tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of version 2 of the GNU General Public
   9  * License as published by the Free Software Foundation.
  10  */
  11
  12 #include <endian.h>
  13 #include <asm/types.h>
  14 #include <linux/types.h>
  15 #include <stdint.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <unistd.h>
  19 #include <errno.h>
  20 #include <string.h>
  21 #include <stddef.h>
  22 #include <stdbool.h>
  23 #include <sched.h>
  24 #include <limits.h>
  25
  26 #include <sys/capability.h>
  27
  28 #include <linux/unistd.h>
  29 #include <linux/filter.h>
  30 #include <linux/bpf_perf_event.h>
  31 #include <linux/bpf.h>
  32 #include <linux/if_ether.h>
  33
  34 #include <bpf/bpf.h>
  35
  36 #ifdef HAVE_GENHDR
  37 # include "autoconf.h"
  38 #else
  39 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  40 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  41 # endif
  42 #endif
  43 #include "bpf_rlimit.h"
  44 #include "bpf_rand.h"
  45 #include "bpf_util.h"
  46 #include "../../../include/linux/filter.h"
  47
  48 #define MAX_INSNS       BPF_MAXINSNS
  49 #define MAX_FIXUPS      8
  50 #define MAX_NR_MAPS     8
  51 #define POINTER_VALUE   0xcafe4all
  52 #define TEST_DATA_LEN   64
  53
  54 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  55 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  56
  57 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  58 static bool unpriv_disabled = false;
  59
  60 struct bpf_test {
  61         const char *descr;
  62         struct bpf_insn insns[MAX_INSNS];
  63         int fixup_map1[MAX_FIXUPS];
  64         int fixup_map2[MAX_FIXUPS];
  65         int fixup_map3[MAX_FIXUPS];
  66         int fixup_map4[MAX_FIXUPS];
  67         int fixup_prog1[MAX_FIXUPS];
  68         int fixup_prog2[MAX_FIXUPS];
  69         int fixup_map_in_map[MAX_FIXUPS];
  70         int fixup_cgroup_storage[MAX_FIXUPS];
  71         const char *errstr;
  72         const char *errstr_unpriv;
  73         uint32_t retval, retval_unpriv;
  74         enum {
  75                 UNDEF,
  76                 ACCEPT,
  77                 REJECT
  78         } result, result_unpriv;
  79         enum bpf_prog_type prog_type;
  80         uint8_t flags;
  81         __u8 data[TEST_DATA_LEN];
  82         void (*fill_helper)(struct bpf_test *self);
  83 };
  84
  85 /* Note we want this to be 64 bit aligned so that the end of our array is
  86  * actually the end of the structure.
  87  */
  88 #define MAX_ENTRIES 11
  89
  90 struct test_val {
  91         unsigned int index;
  92         int foo[MAX_ENTRIES];
  93 };
  94
  95 struct other_val {
  96         long long foo;
  97         long long bar;
  98 };
  99
 100 static void bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
 101 {
 102         /* test: {skb->data[0], vlan_push} x 68 + {skb->data[0], vlan_pop} x 68 */
 103 #define PUSH_CNT 51
 104         unsigned int len = BPF_MAXINSNS;
 105         struct bpf_insn *insn = self->insns;
 106         int i = 0, j, k = 0;
 107
 108         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 109 loop:
 110         for (j = 0; j < PUSH_CNT; j++) {
 111                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 112                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 113                 i++;
 114                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 115                 insn[i++] = BPF_MOV64_IMM(BPF_REG_2, 1);
 116                 insn[i++] = BPF_MOV64_IMM(BPF_REG_3, 2);
 117                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 118                                          BPF_FUNC_skb_vlan_push),
 119                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 120                 i++;
 121         }
 122
 123         for (j = 0; j < PUSH_CNT; j++) {
 124                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 125                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 126                 i++;
 127                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 128                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 129                                          BPF_FUNC_skb_vlan_pop),
 130                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 131                 i++;
 132         }
 133         if (++k < 5)
 134                 goto loop;
 135
 136         for (; i < len - 1; i++)
 137                 insn[i] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 0xbef);
 138         insn[len - 1] = BPF_EXIT_INSN();
 139 }
 140
 141 static void bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 142 {
 143         struct bpf_insn *insn = self->insns;
 144         unsigned int len = BPF_MAXINSNS;
 145         int i = 0;
 146
 147         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 148         insn[i++] = BPF_LD_ABS(BPF_B, 0);
 149         insn[i] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 10, len - i - 2);
 150         i++;
 151         while (i < len - 1)
 152                 insn[i++] = BPF_LD_ABS(BPF_B, 1);
 153         insn[i] = BPF_EXIT_INSN();
 154 }
 155
 156 static void bpf_fill_rand_ld_dw(struct bpf_test *self)
 157 {
 158         struct bpf_insn *insn = self->insns;
 159         uint64_t res = 0;
 160         int i = 0;
 161
 162         insn[i++] = BPF_MOV32_IMM(BPF_REG_0, 0);
 163         while (i < self->retval) {
 164                 uint64_t val = bpf_semi_rand_get();
 165                 struct bpf_insn tmp[2] = { BPF_LD_IMM64(BPF_REG_1, val) };
 166
 167                 res ^= val;
 168                 insn[i++] = tmp[0];
 169                 insn[i++] = tmp[1];
 170                 insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 171         }
 172         insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_0);
 173         insn[i++] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32);
 174         insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 175         insn[i] = BPF_EXIT_INSN();
 176         res ^= (res >> 32);
 177         self->retval = (uint32_t)res;
 178 }
 179
 180 static struct bpf_test tests[] = {
 181         {
 182                 "add+sub+mul",
 183                 .insns = {
 184                         BPF_MOV64_IMM(BPF_REG_1, 1),
 185                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
 186                         BPF_MOV64_IMM(BPF_REG_2, 3),
 187                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
 188                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 189                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 190                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 191                         BPF_EXIT_INSN(),
 192                 },
 193                 .result = ACCEPT,
 194                 .retval = -3,
 195         },
 196         {
 197                 "DIV32 by 0, zero check 1",
 198                 .insns = {
 199                         BPF_MOV32_IMM(BPF_REG_0, 42),
 200                         BPF_MOV32_IMM(BPF_REG_1, 0),
 201                         BPF_MOV32_IMM(BPF_REG_2, 1),
 202                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 203                         BPF_EXIT_INSN(),
 204                 },
 205                 .result = ACCEPT,
 206                 .retval = 42,
 207         },
 208         {
 209                 "DIV32 by 0, zero check 2",
 210                 .insns = {
 211                         BPF_MOV32_IMM(BPF_REG_0, 42),
