tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of version 2 of the GNU General Public
   8  * License as published by the Free Software Foundation.
   9  */
  10
  11 #include <endian.h>
  12 #include <asm/types.h>
  13 #include <linux/types.h>
  14 #include <stdint.h>
  15 #include <stdio.h>
  16 #include <stdlib.h>
  17 #include <unistd.h>
  18 #include <errno.h>
  19 #include <string.h>
  20 #include <stddef.h>
  21 #include <stdbool.h>
  22 #include <sched.h>
  23
  24 #include <sys/capability.h>
  25 #include <sys/resource.h>
  26
  27 #include <linux/unistd.h>
  28 #include <linux/filter.h>
  29 #include <linux/bpf_perf_event.h>
  30 #include <linux/bpf.h>
  31
  32 #include <bpf/bpf.h>
  33
  34 #ifdef HAVE_GENHDR
  35 # include "autoconf.h"
  36 #else
  37 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  38 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  39 # endif
  40 #endif
  41
  42 #include "../../../include/linux/filter.h"
  43
  44 #ifndef ARRAY_SIZE
  45 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
  46 #endif
  47
  48 #define MAX_INSNS       512
  49 #define MAX_FIXUPS      8
  50 #define MAX_NR_MAPS     4
  51
  52 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  53 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  54
  55 struct bpf_test {
  56         const char *descr;
  57         struct bpf_insn insns[MAX_INSNS];
  58         int fixup_map1[MAX_FIXUPS];
  59         int fixup_map2[MAX_FIXUPS];
  60         int fixup_prog[MAX_FIXUPS];
  61         int fixup_map_in_map[MAX_FIXUPS];
  62         const char *errstr;
  63         const char *errstr_unpriv;
  64         enum {
  65                 UNDEF,
  66                 ACCEPT,
  67                 REJECT
  68         } result, result_unpriv;
  69         enum bpf_prog_type prog_type;
  70         uint8_t flags;
  71 };
  72
  73 /* Note we want this to be 64 bit aligned so that the end of our array is
  74  * actually the end of the structure.
  75  */
  76 #define MAX_ENTRIES 11
  77
  78 struct test_val {
  79         unsigned int index;
  80         int foo[MAX_ENTRIES];
  81 };
  82
  83 static struct bpf_test tests[] = {
  84         {
  85                 "add+sub+mul",
  86                 .insns = {
  87                         BPF_MOV64_IMM(BPF_REG_1, 1),
  88                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
  89                         BPF_MOV64_IMM(BPF_REG_2, 3),
  90                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
  91                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
  92                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
  93                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
  94                         BPF_EXIT_INSN(),
  95                 },
  96                 .result = ACCEPT,
  97         },
  98         {
  99                 "unreachable",
 100                 .insns = {
 101                         BPF_EXIT_INSN(),
 102                         BPF_EXIT_INSN(),
 103                 },
 104                 .errstr = "unreachable",
 105                 .result = REJECT,
 106         },
 107         {
 108                 "unreachable2",
 109                 .insns = {
 110                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 111                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 112                         BPF_EXIT_INSN(),
 113                 },
 114                 .errstr = "unreachable",
 115                 .result = REJECT,
 116         },
 117         {
 118                 "out of range jump",
 119                 .insns = {
 120                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 121                         BPF_EXIT_INSN(),
 122                 },
 123                 .errstr = "jump out of range",
 124                 .result = REJECT,
 125         },
 126         {
 127                 "out of range jump2",
 128                 .insns = {
 129                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 130                         BPF_EXIT_INSN(),
 131                 },
 132                 .errstr = "jump out of range",
 133                 .result = REJECT,
 134         },
 135         {
 136                 "test1 ld_imm64",
 137                 .insns = {
 138                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 139                         BPF_LD_IMM64(BPF_REG_0, 0),
 140                         BPF_LD_IMM64(BPF_REG_0, 0),
 141                         BPF_LD_IMM64(BPF_REG_0, 1),
 142                         BPF_LD_IMM64(BPF_REG_0, 1),
 143                         BPF_MOV64_IMM(BPF_REG_0, 2),
 144                         BPF_EXIT_INSN(),
 145                 },
 146                 .errstr = "invalid BPF_LD_IMM insn",
 147                 .errstr_unpriv = "R1 pointer comparison",
 148                 .result = REJECT,
 149         },
 150         {
 151                 "test2 ld_imm64",
 152                 .insns = {
 153                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 154                         BPF_LD_IMM64(BPF_REG_0, 0),
 155                         BPF_LD_IMM64(BPF_REG_0, 0),
 156                         BPF_LD_IMM64(BPF_REG_0, 1),
 157                         BPF_LD_IMM64(BPF_REG_0, 1),
 158                         BPF_EXIT_INSN(),
 159                 },
 160                 .errstr = "invalid BPF_LD_IMM insn",
 161                 .errstr_unpriv = "R1 pointer comparison",
 162                 .result = REJECT,
 163         },
 164         {
 165                 "test3 ld_imm64",
 166                 .insns = {
 167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 168                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 169                         BPF_LD_IMM64(BPF_REG_0, 0),
 170                         BPF_LD_IMM64(BPF_REG_0, 0),
 171                         BPF_LD_IMM64(BPF_REG_0, 1),
 172                         BPF_LD_IMM64(BPF_REG_0, 1),
 173                         BPF_EXIT_INSN(),
 174                 },
 175                 .errstr = "invalid bpf_ld_imm64 insn",
 176                 .result = REJECT,
 177         },
 178         {
 179                 "test4 ld_imm64",
 180                 .insns = {
 181                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 182                         BPF_EXIT_INSN(),
 183                 },
 184                 .errstr = "invalid bpf_ld_imm64 insn",
 185                 .result = REJECT,
 186         },
 187         {
 188                 "test5 ld_imm64",
 189                 .insns = {
 190                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 191                 },
 192                 .errstr = "invalid bpf_ld_imm64 insn",
 193                 .result = REJECT,
 194         },
 195         {
 196                 "test6 ld_imm64",
 197                 .insns = {
 198                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 199                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 200                         BPF_EXIT_INSN(),
 201                 },
 202                 .result = ACCEPT,
 203         },
 204         {
 205                 "test7 ld_imm64",
 206                 .insns = {
 207                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 208                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 209                         BPF_EXIT_INSN(),
 210                 },
 211                 .result = ACCEPT,
 212         },
 213         {
 214                 "test8 ld_imm64",
 215                 .insns = {
 216                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 217                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 218                         BPF_EXIT_INSN(),
 219                 },
 220                 .errstr = "uses reserved fields",
 221                 .result = REJECT,
 222         },
 223         {
 224                 "test9 ld_imm64",
 225                 .insns = {
 226                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 227                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 228                         BPF_EXIT_INSN(),
 229                 },
 230                 .errstr = "invalid bpf_ld_imm64 insn",
 231                 .result = REJECT,
 232         },
 233         {
 234                 "test10 ld_imm64",
 235                 .insns = {
 236                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 237                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 238                         BPF_EXIT_INSN(),
 239                 },
 240                 .errstr = "invalid bpf_ld_imm64 insn",
 241                 .result = REJECT,
 242         },
 243         {
 244                 "test11 ld_imm64",
 245                 .insns = {
 246                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 247                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 248                         BPF_EXIT_INSN(),
 249                 },
 250                 .errstr = "invalid bpf_ld_imm64 insn",
 251                 .result = REJECT,
 252         },
 253         {
 254                 "test12 ld_imm64",
 255                 .insns = {
 256                         BPF_MOV64_IMM(BPF_REG_1, 0),
 257                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 258                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 259                         BPF_EXIT_INSN(),
 260                 },
 261                 .errstr = "not pointing to valid bpf_map",
 262                 .result = REJECT,
 263         },
 264         {
 265                 "test13 ld_imm64",
 266                 .insns = {
 267                         BPF_MOV64_IMM(BPF_REG_1, 0),
 268                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 269                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 270                         BPF_EXIT_INSN(),
 271                 },
 272                 .errstr = "invalid bpf_ld_imm64 insn",
 273                 .result = REJECT,
 274         },
 275         {
 276                 "arsh32 on imm",
 277                 .insns = {
 278                         BPF_MOV64_IMM(BPF_REG_0, 1),
 279                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 280                         BPF_EXIT_INSN(),
 281                 },
 282                 .result = REJECT,
 283                 .errstr = "BPF_ARSH not supported for 32 bit ALU",
 284         },
 285         {
 286                 "arsh32 on reg",
 287                 .insns = {
 288                         BPF_MOV64_IMM(BPF_REG_0, 1),
 289                         BPF_MOV64_IMM(BPF_REG_1, 5),
 290                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 291                         BPF_EXIT_INSN(),
 292                 },
 293                 .result = REJECT,
 294                 .errstr = "BPF_ARSH not supported for 32 bit ALU",
 295         },
 296         {
 297                 "arsh64 on imm",
 298                 .insns = {
 299                         BPF_MOV64_IMM(BPF_REG_0, 1),
 300                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 301                         BPF_EXIT_INSN(),
 302                 },
 303                 .result = ACCEPT,
 304         },
 305         {
 306                 "arsh64 on reg",
 307                 .insns = {
 308                         BPF_MOV64_IMM(BPF_REG_0, 1),
 309                         BPF_MOV64_IMM(BPF_REG_1, 5),
 310                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 311                         BPF_EXIT_INSN(),
 312                 },
 313                 .result = ACCEPT,
 314         },
 315         {
 316                 "no bpf_exit",
 317                 .insns = {
 318                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 319                 },
 320                 .errstr = "jump out of range",
 321                 .result = REJECT,
 322         },
 323         {
 324                 "loop (back-edge)",
 325                 .insns = {
 326                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 327                         BPF_EXIT_INSN(),
 328                 },
 329                 .errstr = "back-edge",
 330                 .result = REJECT,
 331         },
 332         {
 333                 "loop2 (back-edge)",
 334                 .insns = {
 335                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 336                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 337                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 338                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 339                         BPF_EXIT_INSN(),
 340                 },
 341                 .errstr = "back-edge",
 342                 .result = REJECT,
 343         },
 344         {
 345                 "conditional loop",
 346                 .insns = {
 347                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 348                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 349                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 350                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 351                         BPF_EXIT_INSN(),
 352                 },
 353                 .errstr = "back-edge",
 354                 .result = REJECT,
 355         },
 356         {
 357                 "read uninitialized register",
 358                 .insns = {
 359                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 360                         BPF_EXIT_INSN(),
 361                 },
 362                 .errstr = "R2 !read_ok",
 363                 .result = REJECT,
 364         },
 365         {
 366                 "read invalid register",
 367                 .insns = {
 368                         BPF_MOV64_REG(BPF_REG_0, -1),
 369                         BPF_EXIT_INSN(),
 370                 },
 371                 .errstr = "R15 is invalid",
 372                 .result = REJECT,
 373         },
 374         {
 375                 "program doesn't init R0 before exit",
 376                 .insns = {
 377                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 378                         BPF_EXIT_INSN(),
 379                 },
 380                 .errstr = "R0 !read_ok",
 381                 .result = REJECT,
 382         },
 383         {
 384                 "program doesn't init R0 before exit in all branches",
 385                 .insns = {
 386                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 387                         BPF_MOV64_IMM(BPF_REG_0, 1),
 388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 389                         BPF_EXIT_INSN(),
 390                 },
 391                 .errstr = "R0 !read_ok",
 392                 .errstr_unpriv = "R1 pointer comparison",
 393                 .result = REJECT,
 394         },
 395         {
 396                 "stack out of bounds",
 397                 .insns = {
 398                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 399                         BPF_EXIT_INSN(),
 400                 },
 401                 .errstr = "invalid stack",
 402                 .result = REJECT,
 403         },
 404         {
 405                 "invalid call insn1",
 406                 .insns = {
 407                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 408                         BPF_EXIT_INSN(),
 409                 },
 410                 .errstr = "BPF_CALL uses reserved",
 411                 .result = REJECT,
 412         },
 413         {
 414                 "invalid call insn2",
 415                 .insns = {
 416                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 417                         BPF_EXIT_INSN(),
 418                 },
 419                 .errstr = "BPF_CALL uses reserved",
 420                 .result = REJECT,
 421         },
 422         {
 423                 "invalid function call",
 424                 .insns = {
 425                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 426                         BPF_EXIT_INSN(),
 427                 },
 428                 .errstr = "invalid func unknown#1234567",
 429                 .result = REJECT,
 430         },
 431         {
 432                 "uninitialized stack1",
 433                 .insns = {
 434                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 435                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 436                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 437                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 438                                      BPF_FUNC_map_lookup_elem),
 439                         BPF_EXIT_INSN(),
 440                 },
 441                 .fixup_map1 = { 2 },
 442                 .errstr = "invalid indirect read from stack",
 443                 .result = REJECT,
 444         },
 445         {
 446                 "uninitialized stack2",
 447                 .insns = {
 448                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 449                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 450                         BPF_EXIT_INSN(),
 451                 },
 452                 .errstr = "invalid read from stack",
 453                 .result = REJECT,
 454         },
 455         {
 456                 "invalid fp arithmetic",
 457                 /* If this gets ever changed, make sure JITs can deal with it. */
 458                 .insns = {
 459                         BPF_MOV64_IMM(BPF_REG_0, 0),
 460                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 461                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 462                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 463                         BPF_EXIT_INSN(),
 464                 },
 465                 .errstr = "R1 subtraction from stack pointer",
 466                 .result = REJECT,
 467         },
 468         {
 469                 "non-invalid fp arithmetic",
 470                 .insns = {
 471                         BPF_MOV64_IMM(BPF_REG_0, 0),
 472                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 473                         BPF_EXIT_INSN(),
 474                 },
 475                 .result = ACCEPT,
 476         },
 477         {
 478                 "invalid argument register",
 479                 .insns = {
 480                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 481                                      BPF_FUNC_get_cgroup_classid),
 482                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 483                                      BPF_FUNC_get_cgroup_classid),
 484                         BPF_EXIT_INSN(),
 485                 },
 486                 .errstr = "R1 !read_ok",
 487                 .result = REJECT,
 488                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 489         },
 490         {
 491                 "non-invalid argument register",
 492                 .insns = {
 493                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 494                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 495                                      BPF_FUNC_get_cgroup_classid),
 496                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 497                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 498                                      BPF_FUNC_get_cgroup_classid),
 499                         BPF_EXIT_INSN(),
 500                 },
 501                 .result = ACCEPT,
 502                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 503         },
 504         {
 505                 "check valid spill/fill",
 506                 .insns = {
 507                         /* spill R1(ctx) into stack */
 508                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 509                         /* fill it back into R2 */
 510                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 511                         /* should be able to access R0 = *(R2 + 8) */
 512                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 513                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 514                         BPF_EXIT_INSN(),
 515                 },
 516                 .errstr_unpriv = "R0 leaks addr",
 517                 .result = ACCEPT,
 518                 .result_unpriv = REJECT,
 519         },
 520         {
 521                 "check valid spill/fill, skb mark",
 522                 .insns = {
 523                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 524                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 525                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 526                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 527                                     offsetof(struct __sk_buff, mark)),
 528                         BPF_EXIT_INSN(),
 529                 },
 530                 .result = ACCEPT,
 531                 .result_unpriv = ACCEPT,
 532         },
 533         {
 534                 "check corrupted spill/fill",
 535                 .insns = {
 536                         /* spill R1(ctx) into stack */
 537                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 538                         /* mess up with R1 pointer on stack */
 539                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 540                         /* fill back into R0 should fail */
 541                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 542                         BPF_EXIT_INSN(),
 543                 },
 544                 .errstr_unpriv = "attempt to corrupt spilled",
 545                 .errstr = "corrupted spill",
 546                 .result = REJECT,
 547         },
 548         {
 549                 "invalid src register in STX",
 550                 .insns = {
 551                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 552                         BPF_EXIT_INSN(),
 553                 },
 554                 .errstr = "R15 is invalid",
 555                 .result = REJECT,
 556         },
 557         {
 558                 "invalid dst register in STX",
 559                 .insns = {
 560                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 561                         BPF_EXIT_INSN(),
 562                 },
 563                 .errstr = "R14 is invalid",
 564                 .result = REJECT,
 565         },
 566         {
 567                 "invalid dst register in ST",
 568                 .insns = {
 569                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 570                         BPF_EXIT_INSN(),
 571                 },
 572                 .errstr = "R14 is invalid",
 573                 .result = REJECT,
 574         },
 575         {
 576                 "invalid src register in LDX",
 577                 .insns = {
 578                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
 579                         BPF_EXIT_INSN(),
 580                 },
 581                 .errstr = "R12 is invalid",
 582                 .result = REJECT,
 583         },
 584         {
 585                 "invalid dst register in LDX",
 586                 .insns = {
 587                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
 588                         BPF_EXIT_INSN(),
 589                 },
 590                 .errstr = "R11 is invalid",
 591                 .result = REJECT,
 592         },
 593         {
 594                 "junk insn",
 595                 .insns = {
 596                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 597                         BPF_EXIT_INSN(),
 598                 },
 599                 .errstr = "invalid BPF_LD_IMM",
 600                 .result = REJECT,
 601         },
 602         {
 603                 "junk insn2",
 604                 .insns = {
 605                         BPF_RAW_INSN(1, 0, 0, 0, 0),
 606                         BPF_EXIT_INSN(),
 607                 },
 608                 .errstr = "BPF_LDX uses reserved fields",
 609                 .result = REJECT,
 610         },
 611         {
 612                 "junk insn3",
 613                 .insns = {
 614                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
 615                         BPF_EXIT_INSN(),
 616                 },
 617                 .errstr = "invalid BPF_ALU opcode f0",
 618                 .result = REJECT,
 619         },
 620         {
 621                 "junk insn4",
 622                 .insns = {
 623                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
 624                         BPF_EXIT_INSN(),
 625                 },
 626                 .errstr = "invalid BPF_ALU opcode f0",
 627                 .result = REJECT,
 628         },
 629         {
 630                 "junk insn5",
 631                 .insns = {
 632                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
 633                         BPF_EXIT_INSN(),
 634                 },
 635                 .errstr = "BPF_ALU uses reserved fields",
 636                 .result = REJECT,
 637         },
 638         {
 639                 "misaligned read from stack",
 640                 .insns = {
 641                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 642                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
 643                         BPF_EXIT_INSN(),
 644                 },
 645                 .errstr = "misaligned stack access",
 646                 .result = REJECT,
 647         },
 648         {
 649                 "invalid map_fd for function call",
 650                 .insns = {
 651                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 652                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
 653                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 654                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 655                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 656                                      BPF_FUNC_map_delete_elem),
 657                         BPF_EXIT_INSN(),
 658                 },
 659                 .errstr = "fd 0 is not pointing to valid bpf_map",
 660                 .result = REJECT,
 661         },
 662         {
 663                 "don't check return value before access",
 664                 .insns = {
 665                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 666                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 667                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 668                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 670                                      BPF_FUNC_map_lookup_elem),
 671                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
 672                         BPF_EXIT_INSN(),
 673                 },
 674                 .fixup_map1 = { 3 },
 675                 .errstr = "R0 invalid mem access 'map_value_or_null'",
 676                 .result = REJECT,
 677         },
 678         {
 679                 "access memory with incorrect alignment",
 680                 .insns = {
 681                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 682                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 683                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 684                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 685                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 686                                      BPF_FUNC_map_lookup_elem),
 687                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
 688                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
 689                         BPF_EXIT_INSN(),
 690                 },
 691                 .fixup_map1 = { 3 },
 692                 .errstr = "misaligned value access",
 693                 .result = REJECT,
 694                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
 695         },
 696         {
 697                 "sometimes access memory with incorrect alignment",
 698                 .insns = {
 699                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 700                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 701                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 702                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 703                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 704                                      BPF_FUNC_map_lookup_elem),
 705                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
 706                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
 707                         BPF_EXIT_INSN(),
 708                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
 709                         BPF_EXIT_INSN(),
 710                 },
 711                 .fixup_map1 = { 3 },
 712                 .errstr = "R0 invalid mem access",
 713                 .errstr_unpriv = "R0 leaks addr",
 714                 .result = REJECT,
 715                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
 716         },
 717         {
 718                 "jump test 1",
 719                 .insns = {
 720                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 721                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
 722                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 723                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 724                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
 725                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
 726                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
 727                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
 728                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
 729                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
 730                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
 731                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
 732                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
 733                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
 734                         BPF_MOV64_IMM(BPF_REG_0, 0),
 735                         BPF_EXIT_INSN(),
 736                 },
 737                 .errstr_unpriv = "R1 pointer comparison",
 738                 .result_unpriv = REJECT,
 739                 .result = ACCEPT,
 740         },
 741         {
 742                 "jump test 2",
 743                 .insns = {
 744                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 745                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
 746                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 747                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
 748                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
 749                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
 750                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
 751                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
 752                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
 753                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
 754                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
 755                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
 756                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
 757                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
 758                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
 759                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 760                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
 761                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
 762                         BPF_MOV64_IMM(BPF_REG_0, 0),
 763                         BPF_EXIT_INSN(),
 764                 },
 765                 .errstr_unpriv = "R1 pointer comparison",
 766                 .result_unpriv = REJECT,
 767                 .result = ACCEPT,
 768         },
 769         {
 770                 "jump test 3",
 771                 .insns = {
 772                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 773                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
 774                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 775                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 776                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
 777                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
 778                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
 779                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
 780                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
 781                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
 782                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
 783                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
 784                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
 785                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
 786                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
 787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
 788                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
 789                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
 790                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
 791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
 792                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
 793                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
 794                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
 795                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
 796                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 797                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 798                                      BPF_FUNC_map_delete_elem),
 799                         BPF_EXIT_INSN(),
 800                 },
 801                 .fixup_map1 = { 24 },
 802                 .errstr_unpriv = "R1 pointer comparison",
 803                 .result_unpriv = REJECT,
 804                 .result = ACCEPT,
 805         },
 806         {
 807                 "jump test 4",
 808                 .insns = {
 809                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 810                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 811                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 812                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 813                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 814                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 815                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 816                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 817                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 818                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 820                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 821                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 822                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 823                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 824                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 825                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 826                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 827                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 828                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 829                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 830                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 831                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 832                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 833                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 834                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 835                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 836                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 837                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 838                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 839                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 840                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 841                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 842                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 843                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 844                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 845                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 846                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 847                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 848                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 849                         BPF_MOV64_IMM(BPF_REG_0, 0),
 850                         BPF_EXIT_INSN(),
 851                 },
 852                 .errstr_unpriv = "R1 pointer comparison",
 853                 .result_unpriv = REJECT,
 854                 .result = ACCEPT,
 855         },
 856         {
 857                 "jump test 5",
 858                 .insns = {
 859                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 860                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 861                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 862                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 863                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 864                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 865                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 866                         BPF_MOV64_IMM(BPF_REG_0, 0),
 867                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 868                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 869                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 870                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 871                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 872                         BPF_MOV64_IMM(BPF_REG_0, 0),
 873                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 874                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 875                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 876                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 877                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 878                         BPF_MOV64_IMM(BPF_REG_0, 0),
 879                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 880                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 881                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 882                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 883                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 884                         BPF_MOV64_IMM(BPF_REG_0, 0),
 885                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 886                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 887                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 888                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 889                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 890                         BPF_MOV64_IMM(BPF_REG_0, 0),
 891                         BPF_EXIT_INSN(),
 892                 },
 893                 .errstr_unpriv = "R1 pointer comparison",
 894                 .result_unpriv = REJECT,
 895                 .result = ACCEPT,
 896         },
 897         {
 898                 "access skb fields ok",
 899                 .insns = {
 900                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 901                                     offsetof(struct __sk_buff, len)),
 902                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 903                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 904                                     offsetof(struct __sk_buff, mark)),
 905                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 906                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 907                                     offsetof(struct __sk_buff, pkt_type)),
 908                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 909                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 910                                     offsetof(struct __sk_buff, queue_mapping)),
 911                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 912                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 913                                     offsetof(struct __sk_buff, protocol)),
 914                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 915                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 916                                     offsetof(struct __sk_buff, vlan_present)),
 917                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 918                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 919                                     offsetof(struct __sk_buff, vlan_tci)),
 920                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 921                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 922                                     offsetof(struct __sk_buff, napi_id)),
 923                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 924                         BPF_EXIT_INSN(),
 925                 },
 926                 .result = ACCEPT,
 927         },
 928         {
 929                 "access skb fields bad1",
 930                 .insns = {
 931                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
 932                         BPF_EXIT_INSN(),
 933                 },
 934                 .errstr = "invalid bpf_context access",
 935                 .result = REJECT,
 936         },
 937         {
 938                 "access skb fields bad2",
 939                 .insns = {
 940                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
 941                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 942                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 943                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 944                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 945                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 946                                      BPF_FUNC_map_lookup_elem),
 947                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 948                         BPF_EXIT_INSN(),
 949                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 950                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 951                                     offsetof(struct __sk_buff, pkt_type)),
 952                         BPF_EXIT_INSN(),
 953                 },
 954                 .fixup_map1 = { 4 },
 955                 .errstr = "different pointers",
 956                 .errstr_unpriv = "R1 pointer comparison",
 957                 .result = REJECT,
 958         },
 959         {
 960                 "access skb fields bad3",
 961                 .insns = {
 962                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 963                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 964                                     offsetof(struct __sk_buff, pkt_type)),
 965                         BPF_EXIT_INSN(),
 966                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 967                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 969                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 970                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 971                                      BPF_FUNC_map_lookup_elem),
 972                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 973                         BPF_EXIT_INSN(),
 974                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 975                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
 976                 },
 977                 .fixup_map1 = { 6 },
 978                 .errstr = "different pointers",
 979                 .errstr_unpriv = "R1 pointer comparison",
 980                 .result = REJECT,
 981         },
 982         {
 983                 "access skb fields bad4",
 984                 .insns = {
 985                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
 986                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
 987                                     offsetof(struct __sk_buff, len)),
 988                         BPF_MOV64_IMM(BPF_REG_0, 0),
 989                         BPF_EXIT_INSN(),
 990                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 991                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 992                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 993                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 994                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 995                                      BPF_FUNC_map_lookup_elem),
 996                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 997                         BPF_EXIT_INSN(),
 998                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 999                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1000                 },
1001                 .fixup_map1 = { 7 },
1002                 .errstr = "different pointers",
1003                 .errstr_unpriv = "R1 pointer comparison",
1004                 .result = REJECT,
1005         },
1006         {
1007                 "invalid access __sk_buff family",
1008                 .insns = {
1009                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1010                                     offsetof(struct __sk_buff, family)),
1011                         BPF_EXIT_INSN(),
1012                 },
1013                 .errstr = "invalid bpf_context access",
1014                 .result = REJECT,
1015         },
1016         {
1017                 "invalid access __sk_buff remote_ip4",
1018                 .insns = {
1019                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1020                                     offsetof(struct __sk_buff, remote_ip4)),
1021                         BPF_EXIT_INSN(),
1022                 },
1023                 .errstr = "invalid bpf_context access",
1024                 .result = REJECT,
1025         },
1026         {
1027                 "invalid access __sk_buff local_ip4",
1028                 .insns = {
1029                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1030                                     offsetof(struct __sk_buff, local_ip4)),
1031                         BPF_EXIT_INSN(),
1032                 },
1033                 .errstr = "invalid bpf_context access",
1034                 .result = REJECT,
1035         },
1036         {
1037                 "invalid access __sk_buff remote_ip6",
1038                 .insns = {
1039                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1040                                     offsetof(struct __sk_buff, remote_ip6)),
1041                         BPF_EXIT_INSN(),
1042                 },
1043                 .errstr = "invalid bpf_context access",
1044                 .result = REJECT,
1045         },
1046         {
1047                 "invalid access __sk_buff local_ip6",
1048                 .insns = {
1049                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1050                                     offsetof(struct __sk_buff, local_ip6)),
1051                         BPF_EXIT_INSN(),
1052                 },
1053                 .errstr = "invalid bpf_context access",
1054                 .result = REJECT,
1055         },
1056         {
1057                 "invalid access __sk_buff remote_port",
1058                 .insns = {
1059                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1060                                     offsetof(struct __sk_buff, remote_port)),
1061                         BPF_EXIT_INSN(),
1062                 },
1063                 .errstr = "invalid bpf_context access",
1064                 .result = REJECT,
1065         },
1066         {
1067                 "invalid access __sk_buff remote_port",
1068                 .insns = {
1069                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1070                                     offsetof(struct __sk_buff, local_port)),
1071                         BPF_EXIT_INSN(),
1072                 },
1073                 .errstr = "invalid bpf_context access",
1074                 .result = REJECT,
1075         },
1076         {
1077                 "valid access __sk_buff family",
1078                 .insns = {
1079                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1080                                     offsetof(struct __sk_buff, family)),
1081                         BPF_EXIT_INSN(),
1082                 },
1083                 .result = ACCEPT,
1084                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1085         },
1086         {
1087                 "valid access __sk_buff remote_ip4",
1088                 .insns = {
1089                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1090                                     offsetof(struct __sk_buff, remote_ip4)),
1091                         BPF_EXIT_INSN(),
1092                 },
1093                 .result = ACCEPT,
1094                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1095         },
1096         {
1097                 "valid access __sk_buff local_ip4",
1098                 .insns = {
1099                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1100                                     offsetof(struct __sk_buff, local_ip4)),
1101                         BPF_EXIT_INSN(),
1102                 },
1103                 .result = ACCEPT,
1104                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1105         },
1106         {
1107                 "valid access __sk_buff remote_ip6",
1108                 .insns = {
1109                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1110                                     offsetof(struct __sk_buff, remote_ip6[0])),
1111                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1112                                     offsetof(struct __sk_buff, remote_ip6[1])),
1113                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1114                                     offsetof(struct __sk_buff, remote_ip6[2])),
1115                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1116                                     offsetof(struct __sk_buff, remote_ip6[3])),
1117                         BPF_EXIT_INSN(),
1118                 },
1119                 .result = ACCEPT,
1120                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1121         },
1122         {
1123                 "valid access __sk_buff local_ip6",
1124                 .insns = {
1125                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1126                                     offsetof(struct __sk_buff, local_ip6[0])),
1127                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1128                                     offsetof(struct __sk_buff, local_ip6[1])),
1129                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1130                                     offsetof(struct __sk_buff, local_ip6[2])),
1131                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1132                                     offsetof(struct __sk_buff, local_ip6[3])),
1133                         BPF_EXIT_INSN(),
1134                 },
1135                 .result = ACCEPT,
1136                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1137         },
1138         {
1139                 "valid access __sk_buff remote_port",
1140                 .insns = {
1141                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1142                                     offsetof(struct __sk_buff, remote_port)),
1143                         BPF_EXIT_INSN(),
1144                 },
1145                 .result = ACCEPT,
1146                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1147         },
1148         {
1149                 "valid access __sk_buff remote_port",
1150                 .insns = {
1151                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1152                                     offsetof(struct __sk_buff, local_port)),
1153                         BPF_EXIT_INSN(),
1154                 },
1155                 .result = ACCEPT,
1156                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1157         },
1158         {
1159                 "invalid access of tc_classid for SK_SKB",
1160                 .insns = {
1161                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1162                                     offsetof(struct __sk_buff, tc_classid)),
1163                         BPF_EXIT_INSN(),
1164                 },
1165                 .result = REJECT,
1166                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1167                 .errstr = "invalid bpf_context access",
1168         },
1169         {
1170                 "invalid access of skb->mark for SK_SKB",
1171                 .insns = {
1172                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1173                                     offsetof(struct __sk_buff, mark)),
1174                         BPF_EXIT_INSN(),
1175                 },
1176                 .result =  REJECT,
1177                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1178                 .errstr = "invalid bpf_context access",
1179         },
1180         {
1181                 "check skb->mark is not writeable by SK_SKB",
