 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3944 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3945 BPF_LD_MAP_FD(BPF_REG_1, 0),
3946 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3947 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3948 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3949 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3950 offsetof(struct test_val, foo)),
3951 BPF_MOV64_IMM(BPF_REG_2, -8),
3952 BPF_MOV64_IMM(BPF_REG_3, 0),
3953 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3956 .fixup_map2 = { 3 },
3957 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
3959 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3962 "helper access to adjusted map (via const imm): negative range (< adjustment)",
3964 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3965 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3966 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3967 BPF_LD_MAP_FD(BPF_REG_1, 0),
3968 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3969 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3970 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3971 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3972 offsetof(struct test_val, foo)),
3973 BPF_MOV64_IMM(BPF_REG_2, -1),
3974 BPF_MOV64_IMM(BPF_REG_3, 0),
3975 BPF_EMIT_CALL(BPF_FUNC_probe_read),
3978 .fixup_map2 = { 3 },
3979 .errstr = "R1 min value is outside of the array range",
3981 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3984 "helper access to adjusted map (via const reg): full range",
3986 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3987 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3988 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3989 BPF_LD_MAP_FD(BPF_REG_1, 0),
3990 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3991 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3992 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3993 BPF_MOV64_IMM(BPF_REG_3,
3994 offsetof(struct test_val, foo)),
3995 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3996 BPF_MOV64_IMM(BPF_REG_2,
3997 sizeof(struct test_val) -
3998 offsetof(struct test_val, foo)),
3999 BPF_MOV64_IMM(BPF_REG_3, 0),
4000 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4003 .fixup_map2 = { 3 },
4005 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4008 "helper access to adjusted map (via const reg): partial range",
4010 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4011 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4012 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4013 BPF_LD_MAP_FD(BPF_REG_1, 0),
4014 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4015 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4016 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4017 BPF_MOV64_IMM(BPF_REG_3,
4018 offsetof(struct test_val, foo)),
4019 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4020 BPF_MOV64_IMM(BPF_REG_2, 8),
4021 BPF_MOV64_IMM(BPF_REG_3, 0),
4022 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4025 .fixup_map2 = { 3 },
4027 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4030 "helper access to adjusted map (via const reg): empty range",
4032 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4033 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4034 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4035 BPF_LD_MAP_FD(BPF_REG_1, 0),
4036 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4037 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4038 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4039 BPF_MOV64_IMM(BPF_REG_3, 0),
4040 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4041 BPF_MOV64_IMM(BPF_REG_2, 0),
4042 BPF_MOV64_IMM(BPF_REG_3, 0),
4043 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4046 .fixup_map2 = { 3 },
4047 .errstr = "R1 min value is outside of the array range",
4049 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4052 "helper access to adjusted map (via const reg): out-of-bound range",
4054 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4055 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4056 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4057 BPF_LD_MAP_FD(BPF_REG_1, 0),
4058 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4059 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4060 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4061 BPF_MOV64_IMM(BPF_REG_3,
4062 offsetof(struct test_val, foo)),
4063 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4064 BPF_MOV64_IMM(BPF_REG_2,
4065 sizeof(struct test_val) -
4066 offsetof(struct test_val, foo) + 8),
4067 BPF_MOV64_IMM(BPF_REG_3, 0),
4068 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4071 .fixup_map2 = { 3 },
4072 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4074 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4077 "helper access to adjusted map (via const reg): negative range (> adjustment)",
4079 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4080 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4081 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4082 BPF_LD_MAP_FD(BPF_REG_1, 0),
4083 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4084 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4085 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4086 BPF_MOV64_IMM(BPF_REG_3,
4087 offsetof(struct test_val, foo)),
4088 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4089 BPF_MOV64_IMM(BPF_REG_2, -8),
4090 BPF_MOV64_IMM(BPF_REG_3, 0),
4091 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4094 .fixup_map2 = { 3 },
4095 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
4097 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4100 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4102 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4103 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4104 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4105 BPF_LD_MAP_FD(BPF_REG_1, 0),
4106 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4107 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4108 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4109 BPF_MOV64_IMM(BPF_REG_3,
4110 offsetof(struct test_val, foo)),
4111 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4112 BPF_MOV64_IMM(BPF_REG_2, -1),
4113 BPF_MOV64_IMM(BPF_REG_3, 0),
4114 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4117 .fixup_map2 = { 3 },
4118 .errstr = "R1 min value is outside of the array range",