 212                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 213                         BPF_MOV32_IMM(BPF_REG_2, 1),
 214                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 215                         BPF_EXIT_INSN(),
 216                 },
 217                 .result = ACCEPT,
 218                 .retval = 42,
 219         },
 220         {
 221                 "DIV64 by 0, zero check",
 222                 .insns = {
 223                         BPF_MOV32_IMM(BPF_REG_0, 42),
 224                         BPF_MOV32_IMM(BPF_REG_1, 0),
 225                         BPF_MOV32_IMM(BPF_REG_2, 1),
 226                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 227                         BPF_EXIT_INSN(),
 228                 },
 229                 .result = ACCEPT,
 230                 .retval = 42,
 231         },
 232         {
 233                 "MOD32 by 0, zero check 1",
 234                 .insns = {
 235                         BPF_MOV32_IMM(BPF_REG_0, 42),
 236                         BPF_MOV32_IMM(BPF_REG_1, 0),
 237                         BPF_MOV32_IMM(BPF_REG_2, 1),
 238                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 239                         BPF_EXIT_INSN(),
 240                 },
 241                 .result = ACCEPT,
 242                 .retval = 42,
 243         },
 244         {
 245                 "MOD32 by 0, zero check 2",
 246                 .insns = {
 247                         BPF_MOV32_IMM(BPF_REG_0, 42),
 248                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 249                         BPF_MOV32_IMM(BPF_REG_2, 1),
 250                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 251                         BPF_EXIT_INSN(),
 252                 },
 253                 .result = ACCEPT,
 254                 .retval = 42,
 255         },
 256         {
 257                 "MOD64 by 0, zero check",
 258                 .insns = {
 259                         BPF_MOV32_IMM(BPF_REG_0, 42),
 260                         BPF_MOV32_IMM(BPF_REG_1, 0),
 261                         BPF_MOV32_IMM(BPF_REG_2, 1),
 262                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 263                         BPF_EXIT_INSN(),
 264                 },
 265                 .result = ACCEPT,
 266                 .retval = 42,
 267         },
 268         {
 269                 "DIV32 by 0, zero check ok, cls",
 270                 .insns = {
 271                         BPF_MOV32_IMM(BPF_REG_0, 42),
 272                         BPF_MOV32_IMM(BPF_REG_1, 2),
 273                         BPF_MOV32_IMM(BPF_REG_2, 16),
 274                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 275                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 276                         BPF_EXIT_INSN(),
 277                 },
 278                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 279                 .result = ACCEPT,
 280                 .retval = 8,
 281         },
 282         {
 283                 "DIV32 by 0, zero check 1, cls",
 284                 .insns = {
 285                         BPF_MOV32_IMM(BPF_REG_1, 0),
 286                         BPF_MOV32_IMM(BPF_REG_0, 1),
 287                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 288                         BPF_EXIT_INSN(),
 289                 },
 290                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 291                 .result = ACCEPT,
 292                 .retval = 0,
 293         },
 294         {
 295                 "DIV32 by 0, zero check 2, cls",
 296                 .insns = {
 297                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 298                         BPF_MOV32_IMM(BPF_REG_0, 1),
 299                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 300                         BPF_EXIT_INSN(),
 301                 },
 302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 303                 .result = ACCEPT,
 304                 .retval = 0,
 305         },
 306         {
 307                 "DIV64 by 0, zero check, cls",
 308                 .insns = {
 309                         BPF_MOV32_IMM(BPF_REG_1, 0),
 310                         BPF_MOV32_IMM(BPF_REG_0, 1),
 311                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 312                         BPF_EXIT_INSN(),
 313                 },
 314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 315                 .result = ACCEPT,
 316                 .retval = 0,
 317         },
 318         {
 319                 "MOD32 by 0, zero check ok, cls",
 320                 .insns = {
 321                         BPF_MOV32_IMM(BPF_REG_0, 42),
 322                         BPF_MOV32_IMM(BPF_REG_1, 3),
 323                         BPF_MOV32_IMM(BPF_REG_2, 5),
 324                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 325                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 326                         BPF_EXIT_INSN(),
 327                 },
 328                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 329                 .result = ACCEPT,
 330                 .retval = 2,
 331         },
 332         {
 333                 "MOD32 by 0, zero check 1, cls",
 334                 .insns = {
 335                         BPF_MOV32_IMM(BPF_REG_1, 0),
 336                         BPF_MOV32_IMM(BPF_REG_0, 1),
 337                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 338                         BPF_EXIT_INSN(),
 339                 },
 340                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 341                 .result = ACCEPT,
 342                 .retval = 1,
 343         },
 344         {
 345                 "MOD32 by 0, zero check 2, cls",
 346                 .insns = {
 347                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 348                         BPF_MOV32_IMM(BPF_REG_0, 1),
 349                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 350                         BPF_EXIT_INSN(),
 351                 },
 352                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 353                 .result = ACCEPT,
 354                 .retval = 1,
 355         },
 356         {
 357                 "MOD64 by 0, zero check 1, cls",
 358                 .insns = {
 359                         BPF_MOV32_IMM(BPF_REG_1, 0),
 360                         BPF_MOV32_IMM(BPF_REG_0, 2),
 361                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 362                         BPF_EXIT_INSN(),
 363                 },
 364                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 365                 .result = ACCEPT,
 366                 .retval = 2,
 367         },
 368         {
 369                 "MOD64 by 0, zero check 2, cls",
 370                 .insns = {
 371                         BPF_MOV32_IMM(BPF_REG_1, 0),
 372                         BPF_MOV32_IMM(BPF_REG_0, -1),
 373                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 374                         BPF_EXIT_INSN(),
 375                 },
 376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 377                 .result = ACCEPT,
 378                 .retval = -1,
 379         },
 380         /* Just make sure that JITs used udiv/umod as otherwise we get
 381          * an exception from INT_MIN/-1 overflow similarly as with div
 382          * by zero.