1182                 .insns = {
1183                         BPF_MOV64_IMM(BPF_REG_0, 0),
1184                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1185                                     offsetof(struct __sk_buff, mark)),
1186                         BPF_EXIT_INSN(),
1187                 },
1188                 .result =  REJECT,
1189                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1190                 .errstr = "invalid bpf_context access",
1191         },
1192         {
1193                 "check skb->tc_index is writeable by SK_SKB",
1194                 .insns = {
1195                         BPF_MOV64_IMM(BPF_REG_0, 0),
1196                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1197                                     offsetof(struct __sk_buff, tc_index)),
1198                         BPF_EXIT_INSN(),
1199                 },
1200                 .result = ACCEPT,
1201                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1202         },
1203         {
1204                 "check skb->priority is writeable by SK_SKB",
1205                 .insns = {
1206                         BPF_MOV64_IMM(BPF_REG_0, 0),
1207                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1208                                     offsetof(struct __sk_buff, priority)),
1209                         BPF_EXIT_INSN(),
1210                 },
1211                 .result = ACCEPT,
1212                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1213         },
1214         {
1215                 "direct packet read for SK_SKB",
1216                 .insns = {
1217                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1218                                     offsetof(struct __sk_buff, data)),
1219                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1220                                     offsetof(struct __sk_buff, data_end)),
1221                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1223                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1224                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1225                         BPF_MOV64_IMM(BPF_REG_0, 0),
1226                         BPF_EXIT_INSN(),
1227                 },
1228                 .result = ACCEPT,
1229                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1230         },
1231         {
1232                 "direct packet write for SK_SKB",
1233                 .insns = {
1234                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1235                                     offsetof(struct __sk_buff, data)),
1236                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1237                                     offsetof(struct __sk_buff, data_end)),
1238                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1239                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1240                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1241                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1242                         BPF_MOV64_IMM(BPF_REG_0, 0),
1243                         BPF_EXIT_INSN(),
1244                 },
1245                 .result = ACCEPT,
1246                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1247         },
1248         {
1249                 "overlapping checks for direct packet access SK_SKB",
1250                 .insns = {
1251                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1252                                     offsetof(struct __sk_buff, data)),
1253                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1254                                     offsetof(struct __sk_buff, data_end)),
1255                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1256                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1257                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1258                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1259                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1260                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1261                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1262                         BPF_MOV64_IMM(BPF_REG_0, 0),
1263                         BPF_EXIT_INSN(),
1264                 },
1265                 .result = ACCEPT,
1266                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1267         },
1268         {
1269                 "check skb->mark is not writeable by sockets",
1270                 .insns = {
1271                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1272                                     offsetof(struct __sk_buff, mark)),
1273                         BPF_EXIT_INSN(),
1274                 },
1275                 .errstr = "invalid bpf_context access",
1276                 .errstr_unpriv = "R1 leaks addr",
1277                 .result = REJECT,
1278         },
1279         {
1280                 "check skb->tc_index is not writeable by sockets",
1281                 .insns = {
1282                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1283                                     offsetof(struct __sk_buff, tc_index)),
1284                         BPF_EXIT_INSN(),
1285                 },
1286                 .errstr = "invalid bpf_context access",
1287                 .errstr_unpriv = "R1 leaks addr",
1288                 .result = REJECT,
1289         },
1290         {
1291                 "check cb access: byte",
1292                 .insns = {
1293                         BPF_MOV64_IMM(BPF_REG_0, 0),
1294                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1295                                     offsetof(struct __sk_buff, cb[0])),
1296                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1297                                     offsetof(struct __sk_buff, cb[0]) + 1),
1298                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1299                                     offsetof(struct __sk_buff, cb[0]) + 2),
1300                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1301                                     offsetof(struct __sk_buff, cb[0]) + 3),
1302                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1303                                     offsetof(struct __sk_buff, cb[1])),
1304                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1305                                     offsetof(struct __sk_buff, cb[1]) + 1),
1306                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1307                                     offsetof(struct __sk_buff, cb[1]) + 2),
1308                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1309                                     offsetof(struct __sk_buff, cb[1]) + 3),
1310                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1311                                     offsetof(struct __sk_buff, cb[2])),
1312                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1313                                     offsetof(struct __sk_buff, cb[2]) + 1),
1314                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1315                                     offsetof(struct __sk_buff, cb[2]) + 2),
1316                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1317                                     offsetof(struct __sk_buff, cb[2]) + 3),
1318                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1319                                     offsetof(struct __sk_buff, cb[3])),
1320                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1321                                     offsetof(struct __sk_buff, cb[3]) + 1),
1322                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1323                                     offsetof(struct __sk_buff, cb[3]) + 2),
1324                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1325                                     offsetof(struct __sk_buff, cb[3]) + 3),
1326                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1327                                     offsetof(struct __sk_buff, cb[4])),
1328                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1329                                     offsetof(struct __sk_buff, cb[4]) + 1),
1330                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1331                                     offsetof(struct __sk_buff, cb[4]) + 2),
1332                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1333                                     offsetof(struct __sk_buff, cb[4]) + 3),
1334                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1335                                     offsetof(struct __sk_buff, cb[0])),
1336                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1337                                     offsetof(struct __sk_buff, cb[0]) + 1),
1338                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1339                                     offsetof(struct __sk_buff, cb[0]) + 2),
1340                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1341                                     offsetof(struct __sk_buff, cb[0]) + 3),
1342                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1343                                     offsetof(struct __sk_buff, cb[1])),
1344                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1345                                     offsetof(struct __sk_buff, cb[1]) + 1),
1346                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1347                                     offsetof(struct __sk_buff, cb[1]) + 2),
1348                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1349                                     offsetof(struct __sk_buff, cb[1]) + 3),
1350                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1351                                     offsetof(struct __sk_buff, cb[2])),
1352                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1353                                     offsetof(struct __sk_buff, cb[2]) + 1),
1354                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1355                                     offsetof(struct __sk_buff, cb[2]) + 2),
1356                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1357                                     offsetof(struct __sk_buff, cb[2]) + 3),
1358                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1359                                     offsetof(struct __sk_buff, cb[3])),
1360                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1361                                     offsetof(struct __sk_buff, cb[3]) + 1),
1362                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1363                                     offsetof(struct __sk_buff, cb[3]) + 2),
1364                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1365                                     offsetof(struct __sk_buff, cb[3]) + 3),
1366                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1367                                     offsetof(struct __sk_buff, cb[4])),
1368                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1369                                     offsetof(struct __sk_buff, cb[4]) + 1),
1370                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1371                                     offsetof(struct __sk_buff, cb[4]) + 2),
1372                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1373                                     offsetof(struct __sk_buff, cb[4]) + 3),
1374                         BPF_EXIT_INSN(),
1375                 },
1376                 .result = ACCEPT,
1377         },
1378         {
1379                 "__sk_buff->hash, offset 0, byte store not permitted",
1380                 .insns = {
1381                         BPF_MOV64_IMM(BPF_REG_0, 0),
1382                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1383                                     offsetof(struct __sk_buff, hash)),
1384                         BPF_EXIT_INSN(),
1385                 },
1386                 .errstr = "invalid bpf_context access",
1387                 .result = REJECT,
1388         },
1389         {
1390                 "__sk_buff->tc_index, offset 3, byte store not permitted",
1391                 .insns = {
1392                         BPF_MOV64_IMM(BPF_REG_0, 0),
1393                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1394                                     offsetof(struct __sk_buff, tc_index) + 3),
1395                         BPF_EXIT_INSN(),
1396                 },
1397                 .errstr = "invalid bpf_context access",
1398                 .result = REJECT,
1399         },
1400         {
1401                 "check skb->hash byte load permitted",
1402                 .insns = {
1403                         BPF_MOV64_IMM(BPF_REG_0, 0),
1404 #if __BYTE_ORDER == __LITTLE_ENDIAN
1405                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1406                                     offsetof(struct __sk_buff, hash)),
1407 #else
1408                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1409                                     offsetof(struct __sk_buff, hash) + 3),
1410 #endif
1411                         BPF_EXIT_INSN(),
1412                 },
1413                 .result = ACCEPT,
1414         },
1415         {
1416                 "check skb->hash byte load not permitted 1",
1417                 .insns = {
1418                         BPF_MOV64_IMM(BPF_REG_0, 0),
1419                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1420                                     offsetof(struct __sk_buff, hash) + 1),
1421                         BPF_EXIT_INSN(),
1422                 },
1423                 .errstr = "invalid bpf_context access",
1424                 .result = REJECT,
1425         },
1426         {
1427                 "check skb->hash byte load not permitted 2",
1428                 .insns = {
1429                         BPF_MOV64_IMM(BPF_REG_0, 0),
1430                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1431                                     offsetof(struct __sk_buff, hash) + 2),
1432                         BPF_EXIT_INSN(),
1433                 },
1434                 .errstr = "invalid bpf_context access",
1435                 .result = REJECT,
1436         },
1437         {
1438                 "check skb->hash byte load not permitted 3",
1439                 .insns = {
1440                         BPF_MOV64_IMM(BPF_REG_0, 0),
1441 #if __BYTE_ORDER == __LITTLE_ENDIAN
1442                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1443                                     offsetof(struct __sk_buff, hash) + 3),
1444 #else
1445                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1446                                     offsetof(struct __sk_buff, hash)),
1447 #endif
1448                         BPF_EXIT_INSN(),
1449                 },
1450                 .errstr = "invalid bpf_context access",
1451                 .result = REJECT,
1452         },
1453         {
1454                 "check cb access: byte, wrong type",
1455                 .insns = {
1456                         BPF_MOV64_IMM(BPF_REG_0, 0),
1457                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1458                                     offsetof(struct __sk_buff, cb[0])),
1459                         BPF_EXIT_INSN(),
1460                 },
1461                 .errstr = "invalid bpf_context access",
1462                 .result = REJECT,
1463                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1464         },
1465         {
1466                 "check cb access: half",
1467                 .insns = {
1468                         BPF_MOV64_IMM(BPF_REG_0, 0),
1469                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1470                                     offsetof(struct __sk_buff, cb[0])),
1471                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1472                                     offsetof(struct __sk_buff, cb[0]) + 2),
1473                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1474                                     offsetof(struct __sk_buff, cb[1])),
1475                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1476                                     offsetof(struct __sk_buff, cb[1]) + 2),
1477                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1478                                     offsetof(struct __sk_buff, cb[2])),
1479                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1480                                     offsetof(struct __sk_buff, cb[2]) + 2),
1481                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1482                                     offsetof(struct __sk_buff, cb[3])),
1483                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1484                                     offsetof(struct __sk_buff, cb[3]) + 2),
1485                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1486                                     offsetof(struct __sk_buff, cb[4])),
1487                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1488                                     offsetof(struct __sk_buff, cb[4]) + 2),
1489                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1490                                     offsetof(struct __sk_buff, cb[0])),
1491                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1492                                     offsetof(struct __sk_buff, cb[0]) + 2),
1493                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1494                                     offsetof(struct __sk_buff, cb[1])),
1495                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1496                                     offsetof(struct __sk_buff, cb[1]) + 2),
1497                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1498                                     offsetof(struct __sk_buff, cb[2])),
1499                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1500                                     offsetof(struct __sk_buff, cb[2]) + 2),
1501                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1502                                     offsetof(struct __sk_buff, cb[3])),
1503                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1504                                     offsetof(struct __sk_buff, cb[3]) + 2),
1505                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1506                                     offsetof(struct __sk_buff, cb[4])),
1507                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1508                                     offsetof(struct __sk_buff, cb[4]) + 2),
1509                         BPF_EXIT_INSN(),
1510                 },
1511                 .result = ACCEPT,
1512         },
1513         {
1514                 "check cb access: half, unaligned",
1515                 .insns = {
1516                         BPF_MOV64_IMM(BPF_REG_0, 0),
1517                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1518                                     offsetof(struct __sk_buff, cb[0]) + 1),
1519                         BPF_EXIT_INSN(),
1520                 },
1521                 .errstr = "misaligned context access",
1522                 .result = REJECT,
1523                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1524         },
1525         {
1526                 "check __sk_buff->hash, offset 0, half store not permitted",
1527                 .insns = {
1528                         BPF_MOV64_IMM(BPF_REG_0, 0),
1529                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1530                                     offsetof(struct __sk_buff, hash)),
1531                         BPF_EXIT_INSN(),
1532                 },
1533                 .errstr = "invalid bpf_context access",
1534                 .result = REJECT,
1535         },
1536         {
1537                 "check __sk_buff->tc_index, offset 2, half store not permitted",
1538                 .insns = {
1539                         BPF_MOV64_IMM(BPF_REG_0, 0),
1540                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1541                                     offsetof(struct __sk_buff, tc_index) + 2),
1542                         BPF_EXIT_INSN(),
1543                 },
1544                 .errstr = "invalid bpf_context access",
1545                 .result = REJECT,
1546         },
1547         {
1548                 "check skb->hash half load permitted",
1549                 .insns = {
1550                         BPF_MOV64_IMM(BPF_REG_0, 0),
1551 #if __BYTE_ORDER == __LITTLE_ENDIAN
1552                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1553                                     offsetof(struct __sk_buff, hash)),
1554 #else
1555                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1556                                     offsetof(struct __sk_buff, hash) + 2),
1557 #endif
1558                         BPF_EXIT_INSN(),
1559                 },
1560                 .result = ACCEPT,
1561         },
1562         {
1563                 "check skb->hash half load not permitted",
1564                 .insns = {
1565                         BPF_MOV64_IMM(BPF_REG_0, 0),
1566 #if __BYTE_ORDER == __LITTLE_ENDIAN
1567                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1568                                     offsetof(struct __sk_buff, hash) + 2),
1569 #else
1570                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1571                                     offsetof(struct __sk_buff, hash)),
1572 #endif
1573                         BPF_EXIT_INSN(),
1574                 },
1575                 .errstr = "invalid bpf_context access",
1576                 .result = REJECT,
1577         },
1578         {
1579                 "check cb access: half, wrong type",
1580                 .insns = {
1581                         BPF_MOV64_IMM(BPF_REG_0, 0),
1582                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1583                                     offsetof(struct __sk_buff, cb[0])),
1584                         BPF_EXIT_INSN(),
1585                 },
1586                 .errstr = "invalid bpf_context access",
1587                 .result = REJECT,
1588                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1589         },
1590         {
1591                 "check cb access: word",
1592                 .insns = {
1593                         BPF_MOV64_IMM(BPF_REG_0, 0),
1594                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1595                                     offsetof(struct __sk_buff, cb[0])),
1596                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1597                                     offsetof(struct __sk_buff, cb[1])),
1598                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1599                                     offsetof(struct __sk_buff, cb[2])),
1600                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1601                                     offsetof(struct __sk_buff, cb[3])),
1602                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1603                                     offsetof(struct __sk_buff, cb[4])),
1604                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1605                                     offsetof(struct __sk_buff, cb[0])),
1606                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1607                                     offsetof(struct __sk_buff, cb[1])),
1608                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1609                                     offsetof(struct __sk_buff, cb[2])),
1610                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1611                                     offsetof(struct __sk_buff, cb[3])),
1612                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1613                                     offsetof(struct __sk_buff, cb[4])),
1614                         BPF_EXIT_INSN(),
1615                 },
1616                 .result = ACCEPT,
1617         },
1618         {
1619                 "check cb access: word, unaligned 1",
1620                 .insns = {
1621                         BPF_MOV64_IMM(BPF_REG_0, 0),
1622                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1623                                     offsetof(struct __sk_buff, cb[0]) + 2),
1624                         BPF_EXIT_INSN(),
1625                 },
1626                 .errstr = "misaligned context access",
1627                 .result = REJECT,
1628                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1629         },
1630         {
1631                 "check cb access: word, unaligned 2",
1632                 .insns = {
1633                         BPF_MOV64_IMM(BPF_REG_0, 0),
1634                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1635                                     offsetof(struct __sk_buff, cb[4]) + 1),
1636                         BPF_EXIT_INSN(),
1637                 },
1638                 .errstr = "misaligned context access",
1639                 .result = REJECT,
1640                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1641         },
1642         {
1643                 "check cb access: word, unaligned 3",
1644                 .insns = {
1645                         BPF_MOV64_IMM(BPF_REG_0, 0),
1646                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1647                                     offsetof(struct __sk_buff, cb[4]) + 2),
1648                         BPF_EXIT_INSN(),
1649                 },
1650                 .errstr = "misaligned context access",
1651                 .result = REJECT,
1652                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1653         },
1654         {
1655                 "check cb access: word, unaligned 4",
1656                 .insns = {
1657                         BPF_MOV64_IMM(BPF_REG_0, 0),
1658                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1659                                     offsetof(struct __sk_buff, cb[4]) + 3),
1660                         BPF_EXIT_INSN(),
1661                 },
1662                 .errstr = "misaligned context access",
1663                 .result = REJECT,
1664                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1665         },
1666         {
1667                 "check cb access: double",
1668                 .insns = {
1669                         BPF_MOV64_IMM(BPF_REG_0, 0),
1670                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1671                                     offsetof(struct __sk_buff, cb[0])),
1672                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1673                                     offsetof(struct __sk_buff, cb[2])),
1674                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1675                                     offsetof(struct __sk_buff, cb[0])),
1676                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1677                                     offsetof(struct __sk_buff, cb[2])),
1678                         BPF_EXIT_INSN(),
1679                 },
1680                 .result = ACCEPT,
1681         },
1682         {
1683                 "check cb access: double, unaligned 1",
1684                 .insns = {
1685                         BPF_MOV64_IMM(BPF_REG_0, 0),
1686                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1687                                     offsetof(struct __sk_buff, cb[1])),
1688                         BPF_EXIT_INSN(),
1689                 },
1690                 .errstr = "misaligned context access",
1691                 .result = REJECT,
1692                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1693         },
1694         {
1695                 "check cb access: double, unaligned 2",
1696                 .insns = {
1697                         BPF_MOV64_IMM(BPF_REG_0, 0),
1698                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1699                                     offsetof(struct __sk_buff, cb[3])),
1700                         BPF_EXIT_INSN(),
1701                 },
1702                 .errstr = "misaligned context access",
1703                 .result = REJECT,
1704                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1705         },
1706         {
1707                 "check cb access: double, oob 1",
1708                 .insns = {
1709                         BPF_MOV64_IMM(BPF_REG_0, 0),
1710                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1711                                     offsetof(struct __sk_buff, cb[4])),
1712                         BPF_EXIT_INSN(),
1713                 },
1714                 .errstr = "invalid bpf_context access",
1715                 .result = REJECT,
1716         },
1717         {
1718                 "check cb access: double, oob 2",
1719                 .insns = {
1720                         BPF_MOV64_IMM(BPF_REG_0, 0),
1721                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1722                                     offsetof(struct __sk_buff, cb[4])),
1723                         BPF_EXIT_INSN(),
1724                 },
1725                 .errstr = "invalid bpf_context access",
1726                 .result = REJECT,
1727         },
1728         {
1729                 "check __sk_buff->ifindex dw store not permitted",
1730                 .insns = {
1731                         BPF_MOV64_IMM(BPF_REG_0, 0),
1732                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1733                                     offsetof(struct __sk_buff, ifindex)),
1734                         BPF_EXIT_INSN(),
1735                 },
1736                 .errstr = "invalid bpf_context access",
1737                 .result = REJECT,
1738         },
1739         {
1740                 "check __sk_buff->ifindex dw load not permitted",
1741                 .insns = {
1742                         BPF_MOV64_IMM(BPF_REG_0, 0),
1743                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1744                                     offsetof(struct __sk_buff, ifindex)),
1745                         BPF_EXIT_INSN(),
1746                 },
1747                 .errstr = "invalid bpf_context access",
1748                 .result = REJECT,
1749         },
1750         {
1751                 "check cb access: double, wrong type",
1752                 .insns = {
1753                         BPF_MOV64_IMM(BPF_REG_0, 0),
1754                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1755                                     offsetof(struct __sk_buff, cb[0])),
1756                         BPF_EXIT_INSN(),
1757                 },
1758                 .errstr = "invalid bpf_context access",
1759                 .result = REJECT,
1760                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1761         },
1762         {
1763                 "check out of range skb->cb access",
1764                 .insns = {
1765                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1766                                     offsetof(struct __sk_buff, cb[0]) + 256),
1767                         BPF_EXIT_INSN(),
1768                 },
1769                 .errstr = "invalid bpf_context access",
1770                 .errstr_unpriv = "",
1771                 .result = REJECT,
1772                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1773         },
1774         {
1775                 "write skb fields from socket prog",
1776                 .insns = {
1777                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1778                                     offsetof(struct __sk_buff, cb[4])),
1779                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1780                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1781                                     offsetof(struct __sk_buff, mark)),
1782                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1783                                     offsetof(struct __sk_buff, tc_index)),
1784                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1785                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1786                                     offsetof(struct __sk_buff, cb[0])),
1787                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1788                                     offsetof(struct __sk_buff, cb[2])),
1789                         BPF_EXIT_INSN(),
1790                 },
1791                 .result = ACCEPT,
1792                 .errstr_unpriv = "R1 leaks addr",
1793                 .result_unpriv = REJECT,
1794         },
1795         {
1796                 "write skb fields from tc_cls_act prog",
1797                 .insns = {
1798                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1799                                     offsetof(struct __sk_buff, cb[0])),
1800                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1801                                     offsetof(struct __sk_buff, mark)),
1802                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1803                                     offsetof(struct __sk_buff, tc_index)),
1804                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1805                                     offsetof(struct __sk_buff, tc_index)),
1806                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1807                                     offsetof(struct __sk_buff, cb[3])),
1808                         BPF_EXIT_INSN(),
1809                 },
1810                 .errstr_unpriv = "",
1811                 .result_unpriv = REJECT,
1812                 .result = ACCEPT,
1813                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1814         },
1815         {
1816                 "PTR_TO_STACK store/load",
1817                 .insns = {
1818                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1819                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1820                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1821                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1822                         BPF_EXIT_INSN(),
1823                 },
1824                 .result = ACCEPT,
1825         },
1826         {
1827                 "PTR_TO_STACK store/load - bad alignment on off",
1828                 .insns = {
1829                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1830                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1831                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1832                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1833                         BPF_EXIT_INSN(),
1834                 },
1835                 .result = REJECT,
1836                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
1837         },
1838         {
1839                 "PTR_TO_STACK store/load - bad alignment on reg",
1840                 .insns = {
1841                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1843                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1844                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1845                         BPF_EXIT_INSN(),
1846                 },
1847                 .result = REJECT,
1848                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
1849         },
1850         {
1851                 "PTR_TO_STACK store/load - out of bounds low",
1852                 .insns = {
1853                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1855                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1856                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1857                         BPF_EXIT_INSN(),
1858                 },
1859                 .result = REJECT,
1860                 .errstr = "invalid stack off=-79992 size=8",
1861                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
1862         },
1863         {
1864                 "PTR_TO_STACK store/load - out of bounds high",
1865                 .insns = {
1866                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1867                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1868                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1869                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1870                         BPF_EXIT_INSN(),
1871                 },
1872                 .result = REJECT,
1873                 .errstr = "invalid stack off=0 size=8",
1874         },
1875         {
1876                 "unpriv: return pointer",
1877                 .insns = {
1878                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1879                         BPF_EXIT_INSN(),
1880                 },
1881                 .result = ACCEPT,
1882                 .result_unpriv = REJECT,
1883                 .errstr_unpriv = "R0 leaks addr",
1884         },
1885         {
1886                 "unpriv: add const to pointer",
1887                 .insns = {
1888                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1889                         BPF_MOV64_IMM(BPF_REG_0, 0),
1890                         BPF_EXIT_INSN(),
1891                 },
1892                 .result = ACCEPT,
1893         },
1894         {
1895                 "unpriv: add pointer to pointer",
1896                 .insns = {
1897                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1898                         BPF_MOV64_IMM(BPF_REG_0, 0),
1899                         BPF_EXIT_INSN(),
1900                 },
1901                 .result = REJECT,
1902                 .errstr = "R1 pointer += pointer",
1903         },
1904         {
1905                 "unpriv: neg pointer",
1906                 .insns = {
1907                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1908                         BPF_MOV64_IMM(BPF_REG_0, 0),
1909                         BPF_EXIT_INSN(),
1910                 },
1911                 .result = ACCEPT,
1912                 .result_unpriv = REJECT,
1913                 .errstr_unpriv = "R1 pointer arithmetic",
1914         },
1915         {
1916                 "unpriv: cmp pointer with const",
1917                 .insns = {
1918                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1919                         BPF_MOV64_IMM(BPF_REG_0, 0),
1920                         BPF_EXIT_INSN(),
1921                 },
1922                 .result = ACCEPT,
1923                 .result_unpriv = REJECT,
1924                 .errstr_unpriv = "R1 pointer comparison",
1925         },
1926         {
1927                 "unpriv: cmp pointer with pointer",
1928                 .insns = {
1929                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1930                         BPF_MOV64_IMM(BPF_REG_0, 0),
1931                         BPF_EXIT_INSN(),
1932                 },
1933                 .result = ACCEPT,
1934                 .result_unpriv = REJECT,
1935                 .errstr_unpriv = "R10 pointer comparison",
1936         },
1937         {
1938                 "unpriv: check that printk is disallowed",
1939                 .insns = {
1940                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1941                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1942                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1943                         BPF_MOV64_IMM(BPF_REG_2, 8),
1944                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1945                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1946                                      BPF_FUNC_trace_printk),
1947                         BPF_MOV64_IMM(BPF_REG_0, 0),
1948                         BPF_EXIT_INSN(),
1949                 },
1950                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
1951                 .result_unpriv = REJECT,
1952                 .result = ACCEPT,
1953         },
1954         {
1955                 "unpriv: pass pointer to helper function",
1956                 .insns = {
1957                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1958                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1959                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1960                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1961                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1962                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
1963                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1964                                      BPF_FUNC_map_update_elem),
1965                         BPF_MOV64_IMM(BPF_REG_0, 0),
1966                         BPF_EXIT_INSN(),
1967                 },
1968                 .fixup_map1 = { 3 },
1969                 .errstr_unpriv = "R4 leaks addr",
1970                 .result_unpriv = REJECT,
1971                 .result = ACCEPT,
1972         },
1973         {
1974                 "unpriv: indirectly pass pointer on stack to helper function",
1975                 .insns = {
1976                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1978                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1979                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1980                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1981                                      BPF_FUNC_map_lookup_elem),
1982                         BPF_MOV64_IMM(BPF_REG_0, 0),
1983                         BPF_EXIT_INSN(),
1984                 },
1985                 .fixup_map1 = { 3 },
1986                 .errstr = "invalid indirect read from stack off -8+0 size 8",
1987                 .result = REJECT,
1988         },
1989         {
1990                 "unpriv: mangle pointer on stack 1",
1991                 .insns = {
1992                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1993                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1994                         BPF_MOV64_IMM(BPF_REG_0, 0),
1995                         BPF_EXIT_INSN(),
1996                 },
1997                 .errstr_unpriv = "attempt to corrupt spilled",
1998                 .result_unpriv = REJECT,
1999                 .result = ACCEPT,
2000         },
2001         {
2002                 "unpriv: mangle pointer on stack 2",
2003                 .insns = {
2004                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2005                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2006                         BPF_MOV64_IMM(BPF_REG_0, 0),
2007                         BPF_EXIT_INSN(),
2008                 },
2009                 .errstr_unpriv = "attempt to corrupt spilled",
2010                 .result_unpriv = REJECT,
2011                 .result = ACCEPT,
2012         },
2013         {
2014                 "unpriv: read pointer from stack in small chunks",
2015                 .insns = {
2016                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2017                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2018                         BPF_MOV64_IMM(BPF_REG_0, 0),
2019                         BPF_EXIT_INSN(),
2020                 },
2021                 .errstr = "invalid size",
2022                 .result = REJECT,
2023         },
2024         {
2025                 "unpriv: write pointer into ctx",
2026                 .insns = {
2027                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2028                         BPF_MOV64_IMM(BPF_REG_0, 0),
2029                         BPF_EXIT_INSN(),
2030                 },
2031                 .errstr_unpriv = "R1 leaks addr",
2032                 .result_unpriv = REJECT,
2033                 .errstr = "invalid bpf_context access",
2034                 .result = REJECT,
2035         },
2036         {
2037                 "unpriv: spill/fill of ctx",
2038                 .insns = {
2039                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2041                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2042                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2043                         BPF_MOV64_IMM(BPF_REG_0, 0),
2044                         BPF_EXIT_INSN(),
2045                 },
2046                 .result = ACCEPT,
2047         },
2048         {
2049                 "unpriv: spill/fill of ctx 2",
2050                 .insns = {
2051                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2052                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2053                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2054                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2055                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2056                                      BPF_FUNC_get_hash_recalc),
2057                         BPF_EXIT_INSN(),
2058                 },
2059                 .result = ACCEPT,
2060                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2061         },
2062         {
2063                 "unpriv: spill/fill of ctx 3",
2064                 .insns = {
2065                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2066                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2067                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2068                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2069                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2070                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2071                                      BPF_FUNC_get_hash_recalc),
2072                         BPF_EXIT_INSN(),
2073                 },
2074                 .result = REJECT,
2075                 .errstr = "R1 type=fp expected=ctx",
2076                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2077         },
2078         {
2079                 "unpriv: spill/fill of ctx 4",
2080                 .insns = {
2081                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2082                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2083                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2084                         BPF_MOV64_IMM(BPF_REG_0, 1),
2085                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2086                                      BPF_REG_0, -8, 0),
2087                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2088                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2089                                      BPF_FUNC_get_hash_recalc),
2090                         BPF_EXIT_INSN(),
2091                 },
2092                 .result = REJECT,
2093                 .errstr = "R1 type=inv expected=ctx",
2094                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2095         },
2096         {
2097                 "unpriv: spill/fill of different pointers stx",
2098                 .insns = {
2099                         BPF_MOV64_IMM(BPF_REG_3, 42),
2100                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2101                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2102                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2103                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2105                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2106                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2107                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2108                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2109                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2110                                     offsetof(struct __sk_buff, mark)),
2111                         BPF_MOV64_IMM(BPF_REG_0, 0),
2112                         BPF_EXIT_INSN(),
2113                 },
2114                 .result = REJECT,
2115                 .errstr = "same insn cannot be used with different pointers",
2116                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2117         },
2118         {
2119                 "unpriv: spill/fill of different pointers ldx",
2120                 .insns = {
2121                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2122                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2123                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2124                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2126                                       -(__s32)offsetof(struct bpf_perf_event_data,
2127                                                        sample_period) - 8),
2128                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2129                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2130                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2131                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2132                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2133                                     offsetof(struct bpf_perf_event_data,
2134                                              sample_period)),
2135                         BPF_MOV64_IMM(BPF_REG_0, 0),
2136                         BPF_EXIT_INSN(),
2137                 },
2138                 .result = REJECT,
2139                 .errstr = "same insn cannot be used with different pointers",
2140                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2141         },
2142         {
2143                 "unpriv: write pointer into map elem value",
2144                 .insns = {
2145                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2146                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2147                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2148                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2149                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2150                                      BPF_FUNC_map_lookup_elem),
2151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2152                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2153                         BPF_EXIT_INSN(),
2154                 },
2155                 .fixup_map1 = { 3 },
2156                 .errstr_unpriv = "R0 leaks addr",
2157                 .result_unpriv = REJECT,
2158                 .result = ACCEPT,
2159         },
2160         {
2161                 "unpriv: partial copy of pointer",
2162                 .insns = {
2163                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2164                         BPF_MOV64_IMM(BPF_REG_0, 0),
2165                         BPF_EXIT_INSN(),
2166                 },
2167                 .errstr_unpriv = "R10 partial copy",
2168                 .result_unpriv = REJECT,
2169                 .result = ACCEPT,
2170         },
2171         {
2172                 "unpriv: pass pointer to tail_call",
2173                 .insns = {
2174                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2175                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2176                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2177                                      BPF_FUNC_tail_call),
2178                         BPF_MOV64_IMM(BPF_REG_0, 0),
2179                         BPF_EXIT_INSN(),
2180                 },
2181                 .fixup_prog = { 1 },
2182                 .errstr_unpriv = "R3 leaks addr into helper",
2183                 .result_unpriv = REJECT,
2184                 .result = ACCEPT,
2185         },
2186         {
2187                 "unpriv: cmp map pointer with zero",
2188                 .insns = {
2189                         BPF_MOV64_IMM(BPF_REG_1, 0),
2190                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2191                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2192                         BPF_MOV64_IMM(BPF_REG_0, 0),
2193                         BPF_EXIT_INSN(),
2194                 },
2195                 .fixup_map1 = { 1 },
2196                 .errstr_unpriv = "R1 pointer comparison",
2197                 .result_unpriv = REJECT,
2198                 .result = ACCEPT,
2199         },
2200         {
2201                 "unpriv: write into frame pointer",
2202                 .insns = {
2203                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2204                         BPF_MOV64_IMM(BPF_REG_0, 0),
2205                         BPF_EXIT_INSN(),
2206                 },
2207                 .errstr = "frame pointer is read only",
2208                 .result = REJECT,
2209         },
2210         {
2211                 "unpriv: spill/fill frame pointer",
2212                 .insns = {
2213                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2214                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2215                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2216                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2217                         BPF_MOV64_IMM(BPF_REG_0, 0),
2218                         BPF_EXIT_INSN(),
2219                 },
2220                 .errstr = "frame pointer is read only",
2221                 .result = REJECT,
2222         },
2223         {
2224                 "unpriv: cmp of frame pointer",
2225                 .insns = {
2226                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2227                         BPF_MOV64_IMM(BPF_REG_0, 0),
2228                         BPF_EXIT_INSN(),
2229                 },
2230                 .errstr_unpriv = "R10 pointer comparison",
2231                 .result_unpriv = REJECT,
2232                 .result = ACCEPT,
2233         },
2234         {
2235                 "unpriv: adding of fp, reg",
2236                 .insns = {
2237                         BPF_MOV64_IMM(BPF_REG_0, 0),
2238                         BPF_MOV64_IMM(BPF_REG_1, 0),
2239                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2240                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2241                         BPF_EXIT_INSN(),
2242                 },
2243                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
2244                 .result_unpriv = REJECT,
2245                 .result = ACCEPT,
2246         },
2247         {
2248                 "unpriv: adding of fp, imm",
2249                 .insns = {