4120 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4123 "helper access to adjusted map (via variable): full range",
4125 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4126 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4127 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4128 BPF_LD_MAP_FD(BPF_REG_1, 0),
4129 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4130 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4131 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4132 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4133 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4134 offsetof(struct test_val, foo), 4),
4135 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4136 BPF_MOV64_IMM(BPF_REG_2,
4137 sizeof(struct test_val) -
4138 offsetof(struct test_val, foo)),
4139 BPF_MOV64_IMM(BPF_REG_3, 0),
4140 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4143 .fixup_map2 = { 3 },
4145 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4148 "helper access to adjusted map (via variable): partial range",
4150 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4151 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4152 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4153 BPF_LD_MAP_FD(BPF_REG_1, 0),
4154 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4155 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4156 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4157 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4158 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4159 offsetof(struct test_val, foo), 4),
4160 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4161 BPF_MOV64_IMM(BPF_REG_2, 8),
4162 BPF_MOV64_IMM(BPF_REG_3, 0),
4163 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4166 .fixup_map2 = { 3 },
4168 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4171 "helper access to adjusted map (via variable): empty range",
4173 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4174 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4175 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4176 BPF_LD_MAP_FD(BPF_REG_1, 0),
4177 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4178 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4179 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4180 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4181 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4182 offsetof(struct test_val, foo), 4),
4183 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4184 BPF_MOV64_IMM(BPF_REG_2, 0),
4185 BPF_MOV64_IMM(BPF_REG_3, 0),
4186 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4189 .fixup_map2 = { 3 },
4190 .errstr = "R1 min value is outside of the array range",
4192 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4195 "helper access to adjusted map (via variable): no max check",
4197 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4198 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4199 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4200 BPF_LD_MAP_FD(BPF_REG_1, 0),
4201 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4202 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4203 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4204 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4205 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4206 BPF_MOV64_IMM(BPF_REG_2, 0),
4207 BPF_MOV64_IMM(BPF_REG_3, 0),
4208 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4211 .fixup_map2 = { 3 },
4212 .errstr = "R1 min value is negative, either use unsigned index or do a if (index >=0) check",
4214 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4217 "helper access to adjusted map (via variable): wrong max check",
4219 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4220 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4221 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4222 BPF_LD_MAP_FD(BPF_REG_1, 0),
4223 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4224 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4225 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4226 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4227 BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4228 offsetof(struct test_val, foo), 4),
4229 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4230 BPF_MOV64_IMM(BPF_REG_2,
4231 sizeof(struct test_val) -
4232 offsetof(struct test_val, foo) + 1),
4233 BPF_MOV64_IMM(BPF_REG_3, 0),
4234 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4237 .fixup_map2 = { 3 },
4238 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
4240 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4243 "map element value is preserved across register spilling",
4245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4247 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4248 BPF_LD_MAP_FD(BPF_REG_1, 0),
4249 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4250 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4251 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4252 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4254 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4255 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4256 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4259 .fixup_map2 = { 3 },
4260 .errstr_unpriv = "R0 leaks addr",
4262 .result_unpriv = REJECT,
4265 "map element value or null is marked on register spilling",
4267 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4268 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4269 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4270 BPF_LD_MAP_FD(BPF_REG_1, 0),
4271 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4272 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4273 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
4274 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4275 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4276 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4277 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4280 .fixup_map2 = { 3 },
4281 .errstr_unpriv = "R0 leaks addr",
4283 .result_unpriv = REJECT,
4286 "map element value store of cleared call register",
4288 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4289 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4290 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4291 BPF_LD_MAP_FD(BPF_REG_1, 0),
4292 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4293 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4294 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