 383          */
 384         {
 385                 "DIV32 overflow, check 1",
 386                 .insns = {
 387                         BPF_MOV32_IMM(BPF_REG_1, -1),
 388                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 389                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 390                         BPF_EXIT_INSN(),
 391                 },
 392                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 393                 .result = ACCEPT,
 394                 .retval = 0,
 395         },
 396         {
 397                 "DIV32 overflow, check 2",
 398                 .insns = {
 399                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 400                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 401                         BPF_EXIT_INSN(),
 402                 },
 403                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 404                 .result = ACCEPT,
 405                 .retval = 0,
 406         },
 407         {
 408                 "DIV64 overflow, check 1",
 409                 .insns = {
 410                         BPF_MOV64_IMM(BPF_REG_1, -1),
 411                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 412                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 413                         BPF_EXIT_INSN(),
 414                 },
 415                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 416                 .result = ACCEPT,
 417                 .retval = 0,
 418         },
 419         {
 420                 "DIV64 overflow, check 2",
 421                 .insns = {
 422                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 423                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 424                         BPF_EXIT_INSN(),
 425                 },
 426                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 427                 .result = ACCEPT,
 428                 .retval = 0,
 429         },
 430         {
 431                 "MOD32 overflow, check 1",
 432                 .insns = {
 433                         BPF_MOV32_IMM(BPF_REG_1, -1),
 434                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 435                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 436                         BPF_EXIT_INSN(),
 437                 },
 438                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 439                 .result = ACCEPT,
 440                 .retval = INT_MIN,
 441         },
 442         {
 443                 "MOD32 overflow, check 2",
 444                 .insns = {
 445                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 446                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 447                         BPF_EXIT_INSN(),
 448                 },
 449                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 450                 .result = ACCEPT,
 451                 .retval = INT_MIN,
 452         },
 453         {
 454                 "MOD64 overflow, check 1",
 455                 .insns = {
 456                         BPF_MOV64_IMM(BPF_REG_1, -1),
 457                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 458                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 459                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 460                         BPF_MOV32_IMM(BPF_REG_0, 0),
 461                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 462                         BPF_MOV32_IMM(BPF_REG_0, 1),
 463                         BPF_EXIT_INSN(),
 464                 },
 465                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 466                 .result = ACCEPT,
 467                 .retval = 1,
 468         },
 469         {
 470                 "MOD64 overflow, check 2",
 471                 .insns = {
 472                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 473                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 474                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 475                         BPF_MOV32_IMM(BPF_REG_0, 0),
 476                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 477                         BPF_MOV32_IMM(BPF_REG_0, 1),
 478                         BPF_EXIT_INSN(),
 479                 },
 480                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 481                 .result = ACCEPT,
 482                 .retval = 1,
 483         },
 484         {
 485                 "xor32 zero extend check",
 486                 .insns = {
 487                         BPF_MOV32_IMM(BPF_REG_2, -1),
 488                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 489                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 490                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 491                         BPF_MOV32_IMM(BPF_REG_0, 2),
 492                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 493                         BPF_MOV32_IMM(BPF_REG_0, 1),
 494                         BPF_EXIT_INSN(),
 495                 },
 496                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 497                 .result = ACCEPT,
 498                 .retval = 1,
 499         },
 500         {
 501                 "empty prog",
 502                 .insns = {
 503                 },
 504                 .errstr = "unknown opcode 00",
 505                 .result = REJECT,
 506         },
 507         {
 508                 "only exit insn",
 509                 .insns = {
 510                         BPF_EXIT_INSN(),
 511                 },
 512                 .errstr = "R0 !read_ok",
 513                 .result = REJECT,
 514         },
 515         {
 516                 "unreachable",
 517                 .insns = {
 518                         BPF_EXIT_INSN(),
 519                         BPF_EXIT_INSN(),
 520                 },
 521                 .errstr = "unreachable",
 522                 .result = REJECT,
 523         },
 524         {
 525                 "unreachable2",
 526                 .insns = {
 527                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 528                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 529                         BPF_EXIT_INSN(),
 530                 },
 531                 .errstr = "unreachable",
 532                 .result = REJECT,
 533         },
 534         {
 535                 "out of range jump",
 536                 .insns = {
 537                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 538                         BPF_EXIT_INSN(),
 539                 },
 540                 .errstr = "jump out of range",
 541                 .result = REJECT,
 542         },
 543         {
 544                 "out of range jump2",
 545                 .insns = {
 546                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 547                         BPF_EXIT_INSN(),
 548                 },
 549                 .errstr = "jump out of range",
 550                 .result = REJECT,
 551         },
 552         {
 553                 "test1 ld_imm64",
 554                 .insns = {
 555                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 556                         BPF_LD_IMM64(BPF_REG_0, 0),
 557                         BPF_LD_IMM64(BPF_REG_0, 0),
 558                         BPF_LD_IMM64(BPF_REG_0, 1),
 559                         BPF_LD_IMM64(BPF_REG_0, 1),
 560                         BPF_MOV64_IMM(BPF_REG_0, 2),
 561                         BPF_EXIT_INSN(),
 562                 },
 563                 .errstr = "invalid BPF_LD_IMM insn",
 564                 .errstr_unpriv = "R1 pointer comparison",
 565                 .result = REJECT,
 566         },
 567         {
 568                 "test2 ld_imm64",
 569                 .insns = {
 570                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 571                         BPF_LD_IMM64(BPF_REG_0, 0),
 572                         BPF_LD_IMM64(BPF_REG_0, 0),
 573                         BPF_LD_IMM64(BPF_REG_0, 1),
 574                         BPF_LD_IMM64(BPF_REG_0, 1),
 575                         BPF_EXIT_INSN(),
 576                 },
 577                 .errstr = "invalid BPF_LD_IMM insn",
 578                 .errstr_unpriv = "R1 pointer comparison",
 579                 .result = REJECT,
 580         },
 581         {
 582                 "test3 ld_imm64",
 583                 .insns = {
 584                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 585                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 586                         BPF_LD_IMM64(BPF_REG_0, 0),
 587                         BPF_LD_IMM64(BPF_REG_0, 0),
 588                         BPF_LD_IMM64(BPF_REG_0, 1),
 589                         BPF_LD_IMM64(BPF_REG_0, 1),
 590                         BPF_EXIT_INSN(),
 591                 },
 592                 .errstr = "invalid bpf_ld_imm64 insn",
 593                 .result = REJECT,
 594         },
 595         {
 596                 "test4 ld_imm64",
 597                 .insns = {
 598                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 599                         BPF_EXIT_INSN(),
 600                 },
 601                 .errstr = "invalid bpf_ld_imm64 insn",