2250                         BPF_MOV64_IMM(BPF_REG_0, 0),
2251                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
2253                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2254                         BPF_EXIT_INSN(),
2255                 },
2256                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
2257                 .result_unpriv = REJECT,
2258                 .result = ACCEPT,
2259         },
2260         {
2261                 "unpriv: cmp of stack pointer",
2262                 .insns = {
2263                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2264                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2266                         BPF_MOV64_IMM(BPF_REG_0, 0),
2267                         BPF_EXIT_INSN(),
2268                 },
2269                 .errstr_unpriv = "R2 pointer comparison",
2270                 .result_unpriv = REJECT,
2271                 .result = ACCEPT,
2272         },
2273         {
2274                 "runtime/jit: pass negative index to tail_call",
2275                 .insns = {
2276                         BPF_MOV64_IMM(BPF_REG_3, -1),
2277                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2279                                      BPF_FUNC_tail_call),
2280                         BPF_MOV64_IMM(BPF_REG_0, 0),
2281                         BPF_EXIT_INSN(),
2282                 },
2283                 .fixup_prog = { 1 },
2284                 .result = ACCEPT,
2285         },
2286         {
2287                 "runtime/jit: pass > 32bit index to tail_call",
2288                 .insns = {
2289                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2290                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2291                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2292                                      BPF_FUNC_tail_call),
2293                         BPF_MOV64_IMM(BPF_REG_0, 0),
2294                         BPF_EXIT_INSN(),
2295                 },
2296                 .fixup_prog = { 2 },
2297                 .result = ACCEPT,
2298         },
2299         {
2300                 "stack pointer arithmetic",
2301                 .insns = {
2302                         BPF_MOV64_IMM(BPF_REG_1, 4),
2303                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2304                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2305                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2306                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2307                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2308                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2309                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2310                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2311                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2312                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2313                         BPF_MOV64_IMM(BPF_REG_0, 0),
2314                         BPF_EXIT_INSN(),
2315                 },
2316                 .result = ACCEPT,
2317         },
2318         {
2319                 "raw_stack: no skb_load_bytes",
2320                 .insns = {
2321                         BPF_MOV64_IMM(BPF_REG_2, 4),
2322                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2324                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2325                         BPF_MOV64_IMM(BPF_REG_4, 8),
2326                         /* Call to skb_load_bytes() omitted. */
2327                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2328                         BPF_EXIT_INSN(),
2329                 },
2330                 .result = REJECT,
2331                 .errstr = "invalid read from stack off -8+0 size 8",
2332                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2333         },
2334         {
2335                 "raw_stack: skb_load_bytes, negative len",
2336                 .insns = {
2337                         BPF_MOV64_IMM(BPF_REG_2, 4),
2338                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2339                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2340                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2341                         BPF_MOV64_IMM(BPF_REG_4, -8),
2342                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2343                                      BPF_FUNC_skb_load_bytes),
2344                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2345                         BPF_EXIT_INSN(),
2346                 },
2347                 .result = REJECT,
2348                 .errstr = "R4 min value is negative",
2349                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2350         },
2351         {
2352                 "raw_stack: skb_load_bytes, negative len 2",
2353                 .insns = {
2354                         BPF_MOV64_IMM(BPF_REG_2, 4),
2355                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2356                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2357                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2358                         BPF_MOV64_IMM(BPF_REG_4, ~0),
2359                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2360                                      BPF_FUNC_skb_load_bytes),
2361                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2362                         BPF_EXIT_INSN(),
2363                 },
2364                 .result = REJECT,
2365                 .errstr = "R4 min value is negative",
2366                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2367         },
2368         {
2369                 "raw_stack: skb_load_bytes, zero len",
2370                 .insns = {
2371                         BPF_MOV64_IMM(BPF_REG_2, 4),
2372                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2373                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2374                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2375                         BPF_MOV64_IMM(BPF_REG_4, 0),
2376                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2377                                      BPF_FUNC_skb_load_bytes),
2378                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2379                         BPF_EXIT_INSN(),
2380                 },
2381                 .result = REJECT,
2382                 .errstr = "invalid stack type R3",
2383                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2384         },
2385         {
2386                 "raw_stack: skb_load_bytes, no init",
2387                 .insns = {
2388                         BPF_MOV64_IMM(BPF_REG_2, 4),
2389                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2390                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2391                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2392                         BPF_MOV64_IMM(BPF_REG_4, 8),
2393                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2394                                      BPF_FUNC_skb_load_bytes),
2395                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2396                         BPF_EXIT_INSN(),
2397                 },
2398                 .result = ACCEPT,
2399                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2400         },
2401         {
2402                 "raw_stack: skb_load_bytes, init",
2403                 .insns = {
2404                         BPF_MOV64_IMM(BPF_REG_2, 4),
2405                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2406                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2407                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2408                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2409                         BPF_MOV64_IMM(BPF_REG_4, 8),
2410                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2411                                      BPF_FUNC_skb_load_bytes),
2412                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2413                         BPF_EXIT_INSN(),
2414                 },
2415                 .result = ACCEPT,
2416                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2417         },
2418         {
2419                 "raw_stack: skb_load_bytes, spilled regs around bounds",
2420                 .insns = {
2421                         BPF_MOV64_IMM(BPF_REG_2, 4),
2422                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2424                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2425                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2426                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2427                         BPF_MOV64_IMM(BPF_REG_4, 8),
2428                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2429                                      BPF_FUNC_skb_load_bytes),
2430                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2431                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2432                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2433                                     offsetof(struct __sk_buff, mark)),
2434                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2435                                     offsetof(struct __sk_buff, priority)),
2436                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2437                         BPF_EXIT_INSN(),
2438                 },
2439                 .result = ACCEPT,
2440                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2441         },
2442         {
2443                 "raw_stack: skb_load_bytes, spilled regs corruption",
2444                 .insns = {
2445                         BPF_MOV64_IMM(BPF_REG_2, 4),
2446                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2447                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2448                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2449                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2450                         BPF_MOV64_IMM(BPF_REG_4, 8),
2451                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2452                                      BPF_FUNC_skb_load_bytes),
2453                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2454                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2455                                     offsetof(struct __sk_buff, mark)),
2456                         BPF_EXIT_INSN(),
2457                 },
2458                 .result = REJECT,
2459                 .errstr = "R0 invalid mem access 'inv'",
2460                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2461         },
2462         {
2463                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2464                 .insns = {
2465                         BPF_MOV64_IMM(BPF_REG_2, 4),
2466                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2467                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2468                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2469                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2470                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2471                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2472                         BPF_MOV64_IMM(BPF_REG_4, 8),
2473                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2474                                      BPF_FUNC_skb_load_bytes),
2475                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2476                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2477                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2478                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2479                                     offsetof(struct __sk_buff, mark)),
2480                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2481                                     offsetof(struct __sk_buff, priority)),
2482                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2483                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2484                                     offsetof(struct __sk_buff, pkt_type)),
2485                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2486                         BPF_EXIT_INSN(),
2487                 },
2488                 .result = REJECT,
2489                 .errstr = "R3 invalid mem access 'inv'",
2490                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2491         },
2492         {
2493                 "raw_stack: skb_load_bytes, spilled regs + data",
2494                 .insns = {
2495                         BPF_MOV64_IMM(BPF_REG_2, 4),
2496                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2497                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2498                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2499                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2500                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2501                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2502                         BPF_MOV64_IMM(BPF_REG_4, 8),
2503                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2504                                      BPF_FUNC_skb_load_bytes),
2505                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2506                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2507                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2508                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2509                                     offsetof(struct __sk_buff, mark)),
2510                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2511                                     offsetof(struct __sk_buff, priority)),
2512                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2513                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2514                         BPF_EXIT_INSN(),
2515                 },
2516                 .result = ACCEPT,
2517                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2518         },
2519         {
2520                 "raw_stack: skb_load_bytes, invalid access 1",
2521                 .insns = {
2522                         BPF_MOV64_IMM(BPF_REG_2, 4),
2523                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2524                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2525                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2526                         BPF_MOV64_IMM(BPF_REG_4, 8),
2527                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2528                                      BPF_FUNC_skb_load_bytes),
2529                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2530                         BPF_EXIT_INSN(),
2531                 },
2532                 .result = REJECT,
2533                 .errstr = "invalid stack type R3 off=-513 access_size=8",
2534                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2535         },
2536         {
2537                 "raw_stack: skb_load_bytes, invalid access 2",
2538                 .insns = {
2539                         BPF_MOV64_IMM(BPF_REG_2, 4),
2540                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2541                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2542                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2543                         BPF_MOV64_IMM(BPF_REG_4, 8),
2544                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2545                                      BPF_FUNC_skb_load_bytes),
2546                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2547                         BPF_EXIT_INSN(),
2548                 },
2549                 .result = REJECT,
2550                 .errstr = "invalid stack type R3 off=-1 access_size=8",
2551                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2552         },
2553         {
2554                 "raw_stack: skb_load_bytes, invalid access 3",
2555                 .insns = {
2556                         BPF_MOV64_IMM(BPF_REG_2, 4),
2557                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2558                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2559                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2560                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2561                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2562                                      BPF_FUNC_skb_load_bytes),
2563                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2564                         BPF_EXIT_INSN(),
2565                 },
2566                 .result = REJECT,
2567                 .errstr = "R4 min value is negative",
2568                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2569         },
2570         {
2571                 "raw_stack: skb_load_bytes, invalid access 4",
2572                 .insns = {
2573                         BPF_MOV64_IMM(BPF_REG_2, 4),
2574                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2575                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2576                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2577                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2578                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2579                                      BPF_FUNC_skb_load_bytes),
2580                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2581                         BPF_EXIT_INSN(),
2582                 },
2583                 .result = REJECT,
2584                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2585                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2586         },
2587         {
2588                 "raw_stack: skb_load_bytes, invalid access 5",
2589                 .insns = {
2590                         BPF_MOV64_IMM(BPF_REG_2, 4),
2591                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2593                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2594                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2595                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2596                                      BPF_FUNC_skb_load_bytes),
2597                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2598                         BPF_EXIT_INSN(),
2599                 },
2600                 .result = REJECT,
2601                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
2602                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2603         },
2604         {
2605                 "raw_stack: skb_load_bytes, invalid access 6",
2606                 .insns = {
2607                         BPF_MOV64_IMM(BPF_REG_2, 4),
2608                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2609                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2610                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2611                         BPF_MOV64_IMM(BPF_REG_4, 0),
2612                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2613                                      BPF_FUNC_skb_load_bytes),
2614                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2615                         BPF_EXIT_INSN(),
2616                 },
2617                 .result = REJECT,
2618                 .errstr = "invalid stack type R3 off=-512 access_size=0",
2619                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2620         },
2621         {
2622                 "raw_stack: skb_load_bytes, large access",
2623                 .insns = {
2624                         BPF_MOV64_IMM(BPF_REG_2, 4),
2625                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2627                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2628                         BPF_MOV64_IMM(BPF_REG_4, 512),
2629                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2630                                      BPF_FUNC_skb_load_bytes),
2631                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2632                         BPF_EXIT_INSN(),
2633                 },
2634                 .result = ACCEPT,
2635                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2636         },
2637         {
2638                 "context stores via ST",
2639                 .insns = {
2640                         BPF_MOV64_IMM(BPF_REG_0, 0),
2641                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
2642                         BPF_EXIT_INSN(),
2643                 },
2644                 .errstr = "BPF_ST stores into R1 context is not allowed",
2645                 .result = REJECT,
2646                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2647         },
2648         {
2649                 "context stores via XADD",
2650                 .insns = {
2651                         BPF_MOV64_IMM(BPF_REG_0, 0),
2652                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
2653                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
2654                         BPF_EXIT_INSN(),
2655                 },
2656                 .errstr = "BPF_XADD stores into R1 context is not allowed",
2657                 .result = REJECT,
2658                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2659         },
2660         {
2661                 "direct packet access: test1",
2662                 .insns = {
2663                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2664                                     offsetof(struct __sk_buff, data)),
2665                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2666                                     offsetof(struct __sk_buff, data_end)),
2667                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2668                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2669                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2670                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2671                         BPF_MOV64_IMM(BPF_REG_0, 0),
2672                         BPF_EXIT_INSN(),
2673                 },
2674                 .result = ACCEPT,
2675                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2676         },
2677         {
2678                 "direct packet access: test2",
2679                 .insns = {
2680                         BPF_MOV64_IMM(BPF_REG_0, 1),
2681                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2682                                     offsetof(struct __sk_buff, data_end)),
2683                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2684                                     offsetof(struct __sk_buff, data)),
2685                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2686                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2687                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2688                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2689                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2690                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2691                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2692                                     offsetof(struct __sk_buff, data)),
2693                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2694                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2695                                     offsetof(struct __sk_buff, len)),
2696                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
2697                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
2698                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2699                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2701                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2702                                     offsetof(struct __sk_buff, data_end)),
2703                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2704                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2705                         BPF_MOV64_IMM(BPF_REG_0, 0),
2706                         BPF_EXIT_INSN(),
2707                 },
2708                 .result = ACCEPT,
2709                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2710         },
2711         {
2712                 "direct packet access: test3",
2713                 .insns = {
2714                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2715                                     offsetof(struct __sk_buff, data)),
2716                         BPF_MOV64_IMM(BPF_REG_0, 0),
2717                         BPF_EXIT_INSN(),
2718                 },
2719                 .errstr = "invalid bpf_context access off=76",
2720                 .result = REJECT,
2721                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2722         },
2723         {
2724                 "direct packet access: test4 (write)",
2725                 .insns = {
2726                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2727                                     offsetof(struct __sk_buff, data)),
2728                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2729                                     offsetof(struct __sk_buff, data_end)),
2730                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2731                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2732                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2733                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2734                         BPF_MOV64_IMM(BPF_REG_0, 0),
2735                         BPF_EXIT_INSN(),
2736                 },
2737                 .result = ACCEPT,
2738                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2739         },
2740         {
2741                 "direct packet access: test5 (pkt_end >= reg, good access)",
2742                 .insns = {
2743                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2744                                     offsetof(struct __sk_buff, data)),
2745                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2746                                     offsetof(struct __sk_buff, data_end)),
2747                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2748                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2749                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2750                         BPF_MOV64_IMM(BPF_REG_0, 1),
2751                         BPF_EXIT_INSN(),
2752                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2753                         BPF_MOV64_IMM(BPF_REG_0, 0),
2754                         BPF_EXIT_INSN(),
2755                 },
2756                 .result = ACCEPT,
2757                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2758         },
2759         {
2760                 "direct packet access: test6 (pkt_end >= reg, bad access)",
2761                 .insns = {
2762                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2763                                     offsetof(struct __sk_buff, data)),
2764                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2765                                     offsetof(struct __sk_buff, data_end)),
2766                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2767                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2768                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2769                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2770                         BPF_MOV64_IMM(BPF_REG_0, 1),
2771                         BPF_EXIT_INSN(),
2772                         BPF_MOV64_IMM(BPF_REG_0, 0),
2773                         BPF_EXIT_INSN(),
2774                 },
2775                 .errstr = "invalid access to packet",
2776                 .result = REJECT,
2777                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2778         },
2779         {
2780                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2781                 .insns = {
2782                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2783                                     offsetof(struct __sk_buff, data)),
2784                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2785                                     offsetof(struct __sk_buff, data_end)),
2786                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2788                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2789                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2790                         BPF_MOV64_IMM(BPF_REG_0, 1),
2791                         BPF_EXIT_INSN(),
2792                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2793                         BPF_MOV64_IMM(BPF_REG_0, 0),
2794                         BPF_EXIT_INSN(),
2795                 },
2796                 .errstr = "invalid access to packet",
2797                 .result = REJECT,
2798                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2799         },
2800         {
2801                 "direct packet access: test8 (double test, variant 1)",
2802                 .insns = {
2803                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2804                                     offsetof(struct __sk_buff, data)),
2805                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2806                                     offsetof(struct __sk_buff, data_end)),
2807                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2809                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2810                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2811                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2812                         BPF_MOV64_IMM(BPF_REG_0, 1),
2813                         BPF_EXIT_INSN(),
2814                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2815                         BPF_MOV64_IMM(BPF_REG_0, 0),
2816                         BPF_EXIT_INSN(),
2817                 },
2818                 .result = ACCEPT,
2819                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2820         },
2821         {
2822                 "direct packet access: test9 (double test, variant 2)",
2823                 .insns = {
2824                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2825                                     offsetof(struct __sk_buff, data)),
2826                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2827                                     offsetof(struct __sk_buff, data_end)),
2828                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2829                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2830                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2831                         BPF_MOV64_IMM(BPF_REG_0, 1),
2832                         BPF_EXIT_INSN(),
2833                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2834                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2835                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2836                         BPF_MOV64_IMM(BPF_REG_0, 0),
2837                         BPF_EXIT_INSN(),
2838                 },
2839                 .result = ACCEPT,
2840                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2841         },
2842         {
2843                 "direct packet access: test10 (write invalid)",
2844                 .insns = {
2845                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2846                                     offsetof(struct __sk_buff, data)),
2847                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2848                                     offsetof(struct __sk_buff, data_end)),
2849                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2850                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2851                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2852                         BPF_MOV64_IMM(BPF_REG_0, 0),
2853                         BPF_EXIT_INSN(),
2854                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2855                         BPF_MOV64_IMM(BPF_REG_0, 0),
2856                         BPF_EXIT_INSN(),
2857                 },
2858                 .errstr = "invalid access to packet",
2859                 .result = REJECT,
2860                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2861         },
2862         {
2863                 "direct packet access: test11 (shift, good access)",
2864                 .insns = {
2865                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2866                                     offsetof(struct __sk_buff, data)),
2867                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2868                                     offsetof(struct __sk_buff, data_end)),
2869                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2870                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2871                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2872                         BPF_MOV64_IMM(BPF_REG_3, 144),
2873                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2874                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2875                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
2876                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2877                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2878                         BPF_MOV64_IMM(BPF_REG_0, 1),
2879                         BPF_EXIT_INSN(),
2880                         BPF_MOV64_IMM(BPF_REG_0, 0),
2881                         BPF_EXIT_INSN(),
2882                 },
2883                 .result = ACCEPT,
2884                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2885         },
2886         {
2887                 "direct packet access: test12 (and, good access)",
2888                 .insns = {
2889                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2890                                     offsetof(struct __sk_buff, data)),
2891                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2892                                     offsetof(struct __sk_buff, data_end)),
2893                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2895                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2896                         BPF_MOV64_IMM(BPF_REG_3, 144),
2897                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2898                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2899                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2900                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2901                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2902                         BPF_MOV64_IMM(BPF_REG_0, 1),
2903                         BPF_EXIT_INSN(),
2904                         BPF_MOV64_IMM(BPF_REG_0, 0),
2905                         BPF_EXIT_INSN(),
2906                 },
2907                 .result = ACCEPT,
2908                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2909         },
2910         {
2911                 "direct packet access: test13 (branches, good access)",
2912                 .insns = {
2913                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2914                                     offsetof(struct __sk_buff, data)),
2915                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2916                                     offsetof(struct __sk_buff, data_end)),
2917                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2919                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
2920                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2921                                     offsetof(struct __sk_buff, mark)),
2922                         BPF_MOV64_IMM(BPF_REG_4, 1),
2923                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
2924                         BPF_MOV64_IMM(BPF_REG_3, 14),
2925                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
2926                         BPF_MOV64_IMM(BPF_REG_3, 24),
2927                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2928                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2929                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2930                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2931                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2932                         BPF_MOV64_IMM(BPF_REG_0, 1),
2933                         BPF_EXIT_INSN(),
2934                         BPF_MOV64_IMM(BPF_REG_0, 0),
2935                         BPF_EXIT_INSN(),
2936                 },
2937                 .result = ACCEPT,
2938                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2939         },
2940         {
2941                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2942                 .insns = {
2943                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2944                                     offsetof(struct __sk_buff, data)),
2945                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2946                                     offsetof(struct __sk_buff, data_end)),
2947                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2948                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2949                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
2950                         BPF_MOV64_IMM(BPF_REG_5, 12),
2951                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
2952                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2953                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2954                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
2955                         BPF_MOV64_IMM(BPF_REG_0, 1),
2956                         BPF_EXIT_INSN(),
2957                         BPF_MOV64_IMM(BPF_REG_0, 0),
2958                         BPF_EXIT_INSN(),
2959                 },
2960                 .result = ACCEPT,
2961                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2962         },
2963         {
2964                 "direct packet access: test15 (spill with xadd)",
2965                 .insns = {
2966                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2967                                     offsetof(struct __sk_buff, data)),
2968                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2969                                     offsetof(struct __sk_buff, data_end)),
2970                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2971                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2972                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2973                         BPF_MOV64_IMM(BPF_REG_5, 4096),
2974                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
2975                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
2976                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
2977                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
2978                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
2979                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
2980                         BPF_MOV64_IMM(BPF_REG_0, 0),
2981                         BPF_EXIT_INSN(),
2982                 },
2983                 .errstr = "R2 invalid mem access 'inv'",
2984                 .result = REJECT,
2985                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2986         },
2987         {
2988                 "direct packet access: test16 (arith on data_end)",
2989                 .insns = {
2990                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2991                                     offsetof(struct __sk_buff, data)),
2992                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2993                                     offsetof(struct __sk_buff, data_end)),
2994                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
2997                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2998                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2999                         BPF_MOV64_IMM(BPF_REG_0, 0),
3000                         BPF_EXIT_INSN(),
3001                 },
3002                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3003                 .result = REJECT,
3004                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3005         },
3006         {
3007                 "direct packet access: test17 (pruning, alignment)",
3008                 .insns = {
3009                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3010                                     offsetof(struct __sk_buff, data)),
3011                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3012                                     offsetof(struct __sk_buff, data_end)),
3013                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3014                                     offsetof(struct __sk_buff, mark)),
3015                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3016                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3017                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3018                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3019                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3020                         BPF_MOV64_IMM(BPF_REG_0, 0),
3021                         BPF_EXIT_INSN(),
3022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3023                         BPF_JMP_A(-6),
3024                 },
3025                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3026                 .result = REJECT,
3027                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3028                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3029         },
3030         {
3031                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3032                 .insns = {
3033                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3034                                     offsetof(struct __sk_buff, data)),
3035                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3036                                     offsetof(struct __sk_buff, data_end)),
3037                         BPF_MOV64_IMM(BPF_REG_0, 8),
3038                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3039                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3040                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3041                         BPF_MOV64_IMM(BPF_REG_0, 0),
3042                         BPF_EXIT_INSN(),
3043                 },
3044                 .result = ACCEPT,
3045                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3046         },
3047         {
3048                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3049                 .insns = {
3050                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3051                                     offsetof(struct __sk_buff, data)),
3052                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3053                                     offsetof(struct __sk_buff, data_end)),
3054                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3055                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3056                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3057                         BPF_MOV64_IMM(BPF_REG_4, 4),
3058                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3059                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3060                         BPF_MOV64_IMM(BPF_REG_0, 0),
3061                         BPF_EXIT_INSN(),
3062                 },
3063                 .result = ACCEPT,
3064                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3065         },
3066         {
3067                 "direct packet access: test20 (x += pkt_ptr, 1)",
3068                 .insns = {
3069                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3070                                     offsetof(struct __sk_buff, data)),
3071                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3072                                     offsetof(struct __sk_buff, data_end)),
3073                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3074                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3075                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3076                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3077                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3078                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3079                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3080                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3081                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3082                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3083                         BPF_MOV64_IMM(BPF_REG_0, 0),
3084                         BPF_EXIT_INSN(),
3085                 },
3086                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3087                 .result = ACCEPT,
3088         },
3089         {
3090                 "direct packet access: test21 (x += pkt_ptr, 2)",
3091                 .insns = {
3092                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3093                                     offsetof(struct __sk_buff, data)),
3094                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3095                                     offsetof(struct __sk_buff, data_end)),
3096                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3097                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3098                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3099                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3100                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3101                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3102                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3103                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3104                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3106                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3107                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3108                         BPF_MOV64_IMM(BPF_REG_0, 0),
3109                         BPF_EXIT_INSN(),
3110                 },
3111                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3112                 .result = ACCEPT,
3113         },
3114         {
3115                 "direct packet access: test22 (x += pkt_ptr, 3)",
3116                 .insns = {
3117                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3118                                     offsetof(struct __sk_buff, data)),
3119                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3120                                     offsetof(struct __sk_buff, data_end)),
3121                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3122                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3123                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3124                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3125                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3126                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3127                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3128                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3129                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3130                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3131                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3132                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3133                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3135                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3136                         BPF_MOV64_IMM(BPF_REG_2, 1),
3137                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3138                         BPF_MOV64_IMM(BPF_REG_0, 0),
3139                         BPF_EXIT_INSN(),
3140                 },
3141                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3142                 .result = ACCEPT,
3143         },
3144         {
3145                 "direct packet access: test23 (x += pkt_ptr, 4)",
3146                 .insns = {
3147                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3148                                     offsetof(struct __sk_buff, data)),
3149                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3150                                     offsetof(struct __sk_buff, data_end)),
3151                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3152                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3153                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3154                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3155                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3156                         BPF_MOV64_IMM(BPF_REG_0, 31),
3157                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3158                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3159                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3160                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3161                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3162                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3163                         BPF_MOV64_IMM(BPF_REG_0, 0),
3164                         BPF_EXIT_INSN(),
3165                 },
3166                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3167                 .result = REJECT,
3168                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3169         },
3170         {
3171                 "direct packet access: test24 (x += pkt_ptr, 5)",
3172                 .insns = {
3173                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3174                                     offsetof(struct __sk_buff, data)),
3175                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3176                                     offsetof(struct __sk_buff, data_end)),
3177                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3178                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3179                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3180                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3181                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3182                         BPF_MOV64_IMM(BPF_REG_0, 64),
3183                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3184                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3185                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3186                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3187                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3188                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3189                         BPF_MOV64_IMM(BPF_REG_0, 0),
3190                         BPF_EXIT_INSN(),
3191                 },
3192                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3193                 .result = ACCEPT,
3194         },
3195         {
3196                 "direct packet access: test25 (marking on <, good access)",
3197                 .insns = {
3198                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3199                                     offsetof(struct __sk_buff, data)),
3200                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3201                                     offsetof(struct __sk_buff, data_end)),
3202                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3203                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3204                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3205                         BPF_MOV64_IMM(BPF_REG_0, 0),
3206                         BPF_EXIT_INSN(),
3207                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3208                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3209                 },
3210                 .result = ACCEPT,
3211                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3212         },
3213         {
3214                 "direct packet access: test26 (marking on <, bad access)",
3215                 .insns = {
3216                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3217                                     offsetof(struct __sk_buff, data)),
3218                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3219                                     offsetof(struct __sk_buff, data_end)),
3220                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3221                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3222                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3223                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3224                         BPF_MOV64_IMM(BPF_REG_0, 0),
3225                         BPF_EXIT_INSN(),
3226                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3227                 },
3228                 .result = REJECT,
3229                 .errstr = "invalid access to packet",
3230                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3231         },
3232         {
3233                 "direct packet access: test27 (marking on <=, good access)",