4297 .fixup_map2 = { 3 },
4298 .errstr_unpriv = "R1 !read_ok",
4299 .errstr = "R1 !read_ok",
4301 .result_unpriv = REJECT,
4304 "map element value with unaligned store",
4306 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4307 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4308 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4309 BPF_LD_MAP_FD(BPF_REG_1, 0),
4310 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4311 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
4312 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4313 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4314 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
4315 BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
4316 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4317 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
4318 BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
4319 BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
4320 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
4321 BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
4322 BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
4323 BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
4324 BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
4325 BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
4326 BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
4327 BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
4328 BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
4331 .fixup_map2 = { 3 },
4332 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4334 .result_unpriv = REJECT,
4335 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4338 "map element value with unaligned load",
4340 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4341 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4342 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4343 BPF_LD_MAP_FD(BPF_REG_1, 0),
4344 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4345 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4346 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4347 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
4348 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4349 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4350 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
4351 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4352 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
4353 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
4354 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
4355 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4356 BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
4359 .fixup_map2 = { 3 },
4360 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4362 .result_unpriv = REJECT,
4363 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4366 "map element value illegal alu op, 1",
4368 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4369 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4370 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4371 BPF_LD_MAP_FD(BPF_REG_1, 0),
4372 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4373 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4374 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
4375 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4378 .fixup_map2 = { 3 },
4379 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4380 .errstr = "invalid mem access 'inv'",
4382 .result_unpriv = REJECT,
4385 "map element value illegal alu op, 2",
4387 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4388 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4389 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4390 BPF_LD_MAP_FD(BPF_REG_1, 0),
4391 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4392 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4393 BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
4394 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4397 .fixup_map2 = { 3 },
4398 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4399 .errstr = "invalid mem access 'inv'",
4401 .result_unpriv = REJECT,
4404 "map element value illegal alu op, 3",
4406 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4407 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4408 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4409 BPF_LD_MAP_FD(BPF_REG_1, 0),
4410 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4411 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4412 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
4413 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4416 .fixup_map2 = { 3 },
4417 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4418 .errstr = "invalid mem access 'inv'",
4420 .result_unpriv = REJECT,
4423 "map element value illegal alu op, 4",
4425 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4426 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4427 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4428 BPF_LD_MAP_FD(BPF_REG_1, 0),
4429 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4430 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4431 BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
4432 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4435 .fixup_map2 = { 3 },
4436 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4437 .errstr = "invalid mem access 'inv'",
4439 .result_unpriv = REJECT,
4442 "map element value illegal alu op, 5",
4444 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4445 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4446 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4447 BPF_LD_MAP_FD(BPF_REG_1, 0),
4448 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4449 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4450 BPF_MOV64_IMM(BPF_REG_3, 4096),
4451 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4452 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4453 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
4454 BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
4455 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
4456 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4459 .fixup_map2 = { 3 },
4460 .errstr_unpriv = "R0 invalid mem access 'inv'",
4461 .errstr = "R0 invalid mem access 'inv'",
4463 .result_unpriv = REJECT,
4466 "map element value is preserved across register spilling",