 602                 .result = REJECT,
 603         },
 604         {
 605                 "test5 ld_imm64",
 606                 .insns = {
 607                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 608                 },
 609                 .errstr = "invalid bpf_ld_imm64 insn",
 610                 .result = REJECT,
 611         },
 612         {
 613                 "test6 ld_imm64",
 614                 .insns = {
 615                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 616                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 617                         BPF_EXIT_INSN(),
 618                 },
 619                 .result = ACCEPT,
 620         },
 621         {
 622                 "test7 ld_imm64",
 623                 .insns = {
 624                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 625                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 626                         BPF_EXIT_INSN(),
 627                 },
 628                 .result = ACCEPT,
 629                 .retval = 1,
 630         },
 631         {
 632                 "test8 ld_imm64",
 633                 .insns = {
 634                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 635                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 636                         BPF_EXIT_INSN(),
 637                 },
 638                 .errstr = "uses reserved fields",
 639                 .result = REJECT,
 640         },
 641         {
 642                 "test9 ld_imm64",
 643                 .insns = {
 644                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 645                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 646                         BPF_EXIT_INSN(),
 647                 },
 648                 .errstr = "invalid bpf_ld_imm64 insn",
 649                 .result = REJECT,
 650         },
 651         {
 652                 "test10 ld_imm64",
 653                 .insns = {
 654                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 655                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 656                         BPF_EXIT_INSN(),
 657                 },
 658                 .errstr = "invalid bpf_ld_imm64 insn",
 659                 .result = REJECT,
 660         },
 661         {
 662                 "test11 ld_imm64",
 663                 .insns = {
 664                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 665                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 666                         BPF_EXIT_INSN(),
 667                 },
 668                 .errstr = "invalid bpf_ld_imm64 insn",
 669                 .result = REJECT,
 670         },
 671         {
 672                 "test12 ld_imm64",
 673                 .insns = {
 674                         BPF_MOV64_IMM(BPF_REG_1, 0),
 675                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 676                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 677                         BPF_EXIT_INSN(),
 678                 },
 679                 .errstr = "not pointing to valid bpf_map",
 680                 .result = REJECT,
 681         },
 682         {
 683                 "test13 ld_imm64",
 684                 .insns = {
 685                         BPF_MOV64_IMM(BPF_REG_1, 0),
 686                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 687                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 688                         BPF_EXIT_INSN(),
 689                 },
 690                 .errstr = "invalid bpf_ld_imm64 insn",
 691                 .result = REJECT,
 692         },
 693         {
 694                 "arsh32 on imm",
 695                 .insns = {
 696                         BPF_MOV64_IMM(BPF_REG_0, 1),
 697                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 698                         BPF_EXIT_INSN(),
 699                 },
 700                 .result = REJECT,
 701                 .errstr = "unknown opcode c4",
 702         },
 703         {
 704                 "arsh32 on reg",
 705                 .insns = {
 706                         BPF_MOV64_IMM(BPF_REG_0, 1),
 707                         BPF_MOV64_IMM(BPF_REG_1, 5),
 708                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 709                         BPF_EXIT_INSN(),
 710                 },
 711                 .result = REJECT,
 712                 .errstr = "unknown opcode cc",
 713         },
 714         {
 715                 "arsh64 on imm",
 716                 .insns = {
 717                         BPF_MOV64_IMM(BPF_REG_0, 1),
 718                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 719                         BPF_EXIT_INSN(),
 720                 },
 721                 .result = ACCEPT,
 722         },
 723         {
 724                 "arsh64 on reg",
 725                 .insns = {
 726                         BPF_MOV64_IMM(BPF_REG_0, 1),
 727                         BPF_MOV64_IMM(BPF_REG_1, 5),
 728                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 729                         BPF_EXIT_INSN(),
 730                 },
 731                 .result = ACCEPT,
 732         },
 733         {
 734                 "no bpf_exit",
 735                 .insns = {
 736                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 737                 },
 738                 .errstr = "not an exit",
 739                 .result = REJECT,
 740         },
 741         {
 742                 "loop (back-edge)",
 743                 .insns = {
 744                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 745                         BPF_EXIT_INSN(),
 746                 },
 747                 .errstr = "back-edge",
 748                 .result = REJECT,
 749         },
 750         {
 751                 "loop2 (back-edge)",
 752                 .insns = {
 753                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 754                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 755                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 756                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 757                         BPF_EXIT_INSN(),
 758                 },
 759                 .errstr = "back-edge",
 760                 .result = REJECT,
 761         },
 762         {
 763                 "conditional loop",
 764                 .insns = {
 765                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 766                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 767                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 768                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 769                         BPF_EXIT_INSN(),
 770                 },
 771                 .errstr = "back-edge",
 772                 .result = REJECT,
 773         },
 774         {
 775                 "read uninitialized register",
 776                 .insns = {
 777                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 778                         BPF_EXIT_INSN(),
 779                 },
 780                 .errstr = "R2 !read_ok",
 781                 .result = REJECT,
 782         },
 783         {
 784                 "read invalid register",
 785                 .insns = {
 786                         BPF_MOV64_REG(BPF_REG_0, -1),
 787                         BPF_EXIT_INSN(),
 788                 },
 789                 .errstr = "R15 is invalid",
 790                 .result = REJECT,
 791         },
 792         {
 793                 "program doesn't init R0 before exit",
 794                 .insns = {
 795                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 796                         BPF_EXIT_INSN(),
 797                 },
 798                 .errstr = "R0 !read_ok",
 799                 .result = REJECT,
 800         },
 801         {
 802                 "program doesn't init R0 before exit in all branches",
 803                 .insns = {
 804                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 805                         BPF_MOV64_IMM(BPF_REG_0, 1),
 806                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 807                         BPF_EXIT_INSN(),
 808                 },
 809                 .errstr = "R0 !read_ok",
 810                 .errstr_unpriv = "R1 pointer comparison",
 811                 .result = REJECT,
 812         },
 813         {
 814                 "stack out of bounds",
 815                 .insns = {
 816                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 817                         BPF_EXIT_INSN(),
 818                 },
 819                 .errstr = "invalid stack",
 820                 .result = REJECT,
 821         },
 822         {
 823                 "invalid call insn1",
 824                 .insns = {
 825                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 826                         BPF_EXIT_INSN(),
 827                 },
 828                 .errstr = "unknown opcode 8d",
 829                 .result = REJECT,
 830         },
 831         {
 832                 "invalid call insn2",
 833                 .insns = {
 834                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 835                         BPF_EXIT_INSN(),