3234                 .insns = {
3235                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3236                                     offsetof(struct __sk_buff, data)),
3237                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3238                                     offsetof(struct __sk_buff, data_end)),
3239                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3241                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3242                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3243                         BPF_MOV64_IMM(BPF_REG_0, 1),
3244                         BPF_EXIT_INSN(),
3245                 },
3246                 .result = ACCEPT,
3247                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3248         },
3249         {
3250                 "direct packet access: test28 (marking on <=, bad access)",
3251                 .insns = {
3252                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3253                                     offsetof(struct __sk_buff, data)),
3254                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3255                                     offsetof(struct __sk_buff, data_end)),
3256                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3257                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3258                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3259                         BPF_MOV64_IMM(BPF_REG_0, 1),
3260                         BPF_EXIT_INSN(),
3261                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3262                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3263                 },
3264                 .result = REJECT,
3265                 .errstr = "invalid access to packet",
3266                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3267         },
3268         {
3269                 "helper access to packet: test1, valid packet_ptr range",
3270                 .insns = {
3271                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3272                                     offsetof(struct xdp_md, data)),
3273                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3274                                     offsetof(struct xdp_md, data_end)),
3275                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3277                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3278                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3279                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3280                         BPF_MOV64_IMM(BPF_REG_4, 0),
3281                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3282                                      BPF_FUNC_map_update_elem),
3283                         BPF_MOV64_IMM(BPF_REG_0, 0),
3284                         BPF_EXIT_INSN(),
3285                 },
3286                 .fixup_map1 = { 5 },
3287                 .result_unpriv = ACCEPT,
3288                 .result = ACCEPT,
3289                 .prog_type = BPF_PROG_TYPE_XDP,
3290         },
3291         {
3292                 "helper access to packet: test2, unchecked packet_ptr",
3293                 .insns = {
3294                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3295                                     offsetof(struct xdp_md, data)),
3296                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3297                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3298                                      BPF_FUNC_map_lookup_elem),
3299                         BPF_MOV64_IMM(BPF_REG_0, 0),
3300                         BPF_EXIT_INSN(),
3301                 },
3302                 .fixup_map1 = { 1 },
3303                 .result = REJECT,
3304                 .errstr = "invalid access to packet",
3305                 .prog_type = BPF_PROG_TYPE_XDP,
3306         },
3307         {
3308                 "helper access to packet: test3, variable add",
3309                 .insns = {
3310                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3311                                         offsetof(struct xdp_md, data)),
3312                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3313                                         offsetof(struct xdp_md, data_end)),
3314                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3315                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3316                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3317                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3318                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3319                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3320                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3321                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3322                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3323                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3324                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3325                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3326                                      BPF_FUNC_map_lookup_elem),
3327                         BPF_MOV64_IMM(BPF_REG_0, 0),
3328                         BPF_EXIT_INSN(),
3329                 },
3330                 .fixup_map1 = { 11 },
3331                 .result = ACCEPT,
3332                 .prog_type = BPF_PROG_TYPE_XDP,
3333         },
3334         {
3335                 "helper access to packet: test4, packet_ptr with bad range",
3336                 .insns = {
3337                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3338                                     offsetof(struct xdp_md, data)),
3339                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3340                                     offsetof(struct xdp_md, data_end)),
3341                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3342                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3343                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3344                         BPF_MOV64_IMM(BPF_REG_0, 0),
3345                         BPF_EXIT_INSN(),
3346                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3347                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3348                                      BPF_FUNC_map_lookup_elem),
3349                         BPF_MOV64_IMM(BPF_REG_0, 0),
3350                         BPF_EXIT_INSN(),
3351                 },
3352                 .fixup_map1 = { 7 },
3353                 .result = REJECT,
3354                 .errstr = "invalid access to packet",
3355                 .prog_type = BPF_PROG_TYPE_XDP,
3356         },
3357         {
3358                 "helper access to packet: test5, packet_ptr with too short range",
3359                 .insns = {
3360                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3361                                     offsetof(struct xdp_md, data)),
3362                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3363                                     offsetof(struct xdp_md, data_end)),
3364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3365                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3366                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3367                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3368                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3369                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3370                                      BPF_FUNC_map_lookup_elem),
3371                         BPF_MOV64_IMM(BPF_REG_0, 0),
3372                         BPF_EXIT_INSN(),
3373                 },
3374                 .fixup_map1 = { 6 },
3375                 .result = REJECT,
3376                 .errstr = "invalid access to packet",
3377                 .prog_type = BPF_PROG_TYPE_XDP,
3378         },
3379         {
3380                 "helper access to packet: test6, cls valid packet_ptr range",
3381                 .insns = {
3382                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3383                                     offsetof(struct __sk_buff, data)),
3384                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3385                                     offsetof(struct __sk_buff, data_end)),
3386                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3388                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3389                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3390                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3391                         BPF_MOV64_IMM(BPF_REG_4, 0),
3392                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3393                                      BPF_FUNC_map_update_elem),
3394                         BPF_MOV64_IMM(BPF_REG_0, 0),
3395                         BPF_EXIT_INSN(),
3396                 },
3397                 .fixup_map1 = { 5 },
3398                 .result = ACCEPT,
3399                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3400         },
3401         {
3402                 "helper access to packet: test7, cls unchecked packet_ptr",
3403                 .insns = {
3404                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3405                                     offsetof(struct __sk_buff, data)),
3406                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3407                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3408                                      BPF_FUNC_map_lookup_elem),
3409                         BPF_MOV64_IMM(BPF_REG_0, 0),
3410                         BPF_EXIT_INSN(),
3411                 },
3412                 .fixup_map1 = { 1 },
3413                 .result = REJECT,
3414                 .errstr = "invalid access to packet",
3415                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3416         },
3417         {
3418                 "helper access to packet: test8, cls variable add",
3419                 .insns = {
3420                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3421                                         offsetof(struct __sk_buff, data)),
3422                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3423                                         offsetof(struct __sk_buff, data_end)),
3424                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3425                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3426                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3427                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3428                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3429                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3430                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3431                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3432                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3433                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3434                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3435                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3436                                      BPF_FUNC_map_lookup_elem),
3437                         BPF_MOV64_IMM(BPF_REG_0, 0),
3438                         BPF_EXIT_INSN(),
3439                 },
3440                 .fixup_map1 = { 11 },
3441                 .result = ACCEPT,
3442                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3443         },
3444         {
3445                 "helper access to packet: test9, cls packet_ptr with bad range",
3446                 .insns = {
3447                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3448                                     offsetof(struct __sk_buff, data)),
3449                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3450                                     offsetof(struct __sk_buff, data_end)),
3451                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3452                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3453                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3454                         BPF_MOV64_IMM(BPF_REG_0, 0),
3455                         BPF_EXIT_INSN(),
3456                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3457                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3458                                      BPF_FUNC_map_lookup_elem),
3459                         BPF_MOV64_IMM(BPF_REG_0, 0),
3460                         BPF_EXIT_INSN(),
3461                 },
3462                 .fixup_map1 = { 7 },
3463                 .result = REJECT,
3464                 .errstr = "invalid access to packet",
3465                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3466         },
3467         {
3468                 "helper access to packet: test10, cls packet_ptr with too short range",
3469                 .insns = {
3470                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3471                                     offsetof(struct __sk_buff, data)),
3472                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3473                                     offsetof(struct __sk_buff, data_end)),
3474                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3475                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3476                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3477                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3478                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3479                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3480                                      BPF_FUNC_map_lookup_elem),
3481                         BPF_MOV64_IMM(BPF_REG_0, 0),
3482                         BPF_EXIT_INSN(),
3483                 },
3484                 .fixup_map1 = { 6 },
3485                 .result = REJECT,
3486                 .errstr = "invalid access to packet",
3487                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3488         },
3489         {
3490                 "helper access to packet: test11, cls unsuitable helper 1",
3491                 .insns = {
3492                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3493                                     offsetof(struct __sk_buff, data)),
3494                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3495                                     offsetof(struct __sk_buff, data_end)),
3496                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3497                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3498                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
3499                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
3500                         BPF_MOV64_IMM(BPF_REG_2, 0),
3501                         BPF_MOV64_IMM(BPF_REG_4, 42),
3502                         BPF_MOV64_IMM(BPF_REG_5, 0),
3503                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3504                                      BPF_FUNC_skb_store_bytes),
3505                         BPF_MOV64_IMM(BPF_REG_0, 0),
3506                         BPF_EXIT_INSN(),
3507                 },
3508                 .result = REJECT,
3509                 .errstr = "helper access to the packet",
3510                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3511         },
3512         {
3513                 "helper access to packet: test12, cls unsuitable helper 2",
3514                 .insns = {
3515                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3516                                     offsetof(struct __sk_buff, data)),
3517                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3518                                     offsetof(struct __sk_buff, data_end)),
3519                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
3521                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
3522                         BPF_MOV64_IMM(BPF_REG_2, 0),
3523                         BPF_MOV64_IMM(BPF_REG_4, 4),
3524                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3525                                      BPF_FUNC_skb_load_bytes),
3526                         BPF_MOV64_IMM(BPF_REG_0, 0),
3527                         BPF_EXIT_INSN(),
3528                 },
3529                 .result = REJECT,
3530                 .errstr = "helper access to the packet",
3531                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3532         },
3533         {
3534                 "helper access to packet: test13, cls helper ok",
3535                 .insns = {
3536                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3537                                     offsetof(struct __sk_buff, data)),
3538                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3539                                     offsetof(struct __sk_buff, data_end)),
3540                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3541                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3542                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3543                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3544                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3545                         BPF_MOV64_IMM(BPF_REG_2, 4),
3546                         BPF_MOV64_IMM(BPF_REG_3, 0),
3547                         BPF_MOV64_IMM(BPF_REG_4, 0),
3548                         BPF_MOV64_IMM(BPF_REG_5, 0),
3549                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3550                                      BPF_FUNC_csum_diff),
3551                         BPF_MOV64_IMM(BPF_REG_0, 0),
3552                         BPF_EXIT_INSN(),
3553                 },
3554                 .result = ACCEPT,
3555                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3556         },
3557         {
3558                 "helper access to packet: test14, cls helper ok sub",
3559                 .insns = {
3560                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3561                                     offsetof(struct __sk_buff, data)),
3562                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3563                                     offsetof(struct __sk_buff, data_end)),
3564                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3565                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3566                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3567                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3568                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
3569                         BPF_MOV64_IMM(BPF_REG_2, 4),
3570                         BPF_MOV64_IMM(BPF_REG_3, 0),
3571                         BPF_MOV64_IMM(BPF_REG_4, 0),
3572                         BPF_MOV64_IMM(BPF_REG_5, 0),
3573                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3574                                      BPF_FUNC_csum_diff),
3575                         BPF_MOV64_IMM(BPF_REG_0, 0),
3576                         BPF_EXIT_INSN(),
3577                 },
3578                 .result = ACCEPT,
3579                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3580         },
3581         {
3582                 "helper access to packet: test15, cls helper fail sub",
3583                 .insns = {
3584                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3585                                     offsetof(struct __sk_buff, data)),
3586                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3587                                     offsetof(struct __sk_buff, data_end)),
3588                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3589                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3590                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3591                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3592                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
3593                         BPF_MOV64_IMM(BPF_REG_2, 4),
3594                         BPF_MOV64_IMM(BPF_REG_3, 0),
3595                         BPF_MOV64_IMM(BPF_REG_4, 0),
3596                         BPF_MOV64_IMM(BPF_REG_5, 0),
3597                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3598                                      BPF_FUNC_csum_diff),
3599                         BPF_MOV64_IMM(BPF_REG_0, 0),
3600                         BPF_EXIT_INSN(),
3601                 },
3602                 .result = REJECT,
3603                 .errstr = "invalid access to packet",
3604                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3605         },
3606         {
3607                 "helper access to packet: test16, cls helper fail range 1",
3608                 .insns = {
3609                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3610                                     offsetof(struct __sk_buff, data)),
3611                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3612                                     offsetof(struct __sk_buff, data_end)),
3613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3614                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3615                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3616                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3617                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3618                         BPF_MOV64_IMM(BPF_REG_2, 8),
3619                         BPF_MOV64_IMM(BPF_REG_3, 0),
3620                         BPF_MOV64_IMM(BPF_REG_4, 0),
3621                         BPF_MOV64_IMM(BPF_REG_5, 0),
3622                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3623                                      BPF_FUNC_csum_diff),
3624                         BPF_MOV64_IMM(BPF_REG_0, 0),
3625                         BPF_EXIT_INSN(),
3626                 },
3627                 .result = REJECT,
3628                 .errstr = "invalid access to packet",
3629                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3630         },
3631         {
3632                 "helper access to packet: test17, cls helper fail range 2",
3633                 .insns = {
3634                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3635                                     offsetof(struct __sk_buff, data)),
3636                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3637                                     offsetof(struct __sk_buff, data_end)),
3638                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3639                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3640                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3641                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3642                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3643                         BPF_MOV64_IMM(BPF_REG_2, -9),
3644                         BPF_MOV64_IMM(BPF_REG_3, 0),
3645                         BPF_MOV64_IMM(BPF_REG_4, 0),
3646                         BPF_MOV64_IMM(BPF_REG_5, 0),
3647                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3648                                      BPF_FUNC_csum_diff),
3649                         BPF_MOV64_IMM(BPF_REG_0, 0),
3650                         BPF_EXIT_INSN(),
3651                 },
3652                 .result = REJECT,
3653                 .errstr = "R2 min value is negative",
3654                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3655         },
3656         {
3657                 "helper access to packet: test18, cls helper fail range 3",
3658                 .insns = {
3659                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3660                                     offsetof(struct __sk_buff, data)),
3661                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3662                                     offsetof(struct __sk_buff, data_end)),
3663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3664                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3665                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3666                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3667                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3668                         BPF_MOV64_IMM(BPF_REG_2, ~0),
3669                         BPF_MOV64_IMM(BPF_REG_3, 0),
3670                         BPF_MOV64_IMM(BPF_REG_4, 0),
3671                         BPF_MOV64_IMM(BPF_REG_5, 0),
3672                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3673                                      BPF_FUNC_csum_diff),
3674                         BPF_MOV64_IMM(BPF_REG_0, 0),
3675                         BPF_EXIT_INSN(),
3676                 },
3677                 .result = REJECT,
3678                 .errstr = "R2 min value is negative",
3679                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3680         },
3681         {
3682                 "helper access to packet: test19, cls helper fail range zero",
3683                 .insns = {
3684                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3685                                     offsetof(struct __sk_buff, data)),
3686                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3687                                     offsetof(struct __sk_buff, data_end)),
3688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3689                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3690                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3691                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3692                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3693                         BPF_MOV64_IMM(BPF_REG_2, 0),
3694                         BPF_MOV64_IMM(BPF_REG_3, 0),
3695                         BPF_MOV64_IMM(BPF_REG_4, 0),
3696                         BPF_MOV64_IMM(BPF_REG_5, 0),
3697                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3698                                      BPF_FUNC_csum_diff),
3699                         BPF_MOV64_IMM(BPF_REG_0, 0),
3700                         BPF_EXIT_INSN(),
3701                 },
3702                 .result = REJECT,
3703                 .errstr = "invalid access to packet",
3704                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3705         },
3706         {
3707                 "helper access to packet: test20, pkt end as input",
3708                 .insns = {
3709                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3710                                     offsetof(struct __sk_buff, data)),
3711                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3712                                     offsetof(struct __sk_buff, data_end)),
3713                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3714                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3715                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3716                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3717                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
3718                         BPF_MOV64_IMM(BPF_REG_2, 4),
3719                         BPF_MOV64_IMM(BPF_REG_3, 0),
3720                         BPF_MOV64_IMM(BPF_REG_4, 0),
3721                         BPF_MOV64_IMM(BPF_REG_5, 0),
3722                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3723                                      BPF_FUNC_csum_diff),
3724                         BPF_MOV64_IMM(BPF_REG_0, 0),
3725                         BPF_EXIT_INSN(),
3726                 },
3727                 .result = REJECT,
3728                 .errstr = "R1 type=pkt_end expected=fp",
3729                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3730         },
3731         {
3732                 "helper access to packet: test21, wrong reg",
3733                 .insns = {
3734                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3735                                     offsetof(struct __sk_buff, data)),
3736                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3737                                     offsetof(struct __sk_buff, data_end)),
3738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3739                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3740                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3741                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3742                         BPF_MOV64_IMM(BPF_REG_2, 4),
3743                         BPF_MOV64_IMM(BPF_REG_3, 0),
3744                         BPF_MOV64_IMM(BPF_REG_4, 0),
3745                         BPF_MOV64_IMM(BPF_REG_5, 0),
3746                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3747                                      BPF_FUNC_csum_diff),
3748                         BPF_MOV64_IMM(BPF_REG_0, 0),
3749                         BPF_EXIT_INSN(),
3750                 },
3751                 .result = REJECT,
3752                 .errstr = "invalid access to packet",
3753                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3754         },
3755         {
3756                 "valid map access into an array with a constant",
3757                 .insns = {
3758                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3759                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3760                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3761                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3762                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3763                                      BPF_FUNC_map_lookup_elem),
3764                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3765                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3766                                    offsetof(struct test_val, foo)),
3767                         BPF_EXIT_INSN(),
3768                 },
3769                 .fixup_map2 = { 3 },
3770                 .errstr_unpriv = "R0 leaks addr",
3771                 .result_unpriv = REJECT,
3772                 .result = ACCEPT,
3773         },
3774         {
3775                 "valid map access into an array with a register",
3776                 .insns = {
3777                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3778                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3779                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3780                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3781                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3782                                      BPF_FUNC_map_lookup_elem),
3783                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3784                         BPF_MOV64_IMM(BPF_REG_1, 4),
3785                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3786                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3787                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3788                                    offsetof(struct test_val, foo)),
3789                         BPF_EXIT_INSN(),
3790                 },
3791                 .fixup_map2 = { 3 },
3792                 .errstr_unpriv = "R0 leaks addr",
3793                 .result_unpriv = REJECT,
3794                 .result = ACCEPT,
3795                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3796         },
3797         {
3798                 "valid map access into an array with a variable",
3799                 .insns = {
3800                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3801                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3802                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3803                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3804                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3805                                      BPF_FUNC_map_lookup_elem),
3806                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3807                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3808                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
3809                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3810                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3811                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3812                                    offsetof(struct test_val, foo)),
3813                         BPF_EXIT_INSN(),
3814                 },
3815                 .fixup_map2 = { 3 },
3816                 .errstr_unpriv = "R0 leaks addr",
3817                 .result_unpriv = REJECT,
3818                 .result = ACCEPT,
3819                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3820         },
3821         {
3822                 "valid map access into an array with a signed variable",
3823                 .insns = {
3824                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3825                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3826                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3827                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3828                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3829                                      BPF_FUNC_map_lookup_elem),
3830                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
3831                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3832                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
3833                         BPF_MOV32_IMM(BPF_REG_1, 0),
3834                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3835                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3836                         BPF_MOV32_IMM(BPF_REG_1, 0),
3837                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3838                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3839                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3840                                    offsetof(struct test_val, foo)),
3841                         BPF_EXIT_INSN(),
3842                 },
3843                 .fixup_map2 = { 3 },
3844                 .errstr_unpriv = "R0 leaks addr",
3845                 .result_unpriv = REJECT,
3846                 .result = ACCEPT,
3847                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3848         },
3849         {
3850                 "invalid map access into an array with a constant",
3851                 .insns = {
3852                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3853                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3855                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3856                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3857                                      BPF_FUNC_map_lookup_elem),
3858                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3859                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
3860                                    offsetof(struct test_val, foo)),
3861                         BPF_EXIT_INSN(),
3862                 },
3863                 .fixup_map2 = { 3 },
3864                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
3865                 .result = REJECT,
3866         },
3867         {
3868                 "invalid map access into an array with a register",
3869                 .insns = {
3870                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3871                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3872                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3873                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3874                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3875                                      BPF_FUNC_map_lookup_elem),
3876                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3877                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
3878                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3879                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3880                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3881                                    offsetof(struct test_val, foo)),
3882                         BPF_EXIT_INSN(),
3883                 },
3884                 .fixup_map2 = { 3 },
3885                 .errstr = "R0 min value is outside of the array range",
3886                 .result = REJECT,
3887                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3888         },
3889         {
3890                 "invalid map access into an array with a variable",
3891                 .insns = {
3892                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3893                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3895                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3896                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3897                                      BPF_FUNC_map_lookup_elem),
3898                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3899                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3900                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3901                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3902                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3903                                    offsetof(struct test_val, foo)),
3904                         BPF_EXIT_INSN(),
3905                 },
3906                 .fixup_map2 = { 3 },
3907                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
3908                 .result = REJECT,
3909                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3910         },
3911         {
3912                 "invalid map access into an array with no floor check",
3913                 .insns = {
3914                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3915                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3916                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3917                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3918                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3919                                      BPF_FUNC_map_lookup_elem),
3920                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3921                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
3922                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3923                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3924                         BPF_MOV32_IMM(BPF_REG_1, 0),
3925                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3926                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3927                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3928                                    offsetof(struct test_val, foo)),
3929                         BPF_EXIT_INSN(),
3930                 },
3931                 .fixup_map2 = { 3 },
3932                 .errstr_unpriv = "R0 leaks addr",
3933                 .errstr = "R0 unbounded memory access",
3934                 .result_unpriv = REJECT,
3935                 .result = REJECT,
3936                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3937         },
3938         {
3939                 "invalid map access into an array with a invalid max check",
3940                 .insns = {
3941                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3942                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3943                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3944                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3945                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3946                                      BPF_FUNC_map_lookup_elem),
3947                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3948                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3949                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
3950                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3951                         BPF_MOV32_IMM(BPF_REG_1, 0),
3952                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3953                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3954                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3955                                    offsetof(struct test_val, foo)),
3956                         BPF_EXIT_INSN(),
3957                 },
3958                 .fixup_map2 = { 3 },
3959                 .errstr_unpriv = "R0 leaks addr",
3960                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
3961                 .result_unpriv = REJECT,
3962                 .result = REJECT,
3963                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3964         },
3965         {
3966                 "invalid map access into an array with a invalid max check",
3967                 .insns = {
3968                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3969                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3970                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3971                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3972                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3973                                      BPF_FUNC_map_lookup_elem),
3974                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3975                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3976                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3978                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3979                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3980                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3981                                      BPF_FUNC_map_lookup_elem),
3982                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3983                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
3984                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3985                                     offsetof(struct test_val, foo)),
3986                         BPF_EXIT_INSN(),
3987                 },
3988                 .fixup_map2 = { 3, 11 },
3989                 .errstr = "R0 pointer += pointer",
3990                 .result = REJECT,
3991                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3992         },
3993         {
3994                 "multiple registers share map_lookup_elem result",
3995                 .insns = {
3996                         BPF_MOV64_IMM(BPF_REG_1, 10),
3997                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3998                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3999                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4000                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4001                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4002                                      BPF_FUNC_map_lookup_elem),
4003                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4004                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4005                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4006                         BPF_EXIT_INSN(),
4007                 },
4008                 .fixup_map1 = { 4 },
4009                 .result = ACCEPT,
4010                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4011         },
4012         {
4013                 "alu ops on ptr_to_map_value_or_null, 1",
4014                 .insns = {
4015                         BPF_MOV64_IMM(BPF_REG_1, 10),
4016                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4017                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4018                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4019                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4020                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4021                                      BPF_FUNC_map_lookup_elem),
4022                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4024                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4025                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4026                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4027                         BPF_EXIT_INSN(),
4028                 },
4029                 .fixup_map1 = { 4 },
4030                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4031                 .result = REJECT,
4032                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4033         },
4034         {
4035                 "alu ops on ptr_to_map_value_or_null, 2",
4036                 .insns = {
4037                         BPF_MOV64_IMM(BPF_REG_1, 10),
4038                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4039                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4041                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4042                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4043                                      BPF_FUNC_map_lookup_elem),
4044                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4045                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4046                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4047                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4048                         BPF_EXIT_INSN(),
4049                 },
4050                 .fixup_map1 = { 4 },
4051                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4052                 .result = REJECT,
4053                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4054         },
4055         {
4056                 "alu ops on ptr_to_map_value_or_null, 3",
4057                 .insns = {
4058                         BPF_MOV64_IMM(BPF_REG_1, 10),
4059                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4060                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4061                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4062                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4063                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4064                                      BPF_FUNC_map_lookup_elem),
4065                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4066                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4067                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4068                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4069                         BPF_EXIT_INSN(),
4070                 },
4071                 .fixup_map1 = { 4 },
4072                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4073                 .result = REJECT,
4074                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4075         },
4076         {
4077                 "invalid memory access with multiple map_lookup_elem calls",
4078                 .insns = {
4079                         BPF_MOV64_IMM(BPF_REG_1, 10),
4080                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4081                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4082                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4083                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4084                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4085                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4086                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4087                                      BPF_FUNC_map_lookup_elem),
4088                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4089                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4090                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4091                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4092                                      BPF_FUNC_map_lookup_elem),
4093                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4094                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4095                         BPF_EXIT_INSN(),
4096                 },
4097                 .fixup_map1 = { 4 },
4098                 .result = REJECT,
4099                 .errstr = "R4 !read_ok",
4100                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4101         },
4102         {
4103                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4104                 .insns = {
4105                         BPF_MOV64_IMM(BPF_REG_1, 10),
4106                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4107                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4108                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4109                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4110                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4111                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4112                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4113                                      BPF_FUNC_map_lookup_elem),
4114                         BPF_MOV64_IMM(BPF_REG_2, 10),
4115                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4116                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4117                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4118                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4119                                      BPF_FUNC_map_lookup_elem),
4120                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4121                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4122                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4123                         BPF_EXIT_INSN(),
4124                 },
4125                 .fixup_map1 = { 4 },
4126                 .result = ACCEPT,
4127                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4128         },
4129         {
4130                 "invalid map access from else condition",
4131                 .insns = {
4132                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4133                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4135                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4136                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4137                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4138                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4139                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4140                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4141                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4142                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4143                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4144                         BPF_EXIT_INSN(),
4145                 },
4146                 .fixup_map2 = { 3 },
4147                 .errstr = "R0 unbounded memory access",
4148                 .result = REJECT,
4149                 .errstr_unpriv = "R0 leaks addr",
4150                 .result_unpriv = REJECT,
4151                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4152         },
4153         {
4154                 "constant register |= constant should keep constant type",
4155                 .insns = {
4156                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4157                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4158                         BPF_MOV64_IMM(BPF_REG_2, 34),
4159                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4160                         BPF_MOV64_IMM(BPF_REG_3, 0),
4161                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4162                         BPF_EXIT_INSN(),
4163                 },
4164                 .result = ACCEPT,
4165                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4166         },
4167         {
4168                 "constant register |= constant should not bypass stack boundary checks",
4169                 .insns = {
4170                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4171                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4172                         BPF_MOV64_IMM(BPF_REG_2, 34),
4173                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4174                         BPF_MOV64_IMM(BPF_REG_3, 0),
4175                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4176                         BPF_EXIT_INSN(),
4177                 },
4178                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4179                 .result = REJECT,
4180                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4181         },
4182         {
4183                 "constant register |= constant register should keep constant type",
4184                 .insns = {
4185                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4186                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4187                         BPF_MOV64_IMM(BPF_REG_2, 34),
4188                         BPF_MOV64_IMM(BPF_REG_4, 13),
4189                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4190                         BPF_MOV64_IMM(BPF_REG_3, 0),
4191                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4192                         BPF_EXIT_INSN(),
4193                 },
4194                 .result = ACCEPT,
4195                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4196         },
4197         {
4198                 "constant register |= constant register should not bypass stack boundary checks",