4468 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4469 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4470 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4471 BPF_LD_MAP_FD(BPF_REG_1, 0),
4472 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4473 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4474 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
4475 offsetof(struct test_val, foo)),
4476 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4477 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4478 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4479 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4480 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4481 BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4484 .fixup_map2 = { 3 },
4485 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4487 .result_unpriv = REJECT,
4488 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4491 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
4493 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4494 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4495 BPF_MOV64_IMM(BPF_REG_0, 0),
4496 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4497 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4498 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4499 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4500 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4501 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4502 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4503 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4504 BPF_MOV64_IMM(BPF_REG_2, 16),
4505 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4506 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4507 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4508 BPF_MOV64_IMM(BPF_REG_4, 0),
4509 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4510 BPF_MOV64_IMM(BPF_REG_3, 0),
4511 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4512 BPF_MOV64_IMM(BPF_REG_0, 0),
4516 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4519 "helper access to variable memory: stack, bitwise AND, zero included",
4521 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4522 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4523 BPF_MOV64_IMM(BPF_REG_2, 16),
4524 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4525 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4526 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4527 BPF_MOV64_IMM(BPF_REG_3, 0),
4528 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4531 .errstr = "invalid stack type R1 off=-64 access_size=0",
4533 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4536 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
4538 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4539 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4540 BPF_MOV64_IMM(BPF_REG_2, 16),
4541 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4542 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4543 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
4544 BPF_MOV64_IMM(BPF_REG_4, 0),
4545 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4546 BPF_MOV64_IMM(BPF_REG_3, 0),
4547 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4548 BPF_MOV64_IMM(BPF_REG_0, 0),
4551 .errstr = "invalid stack type R1 off=-64 access_size=65",
4553 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4556 "helper access to variable memory: stack, JMP, correct bounds",
4558 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4559 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4560 BPF_MOV64_IMM(BPF_REG_0, 0),
4561 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4562 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4563 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4564 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4565 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4566 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4567 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4568 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4569 BPF_MOV64_IMM(BPF_REG_2, 16),
4570 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4571 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4572 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
4573 BPF_MOV64_IMM(BPF_REG_4, 0),
4574 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4575 BPF_MOV64_IMM(BPF_REG_3, 0),
4576 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4577 BPF_MOV64_IMM(BPF_REG_0, 0),
4581 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4584 "helper access to variable memory: stack, JMP (signed), correct bounds",
4586 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4587 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4588 BPF_MOV64_IMM(BPF_REG_0, 0),
4589 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4590 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4591 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4592 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4593 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4594 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4595 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4596 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4597 BPF_MOV64_IMM(BPF_REG_2, 16),
4598 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4599 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4600 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
4601 BPF_MOV64_IMM(BPF_REG_4, 0),
4602 BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
4603 BPF_MOV64_IMM(BPF_REG_3, 0),
4604 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4605 BPF_MOV64_IMM(BPF_REG_0, 0),
4609 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4612 "helper access to variable memory: stack, JMP, bounds + offset",
4614 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4615 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4616 BPF_MOV64_IMM(BPF_REG_2, 16),
4617 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4618 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4619 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
4620 BPF_MOV64_IMM(BPF_REG_4, 0),
4621 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
4622 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4623 BPF_MOV64_IMM(BPF_REG_3, 0),
4624 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4625 BPF_MOV64_IMM(BPF_REG_0, 0),
4628 .errstr = "invalid stack type R1 off=-64 access_size=65",
4630 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4633 "helper access to variable memory: stack, JMP, wrong max",