 836                 },
 837                 .errstr = "BPF_CALL uses reserved",
 838                 .result = REJECT,
 839         },
 840         {
 841                 "invalid function call",
 842                 .insns = {
 843                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 844                         BPF_EXIT_INSN(),
 845                 },
 846                 .errstr = "invalid func unknown#1234567",
 847                 .result = REJECT,
 848         },
 849         {
 850                 "uninitialized stack1",
 851                 .insns = {
 852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 856                                      BPF_FUNC_map_lookup_elem),
 857                         BPF_EXIT_INSN(),
 858                 },
 859                 .fixup_map1 = { 2 },
 860                 .errstr = "invalid indirect read from stack",
 861                 .result = REJECT,
 862         },
 863         {
 864                 "uninitialized stack2",
 865                 .insns = {
 866                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 867                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 868                         BPF_EXIT_INSN(),
 869                 },
 870                 .errstr = "invalid read from stack",
 871                 .result = REJECT,
 872         },
 873         {
 874                 "invalid fp arithmetic",
 875                 /* If this gets ever changed, make sure JITs can deal with it. */
 876                 .insns = {
 877                         BPF_MOV64_IMM(BPF_REG_0, 0),
 878                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 879                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 880                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 881                         BPF_EXIT_INSN(),
 882                 },
 883                 .errstr = "R1 subtraction from stack pointer",
 884                 .result = REJECT,
 885         },
 886         {
 887                 "non-invalid fp arithmetic",
 888                 .insns = {
 889                         BPF_MOV64_IMM(BPF_REG_0, 0),
 890                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 891                         BPF_EXIT_INSN(),
 892                 },
 893                 .result = ACCEPT,
 894         },
 895         {
 896                 "invalid argument register",
 897                 .insns = {
 898                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 899                                      BPF_FUNC_get_cgroup_classid),
 900                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 901                                      BPF_FUNC_get_cgroup_classid),
 902                         BPF_EXIT_INSN(),
 903                 },
 904                 .errstr = "R1 !read_ok",
 905                 .result = REJECT,
 906                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 907         },
 908         {
 909                 "non-invalid argument register",
 910                 .insns = {
 911                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 912                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 913                                      BPF_FUNC_get_cgroup_classid),
 914                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 915                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 916                                      BPF_FUNC_get_cgroup_classid),
 917                         BPF_EXIT_INSN(),
 918                 },
 919                 .result = ACCEPT,
 920                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 921         },
 922         {
 923                 "check valid spill/fill",
 924                 .insns = {
 925                         /* spill R1(ctx) into stack */
 926                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 927                         /* fill it back into R2 */
 928                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 929                         /* should be able to access R0 = *(R2 + 8) */
 930                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 931                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 932                         BPF_EXIT_INSN(),
 933                 },
 934                 .errstr_unpriv = "R0 leaks addr",
 935                 .result = ACCEPT,
 936                 .result_unpriv = REJECT,
 937                 .retval = POINTER_VALUE,
 938         },
 939         {
 940                 "check valid spill/fill, skb mark",
 941                 .insns = {
 942                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 943                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 944                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 945                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 946                                     offsetof(struct __sk_buff, mark)),
 947                         BPF_EXIT_INSN(),
 948                 },
 949                 .result = ACCEPT,
 950                 .result_unpriv = ACCEPT,
 951         },
 952         {
 953                 "check corrupted spill/fill",
 954                 .insns = {
 955                         /* spill R1(ctx) into stack */
 956                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 957                         /* mess up with R1 pointer on stack */
 958                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 959                         /* fill back into R0 should fail */
 960                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 961                         BPF_EXIT_INSN(),
 962                 },
 963                 .errstr_unpriv = "attempt to corrupt spilled",
 964                 .errstr = "corrupted spill",
 965                 .result = REJECT,
 966         },
 967         {
 968                 "invalid src register in STX",
 969                 .insns = {
 970                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 971                         BPF_EXIT_INSN(),
 972                 },
 973                 .errstr = "R15 is invalid",
 974                 .result = REJECT,
 975         },
 976         {
 977                 "invalid dst register in STX",
 978                 .insns = {
 979                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 980                         BPF_EXIT_INSN(),
 981                 },
 982                 .errstr = "R14 is invalid",
 983                 .result = REJECT,
 984         },
 985         {
 986                 "invalid dst register in ST",
 987                 .insns = {
 988                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 989                         BPF_EXIT_INSN(),
 990                 },
 991                 .errstr = "R14 is invalid",
 992                 .result = REJECT,
 993         },
 994         {
 995                 "invalid src register in LDX",
 996                 .insns = {
 997                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
 998                         BPF_EXIT_INSN(),
 999                 },
1000                 .errstr = "R12 is invalid",
1001                 .result = REJECT,
1002         },
1003         {
1004                 "invalid dst register in LDX",
1005                 .insns = {
1006                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
1007                         BPF_EXIT_INSN(),
1008                 },
1009                 .errstr = "R11 is invalid",
1010                 .result = REJECT,
1011         },
1012         {
1013                 "junk insn",
1014                 .insns = {
1015                         BPF_RAW_INSN(0, 0, 0, 0, 0),
1016                         BPF_EXIT_INSN(),
1017                 },
1018                 .errstr = "unknown opcode 00",
1019                 .result = REJECT,
1020         },
1021         {
1022                 "junk insn2",
1023                 .insns = {
1024                         BPF_RAW_INSN(1, 0, 0, 0, 0),
1025                         BPF_EXIT_INSN(),
1026                 },
1027                 .errstr = "BPF_LDX uses reserved fields",
1028                 .result = REJECT,
1029         },
1030         {
1031                 "junk insn3",
1032                 .insns = {
1033                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
1034                         BPF_EXIT_INSN(),
1035                 },
1036                 .errstr = "unknown opcode ff",
1037                 .result = REJECT,
1038         },
1039         {
1040                 "junk insn4",
1041                 .insns = {
1042                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
1043                         BPF_EXIT_INSN(),
1044                 },
1045                 .errstr = "unknown opcode ff",
1046                 .result = REJECT,
1047         },
1048         {
1049                 "junk insn5",
1050                 .insns = {
1051                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
1052                         BPF_EXIT_INSN(),
1053                 },
1054                 .errstr = "BPF_ALU uses reserved fields",
1055                 .result = REJECT,
1056         },
1057         {
1058                 "misaligned read from stack",