4199                 .insns = {
4200                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4201                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4202                         BPF_MOV64_IMM(BPF_REG_2, 34),
4203                         BPF_MOV64_IMM(BPF_REG_4, 24),
4204                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4205                         BPF_MOV64_IMM(BPF_REG_3, 0),
4206                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4207                         BPF_EXIT_INSN(),
4208                 },
4209                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4210                 .result = REJECT,
4211                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4212         },
4213         {
4214                 "invalid direct packet write for LWT_IN",
4215                 .insns = {
4216                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4217                                     offsetof(struct __sk_buff, data)),
4218                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4219                                     offsetof(struct __sk_buff, data_end)),
4220                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4221                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4222                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4223                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4224                         BPF_MOV64_IMM(BPF_REG_0, 0),
4225                         BPF_EXIT_INSN(),
4226                 },
4227                 .errstr = "cannot write into packet",
4228                 .result = REJECT,
4229                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4230         },
4231         {
4232                 "invalid direct packet write for LWT_OUT",
4233                 .insns = {
4234                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4235                                     offsetof(struct __sk_buff, data)),
4236                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4237                                     offsetof(struct __sk_buff, data_end)),
4238                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4239                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4240                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4241                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4242                         BPF_MOV64_IMM(BPF_REG_0, 0),
4243                         BPF_EXIT_INSN(),
4244                 },
4245                 .errstr = "cannot write into packet",
4246                 .result = REJECT,
4247                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4248         },
4249         {
4250                 "direct packet write for LWT_XMIT",
4251                 .insns = {
4252                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4253                                     offsetof(struct __sk_buff, data)),
4254                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4255                                     offsetof(struct __sk_buff, data_end)),
4256                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4257                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4258                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4259                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4260                         BPF_MOV64_IMM(BPF_REG_0, 0),
4261                         BPF_EXIT_INSN(),
4262                 },
4263                 .result = ACCEPT,
4264                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4265         },
4266         {
4267                 "direct packet read for LWT_IN",
4268                 .insns = {
4269                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4270                                     offsetof(struct __sk_buff, data)),
4271                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4272                                     offsetof(struct __sk_buff, data_end)),
4273                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4275                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4276                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4277                         BPF_MOV64_IMM(BPF_REG_0, 0),
4278                         BPF_EXIT_INSN(),
4279                 },
4280                 .result = ACCEPT,
4281                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4282         },
4283         {
4284                 "direct packet read for LWT_OUT",
4285                 .insns = {
4286                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4287                                     offsetof(struct __sk_buff, data)),
4288                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4289                                     offsetof(struct __sk_buff, data_end)),
4290                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4291                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4292                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4293                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4294                         BPF_MOV64_IMM(BPF_REG_0, 0),
4295                         BPF_EXIT_INSN(),
4296                 },
4297                 .result = ACCEPT,
4298                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4299         },
4300         {
4301                 "direct packet read for LWT_XMIT",
4302                 .insns = {
4303                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4304                                     offsetof(struct __sk_buff, data)),
4305                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4306                                     offsetof(struct __sk_buff, data_end)),
4307                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4308                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4309                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4310                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4311                         BPF_MOV64_IMM(BPF_REG_0, 0),
4312                         BPF_EXIT_INSN(),
4313                 },
4314                 .result = ACCEPT,
4315                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4316         },
4317         {
4318                 "overlapping checks for direct packet access",
4319                 .insns = {
4320                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4321                                     offsetof(struct __sk_buff, data)),
4322                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4323                                     offsetof(struct __sk_buff, data_end)),
4324                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4325                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4326                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
4327                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4328                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
4329                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
4330                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
4331                         BPF_MOV64_IMM(BPF_REG_0, 0),
4332                         BPF_EXIT_INSN(),
4333                 },
4334                 .result = ACCEPT,
4335                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4336         },
4337         {
4338                 "invalid access of tc_classid for LWT_IN",
4339                 .insns = {
4340                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4341                                     offsetof(struct __sk_buff, tc_classid)),
4342                         BPF_EXIT_INSN(),
4343                 },
4344                 .result = REJECT,
4345                 .errstr = "invalid bpf_context access",
4346         },
4347         {
4348                 "invalid access of tc_classid for LWT_OUT",
4349                 .insns = {
4350                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4351                                     offsetof(struct __sk_buff, tc_classid)),
4352                         BPF_EXIT_INSN(),
4353                 },
4354                 .result = REJECT,
4355                 .errstr = "invalid bpf_context access",
4356         },
4357         {
4358                 "invalid access of tc_classid for LWT_XMIT",
4359                 .insns = {
4360                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4361                                     offsetof(struct __sk_buff, tc_classid)),
4362                         BPF_EXIT_INSN(),
4363                 },
4364                 .result = REJECT,
4365                 .errstr = "invalid bpf_context access",
4366         },
4367         {
4368                 "leak pointer into ctx 1",
4369                 .insns = {
4370                         BPF_MOV64_IMM(BPF_REG_0, 0),
4371                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4372                                     offsetof(struct __sk_buff, cb[0])),
4373                         BPF_LD_MAP_FD(BPF_REG_2, 0),
4374                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
4375                                       offsetof(struct __sk_buff, cb[0])),
4376                         BPF_EXIT_INSN(),
4377                 },
4378                 .fixup_map1 = { 2 },
4379                 .errstr_unpriv = "R2 leaks addr into mem",
4380                 .result_unpriv = REJECT,
4381                 .result = REJECT,
4382                 .errstr = "BPF_XADD stores into R1 context is not allowed",
4383         },
4384         {
4385                 "leak pointer into ctx 2",
4386                 .insns = {
4387                         BPF_MOV64_IMM(BPF_REG_0, 0),
4388                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4389                                     offsetof(struct __sk_buff, cb[0])),
4390                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
4391                                       offsetof(struct __sk_buff, cb[0])),
4392                         BPF_EXIT_INSN(),
4393                 },
4394                 .errstr_unpriv = "R10 leaks addr into mem",
4395                 .result_unpriv = REJECT,
4396                 .result = REJECT,
4397                 .errstr = "BPF_XADD stores into R1 context is not allowed",
4398         },
4399         {
4400                 "leak pointer into ctx 3",
4401                 .insns = {
4402                         BPF_MOV64_IMM(BPF_REG_0, 0),
4403                         BPF_LD_MAP_FD(BPF_REG_2, 0),
4404                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
4405                                       offsetof(struct __sk_buff, cb[0])),
4406                         BPF_EXIT_INSN(),
4407                 },
4408                 .fixup_map1 = { 1 },
4409                 .errstr_unpriv = "R2 leaks addr into ctx",
4410                 .result_unpriv = REJECT,
4411                 .result = ACCEPT,
4412         },
4413         {
4414                 "leak pointer into map val",
4415                 .insns = {
4416                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
4417                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4418                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4419                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4420                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4421                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4422                                      BPF_FUNC_map_lookup_elem),
4423                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4424                         BPF_MOV64_IMM(BPF_REG_3, 0),
4425                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
4426                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
4427                         BPF_MOV64_IMM(BPF_REG_0, 0),
4428                         BPF_EXIT_INSN(),
4429                 },
4430                 .fixup_map1 = { 4 },
4431                 .errstr_unpriv = "R6 leaks addr into mem",
4432                 .result_unpriv = REJECT,
4433                 .result = ACCEPT,
4434         },
4435         {
4436                 "helper access to map: full range",
4437                 .insns = {
4438                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4439                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4440                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4441                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4442                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4443                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4444                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4445                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4446                         BPF_MOV64_IMM(BPF_REG_3, 0),
4447                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4448                         BPF_EXIT_INSN(),
4449                 },
4450                 .fixup_map2 = { 3 },
4451                 .result = ACCEPT,
4452                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4453         },
4454         {
4455                 "helper access to map: partial range",
4456                 .insns = {
4457                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4458                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4459                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4460                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4461                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4462                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4463                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4464                         BPF_MOV64_IMM(BPF_REG_2, 8),
4465                         BPF_MOV64_IMM(BPF_REG_3, 0),
4466                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4467                         BPF_EXIT_INSN(),
4468                 },
4469                 .fixup_map2 = { 3 },
4470                 .result = ACCEPT,
4471                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4472         },
4473         {
4474                 "helper access to map: empty range",
4475                 .insns = {
4476                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4477                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4478                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4479                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4480                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4481                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4482                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4483                         BPF_MOV64_IMM(BPF_REG_2, 0),
4484                         BPF_MOV64_IMM(BPF_REG_3, 0),
4485                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4486                         BPF_EXIT_INSN(),
4487                 },
4488                 .fixup_map2 = { 3 },
4489                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
4490                 .result = REJECT,
4491                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4492         },
4493         {
4494                 "helper access to map: out-of-bound range",
4495                 .insns = {
4496                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4497                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4498                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4499                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4500                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4501                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4502                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4503                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
4504                         BPF_MOV64_IMM(BPF_REG_3, 0),
4505                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4506                         BPF_EXIT_INSN(),
4507                 },
4508                 .fixup_map2 = { 3 },
4509                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
4510                 .result = REJECT,
4511                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4512         },
4513         {
4514                 "helper access to map: negative range",
4515                 .insns = {
4516                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4518                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4519                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4520                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4521                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4522                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4523                         BPF_MOV64_IMM(BPF_REG_2, -8),
4524                         BPF_MOV64_IMM(BPF_REG_3, 0),
4525                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4526                         BPF_EXIT_INSN(),
4527                 },
4528                 .fixup_map2 = { 3 },
4529                 .errstr = "R2 min value is negative",
4530                 .result = REJECT,
4531                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4532         },
4533         {
4534                 "helper access to adjusted map (via const imm): full range",
4535                 .insns = {
4536                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4537                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4538                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4539                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4540                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4541                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4542                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4543                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4544                                 offsetof(struct test_val, foo)),
4545                         BPF_MOV64_IMM(BPF_REG_2,
4546                                 sizeof(struct test_val) -
4547                                 offsetof(struct test_val, foo)),
4548                         BPF_MOV64_IMM(BPF_REG_3, 0),
4549                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4550                         BPF_EXIT_INSN(),
4551                 },
4552                 .fixup_map2 = { 3 },
4553                 .result = ACCEPT,
4554                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4555         },
4556         {
4557                 "helper access to adjusted map (via const imm): partial range",
4558                 .insns = {
4559                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4560                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4561                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4562                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4563                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4564                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4565                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4566                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4567                                 offsetof(struct test_val, foo)),
4568                         BPF_MOV64_IMM(BPF_REG_2, 8),
4569                         BPF_MOV64_IMM(BPF_REG_3, 0),
4570                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4571                         BPF_EXIT_INSN(),
4572                 },
4573                 .fixup_map2 = { 3 },
4574                 .result = ACCEPT,
4575                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4576         },
4577         {
4578                 "helper access to adjusted map (via const imm): empty range",
4579                 .insns = {
4580                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4581                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4582                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4583                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4584                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4585                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4586                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4587                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4588                                 offsetof(struct test_val, foo)),
4589                         BPF_MOV64_IMM(BPF_REG_2, 0),
4590                         BPF_MOV64_IMM(BPF_REG_3, 0),
4591                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4592                         BPF_EXIT_INSN(),
4593                 },
4594                 .fixup_map2 = { 3 },
4595                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
4596                 .result = REJECT,
4597                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4598         },
4599         {
4600                 "helper access to adjusted map (via const imm): out-of-bound range",
4601                 .insns = {
4602                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4604                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4605                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4606                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4607                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4608                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4609                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4610                                 offsetof(struct test_val, foo)),
4611                         BPF_MOV64_IMM(BPF_REG_2,
4612                                 sizeof(struct test_val) -
4613                                 offsetof(struct test_val, foo) + 8),
4614                         BPF_MOV64_IMM(BPF_REG_3, 0),
4615                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4616                         BPF_EXIT_INSN(),
4617                 },
4618                 .fixup_map2 = { 3 },
4619                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4620                 .result = REJECT,
4621                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4622         },
4623         {
4624                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
4625                 .insns = {
4626                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4627                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4628                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4629                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4630                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4631                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4632                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4634                                 offsetof(struct test_val, foo)),
4635                         BPF_MOV64_IMM(BPF_REG_2, -8),
4636                         BPF_MOV64_IMM(BPF_REG_3, 0),
4637                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4638                         BPF_EXIT_INSN(),
4639                 },
4640                 .fixup_map2 = { 3 },
4641                 .errstr = "R2 min value is negative",
4642                 .result = REJECT,
4643                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4644         },
4645         {
4646                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
4647                 .insns = {
4648                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4649                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4650                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4651                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4652                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4653                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4654                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4655                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4656                                 offsetof(struct test_val, foo)),
4657                         BPF_MOV64_IMM(BPF_REG_2, -1),
4658                         BPF_MOV64_IMM(BPF_REG_3, 0),
4659                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4660                         BPF_EXIT_INSN(),
4661                 },
4662                 .fixup_map2 = { 3 },
4663                 .errstr = "R2 min value is negative",
4664                 .result = REJECT,
4665                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4666         },
4667         {
4668                 "helper access to adjusted map (via const reg): full range",
4669                 .insns = {
4670                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4671                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4672                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4673                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4674                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4675                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4676                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4677                         BPF_MOV64_IMM(BPF_REG_3,
4678                                 offsetof(struct test_val, foo)),
4679                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4680                         BPF_MOV64_IMM(BPF_REG_2,
4681                                 sizeof(struct test_val) -
4682                                 offsetof(struct test_val, foo)),
4683                         BPF_MOV64_IMM(BPF_REG_3, 0),
4684                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4685                         BPF_EXIT_INSN(),
4686                 },
4687                 .fixup_map2 = { 3 },
4688                 .result = ACCEPT,
4689                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4690         },
4691         {
4692                 "helper access to adjusted map (via const reg): partial range",
4693                 .insns = {
4694                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4696                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4697                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4698                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4699                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4700                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4701                         BPF_MOV64_IMM(BPF_REG_3,
4702                                 offsetof(struct test_val, foo)),
4703                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4704                         BPF_MOV64_IMM(BPF_REG_2, 8),
4705                         BPF_MOV64_IMM(BPF_REG_3, 0),
4706                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4707                         BPF_EXIT_INSN(),
4708                 },
4709                 .fixup_map2 = { 3 },
4710                 .result = ACCEPT,
4711                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4712         },
4713         {
4714                 "helper access to adjusted map (via const reg): empty range",
4715                 .insns = {
4716                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4717                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4718                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4719                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4720                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4721                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4722                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4723                         BPF_MOV64_IMM(BPF_REG_3, 0),
4724                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4725                         BPF_MOV64_IMM(BPF_REG_2, 0),
4726                         BPF_MOV64_IMM(BPF_REG_3, 0),
4727                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4728                         BPF_EXIT_INSN(),
4729                 },
4730                 .fixup_map2 = { 3 },
4731                 .errstr = "R1 min value is outside of the array range",
4732                 .result = REJECT,
4733                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4734         },
4735         {
4736                 "helper access to adjusted map (via const reg): out-of-bound range",
4737                 .insns = {
4738                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4740                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4741                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4742                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4743                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4744                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4745                         BPF_MOV64_IMM(BPF_REG_3,
4746                                 offsetof(struct test_val, foo)),
4747                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4748                         BPF_MOV64_IMM(BPF_REG_2,
4749                                 sizeof(struct test_val) -
4750                                 offsetof(struct test_val, foo) + 8),
4751                         BPF_MOV64_IMM(BPF_REG_3, 0),
4752                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4753                         BPF_EXIT_INSN(),
4754                 },
4755                 .fixup_map2 = { 3 },
4756                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
4757                 .result = REJECT,
4758                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4759         },
4760         {
4761                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
4762                 .insns = {
4763                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4765                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4766                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4767                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4768                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4769                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4770                         BPF_MOV64_IMM(BPF_REG_3,
4771                                 offsetof(struct test_val, foo)),
4772                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4773                         BPF_MOV64_IMM(BPF_REG_2, -8),
4774                         BPF_MOV64_IMM(BPF_REG_3, 0),
4775                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4776                         BPF_EXIT_INSN(),
4777                 },
4778                 .fixup_map2 = { 3 },
4779                 .errstr = "R2 min value is negative",
4780                 .result = REJECT,
4781                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4782         },
4783         {
4784                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4785                 .insns = {
4786                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4788                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4789                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4790                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4791                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4792                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4793                         BPF_MOV64_IMM(BPF_REG_3,
4794                                 offsetof(struct test_val, foo)),
4795                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4796                         BPF_MOV64_IMM(BPF_REG_2, -1),
4797                         BPF_MOV64_IMM(BPF_REG_3, 0),
4798                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4799                         BPF_EXIT_INSN(),
4800                 },
4801                 .fixup_map2 = { 3 },
4802                 .errstr = "R2 min value is negative",
4803                 .result = REJECT,
4804                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4805         },
4806         {
4807                 "helper access to adjusted map (via variable): full range",
4808                 .insns = {
4809                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4810                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4811                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4812                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4813                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4814                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4815                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4816                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4817                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4818                                 offsetof(struct test_val, foo), 4),
4819                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4820                         BPF_MOV64_IMM(BPF_REG_2,
4821                                 sizeof(struct test_val) -
4822                                 offsetof(struct test_val, foo)),
4823                         BPF_MOV64_IMM(BPF_REG_3, 0),
4824                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4825                         BPF_EXIT_INSN(),
4826                 },
4827                 .fixup_map2 = { 3 },
4828                 .result = ACCEPT,
4829                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4830         },
4831         {
4832                 "helper access to adjusted map (via variable): partial range",
4833                 .insns = {
4834                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4836                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4837                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4838                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4839                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4840                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4841                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4842                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4843                                 offsetof(struct test_val, foo), 4),
4844                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4845                         BPF_MOV64_IMM(BPF_REG_2, 8),
4846                         BPF_MOV64_IMM(BPF_REG_3, 0),
4847                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4848                         BPF_EXIT_INSN(),
4849                 },
4850                 .fixup_map2 = { 3 },
4851                 .result = ACCEPT,
4852                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4853         },
4854         {
4855                 "helper access to adjusted map (via variable): empty range",
4856                 .insns = {
4857                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4858                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4859                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4860                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4861                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4862                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4863                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4864                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4865                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4866                                 offsetof(struct test_val, foo), 4),
4867                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4868                         BPF_MOV64_IMM(BPF_REG_2, 0),
4869                         BPF_MOV64_IMM(BPF_REG_3, 0),
4870                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4871                         BPF_EXIT_INSN(),
4872                 },
4873                 .fixup_map2 = { 3 },
4874                 .errstr = "R1 min value is outside of the array range",
4875                 .result = REJECT,
4876                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4877         },
4878         {
4879                 "helper access to adjusted map (via variable): no max check",
4880                 .insns = {
4881                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4882                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4883                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4884                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4885                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4886                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4887                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4888                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4889                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4890                         BPF_MOV64_IMM(BPF_REG_2, 1),
4891                         BPF_MOV64_IMM(BPF_REG_3, 0),
4892                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4893                         BPF_EXIT_INSN(),
4894                 },
4895                 .fixup_map2 = { 3 },
4896                 .errstr = "R1 unbounded memory access",
4897                 .result = REJECT,
4898                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4899         },
4900         {
4901                 "helper access to adjusted map (via variable): wrong max check",
4902                 .insns = {
4903                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4904                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4905                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4906                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4907                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4908                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4909                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4910                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4911                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4912                                 offsetof(struct test_val, foo), 4),
4913                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4914                         BPF_MOV64_IMM(BPF_REG_2,
4915                                 sizeof(struct test_val) -
4916                                 offsetof(struct test_val, foo) + 1),
4917                         BPF_MOV64_IMM(BPF_REG_3, 0),
4918                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4919                         BPF_EXIT_INSN(),
4920                 },
4921                 .fixup_map2 = { 3 },
4922                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
4923                 .result = REJECT,
4924                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4925         },
4926         {
4927                 "helper access to map: bounds check using <, good access",
4928                 .insns = {
4929                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4930                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4931                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4932                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4933                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4934                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4935                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4936                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4937                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
4938                         BPF_MOV64_IMM(BPF_REG_0, 0),
4939                         BPF_EXIT_INSN(),
4940                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4941                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4942                         BPF_MOV64_IMM(BPF_REG_0, 0),
4943                         BPF_EXIT_INSN(),
4944                 },
4945                 .fixup_map2 = { 3 },
4946                 .result = ACCEPT,
4947                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4948         },
4949         {
4950                 "helper access to map: bounds check using <, bad access",
4951                 .insns = {
4952                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4954                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4955                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4956                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4957                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4958                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4959                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4960                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
4961                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4962                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4963                         BPF_MOV64_IMM(BPF_REG_0, 0),
4964                         BPF_EXIT_INSN(),
4965                         BPF_MOV64_IMM(BPF_REG_0, 0),
4966                         BPF_EXIT_INSN(),
4967                 },
4968                 .fixup_map2 = { 3 },
4969                 .result = REJECT,
4970                 .errstr = "R1 unbounded memory access",
4971                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4972         },
4973         {
4974                 "helper access to map: bounds check using <=, good access",
4975                 .insns = {
4976                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4978                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4979                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4980                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4981                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4982                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4983                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4984                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
4985                         BPF_MOV64_IMM(BPF_REG_0, 0),
4986                         BPF_EXIT_INSN(),
4987                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4988                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
4989                         BPF_MOV64_IMM(BPF_REG_0, 0),
4990                         BPF_EXIT_INSN(),
4991                 },
4992                 .fixup_map2 = { 3 },
4993                 .result = ACCEPT,
4994                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4995         },
4996         {
4997                 "helper access to map: bounds check using <=, bad access",
4998                 .insns = {
4999                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5000                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5001                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5002                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5003                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5004                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5005                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5006                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5007                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5008                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5009                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5010                         BPF_MOV64_IMM(BPF_REG_0, 0),
5011                         BPF_EXIT_INSN(),
5012                         BPF_MOV64_IMM(BPF_REG_0, 0),
5013                         BPF_EXIT_INSN(),
5014                 },
5015                 .fixup_map2 = { 3 },
5016                 .result = REJECT,
5017                 .errstr = "R1 unbounded memory access",
5018                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5019         },
5020         {
5021                 "helper access to map: bounds check using s<, good access",
5022                 .insns = {
5023                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5024                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5025                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5026                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5027                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5028                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5029                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5030                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5031                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5032                         BPF_MOV64_IMM(BPF_REG_0, 0),
5033                         BPF_EXIT_INSN(),
5034                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5035                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5036                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5037                         BPF_MOV64_IMM(BPF_REG_0, 0),
5038                         BPF_EXIT_INSN(),
5039                 },
5040                 .fixup_map2 = { 3 },
5041                 .result = ACCEPT,
5042                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5043         },
5044         {
5045                 "helper access to map: bounds check using s<, good access 2",
5046                 .insns = {
5047                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5048                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5049                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5050                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5051                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5052                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5053                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5054                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5055                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5056                         BPF_MOV64_IMM(BPF_REG_0, 0),
5057                         BPF_EXIT_INSN(),
5058                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5059                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5060                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5061                         BPF_MOV64_IMM(BPF_REG_0, 0),
5062                         BPF_EXIT_INSN(),
5063                 },
5064                 .fixup_map2 = { 3 },
5065                 .result = ACCEPT,
5066                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5067         },
5068         {
5069                 "helper access to map: bounds check using s<, bad access",
5070                 .insns = {
5071                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5072                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5073                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5074                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5075                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5076                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5077                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5078                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5079                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5080                         BPF_MOV64_IMM(BPF_REG_0, 0),
5081                         BPF_EXIT_INSN(),
5082                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5083                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5084                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5085                         BPF_MOV64_IMM(BPF_REG_0, 0),
5086                         BPF_EXIT_INSN(),
5087                 },
5088                 .fixup_map2 = { 3 },
5089                 .result = REJECT,
5090                 .errstr = "R1 min value is negative",
5091                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5092         },
5093         {
5094                 "helper access to map: bounds check using s<=, good access",
5095                 .insns = {
5096                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5097                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5098                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5099                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5100                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5101                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5102                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5103                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5104                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5105                         BPF_MOV64_IMM(BPF_REG_0, 0),
5106                         BPF_EXIT_INSN(),
5107                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5108                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5109                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5110                         BPF_MOV64_IMM(BPF_REG_0, 0),
5111                         BPF_EXIT_INSN(),
5112                 },
5113                 .fixup_map2 = { 3 },
5114                 .result = ACCEPT,
5115                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5116         },
5117         {
5118                 "helper access to map: bounds check using s<=, good access 2",
5119                 .insns = {
5120                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5121                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5122                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5123                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5124                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5125                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5126                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5127                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5128                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5129                         BPF_MOV64_IMM(BPF_REG_0, 0),
5130                         BPF_EXIT_INSN(),
5131                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5132                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5133                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5134                         BPF_MOV64_IMM(BPF_REG_0, 0),
5135                         BPF_EXIT_INSN(),
5136                 },
5137                 .fixup_map2 = { 3 },
5138                 .result = ACCEPT,
5139                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5140         },
5141         {
5142                 "helper access to map: bounds check using s<=, bad access",
5143                 .insns = {
5144                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5145                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5146                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5147                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5148                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5149                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5150                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5151                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5152                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5153                         BPF_MOV64_IMM(BPF_REG_0, 0),
5154                         BPF_EXIT_INSN(),
5155                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5156                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5157                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5158                         BPF_MOV64_IMM(BPF_REG_0, 0),
5159                         BPF_EXIT_INSN(),
5160                 },
5161                 .fixup_map2 = { 3 },
5162                 .result = REJECT,
5163                 .errstr = "R1 min value is negative",
5164                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5165         },
5166         {
5167                 "map element value is preserved across register spilling",
5168                 .insns = {
5169                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5172                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5173                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5174                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5175                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5176                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5177                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5178                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5179                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5180                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5181                         BPF_EXIT_INSN(),
5182                 },
5183                 .fixup_map2 = { 3 },
5184                 .errstr_unpriv = "R0 leaks addr",
5185                 .result = ACCEPT,
5186                 .result_unpriv = REJECT,
5187         },
5188         {