4635 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4636 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4637 BPF_MOV64_IMM(BPF_REG_2, 16),
4638 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4639 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4640 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
4641 BPF_MOV64_IMM(BPF_REG_4, 0),
4642 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4643 BPF_MOV64_IMM(BPF_REG_3, 0),
4644 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4645 BPF_MOV64_IMM(BPF_REG_0, 0),
4648 .errstr = "invalid stack type R1 off=-64 access_size=65",
4650 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4653 "helper access to variable memory: stack, JMP, no max check",
4655 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4656 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4657 BPF_MOV64_IMM(BPF_REG_2, 16),
4658 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4659 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4660 BPF_MOV64_IMM(BPF_REG_4, 0),
4661 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4662 BPF_MOV64_IMM(BPF_REG_3, 0),
4663 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4664 BPF_MOV64_IMM(BPF_REG_0, 0),
4667 .errstr = "R2 unbounded memory access",
4669 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4672 "helper access to variable memory: stack, JMP, no min check",
4674 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4675 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4676 BPF_MOV64_IMM(BPF_REG_2, 16),
4677 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4678 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4679 BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
4680 BPF_MOV64_IMM(BPF_REG_3, 0),
4681 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4682 BPF_MOV64_IMM(BPF_REG_0, 0),
4685 .errstr = "invalid stack type R1 off=-64 access_size=0",
4687 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4690 "helper access to variable memory: stack, JMP (signed), no min check",
4692 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4693 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4694 BPF_MOV64_IMM(BPF_REG_2, 16),
4695 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4696 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4697 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
4698 BPF_MOV64_IMM(BPF_REG_3, 0),
4699 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4700 BPF_MOV64_IMM(BPF_REG_0, 0),
4703 .errstr = "R2 min value is negative",
4705 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4708 "helper access to variable memory: map, JMP, correct bounds",
4710 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4711 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4712 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4713 BPF_LD_MAP_FD(BPF_REG_1, 0),
4714 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4715 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4716 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4717 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4718 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4719 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4720 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4721 sizeof(struct test_val), 4),
4722 BPF_MOV64_IMM(BPF_REG_4, 0),
4723 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4724 BPF_MOV64_IMM(BPF_REG_3, 0),
4725 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4726 BPF_MOV64_IMM(BPF_REG_0, 0),
4729 .fixup_map2 = { 3 },
4731 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4734 "helper access to variable memory: map, JMP, wrong max",
4736 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4737 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4738 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4739 BPF_LD_MAP_FD(BPF_REG_1, 0),
4740 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4741 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4742 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4743 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4744 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4745 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4746 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4747 sizeof(struct test_val) + 1, 4),
4748 BPF_MOV64_IMM(BPF_REG_4, 0),
4749 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4750 BPF_MOV64_IMM(BPF_REG_3, 0),
4751 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4752 BPF_MOV64_IMM(BPF_REG_0, 0),
4755 .fixup_map2 = { 3 },
4756 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
4758 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4761 "helper access to variable memory: map adjusted, JMP, correct bounds",
4763 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4764 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4765 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4766 BPF_LD_MAP_FD(BPF_REG_1, 0),
4767 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4768 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4769 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4771 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4772 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4773 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4774 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4775 sizeof(struct test_val) - 20, 4),
4776 BPF_MOV64_IMM(BPF_REG_4, 0),
4777 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4778 BPF_MOV64_IMM(BPF_REG_3, 0),
4779 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4780 BPF_MOV64_IMM(BPF_REG_0, 0),
4783 .fixup_map2 = { 3 },
4785 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4788 "helper access to variable memory: map adjusted, JMP, wrong max",
4790 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4791 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4792 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4793 BPF_LD_MAP_FD(BPF_REG_1, 0),
4794 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4795 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4796 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4797 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4798 BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4799 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4800 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4801 BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4802 sizeof(struct test_val) - 19, 4),
4803 BPF_MOV64_IMM(BPF_REG_4, 0),