1059                 .insns = {
1060                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1061                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
1062                         BPF_EXIT_INSN(),
1063                 },
1064                 .errstr = "misaligned stack access",
1065                 .result = REJECT,
1066         },
1067         {
1068                 "invalid map_fd for function call",
1069                 .insns = {
1070                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1071                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
1072                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1073                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1074                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1075                                      BPF_FUNC_map_delete_elem),
1076                         BPF_EXIT_INSN(),
1077                 },
1078                 .errstr = "fd 0 is not pointing to valid bpf_map",
1079                 .result = REJECT,
1080         },
1081         {
1082                 "don't check return value before access",
1083                 .insns = {
1084                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1085                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1087                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1088                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1089                                      BPF_FUNC_map_lookup_elem),
1090                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1091                         BPF_EXIT_INSN(),
1092                 },
1093                 .fixup_map1 = { 3 },
1094                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1095                 .result = REJECT,
1096         },
1097         {
1098                 "access memory with incorrect alignment",
1099                 .insns = {
1100                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1103                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1104                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1105                                      BPF_FUNC_map_lookup_elem),
1106                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1107                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1108                         BPF_EXIT_INSN(),
1109                 },
1110                 .fixup_map1 = { 3 },
1111                 .errstr = "misaligned value access",
1112                 .result = REJECT,
1113                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1114         },
1115         {
1116                 "sometimes access memory with incorrect alignment",
1117                 .insns = {
1118                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1119                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1120                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1121                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1122                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1123                                      BPF_FUNC_map_lookup_elem),
1124                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1125                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1126                         BPF_EXIT_INSN(),
1127                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1128                         BPF_EXIT_INSN(),
1129                 },
1130                 .fixup_map1 = { 3 },
1131                 .errstr = "R0 invalid mem access",
1132                 .errstr_unpriv = "R0 leaks addr",
1133                 .result = REJECT,
1134                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1135         },
1136         {
1137                 "jump test 1",
1138                 .insns = {
1139                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1140                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1141                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1142                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1143                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1144                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1145                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1146                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1147                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1148                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1149                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1150                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1152                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1153                         BPF_MOV64_IMM(BPF_REG_0, 0),
1154                         BPF_EXIT_INSN(),
1155                 },
1156                 .errstr_unpriv = "R1 pointer comparison",
1157                 .result_unpriv = REJECT,
1158                 .result = ACCEPT,
1159         },
1160         {
1161                 "jump test 2",
1162                 .insns = {
1163                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1164                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1165                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1166                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1168                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1169                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1172                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1175                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1176                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1177                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1178                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1179                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1180                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1181                         BPF_MOV64_IMM(BPF_REG_0, 0),
1182                         BPF_EXIT_INSN(),
1183                 },
1184                 .errstr_unpriv = "R1 pointer comparison",
1185                 .result_unpriv = REJECT,
1186                 .result = ACCEPT,
1187         },
1188         {
1189                 "jump test 3",
1190                 .insns = {
1191                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1192                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1193                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1195                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1196                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1197                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1198                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1199                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1201                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1202                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1203                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1204                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1205                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1206                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1207                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1208                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1209                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1210                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1211                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1212                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1213                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1214                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1215                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1216                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1217                                      BPF_FUNC_map_delete_elem),
1218                         BPF_EXIT_INSN(),
1219                 },
1220                 .fixup_map1 = { 24 },
1221                 .errstr_unpriv = "R1 pointer comparison",
1222                 .result_unpriv = REJECT,
1223                 .result = ACCEPT,
1224                 .retval = -ENOENT,
1225         },
1226         {
1227                 "jump test 4",
1228                 .insns = {