5189                 "map element value or null is marked on register spilling",
5190                 .insns = {
5191                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5192                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5193                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5194                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5195                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5196                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
5198                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5200                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5201                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5202                         BPF_EXIT_INSN(),
5203                 },
5204                 .fixup_map2 = { 3 },
5205                 .errstr_unpriv = "R0 leaks addr",
5206                 .result = ACCEPT,
5207                 .result_unpriv = REJECT,
5208         },
5209         {
5210                 "map element value store of cleared call register",
5211                 .insns = {
5212                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5213                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5214                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5215                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5216                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5217                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5218                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
5219                         BPF_EXIT_INSN(),
5220                 },
5221                 .fixup_map2 = { 3 },
5222                 .errstr_unpriv = "R1 !read_ok",
5223                 .errstr = "R1 !read_ok",
5224                 .result = REJECT,
5225                 .result_unpriv = REJECT,
5226         },
5227         {
5228                 "map element value with unaligned store",
5229                 .insns = {
5230                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5231                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5232                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5233                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5234                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5235                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
5236                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5237                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5238                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
5239                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
5240                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5241                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
5242                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
5243                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
5244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
5245                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
5246                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
5247                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
5248                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
5249                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
5250                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
5251                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
5252                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
5253                         BPF_EXIT_INSN(),
5254                 },
5255                 .fixup_map2 = { 3 },
5256                 .errstr_unpriv = "R0 leaks addr",
5257                 .result = ACCEPT,
5258                 .result_unpriv = REJECT,
5259                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5260         },
5261         {
5262                 "map element value with unaligned load",
5263                 .insns = {
5264                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5265                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5266                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5267                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5268                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5269                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5270                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5271                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
5272                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5273                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5274                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
5275                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5276                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
5277                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
5278                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
5279                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5280                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
5281                         BPF_EXIT_INSN(),
5282                 },
5283                 .fixup_map2 = { 3 },
5284                 .errstr_unpriv = "R0 leaks addr",
5285                 .result = ACCEPT,
5286                 .result_unpriv = REJECT,
5287                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5288         },
5289         {
5290                 "map element value illegal alu op, 1",
5291                 .insns = {
5292                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5293                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5294                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5295                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5296                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5297                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5298                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
5299                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5300                         BPF_EXIT_INSN(),
5301                 },
5302                 .fixup_map2 = { 3 },
5303                 .errstr = "R0 bitwise operator &= on pointer",
5304                 .result = REJECT,
5305         },
5306         {
5307                 "map element value illegal alu op, 2",
5308                 .insns = {
5309                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5310                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5311                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5312                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5313                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5314                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5315                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
5316                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5317                         BPF_EXIT_INSN(),
5318                 },
5319                 .fixup_map2 = { 3 },
5320                 .errstr = "R0 32-bit pointer arithmetic prohibited",
5321                 .result = REJECT,
5322         },
5323         {
5324                 "map element value illegal alu op, 3",
5325                 .insns = {
5326                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5327                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5328                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5329                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5330                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5331                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5332                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
5333                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5334                         BPF_EXIT_INSN(),
5335                 },
5336                 .fixup_map2 = { 3 },
5337                 .errstr = "R0 pointer arithmetic with /= operator",
5338                 .result = REJECT,
5339         },
5340         {
5341                 "map element value illegal alu op, 4",
5342                 .insns = {
5343                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5344                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5345                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5346                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5347                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5348                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5349                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
5350                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5351                         BPF_EXIT_INSN(),
5352                 },
5353                 .fixup_map2 = { 3 },
5354                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5355                 .errstr = "invalid mem access 'inv'",
5356                 .result = REJECT,
5357                 .result_unpriv = REJECT,
5358         },
5359         {
5360                 "map element value illegal alu op, 5",
5361                 .insns = {
5362                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5364                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5366                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5367                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5368                         BPF_MOV64_IMM(BPF_REG_3, 4096),
5369                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5370                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5371                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5372                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
5373                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
5374                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5375                         BPF_EXIT_INSN(),
5376                 },
5377                 .fixup_map2 = { 3 },
5378                 .errstr = "R0 invalid mem access 'inv'",
5379                 .result = REJECT,
5380         },
5381         {
5382                 "map element value is preserved across register spilling",
5383                 .insns = {
5384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5386                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5387                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5388                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5389                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5390                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
5391                                 offsetof(struct test_val, foo)),
5392                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5394                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5395                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5396                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5397                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5398                         BPF_EXIT_INSN(),
5399                 },
5400                 .fixup_map2 = { 3 },
5401                 .errstr_unpriv = "R0 leaks addr",
5402                 .result = ACCEPT,
5403                 .result_unpriv = REJECT,
5404                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5405         },
5406         {
5407                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
5408                 .insns = {
5409                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5411                         BPF_MOV64_IMM(BPF_REG_0, 0),
5412                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5413                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5414                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5415                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5416                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5417                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5418                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5419                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5420                         BPF_MOV64_IMM(BPF_REG_2, 16),
5421                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5422                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5423                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5424                         BPF_MOV64_IMM(BPF_REG_4, 0),
5425                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5426                         BPF_MOV64_IMM(BPF_REG_3, 0),
5427                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5428                         BPF_MOV64_IMM(BPF_REG_0, 0),
5429                         BPF_EXIT_INSN(),
5430                 },
5431                 .result = ACCEPT,
5432                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5433         },
5434         {
5435                 "helper access to variable memory: stack, bitwise AND, zero included",
5436                 .insns = {
5437                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5438                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5439                         BPF_MOV64_IMM(BPF_REG_2, 16),
5440                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5441                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5442                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5443                         BPF_MOV64_IMM(BPF_REG_3, 0),
5444                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5445                         BPF_EXIT_INSN(),
5446                 },
5447                 .errstr = "invalid stack type R1 off=-64 access_size=0",
5448                 .result = REJECT,
5449                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5450         },
5451         {
5452                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
5453                 .insns = {
5454                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5455                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5456                         BPF_MOV64_IMM(BPF_REG_2, 16),
5457                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5458                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5459                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
5460                         BPF_MOV64_IMM(BPF_REG_4, 0),
5461                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5462                         BPF_MOV64_IMM(BPF_REG_3, 0),
5463                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5464                         BPF_MOV64_IMM(BPF_REG_0, 0),
5465                         BPF_EXIT_INSN(),
5466                 },
5467                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5468                 .result = REJECT,
5469                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5470         },
5471         {
5472                 "helper access to variable memory: stack, JMP, correct bounds",
5473                 .insns = {
5474                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5475                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5476                         BPF_MOV64_IMM(BPF_REG_0, 0),
5477                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5478                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5479                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5480                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5481                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5482                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5483                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5484                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5485                         BPF_MOV64_IMM(BPF_REG_2, 16),
5486                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5487                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5488                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
5489                         BPF_MOV64_IMM(BPF_REG_4, 0),
5490                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5491                         BPF_MOV64_IMM(BPF_REG_3, 0),
5492                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5493                         BPF_MOV64_IMM(BPF_REG_0, 0),
5494                         BPF_EXIT_INSN(),
5495                 },
5496                 .result = ACCEPT,
5497                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5498         },
5499         {
5500                 "helper access to variable memory: stack, JMP (signed), correct bounds",
5501                 .insns = {
5502                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5503                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5504                         BPF_MOV64_IMM(BPF_REG_0, 0),
5505                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5506                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5507                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5508                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5509                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5510                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5511                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5512                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5513                         BPF_MOV64_IMM(BPF_REG_2, 16),
5514                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5515                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5516                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
5517                         BPF_MOV64_IMM(BPF_REG_4, 0),
5518                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5519                         BPF_MOV64_IMM(BPF_REG_3, 0),
5520                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5521                         BPF_MOV64_IMM(BPF_REG_0, 0),
5522                         BPF_EXIT_INSN(),
5523                 },
5524                 .result = ACCEPT,
5525                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5526         },
5527         {
5528                 "helper access to variable memory: stack, JMP, bounds + offset",
5529                 .insns = {
5530                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5531                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5532                         BPF_MOV64_IMM(BPF_REG_2, 16),
5533                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5534                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5535                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
5536                         BPF_MOV64_IMM(BPF_REG_4, 0),
5537                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
5538                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5539                         BPF_MOV64_IMM(BPF_REG_3, 0),
5540                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5541                         BPF_MOV64_IMM(BPF_REG_0, 0),
5542                         BPF_EXIT_INSN(),
5543                 },
5544                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5545                 .result = REJECT,
5546                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5547         },
5548         {
5549                 "helper access to variable memory: stack, JMP, wrong max",
5550                 .insns = {
5551                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5553                         BPF_MOV64_IMM(BPF_REG_2, 16),
5554                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5555                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5556                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
5557                         BPF_MOV64_IMM(BPF_REG_4, 0),
5558                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5559                         BPF_MOV64_IMM(BPF_REG_3, 0),
5560                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5561                         BPF_MOV64_IMM(BPF_REG_0, 0),
5562                         BPF_EXIT_INSN(),
5563                 },
5564                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5565                 .result = REJECT,
5566                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5567         },
5568         {
5569                 "helper access to variable memory: stack, JMP, no max check",
5570                 .insns = {
5571                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5572                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5573                         BPF_MOV64_IMM(BPF_REG_2, 16),
5574                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5575                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5576                         BPF_MOV64_IMM(BPF_REG_4, 0),
5577                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5578                         BPF_MOV64_IMM(BPF_REG_3, 0),
5579                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5580                         BPF_MOV64_IMM(BPF_REG_0, 0),
5581                         BPF_EXIT_INSN(),
5582                 },
5583                 /* because max wasn't checked, signed min is negative */
5584                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
5585                 .result = REJECT,
5586                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5587         },
5588         {
5589                 "helper access to variable memory: stack, JMP, no min check",
5590                 .insns = {
5591                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5593                         BPF_MOV64_IMM(BPF_REG_2, 16),
5594                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5595                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5596                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
5597                         BPF_MOV64_IMM(BPF_REG_3, 0),
5598                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5599                         BPF_MOV64_IMM(BPF_REG_0, 0),
5600                         BPF_EXIT_INSN(),
5601                 },
5602                 .errstr = "invalid stack type R1 off=-64 access_size=0",
5603                 .result = REJECT,
5604                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5605         },
5606         {
5607                 "helper access to variable memory: stack, JMP (signed), no min check",
5608                 .insns = {
5609                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5610                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5611                         BPF_MOV64_IMM(BPF_REG_2, 16),
5612                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5613                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5614                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
5615                         BPF_MOV64_IMM(BPF_REG_3, 0),
5616                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5617                         BPF_MOV64_IMM(BPF_REG_0, 0),
5618                         BPF_EXIT_INSN(),
5619                 },
5620                 .errstr = "R2 min value is negative",
5621                 .result = REJECT,
5622                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5623         },
5624         {
5625                 "helper access to variable memory: map, JMP, correct bounds",
5626                 .insns = {
5627                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5628                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5629                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5630                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5631                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5632                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5633                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5634                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5635                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5636                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5637                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5638                                 sizeof(struct test_val), 4),
5639                         BPF_MOV64_IMM(BPF_REG_4, 0),
5640                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5641                         BPF_MOV64_IMM(BPF_REG_3, 0),
5642                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5643                         BPF_MOV64_IMM(BPF_REG_0, 0),
5644                         BPF_EXIT_INSN(),
5645                 },
5646                 .fixup_map2 = { 3 },
5647                 .result = ACCEPT,
5648                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5649         },
5650         {
5651                 "helper access to variable memory: map, JMP, wrong max",
5652                 .insns = {
5653                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5654                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5655                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5656                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5657                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5658                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
5659                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5660                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5661                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5662                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5663                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5664                                 sizeof(struct test_val) + 1, 4),
5665                         BPF_MOV64_IMM(BPF_REG_4, 0),
5666                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5667                         BPF_MOV64_IMM(BPF_REG_3, 0),
5668                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5669                         BPF_MOV64_IMM(BPF_REG_0, 0),
5670                         BPF_EXIT_INSN(),
5671                 },
5672                 .fixup_map2 = { 3 },
5673                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
5674                 .result = REJECT,
5675                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5676         },
5677         {
5678                 "helper access to variable memory: map adjusted, JMP, correct bounds",
5679                 .insns = {
5680                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5681                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5682                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5683                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5684                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5685                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5686                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
5688                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5689                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5690                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5691                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5692                                 sizeof(struct test_val) - 20, 4),
5693                         BPF_MOV64_IMM(BPF_REG_4, 0),
5694                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5695                         BPF_MOV64_IMM(BPF_REG_3, 0),
5696                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5697                         BPF_MOV64_IMM(BPF_REG_0, 0),
5698                         BPF_EXIT_INSN(),
5699                 },
5700                 .fixup_map2 = { 3 },
5701                 .result = ACCEPT,
5702                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5703         },
5704         {
5705                 "helper access to variable memory: map adjusted, JMP, wrong max",
5706                 .insns = {
5707                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5709                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5710                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5711                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5712                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5713                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5714                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
5715                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5716                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5717                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5718                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
5719                                 sizeof(struct test_val) - 19, 4),
5720                         BPF_MOV64_IMM(BPF_REG_4, 0),
5721                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5722                         BPF_MOV64_IMM(BPF_REG_3, 0),
5723                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5724                         BPF_MOV64_IMM(BPF_REG_0, 0),
5725                         BPF_EXIT_INSN(),
5726                 },
5727                 .fixup_map2 = { 3 },
5728                 .errstr = "R1 min value is outside of the array range",
5729                 .result = REJECT,
5730                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5731         },
5732         {
5733                 "helper access to variable memory: size = 0 allowed on NULL",
5734                 .insns = {
5735                         BPF_MOV64_IMM(BPF_REG_1, 0),
5736                         BPF_MOV64_IMM(BPF_REG_2, 0),
5737                         BPF_MOV64_IMM(BPF_REG_3, 0),
5738                         BPF_MOV64_IMM(BPF_REG_4, 0),
5739                         BPF_MOV64_IMM(BPF_REG_5, 0),
5740                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5741                         BPF_EXIT_INSN(),
5742                 },
5743                 .result = ACCEPT,
5744                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5745         },
5746         {
5747                 "helper access to variable memory: size > 0 not allowed on NULL",
5748                 .insns = {
5749                         BPF_MOV64_IMM(BPF_REG_1, 0),
5750                         BPF_MOV64_IMM(BPF_REG_2, 0),
5751                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5752                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5753                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5754                         BPF_MOV64_IMM(BPF_REG_3, 0),
5755                         BPF_MOV64_IMM(BPF_REG_4, 0),
5756                         BPF_MOV64_IMM(BPF_REG_5, 0),
5757                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5758                         BPF_EXIT_INSN(),
5759                 },
5760                 .errstr = "R1 type=inv expected=fp",
5761                 .result = REJECT,
5762                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5763         },
5764         {
5765                 "helper access to variable memory: size = 0 not allowed on != NULL",
5766                 .insns = {
5767                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5768                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
5769                         BPF_MOV64_IMM(BPF_REG_2, 0),
5770                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
5771                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
5772                         BPF_MOV64_IMM(BPF_REG_3, 0),
5773                         BPF_MOV64_IMM(BPF_REG_4, 0),
5774                         BPF_MOV64_IMM(BPF_REG_5, 0),
5775                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
5776                         BPF_EXIT_INSN(),
5777                 },
5778                 .errstr = "invalid stack type R1 off=-8 access_size=0",
5779                 .result = REJECT,
5780                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
5781         },
5782         {
5783                 "helper access to variable memory: 8 bytes leak",
5784                 .insns = {
5785                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5787                         BPF_MOV64_IMM(BPF_REG_0, 0),
5788                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5789                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5790                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5791                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5792                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5793                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5794                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5795                         BPF_MOV64_IMM(BPF_REG_2, 0),
5796                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
5797                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
5798                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
5799                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5800                         BPF_MOV64_IMM(BPF_REG_3, 0),
5801                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5802                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5803                         BPF_EXIT_INSN(),
5804                 },
5805                 .errstr = "invalid indirect read from stack off -64+32 size 64",
5806                 .result = REJECT,
5807                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5808         },
5809         {
5810                 "helper access to variable memory: 8 bytes no leak (init memory)",
5811                 .insns = {
5812                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5813                         BPF_MOV64_IMM(BPF_REG_0, 0),
5814                         BPF_MOV64_IMM(BPF_REG_0, 0),
5815                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5816                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5817                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5818                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5819                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5820                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5821                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5822                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5823                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5824                         BPF_MOV64_IMM(BPF_REG_2, 0),
5825                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
5826                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
5827                         BPF_MOV64_IMM(BPF_REG_3, 0),
5828                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5829                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
5830                         BPF_EXIT_INSN(),
5831                 },
5832                 .result = ACCEPT,
5833                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5834         },
5835         {
5836                 "invalid and of negative number",
5837                 .insns = {
5838                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5839                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5840                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5841                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5842                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5843                                      BPF_FUNC_map_lookup_elem),
5844                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5845                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
5846                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
5847                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
5848                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5849                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
5850                                    offsetof(struct test_val, foo)),
5851                         BPF_EXIT_INSN(),
5852                 },
5853                 .fixup_map2 = { 3 },
5854                 .errstr = "R0 max value is outside of the array range",
5855                 .result = REJECT,
5856                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5857         },
5858         {
5859                 "invalid range check",
5860                 .insns = {
5861                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5862                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5863                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5864                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5865                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5866                                      BPF_FUNC_map_lookup_elem),
5867                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
5868                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5869                         BPF_MOV64_IMM(BPF_REG_9, 1),
5870                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
5871                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
5872                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
5873                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
5874                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
5875                         BPF_MOV32_IMM(BPF_REG_3, 1),
5876                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
5877                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
5878                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
5879                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
5880                         BPF_MOV64_REG(BPF_REG_0, 0),
5881                         BPF_EXIT_INSN(),
5882                 },
5883                 .fixup_map2 = { 3 },
5884                 .errstr = "R0 max value is outside of the array range",
5885                 .result = REJECT,
5886                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5887         },
5888         {
5889                 "map in map access",
5890                 .insns = {
5891                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5892                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5893                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5896                                      BPF_FUNC_map_lookup_elem),
5897                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5898                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5899                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5900                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5902                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5903                                      BPF_FUNC_map_lookup_elem),
5904                         BPF_MOV64_IMM(BPF_REG_0, 0),
5905                         BPF_EXIT_INSN(),
5906                 },
5907                 .fixup_map_in_map = { 3 },
5908                 .result = ACCEPT,
5909         },
5910         {
5911                 "invalid inner map pointer",
5912                 .insns = {
5913                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5914                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5915                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5916                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5917                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5918                                      BPF_FUNC_map_lookup_elem),
5919                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5920                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5921                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5922                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5923                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5924                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
5925                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5926                                      BPF_FUNC_map_lookup_elem),
5927                         BPF_MOV64_IMM(BPF_REG_0, 0),
5928                         BPF_EXIT_INSN(),
5929                 },
5930                 .fixup_map_in_map = { 3 },
5931                 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
5932                 .result = REJECT,
5933         },
5934         {
5935                 "forgot null checking on the inner map pointer",
5936                 .insns = {
5937                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5938                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5939                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5940                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5941                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5942                                      BPF_FUNC_map_lookup_elem),
5943                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5944                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5945                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
5946                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5947                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5948                                      BPF_FUNC_map_lookup_elem),
5949                         BPF_MOV64_IMM(BPF_REG_0, 0),
5950                         BPF_EXIT_INSN(),
5951                 },
5952                 .fixup_map_in_map = { 3 },
5953                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
5954                 .result = REJECT,
5955         },
5956         {
5957                 "ld_abs: check calling conv, r1",
5958                 .insns = {
5959                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5960                         BPF_MOV64_IMM(BPF_REG_1, 0),
5961                         BPF_LD_ABS(BPF_W, -0x200000),
5962                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5963                         BPF_EXIT_INSN(),
5964                 },
5965                 .errstr = "R1 !read_ok",
5966                 .result = REJECT,
5967         },
5968         {
5969                 "ld_abs: check calling conv, r2",
5970                 .insns = {
5971                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5972                         BPF_MOV64_IMM(BPF_REG_2, 0),
5973                         BPF_LD_ABS(BPF_W, -0x200000),
5974                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5975                         BPF_EXIT_INSN(),
5976                 },
5977                 .errstr = "R2 !read_ok",
5978                 .result = REJECT,
5979         },
5980         {
5981                 "ld_abs: check calling conv, r3",
5982                 .insns = {
5983                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5984                         BPF_MOV64_IMM(BPF_REG_3, 0),
5985                         BPF_LD_ABS(BPF_W, -0x200000),
5986                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
5987                         BPF_EXIT_INSN(),
5988                 },
5989                 .errstr = "R3 !read_ok",
5990                 .result = REJECT,
5991         },
5992         {
5993                 "ld_abs: check calling conv, r4",
5994                 .insns = {
5995                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5996                         BPF_MOV64_IMM(BPF_REG_4, 0),
5997                         BPF_LD_ABS(BPF_W, -0x200000),
5998                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
5999                         BPF_EXIT_INSN(),
6000                 },
6001                 .errstr = "R4 !read_ok",
6002                 .result = REJECT,
6003         },
6004         {
6005                 "ld_abs: check calling conv, r5",
6006                 .insns = {
6007                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6008                         BPF_MOV64_IMM(BPF_REG_5, 0),
6009                         BPF_LD_ABS(BPF_W, -0x200000),
6010                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6011                         BPF_EXIT_INSN(),
6012                 },
6013                 .errstr = "R5 !read_ok",
6014                 .result = REJECT,
6015         },
6016         {
6017                 "ld_abs: check calling conv, r7",
6018                 .insns = {
6019                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6020                         BPF_MOV64_IMM(BPF_REG_7, 0),
6021                         BPF_LD_ABS(BPF_W, -0x200000),
6022                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6023                         BPF_EXIT_INSN(),
6024                 },
6025                 .result = ACCEPT,
6026         },
6027         {
6028                 "ld_ind: check calling conv, r1",
6029                 .insns = {
6030                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6031                         BPF_MOV64_IMM(BPF_REG_1, 1),
6032                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
6033                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6034                         BPF_EXIT_INSN(),
6035                 },
6036                 .errstr = "R1 !read_ok",
6037                 .result = REJECT,
6038         },
6039         {
6040                 "ld_ind: check calling conv, r2",
6041                 .insns = {
6042                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6043                         BPF_MOV64_IMM(BPF_REG_2, 1),
6044                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
6045                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6046                         BPF_EXIT_INSN(),
6047                 },
6048                 .errstr = "R2 !read_ok",
6049                 .result = REJECT,
6050         },
6051         {
6052                 "ld_ind: check calling conv, r3",
6053                 .insns = {
6054                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6055                         BPF_MOV64_IMM(BPF_REG_3, 1),
6056                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
6057                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6058                         BPF_EXIT_INSN(),
6059                 },
6060                 .errstr = "R3 !read_ok",
6061                 .result = REJECT,
6062         },
6063         {
6064                 "ld_ind: check calling conv, r4",
6065                 .insns = {
6066                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6067                         BPF_MOV64_IMM(BPF_REG_4, 1),
6068                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
6069                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6070                         BPF_EXIT_INSN(),
6071                 },
6072                 .errstr = "R4 !read_ok",
6073                 .result = REJECT,
6074         },
6075         {
6076                 "ld_ind: check calling conv, r5",
6077                 .insns = {
6078                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6079                         BPF_MOV64_IMM(BPF_REG_5, 1),
6080                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
6081                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6082                         BPF_EXIT_INSN(),
6083                 },
6084                 .errstr = "R5 !read_ok",
6085                 .result = REJECT,
6086         },
6087         {
6088                 "ld_ind: check calling conv, r7",
6089                 .insns = {
6090                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6091                         BPF_MOV64_IMM(BPF_REG_7, 1),
6092                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
6093                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6094                         BPF_EXIT_INSN(),
6095                 },
6096                 .result = ACCEPT,
6097         },
6098         {
6099                 "check bpf_perf_event_data->sample_period byte load permitted",
6100                 .insns = {
6101                         BPF_MOV64_IMM(BPF_REG_0, 0),
6102 #if __BYTE_ORDER == __LITTLE_ENDIAN
6103                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6104                                     offsetof(struct bpf_perf_event_data, sample_period)),
6105 #else
6106                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6107                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
6108 #endif
6109                         BPF_EXIT_INSN(),
6110                 },
6111                 .result = ACCEPT,
6112                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6113         },
6114         {
6115                 "check bpf_perf_event_data->sample_period half load permitted",
6116                 .insns = {
6117                         BPF_MOV64_IMM(BPF_REG_0, 0),
6118 #if __BYTE_ORDER == __LITTLE_ENDIAN
6119                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6120                                     offsetof(struct bpf_perf_event_data, sample_period)),
6121 #else
6122                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6123                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
6124 #endif
6125                         BPF_EXIT_INSN(),
6126                 },
6127                 .result = ACCEPT,
6128                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6129         },
6130         {
6131                 "check bpf_perf_event_data->sample_period word load permitted",
6132                 .insns = {
6133                         BPF_MOV64_IMM(BPF_REG_0, 0),
6134 #if __BYTE_ORDER == __LITTLE_ENDIAN
6135                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6136                                     offsetof(struct bpf_perf_event_data, sample_period)),
6137 #else
6138                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6139                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
6140 #endif
6141                         BPF_EXIT_INSN(),
6142                 },
6143                 .result = ACCEPT,
6144                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6145         },
6146         {
6147                 "check bpf_perf_event_data->sample_period dword load permitted",
6148                 .insns = {
6149                         BPF_MOV64_IMM(BPF_REG_0, 0),
6150                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
6151                                     offsetof(struct bpf_perf_event_data, sample_period)),
6152                         BPF_EXIT_INSN(),
6153                 },
6154                 .result = ACCEPT,
6155                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6156         },
6157         {
6158                 "check skb->data half load not permitted",
6159                 .insns = {
6160                         BPF_MOV64_IMM(BPF_REG_0, 0),
6161 #if __BYTE_ORDER == __LITTLE_ENDIAN
6162                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6163                                     offsetof(struct __sk_buff, data)),
6164 #else
6165                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6166                                     offsetof(struct __sk_buff, data) + 2),
6167 #endif
6168                         BPF_EXIT_INSN(),
6169                 },
6170                 .result = REJECT,
6171                 .errstr = "invalid bpf_context access",
6172         },
6173         {
6174                 "check skb->tc_classid half load not permitted for lwt prog",
6175                 .insns = {
6176                         BPF_MOV64_IMM(BPF_REG_0, 0),
6177 #if __BYTE_ORDER == __LITTLE_ENDIAN
6178                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6179                                     offsetof(struct __sk_buff, tc_classid)),
6180 #else
6181                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6182                                     offsetof(struct __sk_buff, tc_classid) + 2),
6183 #endif
6184                         BPF_EXIT_INSN(),
6185                 },
6186                 .result = REJECT,
6187                 .errstr = "invalid bpf_context access",
6188                 .prog_type = BPF_PROG_TYPE_LWT_IN,
6189         },
6190         {
6191                 "bounds checks mixing signed and unsigned, positive bounds",
6192                 .insns = {
6193                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6196                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6197                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6198                                      BPF_FUNC_map_lookup_elem),
6199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6200                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6201                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6202                         BPF_MOV64_IMM(BPF_REG_2, 2),
6203                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
6204                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