4804 BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4805 BPF_MOV64_IMM(BPF_REG_3, 0),
4806 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4807 BPF_MOV64_IMM(BPF_REG_0, 0),
4810 .fixup_map2 = { 3 },
4811 .errstr = "R1 min value is outside of the array range",
4813 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4816 "helper access to variable memory: size > 0 not allowed on NULL",
4818 BPF_MOV64_IMM(BPF_REG_1, 0),
4819 BPF_MOV64_IMM(BPF_REG_2, 0),
4820 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4821 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4822 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4823 BPF_MOV64_IMM(BPF_REG_3, 0),
4824 BPF_MOV64_IMM(BPF_REG_4, 0),
4825 BPF_MOV64_IMM(BPF_REG_5, 0),
4826 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4829 .errstr = "R1 type=imm expected=fp",
4831 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4834 "helper access to variable memory: size = 0 not allowed on != NULL",
4836 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4837 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
4838 BPF_MOV64_IMM(BPF_REG_2, 0),
4839 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
4840 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
4841 BPF_MOV64_IMM(BPF_REG_3, 0),
4842 BPF_MOV64_IMM(BPF_REG_4, 0),
4843 BPF_MOV64_IMM(BPF_REG_5, 0),
4844 BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4847 .errstr = "invalid stack type R1 off=-8 access_size=0",
4849 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4852 "helper access to variable memory: 8 bytes leak",
4854 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4855 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4856 BPF_MOV64_IMM(BPF_REG_0, 0),
4857 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4858 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4859 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4860 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4861 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4862 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4863 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4864 BPF_MOV64_IMM(BPF_REG_2, 0),
4865 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4866 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4867 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
4868 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4869 BPF_MOV64_IMM(BPF_REG_3, 0),
4870 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4871 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4874 .errstr = "invalid indirect read from stack off -64+32 size 64",
4876 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4879 "helper access to variable memory: 8 bytes no leak (init memory)",
4881 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4882 BPF_MOV64_IMM(BPF_REG_0, 0),
4883 BPF_MOV64_IMM(BPF_REG_0, 0),
4884 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4885 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4886 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4887 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4888 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4889 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4890 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4891 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4892 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4893 BPF_MOV64_IMM(BPF_REG_2, 0),
4894 BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
4895 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
4896 BPF_MOV64_IMM(BPF_REG_3, 0),
4897 BPF_EMIT_CALL(BPF_FUNC_probe_read),
4898 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4902 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4905 "invalid and of negative number",
4907 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4908 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4909 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4910 BPF_LD_MAP_FD(BPF_REG_1, 0),
4911 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4912 BPF_FUNC_map_lookup_elem),
4913 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4914 BPF_MOV64_IMM(BPF_REG_1, 6),
4915 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
4916 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4917 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4918 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4919 offsetof(struct test_val, foo)),
4922 .fixup_map2 = { 3 },
4923 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4924 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4926 .result_unpriv = REJECT,
4927 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4930 "invalid range check",
4932 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4933 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4934 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4935 BPF_LD_MAP_FD(BPF_REG_1, 0),
4936 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4937 BPF_FUNC_map_lookup_elem),
4938 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
4939 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4940 BPF_MOV64_IMM(BPF_REG_9, 1),
4941 BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
4942 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
4943 BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
4944 BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
4945 BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
4946 BPF_MOV32_IMM(BPF_REG_3, 1),
4947 BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
4948 BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
4949 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
4950 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
4951 BPF_MOV64_REG(BPF_REG_0, 0),
4954 .fixup_map2 = { 3 },
4955 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4956 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4958 .result_unpriv = REJECT,
4959 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4962 "map in map access",
4964 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4965 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4966 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4967 BPF_LD_MAP_FD(BPF_REG_1, 0),
4968 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4969 BPF_FUNC_map_lookup_elem),
4970 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4971 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4972 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4973 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4974 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4975 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4976 BPF_FUNC_map_lookup_elem),