1229                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1230                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1231                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1233                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1234                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1235                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1237                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1238                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1239                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1240                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1241                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1242                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1243                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1244                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1245                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1247                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1249                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1250                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1251                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1252                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1253                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1258                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1260                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1261                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1262                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1263                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1268                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1269                         BPF_MOV64_IMM(BPF_REG_0, 0),
1270                         BPF_EXIT_INSN(),
1271                 },
1272                 .errstr_unpriv = "R1 pointer comparison",
1273                 .result_unpriv = REJECT,
1274                 .result = ACCEPT,
1275         },
1276         {
1277                 "jump test 5",
1278                 .insns = {
1279                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1280                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1281                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1282                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1283                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1284                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1285                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1286                         BPF_MOV64_IMM(BPF_REG_0, 0),
1287                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1288                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1289                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1290                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1291                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1292                         BPF_MOV64_IMM(BPF_REG_0, 0),
1293                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1294                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1295                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1296                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1297                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1298                         BPF_MOV64_IMM(BPF_REG_0, 0),
1299                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1300                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1301                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1302                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1303                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1304                         BPF_MOV64_IMM(BPF_REG_0, 0),
1305                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1306                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1307                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1308                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1309                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1310                         BPF_MOV64_IMM(BPF_REG_0, 0),
1311                         BPF_EXIT_INSN(),
1312                 },
1313                 .errstr_unpriv = "R1 pointer comparison",
1314                 .result_unpriv = REJECT,
1315                 .result = ACCEPT,
1316         },
1317         {
1318                 "access skb fields ok",
1319                 .insns = {
1320                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1321                                     offsetof(struct __sk_buff, len)),
1322                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1323                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1324                                     offsetof(struct __sk_buff, mark)),
1325                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1326                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1327                                     offsetof(struct __sk_buff, pkt_type)),
1328                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1329                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1330                                     offsetof(struct __sk_buff, queue_mapping)),
1331                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1332                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1333                                     offsetof(struct __sk_buff, protocol)),
1334                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1335                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1336                                     offsetof(struct __sk_buff, vlan_present)),
1337                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1338                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1339                                     offsetof(struct __sk_buff, vlan_tci)),
1340                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1341                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1342                                     offsetof(struct __sk_buff, napi_id)),
1343                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1344                         BPF_EXIT_INSN(),
1345                 },
1346                 .result = ACCEPT,
1347         },
1348         {
1349                 "access skb fields bad1",
1350                 .insns = {
1351                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1352                         BPF_EXIT_INSN(),
1353                 },
1354                 .errstr = "invalid bpf_context access",
1355                 .result = REJECT,
1356         },
1357         {
1358                 "access skb fields bad2",
1359                 .insns = {
1360                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1361                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1362                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1364                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1365                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1366                                      BPF_FUNC_map_lookup_elem),
1367                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1368                         BPF_EXIT_INSN(),
1369                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1371                                     offsetof(struct __sk_buff, pkt_type)),
1372                         BPF_EXIT_INSN(),
1373                 },
1374                 .fixup_map1 = { 4 },
1375                 .errstr = "different pointers",
1376                 .errstr_unpriv = "R1 pointer comparison",
1377                 .result = REJECT,
1378         },
1379         {
1380                 "access skb fields bad3",
1381                 .insns = {
1382                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1383                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1384                                     offsetof(struct __sk_buff, pkt_type)),
1385                         BPF_EXIT_INSN(),
1386                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1389                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1390                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1391                                      BPF_FUNC_map_lookup_elem),
1392                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1393                         BPF_EXIT_INSN(),
1394                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1395                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1396                 },
1397                 .fixup_map1 = { 6 },
1398                 .errstr = "different pointers",
1399                 .errstr_unpriv = "R1 pointer comparison",
1400                 .result = REJECT,
1401         },
1402         {
1403                 "access skb fields bad4",
1404                 .insns = {
1405                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1406                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1407                                     offsetof(struct __sk_buff, len)),
1408                         BPF_MOV64_IMM(BPF_REG_0, 0),
1409                         BPF_EXIT_INSN(),
1410                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1415                                      BPF_FUNC_map_lookup_elem),