6205                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6206                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6207                         BPF_MOV64_IMM(BPF_REG_0, 0),
6208                         BPF_EXIT_INSN(),
6209                 },
6210                 .fixup_map1 = { 3 },
6211                 .errstr = "unbounded min value",
6212                 .result = REJECT,
6213         },
6214         {
6215                 "bounds checks mixing signed and unsigned",
6216                 .insns = {
6217                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6218                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6219                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6220                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6221                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6222                                      BPF_FUNC_map_lookup_elem),
6223                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6224                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6225                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6226                         BPF_MOV64_IMM(BPF_REG_2, -1),
6227                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6228                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6229                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6230                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6231                         BPF_MOV64_IMM(BPF_REG_0, 0),
6232                         BPF_EXIT_INSN(),
6233                 },
6234                 .fixup_map1 = { 3 },
6235                 .errstr = "unbounded min value",
6236                 .result = REJECT,
6237         },
6238         {
6239                 "bounds checks mixing signed and unsigned, variant 2",
6240                 .insns = {
6241                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6242                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6243                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6244                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6245                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6246                                      BPF_FUNC_map_lookup_elem),
6247                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6248                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6249                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6250                         BPF_MOV64_IMM(BPF_REG_2, -1),
6251                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6252                         BPF_MOV64_IMM(BPF_REG_8, 0),
6253                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
6254                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6255                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6256                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6257                         BPF_MOV64_IMM(BPF_REG_0, 0),
6258                         BPF_EXIT_INSN(),
6259                 },
6260                 .fixup_map1 = { 3 },
6261                 .errstr = "unbounded min value",
6262                 .result = REJECT,
6263         },
6264         {
6265                 "bounds checks mixing signed and unsigned, variant 3",
6266                 .insns = {
6267                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6268                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6269                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6270                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6271                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6272                                      BPF_FUNC_map_lookup_elem),
6273                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6274                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6275                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6276                         BPF_MOV64_IMM(BPF_REG_2, -1),
6277                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
6278                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
6279                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6280                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6281                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6282                         BPF_MOV64_IMM(BPF_REG_0, 0),
6283                         BPF_EXIT_INSN(),
6284                 },
6285                 .fixup_map1 = { 3 },
6286                 .errstr = "unbounded min value",
6287                 .result = REJECT,
6288         },
6289         {
6290                 "bounds checks mixing signed and unsigned, variant 4",
6291                 .insns = {
6292                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6293                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6294                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6295                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6296                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6297                                      BPF_FUNC_map_lookup_elem),
6298                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6299                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6300                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6301                         BPF_MOV64_IMM(BPF_REG_2, 1),
6302                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
6303                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6304                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6305                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6306                         BPF_MOV64_IMM(BPF_REG_0, 0),
6307                         BPF_EXIT_INSN(),
6308                 },
6309                 .fixup_map1 = { 3 },
6310                 .result = ACCEPT,
6311         },
6312         {
6313                 "bounds checks mixing signed and unsigned, variant 5",
6314                 .insns = {
6315                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6316                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6318                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6319                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6320                                      BPF_FUNC_map_lookup_elem),
6321                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6322                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6323                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6324                         BPF_MOV64_IMM(BPF_REG_2, -1),
6325                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6326                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
6327                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
6328                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6329                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6330                         BPF_MOV64_IMM(BPF_REG_0, 0),
6331                         BPF_EXIT_INSN(),
6332                 },
6333                 .fixup_map1 = { 3 },
6334                 .errstr = "unbounded min value",
6335                 .result = REJECT,
6336         },
6337         {
6338                 "bounds checks mixing signed and unsigned, variant 6",
6339                 .insns = {
6340                         BPF_MOV64_IMM(BPF_REG_2, 0),
6341                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
6342                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
6343                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6344                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
6345                         BPF_MOV64_IMM(BPF_REG_6, -1),
6346                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
6347                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
6348                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
6349                         BPF_MOV64_IMM(BPF_REG_5, 0),
6350                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
6351                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6352                                      BPF_FUNC_skb_load_bytes),
6353                         BPF_MOV64_IMM(BPF_REG_0, 0),
6354                         BPF_EXIT_INSN(),
6355                 },
6356                 .errstr = "R4 min value is negative, either use unsigned",
6357                 .result = REJECT,
6358         },
6359         {
6360                 "bounds checks mixing signed and unsigned, variant 7",
6361                 .insns = {
6362                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6363                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6366                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6367                                      BPF_FUNC_map_lookup_elem),
6368                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6369                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6370                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6371                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
6372                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6373                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6374                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6375                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6376                         BPF_MOV64_IMM(BPF_REG_0, 0),
6377                         BPF_EXIT_INSN(),
6378                 },
6379                 .fixup_map1 = { 3 },
6380                 .result = ACCEPT,
6381         },
6382         {
6383                 "bounds checks mixing signed and unsigned, variant 8",
6384                 .insns = {
6385                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6386                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6388                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6389                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6390                                      BPF_FUNC_map_lookup_elem),
6391                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6392                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6393                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6394                         BPF_MOV64_IMM(BPF_REG_2, -1),
6395                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6396                         BPF_MOV64_IMM(BPF_REG_0, 0),
6397                         BPF_EXIT_INSN(),
6398                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6399                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6400                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6401                         BPF_MOV64_IMM(BPF_REG_0, 0),
6402                         BPF_EXIT_INSN(),
6403                 },
6404                 .fixup_map1 = { 3 },
6405                 .errstr = "unbounded min value",
6406                 .result = REJECT,
6407         },
6408         {
6409                 "bounds checks mixing signed and unsigned, variant 9",
6410                 .insns = {
6411                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6412                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6413                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6414                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6415                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6416                                      BPF_FUNC_map_lookup_elem),
6417                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6418                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6419                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6420                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
6421                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6422                         BPF_MOV64_IMM(BPF_REG_0, 0),
6423                         BPF_EXIT_INSN(),
6424                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6425                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6426                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6427                         BPF_MOV64_IMM(BPF_REG_0, 0),
6428                         BPF_EXIT_INSN(),
6429                 },
6430                 .fixup_map1 = { 3 },
6431                 .result = ACCEPT,
6432         },
6433         {
6434                 "bounds checks mixing signed and unsigned, variant 10",
6435                 .insns = {
6436                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6437                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6438                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6439                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6440                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6441                                      BPF_FUNC_map_lookup_elem),
6442                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6443                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6444                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6445                         BPF_MOV64_IMM(BPF_REG_2, 0),
6446                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
6447                         BPF_MOV64_IMM(BPF_REG_0, 0),
6448                         BPF_EXIT_INSN(),
6449                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6450                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6451                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6452                         BPF_MOV64_IMM(BPF_REG_0, 0),
6453                         BPF_EXIT_INSN(),
6454                 },
6455                 .fixup_map1 = { 3 },
6456                 .errstr = "unbounded min value",
6457                 .result = REJECT,
6458         },
6459         {
6460                 "bounds checks mixing signed and unsigned, variant 11",
6461                 .insns = {
6462                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6463                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6464                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6465                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6467                                      BPF_FUNC_map_lookup_elem),
6468                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6469                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6470                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6471                         BPF_MOV64_IMM(BPF_REG_2, -1),
6472                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6473                         /* Dead branch. */
6474                         BPF_MOV64_IMM(BPF_REG_0, 0),
6475                         BPF_EXIT_INSN(),
6476                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6477                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6478                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6479                         BPF_MOV64_IMM(BPF_REG_0, 0),
6480                         BPF_EXIT_INSN(),
6481                 },
6482                 .fixup_map1 = { 3 },
6483                 .errstr = "unbounded min value",
6484                 .result = REJECT,
6485         },
6486         {
6487                 "bounds checks mixing signed and unsigned, variant 12",
6488                 .insns = {
6489                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6490                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6491                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6492                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6493                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6494                                      BPF_FUNC_map_lookup_elem),
6495                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6496                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6497                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6498                         BPF_MOV64_IMM(BPF_REG_2, -6),
6499                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6500                         BPF_MOV64_IMM(BPF_REG_0, 0),
6501                         BPF_EXIT_INSN(),
6502                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6503                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6504                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6505                         BPF_MOV64_IMM(BPF_REG_0, 0),
6506                         BPF_EXIT_INSN(),
6507                 },
6508                 .fixup_map1 = { 3 },
6509                 .errstr = "unbounded min value",
6510                 .result = REJECT,
6511         },
6512         {
6513                 "bounds checks mixing signed and unsigned, variant 13",
6514                 .insns = {
6515                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6516                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6518                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6519                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6520                                      BPF_FUNC_map_lookup_elem),
6521                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6522                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6523                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6524                         BPF_MOV64_IMM(BPF_REG_2, 2),
6525                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6526                         BPF_MOV64_IMM(BPF_REG_7, 1),
6527                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
6528                         BPF_MOV64_IMM(BPF_REG_0, 0),
6529                         BPF_EXIT_INSN(),
6530                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
6531                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
6532                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
6533                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6534                         BPF_MOV64_IMM(BPF_REG_0, 0),
6535                         BPF_EXIT_INSN(),
6536                 },
6537                 .fixup_map1 = { 3 },
6538                 .errstr = "unbounded min value",
6539                 .result = REJECT,
6540         },
6541         {
6542                 "bounds checks mixing signed and unsigned, variant 14",
6543                 .insns = {
6544                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
6545                                     offsetof(struct __sk_buff, mark)),
6546                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6547                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6548                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6549                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6550                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6551                                      BPF_FUNC_map_lookup_elem),
6552                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6553                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6554                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6555                         BPF_MOV64_IMM(BPF_REG_2, -1),
6556                         BPF_MOV64_IMM(BPF_REG_8, 2),
6557                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
6558                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
6559                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6560                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6561                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6562                         BPF_MOV64_IMM(BPF_REG_0, 0),
6563                         BPF_EXIT_INSN(),
6564                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
6565                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
6566                 },
6567                 .fixup_map1 = { 4 },
6568                 .errstr = "R0 invalid mem access 'inv'",
6569                 .result = REJECT,
6570         },
6571         {
6572                 "bounds checks mixing signed and unsigned, variant 15",
6573                 .insns = {
6574                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6575                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6577                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6578                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6579                                      BPF_FUNC_map_lookup_elem),
6580                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6581                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6582                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6583                         BPF_MOV64_IMM(BPF_REG_2, -6),
6584                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
6585                         BPF_MOV64_IMM(BPF_REG_0, 0),
6586                         BPF_EXIT_INSN(),
6587                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6588                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
6589                         BPF_MOV64_IMM(BPF_REG_0, 0),
6590                         BPF_EXIT_INSN(),
6591                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6592                         BPF_MOV64_IMM(BPF_REG_0, 0),
6593                         BPF_EXIT_INSN(),
6594                 },
6595                 .fixup_map1 = { 3 },
6596                 .errstr = "unbounded min value",
6597                 .result = REJECT,
6598                 .result_unpriv = REJECT,
6599         },
6600         {
6601                 "subtraction bounds (map value) variant 1",
6602                 .insns = {
6603                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6604                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6605                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6606                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6607                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6608                                      BPF_FUNC_map_lookup_elem),
6609                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6610                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6611                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
6612                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
6613                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
6614                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
6615                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
6616                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6617                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6618                         BPF_EXIT_INSN(),
6619                         BPF_MOV64_IMM(BPF_REG_0, 0),
6620                         BPF_EXIT_INSN(),
6621                 },
6622                 .fixup_map1 = { 3 },
6623                 .errstr = "R0 max value is outside of the array range",
6624                 .result = REJECT,
6625         },
6626         {
6627                 "subtraction bounds (map value) variant 2",
6628                 .insns = {
6629                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6630                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6631                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6632                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6633                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6634                                      BPF_FUNC_map_lookup_elem),
6635                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6636                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6637                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
6638                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
6639                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
6640                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
6641                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6642                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6643                         BPF_EXIT_INSN(),
6644                         BPF_MOV64_IMM(BPF_REG_0, 0),
6645                         BPF_EXIT_INSN(),
6646                 },
6647                 .fixup_map1 = { 3 },
6648                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
6649                 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
6650                 .result = REJECT,
6651         },
6652         {
6653                 "bounds check based on zero-extended MOV",
6654                 .insns = {
6655                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6656                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6657                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6658                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6659                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6660                                      BPF_FUNC_map_lookup_elem),
6661                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6662                         /* r2 = 0x0000'0000'ffff'ffff */
6663                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
6664                         /* r2 = 0 */
6665                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
6666                         /* no-op */
6667                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
6668                         /* access at offset 0 */
6669                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6670                         /* exit */
6671                         BPF_MOV64_IMM(BPF_REG_0, 0),
6672                         BPF_EXIT_INSN(),
6673                 },
6674                 .fixup_map1 = { 3 },
6675                 .result = ACCEPT
6676         },
6677         {
6678                 "bounds check based on sign-extended MOV. test1",
6679                 .insns = {
6680                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6681                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6682                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6683                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6684                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6685                                      BPF_FUNC_map_lookup_elem),
6686                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6687                         /* r2 = 0xffff'ffff'ffff'ffff */
6688                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
6689                         /* r2 = 0xffff'ffff */
6690                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
6691                         /* r0 = <oob pointer> */
6692                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
6693                         /* access to OOB pointer */
6694                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6695                         /* exit */
6696                         BPF_MOV64_IMM(BPF_REG_0, 0),
6697                         BPF_EXIT_INSN(),
6698                 },
6699                 .fixup_map1 = { 3 },
6700                 .errstr = "map_value pointer and 4294967295",
6701                 .result = REJECT
6702         },
6703         {
6704                 "bounds check based on sign-extended MOV. test2",
6705                 .insns = {
6706                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6707                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6709                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6710                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6711                                      BPF_FUNC_map_lookup_elem),
6712                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6713                         /* r2 = 0xffff'ffff'ffff'ffff */
6714                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
6715                         /* r2 = 0xfff'ffff */
6716                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
6717                         /* r0 = <oob pointer> */
6718                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
6719                         /* access to OOB pointer */
6720                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6721                         /* exit */
6722                         BPF_MOV64_IMM(BPF_REG_0, 0),
6723                         BPF_EXIT_INSN(),
6724                 },
6725                 .fixup_map1 = { 3 },
6726                 .errstr = "R0 min value is outside of the array range",
6727                 .result = REJECT
6728         },
6729         {
6730                 "bounds check based on reg_off + var_off + insn_off. test1",
6731                 .insns = {
6732                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6733                                     offsetof(struct __sk_buff, mark)),
6734                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6735                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6736                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6737                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6738                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6739                                      BPF_FUNC_map_lookup_elem),
6740                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6741                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
6742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
6743                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
6744                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
6745                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
6746                         BPF_MOV64_IMM(BPF_REG_0, 0),
6747                         BPF_EXIT_INSN(),
6748                 },
6749                 .fixup_map1 = { 4 },
6750                 .errstr = "value_size=8 off=1073741825",
6751                 .result = REJECT,
6752                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6753         },
6754         {
6755                 "bounds check based on reg_off + var_off + insn_off. test2",
6756                 .insns = {
6757                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6758                                     offsetof(struct __sk_buff, mark)),
6759                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6760                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6761                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6762                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6763                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6764                                      BPF_FUNC_map_lookup_elem),
6765                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6766                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
6767                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
6768                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
6769                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
6770                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
6771                         BPF_MOV64_IMM(BPF_REG_0, 0),
6772                         BPF_EXIT_INSN(),
6773                 },
6774                 .fixup_map1 = { 4 },
6775                 .errstr = "value 1073741823",
6776                 .result = REJECT,
6777                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6778         },
6779         {
6780                 "bounds check after truncation of non-boundary-crossing range",
6781                 .insns = {
6782                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6783                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6784                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6785                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6786                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6787                                      BPF_FUNC_map_lookup_elem),
6788                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6789                         /* r1 = [0x00, 0xff] */
6790                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6791                         BPF_MOV64_IMM(BPF_REG_2, 1),
6792                         /* r2 = 0x10'0000'0000 */
6793                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
6794                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
6795                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
6796                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
6797                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
6798                         /* r1 = [0x00, 0xff] */
6799                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
6800                         /* r1 = 0 */
6801                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
6802                         /* no-op */
6803                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6804                         /* access at offset 0 */
6805                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6806                         /* exit */
6807                         BPF_MOV64_IMM(BPF_REG_0, 0),
6808                         BPF_EXIT_INSN(),
6809                 },
6810                 .fixup_map1 = { 3 },
6811                 .result = ACCEPT
6812         },
6813         {
6814                 "bounds check after truncation of boundary-crossing range (1)",
6815                 .insns = {
6816                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6817                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6818                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6819                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6820                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6821                                      BPF_FUNC_map_lookup_elem),
6822                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6823                         /* r1 = [0x00, 0xff] */
6824                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6825                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
6826                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
6827                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
6828                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
6829                          *      [0x0000'0000, 0x0000'007f]
6830                          */
6831                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
6832                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
6833                         /* r1 = [0x00, 0xff] or
6834                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
6835                          */
6836                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
6837                         /* r1 = 0 or
6838                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
6839                          */
6840                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
6841                         /* no-op or OOB pointer computation */
6842                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6843                         /* potentially OOB access */
6844                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6845                         /* exit */
6846                         BPF_MOV64_IMM(BPF_REG_0, 0),
6847                         BPF_EXIT_INSN(),
6848                 },
6849                 .fixup_map1 = { 3 },
6850                 /* not actually fully unbounded, but the bound is very high */
6851                 .errstr = "R0 unbounded memory access",
6852                 .result = REJECT
6853         },
6854         {
6855                 "bounds check after truncation of boundary-crossing range (2)",
6856                 .insns = {
6857                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6858                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6859                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6860                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6861                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6862                                      BPF_FUNC_map_lookup_elem),
6863                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6864                         /* r1 = [0x00, 0xff] */
6865                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6866                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
6867                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
6868                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
6869                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
6870                          *      [0x0000'0000, 0x0000'007f]
6871                          * difference to previous test: truncation via MOV32
6872                          * instead of ALU32.
6873                          */
6874                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
6875                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
6876                         /* r1 = [0x00, 0xff] or
6877                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
6878                          */
6879                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
6880                         /* r1 = 0 or
6881                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
6882                          */
6883                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
6884                         /* no-op or OOB pointer computation */
6885                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6886                         /* potentially OOB access */
6887                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6888                         /* exit */
6889                         BPF_MOV64_IMM(BPF_REG_0, 0),
6890                         BPF_EXIT_INSN(),
6891                 },
6892                 .fixup_map1 = { 3 },
6893                 /* not actually fully unbounded, but the bound is very high */
6894                 .errstr = "R0 unbounded memory access",
6895                 .result = REJECT
6896         },
6897         {
6898                 "bounds check after wrapping 32-bit addition",
6899                 .insns = {
6900                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6901                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6903                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6904                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6905                                      BPF_FUNC_map_lookup_elem),
6906                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6907                         /* r1 = 0x7fff'ffff */
6908                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
6909                         /* r1 = 0xffff'fffe */
6910                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
6911                         /* r1 = 0 */
6912                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
6913                         /* no-op */
6914                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6915                         /* access at offset 0 */
6916                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6917                         /* exit */
6918                         BPF_MOV64_IMM(BPF_REG_0, 0),
6919                         BPF_EXIT_INSN(),
6920                 },
6921                 .fixup_map1 = { 3 },
6922                 .result = ACCEPT
6923         },
6924         {
6925                 "bounds check after shift with oversized count operand",
6926                 .insns = {
6927                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6928                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6929                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6930                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6931                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6932                                      BPF_FUNC_map_lookup_elem),
6933                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6934                         BPF_MOV64_IMM(BPF_REG_2, 32),
6935                         BPF_MOV64_IMM(BPF_REG_1, 1),
6936                         /* r1 = (u32)1 << (u32)32 = ? */
6937                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
6938                         /* r1 = [0x0000, 0xffff] */
6939                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
6940                         /* computes unknown pointer, potentially OOB */
6941                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6942                         /* potentially OOB access */
6943                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6944                         /* exit */
6945                         BPF_MOV64_IMM(BPF_REG_0, 0),
6946                         BPF_EXIT_INSN(),
6947                 },
6948                 .fixup_map1 = { 3 },
6949                 .errstr = "R0 max value is outside of the array range",
6950                 .result = REJECT
6951         },
6952         {
6953                 "bounds check after right shift of maybe-negative number",
6954                 .insns = {
6955                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6956                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6957                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6958                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6959                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6960                                      BPF_FUNC_map_lookup_elem),
6961                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6962                         /* r1 = [0x00, 0xff] */
6963                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6964                         /* r1 = [-0x01, 0xfe] */
6965                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
6966                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
6967                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
6968                         /* r1 = 0 or 0xffff'ffff'ffff */
6969                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
6970                         /* computes unknown pointer, potentially OOB */
6971                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6972                         /* potentially OOB access */
6973                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
6974                         /* exit */
6975                         BPF_MOV64_IMM(BPF_REG_0, 0),
6976                         BPF_EXIT_INSN(),
6977                 },
6978                 .fixup_map1 = { 3 },
6979                 .errstr = "R0 unbounded memory access",
6980                 .result = REJECT
6981         },
6982         {
6983                 "bounds check map access with off+size signed 32bit overflow. test1",
6984                 .insns = {
6985                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6986                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6987                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6988                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6989                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6990                                      BPF_FUNC_map_lookup_elem),
6991                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
6992                         BPF_EXIT_INSN(),
6993                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
6994                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
6995                         BPF_JMP_A(0),
6996                         BPF_EXIT_INSN(),
6997                 },
6998                 .fixup_map1 = { 3 },
6999                 .errstr = "map_value pointer and 2147483646",
7000                 .result = REJECT
7001         },
7002         {
7003                 "bounds check map access with off+size signed 32bit overflow. test2",
7004                 .insns = {
7005                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7006                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7007                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7008                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7009                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7010                                      BPF_FUNC_map_lookup_elem),
7011                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7012                         BPF_EXIT_INSN(),
7013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7015                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7016                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7017                         BPF_JMP_A(0),
7018                         BPF_EXIT_INSN(),
7019                 },
7020                 .fixup_map1 = { 3 },
7021                 .errstr = "pointer offset 1073741822",
7022                 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
7023                 .result = REJECT
7024         },
7025         {
7026                 "bounds check map access with off+size signed 32bit overflow. test3",
7027                 .insns = {
7028                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7029                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7031                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7032                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7033                                      BPF_FUNC_map_lookup_elem),
7034                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7035                         BPF_EXIT_INSN(),
7036                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7037                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7038                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7039                         BPF_JMP_A(0),
7040                         BPF_EXIT_INSN(),
7041                 },
7042                 .fixup_map1 = { 3 },
7043                 .errstr = "pointer offset -1073741822",
7044                 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
7045                 .result = REJECT
7046         },
7047         {
7048                 "bounds check map access with off+size signed 32bit overflow. test4",
7049                 .insns = {
7050                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7051                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7052                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7053                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7054                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7055                                      BPF_FUNC_map_lookup_elem),
7056                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7057                         BPF_EXIT_INSN(),
7058                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
7059                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
7060                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7061                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7062                         BPF_JMP_A(0),
7063                         BPF_EXIT_INSN(),
7064                 },
7065                 .fixup_map1 = { 3 },
7066                 .errstr = "map_value pointer and 1000000000000",
7067                 .result = REJECT
7068         },
7069         {
7070                 "pointer/scalar confusion in state equality check (way 1)",
7071                 .insns = {
7072                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7073                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7074                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7075                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7076                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7077                                      BPF_FUNC_map_lookup_elem),
7078                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7079                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7080                         BPF_JMP_A(1),
7081                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7082                         BPF_JMP_A(0),
7083                         BPF_EXIT_INSN(),
7084                 },
7085                 .fixup_map1 = { 3 },
7086                 .result = ACCEPT,
7087                 .result_unpriv = REJECT,
7088                 .errstr_unpriv = "R0 leaks addr as return value"
7089         },
7090         {
7091                 "pointer/scalar confusion in state equality check (way 2)",
7092                 .insns = {
7093                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7094                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7096                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7097                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7098                                      BPF_FUNC_map_lookup_elem),
7099                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
7100                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7101                         BPF_JMP_A(1),
7102                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7103                         BPF_EXIT_INSN(),
7104                 },
7105                 .fixup_map1 = { 3 },
7106                 .result = ACCEPT,
7107                 .result_unpriv = REJECT,
7108                 .errstr_unpriv = "R0 leaks addr as return value"
7109         },
7110         {
7111                 "variable-offset ctx access",
7112                 .insns = {
7113                         /* Get an unknown value */
7114                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7115                         /* Make it small and 4-byte aligned */
7116                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7117                         /* add it to skb.  We now have either &skb->len or
7118                          * &skb->pkt_type, but we don't know which
7119                          */
7120                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
7121                         /* dereference it */
7122                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7123                         BPF_EXIT_INSN(),
7124                 },
7125                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
7126                 .result = REJECT,
7127                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7128         },
7129         {
7130                 "variable-offset stack access",
7131                 .insns = {
7132                         /* Fill the top 8 bytes of the stack */
7133                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7134                         /* Get an unknown value */
7135                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7136                         /* Make it small and 4-byte aligned */
7137                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7138                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7139                         /* add it to fp.  We now have either fp-4 or fp-8, but
7140                          * we don't know which
7141                          */
7142                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7143                         /* dereference it */
7144                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
7145                         BPF_EXIT_INSN(),
7146                 },
7147                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
7148                 .result = REJECT,
7149                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7150         },
7151         {
7152                 "indirect variable-offset stack access",
7153                 .insns = {
7154                         /* Fill the top 8 bytes of the stack */
7155                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7156                         /* Get an unknown value */
7157                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7158                         /* Make it small and 4-byte aligned */
7159                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7160                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7161                         /* add it to fp.  We now have either fp-4 or fp-8, but
7162                          * we don't know which
7163                          */
7164                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7165                         /* dereference it indirectly */
7166                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7167                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7168                                      BPF_FUNC_map_lookup_elem),
7169                         BPF_MOV64_IMM(BPF_REG_0, 0),
7170                         BPF_EXIT_INSN(),
7171                 },
7172                 .fixup_map1 = { 5 },
7173                 .errstr = "variable stack read R2",
7174                 .result = REJECT,
7175                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7176         },