4977 BPF_MOV64_REG(BPF_REG_0, 0),
4980 .fixup_map_in_map = { 3 },
4984 "invalid inner map pointer",
4986 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4987 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4988 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4989 BPF_LD_MAP_FD(BPF_REG_1, 0),
4990 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4991 BPF_FUNC_map_lookup_elem),
4992 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4993 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4994 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4995 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4996 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4998 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4999 BPF_FUNC_map_lookup_elem),
5000 BPF_MOV64_REG(BPF_REG_0, 0),
5003 .fixup_map_in_map = { 3 },
5004 .errstr = "R1 type=inv expected=map_ptr",
5005 .errstr_unpriv = "R1 pointer arithmetic prohibited",
5009 "forgot null checking on the inner map pointer",
5011 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5012 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5013 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5014 BPF_LD_MAP_FD(BPF_REG_1, 0),
5015 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5016 BPF_FUNC_map_lookup_elem),
5017 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5018 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5019 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5020 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5021 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5022 BPF_FUNC_map_lookup_elem),
5023 BPF_MOV64_REG(BPF_REG_0, 0),
5026 .fixup_map_in_map = { 3 },
5027 .errstr = "R1 type=map_value_or_null expected=map_ptr",
5031 "ld_abs: check calling conv, r1",
5033 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5034 BPF_MOV64_IMM(BPF_REG_1, 0),
5035 BPF_LD_ABS(BPF_W, -0x200000),
5036 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5039 .errstr = "R1 !read_ok",
5043 "ld_abs: check calling conv, r2",
5045 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5046 BPF_MOV64_IMM(BPF_REG_2, 0),
5047 BPF_LD_ABS(BPF_W, -0x200000),
5048 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5051 .errstr = "R2 !read_ok",
5055 "ld_abs: check calling conv, r3",
5057 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5058 BPF_MOV64_IMM(BPF_REG_3, 0),
5059 BPF_LD_ABS(BPF_W, -0x200000),
5060 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5063 .errstr = "R3 !read_ok",
5067 "ld_abs: check calling conv, r4",
5069 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5070 BPF_MOV64_IMM(BPF_REG_4, 0),
5071 BPF_LD_ABS(BPF_W, -0x200000),
5072 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5075 .errstr = "R4 !read_ok",
5079 "ld_abs: check calling conv, r5",
5081 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5082 BPF_MOV64_IMM(BPF_REG_5, 0),
5083 BPF_LD_ABS(BPF_W, -0x200000),
5084 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
5087 .errstr = "R5 !read_ok",
5091 "ld_abs: check calling conv, r7",
5093 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5094 BPF_MOV64_IMM(BPF_REG_7, 0),
5095 BPF_LD_ABS(BPF_W, -0x200000),
5096 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
5102 "ld_ind: check calling conv, r1",
5104 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5105 BPF_MOV64_IMM(BPF_REG_1, 1),
5106 BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
5107 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5110 .errstr = "R1 !read_ok",
5114 "ld_ind: check calling conv, r2",
5116 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5117 BPF_MOV64_IMM(BPF_REG_2, 1),
5118 BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
5119 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5122 .errstr = "R2 !read_ok",
5126 "ld_ind: check calling conv, r3",
5128 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5129 BPF_MOV64_IMM(BPF_REG_3, 1),
5130 BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
5131 BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5134 .errstr = "R3 !read_ok",
5138 "ld_ind: check calling conv, r4",
5140 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5141 BPF_MOV64_IMM(BPF_REG_4, 1),
5142 BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
5143 BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5146 .errstr = "R4 !read_ok",
5150 "ld_ind: check calling conv, r5",
5152 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5153 BPF_MOV64_IMM(BPF_REG_5, 1),
5154 BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
5155 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
5158 .errstr = "R5 !read_ok",
5162 "ld_ind: check calling conv, r7",
5164 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5165 BPF_MOV64_IMM(BPF_REG_7, 1),
5166 BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
5167 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
5174 static int probe_filter_length(const struct bpf_insn *fp)
5178 for (len = MAX_INSNS - 1; len > 0; --len)
5179 if (fp[len].code != 0 || fp[len].imm != 0)
5184 static int create_map(uint32_t size_value, uint32_t max_elem)
5188 fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
5189 size_value, max_elem, BPF_F_NO_PREALLOC);
5191 printf("Failed to create hash map '%s'!\n", strerror(errno));
5196 static int create_prog_array(void)
5200 fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
5203 printf("Failed to create prog array '%s'!\n", strerror(errno));
5208 static int create_map_in_map(void)
5210 int inner_map_fd, outer_map_fd;
5212 inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
5214 if (inner_map_fd < 0) {
5215 printf("Failed to create array '%s'!\n", strerror(errno));
5216 return inner_map_fd;
5219 outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS,
5220 sizeof(int), inner_map_fd, 1, 0);
5221 if (outer_map_fd < 0)
5222 printf("Failed to create array of maps '%s'!\n",
5225 close(inner_map_fd);
5227 return outer_map_fd;
5230 static char bpf_vlog[32768];
5232 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
5235 int *fixup_map1 = test->fixup_map1;
5236 int *fixup_map2 = test->fixup_map2;
5237 int *fixup_prog = test->fixup_prog;
5238 int *fixup_map_in_map = test->fixup_map_in_map;
5240 /* Allocating HTs with 1 elem is fine here, since we only test
5241 * for verifier and not do a runtime lookup, so the only thing
5242 * that really matters is value size in this case.
5245 map_fds[0] = create_map(sizeof(long long), 1);
5247 prog[*fixup_map1].imm = map_fds[0];
5249 } while (*fixup_map1);
5253 map_fds[1] = create_map(sizeof(struct test_val), 1);
5255 prog[*fixup_map2].imm = map_fds[1];
5257 } while (*fixup_map2);
5261 map_fds[2] = create_prog_array();
5263 prog[*fixup_prog].imm = map_fds[2];
5265 } while (*fixup_prog);
5268 if (*fixup_map_in_map) {
5269 map_fds[3] = create_map_in_map();
5271 prog[*fixup_map_in_map].imm = map_fds[3];
5273 } while (*fixup_map_in_map);
5277 static void do_test_single(struct bpf_test *test, bool unpriv,
5278 int *passes, int *errors)
5280 int fd_prog, expected_ret, reject_from_alignment;
5281 struct bpf_insn *prog = test->insns;
5282 int prog_len = probe_filter_length(prog);
5283 int prog_type = test->prog_type;
5284 int map_fds[MAX_NR_MAPS];
5285 const char *expected_err;
5288 for (i = 0; i < MAX_NR_MAPS; i++)
5291 do_test_fixup(test, prog, map_fds);
5293 fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
5294 prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
5295 "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
5297 expected_ret = unpriv && test->result_unpriv != UNDEF ?
5298 test->result_unpriv : test->result;
5299 expected_err = unpriv && test->errstr_unpriv ?
5300 test->errstr_unpriv : test->errstr;
5302 reject_from_alignment = fd_prog < 0 &&
5303 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
5304 strstr(bpf_vlog, "Unknown alignment.");
5305 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
5306 if (reject_from_alignment) {
5307 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
5312 if (expected_ret == ACCEPT) {
5313 if (fd_prog < 0 && !reject_from_alignment) {
5314 printf("FAIL\nFailed to load prog '%s'!\n",
5320 printf("FAIL\nUnexpected success to load!\n");
5323 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
5324 printf("FAIL\nUnexpected error message!\n");
5330 printf("OK%s\n", reject_from_alignment ?
5331 " (NOTE: reject due to unknown alignment)" : "");
5334 for (i = 0; i < MAX_NR_MAPS; i++)
5340 printf("%s", bpf_vlog);
5344 static bool is_admin(void)
5347 cap_flag_value_t sysadmin = CAP_CLEAR;
5348 const cap_value_t cap_val = CAP_SYS_ADMIN;
5350 #ifdef CAP_IS_SUPPORTED
5351 if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
5352 perror("cap_get_flag");
5356 caps = cap_get_proc();
5358 perror("cap_get_proc");
5361 if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
5362 perror("cap_get_flag");
5365 return (sysadmin == CAP_SET);
5368 static int set_admin(bool admin)
5371 const cap_value_t cap_val = CAP_SYS_ADMIN;
5374 caps = cap_get_proc();
5376 perror("cap_get_proc");
5379 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
5380 admin ? CAP_SET : CAP_CLEAR)) {
5381 perror("cap_set_flag");
5384 if (cap_set_proc(caps)) {
5385 perror("cap_set_proc");
5395 static int do_test(bool unpriv, unsigned int from, unsigned int to)
5397 int i, passes = 0, errors = 0;
5399 for (i = from; i < to; i++) {
5400 struct bpf_test *test = &tests[i];
5402 /* Program types that are not supported by non-root we
5405 if (!test->prog_type) {
5408 printf("#%d/u %s ", i, test->descr);
5409 do_test_single(test, true, &passes, &errors);
5415 printf("#%d/p %s ", i, test->descr);
5416 do_test_single(test, false, &passes, &errors);
5420 printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
5421 return errors ? -errors : 0;
5424 int main(int argc, char **argv)
5426 struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
5427 struct rlimit rlim = { 1 << 20, 1 << 20 };
5428 unsigned int from = 0, to = ARRAY_SIZE(tests);
5429 bool unpriv = !is_admin();
5432 unsigned int l = atoi(argv[argc - 2]);
5433 unsigned int u = atoi(argv[argc - 1]);
5435 if (l < to && u < to) {
5439 } else if (argc == 2) {
5440 unsigned int t = atoi(argv[argc - 1]);
5448 setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
5449 return do_test(unpriv, from, to);