7177         {
7178                 "direct stack access with 32-bit wraparound. test1",
7179                 .insns = {
7180                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7181                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7182                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7183                         BPF_MOV32_IMM(BPF_REG_0, 0),
7184                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7185                         BPF_EXIT_INSN()
7186                 },
7187                 .errstr = "fp pointer and 2147483647",
7188                 .result = REJECT
7189         },
7190         {
7191                 "direct stack access with 32-bit wraparound. test2",
7192                 .insns = {
7193                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7196                         BPF_MOV32_IMM(BPF_REG_0, 0),
7197                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7198                         BPF_EXIT_INSN()
7199                 },
7200                 .errstr = "fp pointer and 1073741823",
7201                 .result = REJECT
7202         },
7203         {
7204                 "direct stack access with 32-bit wraparound. test3",
7205                 .insns = {
7206                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7207                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7208                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7209                         BPF_MOV32_IMM(BPF_REG_0, 0),
7210                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7211                         BPF_EXIT_INSN()
7212                 },
7213                 .errstr = "fp pointer offset 1073741822",
7214                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
7215                 .result = REJECT
7216         },
7217         {
7218                 "liveness pruning and write screening",
7219                 .insns = {
7220                         /* Get an unknown value */
7221                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7222                         /* branch conditions teach us nothing about R2 */
7223                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7224                         BPF_MOV64_IMM(BPF_REG_0, 0),
7225                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7226                         BPF_MOV64_IMM(BPF_REG_0, 0),
7227                         BPF_EXIT_INSN(),
7228                 },
7229                 .errstr = "R0 !read_ok",
7230                 .result = REJECT,
7231                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7232         },
7233         {
7234                 "varlen_map_value_access pruning",
7235                 .insns = {
7236                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7237                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7241                                      BPF_FUNC_map_lookup_elem),
7242                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7243                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
7244                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
7245                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
7246                         BPF_MOV32_IMM(BPF_REG_1, 0),
7247                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
7248                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7249                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
7250                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7251                                    offsetof(struct test_val, foo)),
7252                         BPF_EXIT_INSN(),
7253                 },
7254                 .fixup_map2 = { 3 },
7255                 .errstr_unpriv = "R0 leaks addr",
7256                 .errstr = "R0 unbounded memory access",
7257                 .result_unpriv = REJECT,
7258                 .result = REJECT,
7259                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7260         },
7261         {
7262                 "invalid 64-bit BPF_END",
7263                 .insns = {
7264                         BPF_MOV32_IMM(BPF_REG_0, 0),
7265                         {
7266                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
7267                                 .dst_reg = BPF_REG_0,
7268                                 .src_reg = 0,
7269                                 .off   = 0,
7270                                 .imm   = 32,
7271                         },
7272                         BPF_EXIT_INSN(),
7273                 },
7274                 .errstr = "BPF_END uses reserved fields",
7275                 .result = REJECT,
7276         },
7277         {
7278                 "arithmetic ops make PTR_TO_CTX unusable",
7279                 .insns = {
7280                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
7281                                       offsetof(struct __sk_buff, data) -
7282                                       offsetof(struct __sk_buff, mark)),
7283                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7284                                     offsetof(struct __sk_buff, mark)),
7285                         BPF_EXIT_INSN(),
7286                 },
7287                 .errstr = "dereference of modified ctx ptr",
7288                 .result = REJECT,
7289                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7290         },
7291         {
7292                 "pkt_end - pkt_start is allowed",
7293                 .insns = {
7294                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7295                                     offsetof(struct __sk_buff, data_end)),
7296                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7297                                     offsetof(struct __sk_buff, data)),
7298                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
7299                         BPF_EXIT_INSN(),
7300                 },
7301                 .result = ACCEPT,
7302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7303         },
7304         {
7305                 "XDP pkt read, pkt_end mangling, bad access 1",
7306                 .insns = {
7307                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7308                                     offsetof(struct xdp_md, data)),
7309                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7310                                     offsetof(struct xdp_md, data_end)),
7311                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7312                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7313                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
7314                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7315                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7316                         BPF_MOV64_IMM(BPF_REG_0, 0),
7317                         BPF_EXIT_INSN(),
7318                 },
7319                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
7320                 .result = REJECT,
7321                 .prog_type = BPF_PROG_TYPE_XDP,
7322         },
7323         {
7324                 "XDP pkt read, pkt_end mangling, bad access 2",
7325                 .insns = {
7326                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7327                                     offsetof(struct xdp_md, data)),
7328                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7329                                     offsetof(struct xdp_md, data_end)),
7330                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7332                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
7333                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7334                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7335                         BPF_MOV64_IMM(BPF_REG_0, 0),
7336                         BPF_EXIT_INSN(),
7337                 },
7338                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
7339                 .result = REJECT,
7340                 .prog_type = BPF_PROG_TYPE_XDP,
7341         },
7342         {
7343                 "XDP pkt read, pkt_data' > pkt_end, good access",
7344                 .insns = {
7345                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7346                                     offsetof(struct xdp_md, data)),
7347                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7348                                     offsetof(struct xdp_md, data_end)),
7349                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7351                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7352                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7353                         BPF_MOV64_IMM(BPF_REG_0, 0),
7354                         BPF_EXIT_INSN(),
7355                 },
7356                 .result = ACCEPT,
7357                 .prog_type = BPF_PROG_TYPE_XDP,
7358         },
7359         {
7360                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
7361                 .insns = {
7362                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7363                                     offsetof(struct xdp_md, data)),
7364                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7365                                     offsetof(struct xdp_md, data_end)),
7366                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7367                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7368                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
7369                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7370                         BPF_MOV64_IMM(BPF_REG_0, 0),
7371                         BPF_EXIT_INSN(),
7372                 },
7373                 .errstr = "R1 offset is outside of the packet",
7374                 .result = REJECT,
7375                 .prog_type = BPF_PROG_TYPE_XDP,
7376                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7377         },
7378         {
7379                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
7380                 .insns = {
7381                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7382                                     offsetof(struct xdp_md, data)),
7383                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7384                                     offsetof(struct xdp_md, data_end)),
7385                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7386                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7387                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
7388                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7389                         BPF_MOV64_IMM(BPF_REG_0, 0),
7390                         BPF_EXIT_INSN(),
7391                 },
7392                 .errstr = "R1 offset is outside of the packet",
7393                 .result = REJECT,
7394                 .prog_type = BPF_PROG_TYPE_XDP,
7395         },
7396         {
7397                 "XDP pkt read, pkt_end > pkt_data', good access",
7398                 .insns = {
7399                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7400                                     offsetof(struct xdp_md, data)),
7401                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7402                                     offsetof(struct xdp_md, data_end)),
7403                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7405                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7406                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7407                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7408                         BPF_MOV64_IMM(BPF_REG_0, 0),
7409                         BPF_EXIT_INSN(),
7410                 },
7411                 .result = ACCEPT,
7412                 .prog_type = BPF_PROG_TYPE_XDP,
7413                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7414         },
7415         {
7416                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
7417                 .insns = {
7418                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7419                                     offsetof(struct xdp_md, data)),
7420                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7421                                     offsetof(struct xdp_md, data_end)),
7422                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7424                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7425                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7426                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7427                         BPF_MOV64_IMM(BPF_REG_0, 0),
7428                         BPF_EXIT_INSN(),
7429                 },
7430                 .errstr = "R1 offset is outside of the packet",
7431                 .result = REJECT,
7432                 .prog_type = BPF_PROG_TYPE_XDP,
7433         },
7434         {
7435                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
7436                 .insns = {
7437                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7438                                     offsetof(struct xdp_md, data)),
7439                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7440                                     offsetof(struct xdp_md, data_end)),
7441                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7442                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7443                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
7444                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7445                         BPF_MOV64_IMM(BPF_REG_0, 0),
7446                         BPF_EXIT_INSN(),
7447                 },
7448                 .errstr = "R1 offset is outside of the packet",
7449                 .result = REJECT,
7450                 .prog_type = BPF_PROG_TYPE_XDP,
7451         },
7452         {
7453                 "XDP pkt read, pkt_data' < pkt_end, good access",
7454                 .insns = {
7455                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7456                                     offsetof(struct xdp_md, data)),
7457                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7458                                     offsetof(struct xdp_md, data_end)),
7459                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7461                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7462                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7463                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7464                         BPF_MOV64_IMM(BPF_REG_0, 0),
7465                         BPF_EXIT_INSN(),
7466                 },
7467                 .result = ACCEPT,
7468                 .prog_type = BPF_PROG_TYPE_XDP,
7469                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7470         },
7471         {
7472                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
7473                 .insns = {
7474                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7475                                     offsetof(struct xdp_md, data)),
7476                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7477                                     offsetof(struct xdp_md, data_end)),
7478                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7480                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7481                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7482                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7483                         BPF_MOV64_IMM(BPF_REG_0, 0),
7484                         BPF_EXIT_INSN(),
7485                 },
7486                 .errstr = "R1 offset is outside of the packet",
7487                 .result = REJECT,
7488                 .prog_type = BPF_PROG_TYPE_XDP,
7489         },
7490         {
7491                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
7492                 .insns = {
7493                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7494                                     offsetof(struct xdp_md, data)),
7495                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7496                                     offsetof(struct xdp_md, data_end)),
7497                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7498                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7499                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
7500                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7501                         BPF_MOV64_IMM(BPF_REG_0, 0),
7502                         BPF_EXIT_INSN(),
7503                 },
7504                 .errstr = "R1 offset is outside of the packet",
7505                 .result = REJECT,
7506                 .prog_type = BPF_PROG_TYPE_XDP,
7507         },
7508         {
7509                 "XDP pkt read, pkt_end < pkt_data', good access",
7510                 .insns = {
7511                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7512                                     offsetof(struct xdp_md, data)),
7513                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7514                                     offsetof(struct xdp_md, data_end)),
7515                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7516                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7517                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7518                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7519                         BPF_MOV64_IMM(BPF_REG_0, 0),
7520                         BPF_EXIT_INSN(),
7521                 },
7522                 .result = ACCEPT,
7523                 .prog_type = BPF_PROG_TYPE_XDP,
7524         },
7525         {
7526                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
7527                 .insns = {
7528                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7529                                     offsetof(struct xdp_md, data)),
7530                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7531                                     offsetof(struct xdp_md, data_end)),
7532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7533                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7534                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
7535                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7536                         BPF_MOV64_IMM(BPF_REG_0, 0),
7537                         BPF_EXIT_INSN(),
7538                 },
7539                 .errstr = "R1 offset is outside of the packet",
7540                 .result = REJECT,
7541                 .prog_type = BPF_PROG_TYPE_XDP,
7542                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7543         },
7544         {
7545                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
7546                 .insns = {
7547                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7548                                     offsetof(struct xdp_md, data)),
7549                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7550                                     offsetof(struct xdp_md, data_end)),
7551                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7553                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
7554                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7555                         BPF_MOV64_IMM(BPF_REG_0, 0),
7556                         BPF_EXIT_INSN(),
7557                 },
7558                 .errstr = "R1 offset is outside of the packet",
7559                 .result = REJECT,
7560                 .prog_type = BPF_PROG_TYPE_XDP,
7561         },
7562         {
7563                 "XDP pkt read, pkt_data' >= pkt_end, good access",
7564                 .insns = {
7565                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7566                                     offsetof(struct xdp_md, data)),
7567                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7568                                     offsetof(struct xdp_md, data_end)),
7569                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7570                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7571                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7572                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7573                         BPF_MOV64_IMM(BPF_REG_0, 0),
7574                         BPF_EXIT_INSN(),
7575                 },
7576                 .result = ACCEPT,
7577                 .prog_type = BPF_PROG_TYPE_XDP,
7578                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7579         },
7580         {
7581                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
7582                 .insns = {
7583                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7584                                     offsetof(struct xdp_md, data)),
7585                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7586                                     offsetof(struct xdp_md, data_end)),
7587                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7588                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7589                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
7590                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7591                         BPF_MOV64_IMM(BPF_REG_0, 0),
7592                         BPF_EXIT_INSN(),
7593                 },
7594                 .errstr = "R1 offset is outside of the packet",
7595                 .result = REJECT,
7596                 .prog_type = BPF_PROG_TYPE_XDP,
7597         },
7598         {
7599                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
7600                 .insns = {
7601                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7602                                     offsetof(struct xdp_md, data)),
7603                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7604                                     offsetof(struct xdp_md, data_end)),
7605                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7606                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7607                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
7608                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7609                         BPF_MOV64_IMM(BPF_REG_0, 0),
7610                         BPF_EXIT_INSN(),
7611                 },
7612                 .errstr = "R1 offset is outside of the packet",
7613                 .result = REJECT,
7614                 .prog_type = BPF_PROG_TYPE_XDP,
7615                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7616         },
7617         {
7618                 "XDP pkt read, pkt_end >= pkt_data', good access",
7619                 .insns = {
7620                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7621                                     offsetof(struct xdp_md, data)),
7622                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7623                                     offsetof(struct xdp_md, data_end)),
7624                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7626                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7627                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7628                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7629                         BPF_MOV64_IMM(BPF_REG_0, 0),
7630                         BPF_EXIT_INSN(),
7631                 },
7632                 .result = ACCEPT,
7633                 .prog_type = BPF_PROG_TYPE_XDP,
7634         },
7635         {
7636                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
7637                 .insns = {
7638                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7639                                     offsetof(struct xdp_md, data)),
7640                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7641                                     offsetof(struct xdp_md, data_end)),
7642                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7643                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7644                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7645                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7646                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7647                         BPF_MOV64_IMM(BPF_REG_0, 0),
7648                         BPF_EXIT_INSN(),
7649                 },
7650                 .errstr = "R1 offset is outside of the packet",
7651                 .result = REJECT,
7652                 .prog_type = BPF_PROG_TYPE_XDP,
7653                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7654         },
7655         {
7656                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
7657                 .insns = {
7658                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7659                                     offsetof(struct xdp_md, data)),
7660                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7661                                     offsetof(struct xdp_md, data_end)),
7662                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7664                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
7665                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7666                         BPF_MOV64_IMM(BPF_REG_0, 0),
7667                         BPF_EXIT_INSN(),
7668                 },
7669                 .errstr = "R1 offset is outside of the packet",
7670                 .result = REJECT,
7671                 .prog_type = BPF_PROG_TYPE_XDP,
7672         },
7673         {
7674                 "XDP pkt read, pkt_data' <= pkt_end, good access",
7675                 .insns = {
7676                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7677                                     offsetof(struct xdp_md, data)),
7678                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7679                                     offsetof(struct xdp_md, data_end)),
7680                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7681                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7682                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7683                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7684                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7685                         BPF_MOV64_IMM(BPF_REG_0, 0),
7686                         BPF_EXIT_INSN(),
7687                 },
7688                 .result = ACCEPT,
7689                 .prog_type = BPF_PROG_TYPE_XDP,
7690         },
7691         {
7692                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
7693                 .insns = {
7694                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7695                                     offsetof(struct xdp_md, data)),
7696                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7697                                     offsetof(struct xdp_md, data_end)),
7698                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7699                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7700                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7701                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
7702                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
7703                         BPF_MOV64_IMM(BPF_REG_0, 0),
7704                         BPF_EXIT_INSN(),
7705                 },
7706                 .errstr = "R1 offset is outside of the packet",
7707                 .result = REJECT,
7708                 .prog_type = BPF_PROG_TYPE_XDP,
7709                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7710         },
7711         {
7712                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
7713                 .insns = {
7714                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7715                                     offsetof(struct xdp_md, data)),
7716                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7717                                     offsetof(struct xdp_md, data_end)),
7718                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7720                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
7721                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7722                         BPF_MOV64_IMM(BPF_REG_0, 0),
7723                         BPF_EXIT_INSN(),
7724                 },
7725                 .errstr = "R1 offset is outside of the packet",
7726                 .result = REJECT,
7727                 .prog_type = BPF_PROG_TYPE_XDP,
7728         },
7729         {
7730                 "XDP pkt read, pkt_end <= pkt_data', good access",
7731                 .insns = {
7732                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7733                                     offsetof(struct xdp_md, data)),
7734                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7735                                     offsetof(struct xdp_md, data_end)),
7736                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7737                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7738                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7739                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7740                         BPF_MOV64_IMM(BPF_REG_0, 0),
7741                         BPF_EXIT_INSN(),
7742                 },
7743                 .result = ACCEPT,
7744                 .prog_type = BPF_PROG_TYPE_XDP,
7745                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7746         },
7747         {
7748                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
7749                 .insns = {
7750                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7751                                     offsetof(struct xdp_md, data)),
7752                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7753                                     offsetof(struct xdp_md, data_end)),
7754                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7756                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
7757                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
7758                         BPF_MOV64_IMM(BPF_REG_0, 0),
7759                         BPF_EXIT_INSN(),
7760                 },
7761                 .errstr = "R1 offset is outside of the packet",
7762                 .result = REJECT,
7763                 .prog_type = BPF_PROG_TYPE_XDP,
7764         },
7765         {
7766                 "check deducing bounds from const, 1",
7767                 .insns = {
7768                         BPF_MOV64_IMM(BPF_REG_0, 1),
7769                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
7770                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7771                         BPF_EXIT_INSN(),
7772                 },
7773                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7774                 .errstr = "R0 tried to subtract pointer from scalar",
7775                 .result = REJECT,
7776         },
7777         {
7778                 "check deducing bounds from const, 2",
7779                 .insns = {
7780                         BPF_MOV64_IMM(BPF_REG_0, 1),
7781                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
7782                         BPF_EXIT_INSN(),
7783                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
7784                         BPF_EXIT_INSN(),
7785                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
7786                         BPF_EXIT_INSN(),
7787                 },
7788                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7789                 .result_unpriv = REJECT,
7790                 .result = ACCEPT,
7791         },
7792         {
7793                 "check deducing bounds from const, 3",
7794                 .insns = {
7795                         BPF_MOV64_IMM(BPF_REG_0, 0),
7796                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
7797                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7798                         BPF_EXIT_INSN(),
7799                 },
7800                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7801                 .errstr = "R0 tried to subtract pointer from scalar",
7802                 .result = REJECT,
7803         },
7804         {
7805                 "check deducing bounds from const, 4",
7806                 .insns = {
7807                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7808                         BPF_MOV64_IMM(BPF_REG_0, 0),
7809                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
7810                         BPF_EXIT_INSN(),
7811                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
7812                         BPF_EXIT_INSN(),
7813                         BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0),
7814                         BPF_EXIT_INSN(),
7815                 },
7816                 .errstr_unpriv = "R6 has pointer with unsupported alu operation",
7817                 .result_unpriv = REJECT,
7818                 .result = ACCEPT,
7819         },
7820         {
7821                 "check deducing bounds from const, 5",
7822                 .insns = {
7823                         BPF_MOV64_IMM(BPF_REG_0, 0),
7824                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
7825                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7826                         BPF_EXIT_INSN(),
7827                 },
7828                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7829                 .errstr = "R0 tried to subtract pointer from scalar",
7830                 .result = REJECT,
7831         },
7832         {
7833                 "check deducing bounds from const, 6",
7834                 .insns = {
7835                         BPF_MOV64_IMM(BPF_REG_0, 0),
7836                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
7837                         BPF_EXIT_INSN(),
7838                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7839                         BPF_EXIT_INSN(),
7840                 },
7841                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7842                 .errstr = "R0 tried to subtract pointer from scalar",
7843                 .result = REJECT,
7844         },
7845         {
7846                 "check deducing bounds from const, 7",
7847                 .insns = {
7848                         BPF_MOV64_IMM(BPF_REG_0, ~0),
7849                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
7850                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
7851                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7852                                     offsetof(struct __sk_buff, mark)),
7853                         BPF_EXIT_INSN(),
7854                 },
7855                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7856                 .errstr = "dereference of modified ctx ptr",
7857                 .result = REJECT,
7858         },
7859         {
7860                 "check deducing bounds from const, 8",
7861                 .insns = {
7862                         BPF_MOV64_IMM(BPF_REG_0, ~0),
7863                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
7864                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
7865                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7866                                     offsetof(struct __sk_buff, mark)),
7867                         BPF_EXIT_INSN(),
7868                 },
7869                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7870                 .errstr = "dereference of modified ctx ptr",
7871                 .result = REJECT,
7872         },
7873         {
7874                 "check deducing bounds from const, 9",
7875                 .insns = {
7876                         BPF_MOV64_IMM(BPF_REG_0, 0),
7877                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
7878                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7879                         BPF_EXIT_INSN(),
7880                 },
7881                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
7882                 .errstr = "R0 tried to subtract pointer from scalar",
7883                 .result = REJECT,
7884         },
7885         {
7886                 "check deducing bounds from const, 10",
7887                 .insns = {
7888                         BPF_MOV64_IMM(BPF_REG_0, 0),
7889                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
7890                         /* Marks reg as unknown. */
7891                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
7892                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7893                         BPF_EXIT_INSN(),
7894                 },
7895                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
7896                 .result = REJECT,
7897         },
7898         {
7899                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
7900                 .insns = {
7901                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7902                                     offsetof(struct xdp_md, data)),
7903                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7904                                     offsetof(struct xdp_md, data_end)),
7905                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7906                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7907                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
7908                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
7909                         BPF_MOV64_IMM(BPF_REG_0, 0),
7910                         BPF_EXIT_INSN(),
7911                 },
7912                 .errstr = "R1 offset is outside of the packet",
7913                 .result = REJECT,
7914                 .prog_type = BPF_PROG_TYPE_XDP,
7915                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7916         },
7917         {
7918                 "xadd/w check unaligned stack",
7919                 .insns = {
7920                         BPF_MOV64_IMM(BPF_REG_0, 1),
7921                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7922                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
7923                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
7924                         BPF_EXIT_INSN(),
7925                 },
7926                 .result = REJECT,
7927                 .errstr = "misaligned stack access off",
7928                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7929         },
7930         {
7931                 "xadd/w check unaligned map",
7932                 .insns = {
7933                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7934                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7935                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7936                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7937                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7938                                      BPF_FUNC_map_lookup_elem),
7939                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7940                         BPF_EXIT_INSN(),
7941                         BPF_MOV64_IMM(BPF_REG_1, 1),
7942                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
7943                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
7944                         BPF_EXIT_INSN(),
7945                 },
7946                 .fixup_map1 = { 3 },
7947                 .result = REJECT,
7948                 .errstr = "misaligned value access off",
7949                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7950         },
7951         {
7952                 "xadd/w check unaligned pkt",
7953                 .insns = {
7954                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7955                                     offsetof(struct xdp_md, data)),
7956                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7957                                     offsetof(struct xdp_md, data_end)),
7958                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
7959                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7960                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
7961                         BPF_MOV64_IMM(BPF_REG_0, 99),
7962                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
7963                         BPF_MOV64_IMM(BPF_REG_0, 1),
7964                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
7965                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
7966                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
7967                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
7968                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
7969                         BPF_EXIT_INSN(),
7970                 },
7971                 .result = REJECT,
7972                 .errstr = "BPF_XADD stores into R2 packet",
7973                 .prog_type = BPF_PROG_TYPE_XDP,
7974         },
7975         {
7976                 "pass unmodified ctx pointer to helper",
7977                 .insns = {
7978                         BPF_MOV64_IMM(BPF_REG_2, 0),
7979                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7980                                      BPF_FUNC_csum_update),
7981                         BPF_MOV64_IMM(BPF_REG_0, 0),
7982                         BPF_EXIT_INSN(),
7983                 },
7984                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7985                 .result = ACCEPT,
7986         },
7987         {
7988                 "pass modified ctx pointer to helper, 1",
7989                 .insns = {
7990                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
7991                         BPF_MOV64_IMM(BPF_REG_2, 0),
7992                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7993                                      BPF_FUNC_csum_update),
7994                         BPF_MOV64_IMM(BPF_REG_0, 0),
7995                         BPF_EXIT_INSN(),
7996                 },
7997                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7998                 .result = REJECT,
7999                 .errstr = "dereference of modified ctx ptr",
8000         },
8001         {
8002                 "pass modified ctx pointer to helper, 2",
8003                 .insns = {
8004                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
8005                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8006                                      BPF_FUNC_get_socket_cookie),
8007                         BPF_MOV64_IMM(BPF_REG_0, 0),
8008                         BPF_EXIT_INSN(),
8009                 },
8010                 .result_unpriv = REJECT,
8011                 .result = REJECT,
8012                 .errstr_unpriv = "dereference of modified ctx ptr",
8013                 .errstr = "dereference of modified ctx ptr",
8014         },
8015         {
8016                 "pass modified ctx pointer to helper, 3",
8017                 .insns = {
8018                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
8019                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
8020                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
8021                         BPF_MOV64_IMM(BPF_REG_2, 0),
8022                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8023                                      BPF_FUNC_csum_update),
8024                         BPF_MOV64_IMM(BPF_REG_0, 0),
8025                         BPF_EXIT_INSN(),
8026                 },
8027                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8028                 .result = REJECT,
8029                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
8030         },
8031 };
8032
8033 static int probe_filter_length(const struct bpf_insn *fp)
8034 {
8035         int len;
8036
8037         for (len = MAX_INSNS - 1; len > 0; --len)
8038                 if (fp[len].code != 0 || fp[len].imm != 0)
8039                         break;
8040         return len + 1;
8041 }
8042
8043 static int create_map(uint32_t size_value, uint32_t max_elem)
8044 {
8045         int fd;
8046
8047         fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
8048                             size_value, max_elem, BPF_F_NO_PREALLOC);
8049         if (fd < 0)
8050                 printf("Failed to create hash map '%s'!\n", strerror(errno));
8051
8052         return fd;
8053 }
8054
8055 static int create_prog_array(void)
8056 {
8057         int fd;
8058
8059         fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
8060                             sizeof(int), 4, 0);
8061         if (fd < 0)
8062                 printf("Failed to create prog array '%s'!\n", strerror(errno));
8063
8064         return fd;
8065 }
8066
8067 static int create_map_in_map(void)
8068 {
8069         int inner_map_fd, outer_map_fd;
8070
8071         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
8072                                       sizeof(int), 1, 0);
8073         if (inner_map_fd < 0) {
8074                 printf("Failed to create array '%s'!\n", strerror(errno));
8075                 return inner_map_fd;
8076         }
8077
8078         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS,
8079                                              sizeof(int), inner_map_fd, 1, 0);
8080         if (outer_map_fd < 0)
8081                 printf("Failed to create array of maps '%s'!\n",
8082                        strerror(errno));
8083
8084         close(inner_map_fd);
8085
8086         return outer_map_fd;
8087 }
8088
8089 static char bpf_vlog[32768];
8090
8091 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
8092                           int *map_fds)
8093 {
8094         int *fixup_map1 = test->fixup_map1;
8095         int *fixup_map2 = test->fixup_map2;
8096         int *fixup_prog = test->fixup_prog;
8097         int *fixup_map_in_map = test->fixup_map_in_map;
8098
8099         /* Allocating HTs with 1 elem is fine here, since we only test
8100          * for verifier and not do a runtime lookup, so the only thing
8101          * that really matters is value size in this case.
8102          */
8103         if (*fixup_map1) {
8104                 map_fds[0] = create_map(sizeof(long long), 1);
8105                 do {
8106                         prog[*fixup_map1].imm = map_fds[0];
8107                         fixup_map1++;
8108                 } while (*fixup_map1);
8109         }
8110
8111         if (*fixup_map2) {
8112                 map_fds[1] = create_map(sizeof(struct test_val), 1);
8113                 do {
8114                         prog[*fixup_map2].imm = map_fds[1];
8115                         fixup_map2++;
8116                 } while (*fixup_map2);
8117         }
8118
8119         if (*fixup_prog) {
8120                 map_fds[2] = create_prog_array();
8121                 do {
8122                         prog[*fixup_prog].imm = map_fds[2];
8123                         fixup_prog++;
8124                 } while (*fixup_prog);
8125         }
8126
8127         if (*fixup_map_in_map) {
8128                 map_fds[3] = create_map_in_map();
8129                 do {
8130                         prog[*fixup_map_in_map].imm = map_fds[3];
8131                         fixup_map_in_map++;
8132                 } while (*fixup_map_in_map);
8133         }
8134 }
8135
8136 static void do_test_single(struct bpf_test *test, bool unpriv,
8137                            int *passes, int *errors)
8138 {
8139         int fd_prog, expected_ret, reject_from_alignment;
8140         struct bpf_insn *prog = test->insns;
8141         int prog_len = probe_filter_length(prog);
8142         int prog_type = test->prog_type;
8143         int map_fds[MAX_NR_MAPS];
8144         const char *expected_err;
8145         int i;
8146
8147         for (i = 0; i < MAX_NR_MAPS; i++)
8148                 map_fds[i] = -1;
8149
8150         do_test_fixup(test, prog, map_fds);
8151
8152         fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
8153                                      prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
8154                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
8155
8156         expected_ret = unpriv && test->result_unpriv != UNDEF ?
8157                        test->result_unpriv : test->result;
8158         expected_err = unpriv && test->errstr_unpriv ?
8159                        test->errstr_unpriv : test->errstr;
8160
8161         reject_from_alignment = fd_prog < 0 &&
8162                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
8163                                 strstr(bpf_vlog, "misaligned");
8164 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
8165         if (reject_from_alignment) {
8166                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
8167                        strerror(errno));
8168                 goto fail_log;
8169         }
8170 #endif
8171         if (expected_ret == ACCEPT) {
8172                 if (fd_prog < 0 && !reject_from_alignment) {
8173                         printf("FAIL\nFailed to load prog '%s'!\n",
8174                                strerror(errno));
8175                         goto fail_log;
8176                 }
8177         } else {
8178                 if (fd_prog >= 0) {
8179                         printf("FAIL\nUnexpected success to load!\n");
8180                         goto fail_log;
8181                 }
8182                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
8183                         printf("FAIL\nUnexpected error message!\n");
8184                         goto fail_log;
8185                 }
8186         }
8187
8188         (*passes)++;
8189         printf("OK%s\n", reject_from_alignment ?
8190                " (NOTE: reject due to unknown alignment)" : "");
8191 close_fds:
8192         close(fd_prog);
8193         for (i = 0; i < MAX_NR_MAPS; i++)
8194                 close(map_fds[i]);
8195         sched_yield();
8196         return;
8197 fail_log:
8198         (*errors)++;
8199         printf("%s", bpf_vlog);
8200         goto close_fds;
8201 }
8202
8203 static bool is_admin(void)
8204 {
8205         cap_t caps;
8206         cap_flag_value_t sysadmin = CAP_CLEAR;
8207         const cap_value_t cap_val = CAP_SYS_ADMIN;
8208
8209 #ifdef CAP_IS_SUPPORTED
8210         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
8211                 perror("cap_get_flag");
8212                 return false;
8213         }
8214 #endif
8215         caps = cap_get_proc();
8216         if (!caps) {
8217                 perror("cap_get_proc");
8218                 return false;
8219         }
8220         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
8221                 perror("cap_get_flag");
8222         if (cap_free(caps))
8223                 perror("cap_free");
8224         return (sysadmin == CAP_SET);
8225 }
8226
8227 static int set_admin(bool admin)
8228 {
8229         cap_t caps;
8230         const cap_value_t cap_val = CAP_SYS_ADMIN;
8231         int ret = -1;
8232
8233         caps = cap_get_proc();
8234         if (!caps) {
8235                 perror("cap_get_proc");
8236                 return -1;
8237         }
8238         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
8239                                 admin ? CAP_SET : CAP_CLEAR)) {
8240                 perror("cap_set_flag");
8241                 goto out;
8242         }
8243         if (cap_set_proc(caps)) {
8244                 perror("cap_set_proc");
8245                 goto out;
8246         }
8247         ret = 0;
8248 out:
8249         if (cap_free(caps))
8250                 perror("cap_free");
8251         return ret;
8252 }
8253
8254 static int do_test(bool unpriv, unsigned int from, unsigned int to)
8255 {
8256         int i, passes = 0, errors = 0;
8257
8258         for (i = from; i < to; i++) {
8259                 struct bpf_test *test = &tests[i];
8260
8261                 /* Program types that are not supported by non-root we
8262                  * skip right away.
8263                  */
8264                 if (!test->prog_type) {
8265                         if (!unpriv)
8266                                 set_admin(false);
8267                         printf("#%d/u %s ", i, test->descr);
8268                         do_test_single(test, true, &passes, &errors);
8269                         if (!unpriv)
8270                                 set_admin(true);
8271                 }
8272
8273                 if (!unpriv) {
8274                         printf("#%d/p %s ", i, test->descr);
8275                         do_test_single(test, false, &passes, &errors);
8276                 }
8277         }
8278
8279         printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
8280         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
8281 }
8282
8283 int main(int argc, char **argv)
8284 {
8285         struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
8286         struct rlimit rlim = { 1 << 20, 1 << 20 };
8287         unsigned int from = 0, to = ARRAY_SIZE(tests);
8288         bool unpriv = !is_admin();
8289
8290         if (argc == 3) {
8291                 unsigned int l = atoi(argv[argc - 2]);
8292                 unsigned int u = atoi(argv[argc - 1]);
8293
8294                 if (l < to && u < to) {
8295                         from = l;
8296                         to   = u + 1;
8297                 }
8298         } else if (argc == 2) {
8299                 unsigned int t = atoi(argv[argc - 1]);
8300
8301                 if (t < to) {
8302                         from = t;
8303                         to   = t + 1;
8304                 }
8305         }
8306
8307         setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
8308         return do_test(unpriv, from, to);
8309 }