1416                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1417                         BPF_EXIT_INSN(),
1418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1419                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1420                 },
1421                 .fixup_map1 = { 7 },
1422                 .errstr = "different pointers",
1423                 .errstr_unpriv = "R1 pointer comparison",
1424                 .result = REJECT,
1425         },
1426         {
1427                 "invalid access __sk_buff family",
1428                 .insns = {
1429                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1430                                     offsetof(struct __sk_buff, family)),
1431                         BPF_EXIT_INSN(),
1432                 },
1433                 .errstr = "invalid bpf_context access",
1434                 .result = REJECT,
1435         },
1436         {
1437                 "invalid access __sk_buff remote_ip4",
1438                 .insns = {
1439                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1440                                     offsetof(struct __sk_buff, remote_ip4)),
1441                         BPF_EXIT_INSN(),
1442                 },
1443                 .errstr = "invalid bpf_context access",
1444                 .result = REJECT,
1445         },
1446         {
1447                 "invalid access __sk_buff local_ip4",
1448                 .insns = {
1449                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1450                                     offsetof(struct __sk_buff, local_ip4)),
1451                         BPF_EXIT_INSN(),
1452                 },
1453                 .errstr = "invalid bpf_context access",
1454                 .result = REJECT,
1455         },
1456         {
1457                 "invalid access __sk_buff remote_ip6",
1458                 .insns = {
1459                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1460                                     offsetof(struct __sk_buff, remote_ip6)),
1461                         BPF_EXIT_INSN(),
1462                 },
1463                 .errstr = "invalid bpf_context access",
1464                 .result = REJECT,
1465         },
1466         {
1467                 "invalid access __sk_buff local_ip6",
1468                 .insns = {
1469                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1470                                     offsetof(struct __sk_buff, local_ip6)),
1471                         BPF_EXIT_INSN(),
1472                 },
1473                 .errstr = "invalid bpf_context access",
1474                 .result = REJECT,
1475         },
1476         {
1477                 "invalid access __sk_buff remote_port",
1478                 .insns = {
1479                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1480                                     offsetof(struct __sk_buff, remote_port)),
1481                         BPF_EXIT_INSN(),
1482                 },
1483                 .errstr = "invalid bpf_context access",
1484                 .result = REJECT,
1485         },
1486         {
1487                 "invalid access __sk_buff remote_port",
1488                 .insns = {
1489                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1490                                     offsetof(struct __sk_buff, local_port)),
1491                         BPF_EXIT_INSN(),
1492                 },
1493                 .errstr = "invalid bpf_context access",
1494                 .result = REJECT,
1495         },
1496         {
1497                 "valid access __sk_buff family",
1498                 .insns = {
1499                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1500                                     offsetof(struct __sk_buff, family)),
1501                         BPF_EXIT_INSN(),
1502                 },
1503                 .result = ACCEPT,
1504                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1505         },
1506         {
1507                 "valid access __sk_buff remote_ip4",
1508                 .insns = {
1509                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1510                                     offsetof(struct __sk_buff, remote_ip4)),
1511                         BPF_EXIT_INSN(),
1512                 },
1513                 .result = ACCEPT,
1514                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1515         },
1516         {
1517                 "valid access __sk_buff local_ip4",
1518                 .insns = {
1519                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1520                                     offsetof(struct __sk_buff, local_ip4)),
1521                         BPF_EXIT_INSN(),
1522                 },
1523                 .result = ACCEPT,
1524                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1525         },
1526         {
1527                 "valid access __sk_buff remote_ip6",
1528                 .insns = {
1529                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1530                                     offsetof(struct __sk_buff, remote_ip6[0])),
1531                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1532                                     offsetof(struct __sk_buff, remote_ip6[1])),
1533                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1534                                     offsetof(struct __sk_buff, remote_ip6[2])),
1535                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1536                                     offsetof(struct __sk_buff, remote_ip6[3])),
1537                         BPF_EXIT_INSN(),
1538                 },
1539                 .result = ACCEPT,
1540                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1541         },
1542         {
1543                 "valid access __sk_buff local_ip6",
1544                 .insns = {
1545                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1546                                     offsetof(struct __sk_buff, local_ip6[0])),
1547                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1548                                     offsetof(struct __sk_buff, local_ip6[1])),
1549                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1550                                     offsetof(struct __sk_buff, local_ip6[2])),
1551                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1552                                     offsetof(struct __sk_buff, local_ip6[3])),
1553                         BPF_EXIT_INSN(),
1554                 },
1555                 .result = ACCEPT,
1556                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1557         },
1558         {
1559                 "valid access __sk_buff remote_port",
1560                 .insns = {
1561                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1562                                     offsetof(struct __sk_buff, remote_port)),
1563                         BPF_EXIT_INSN(),
1564                 },
1565                 .result = ACCEPT,
1566                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1567         },
1568         {
1569                 "valid access __sk_buff remote_port",
1570                 .insns = {
1571                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1572                                     offsetof(struct __sk_buff, local_port)),
1573                         BPF_EXIT_INSN(),
1574                 },
1575                 .result = ACCEPT,
1576                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1577         },
1578         {
1579                 "invalid access of tc_classid for SK_SKB",
1580                 .insns = {
1581                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1582                                     offsetof(struct __sk_buff, tc_classid)),
1583                         BPF_EXIT_INSN(),
1584                 },
1585                 .result = REJECT,
1586                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1587                 .errstr = "invalid bpf_context access",
1588         },
1589         {
1590                 "invalid access of skb->mark for SK_SKB",
1591                 .insns = {
1592                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1593                                     offsetof(struct __sk_buff, mark)),
1594                         BPF_EXIT_INSN(),
1595                 },
1596                 .result =  REJECT,
1597                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1598                 .errstr = "invalid bpf_context access",
1599         },
1600         {
1601                 "check skb->mark is not writeable by SK_SKB",
1602                 .insns = {
1603                         BPF_MOV64_IMM(BPF_REG_0, 0),
1604                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1605                                     offsetof(struct __sk_buff, mark)),
1606                         BPF_EXIT_INSN(),
1607                 },
1608                 .result =  REJECT,
1609                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1610                 .errstr = "invalid bpf_context access",
1611         },
1612         {
1613                 "check skb->tc_index is writeable by SK_SKB",
1614                 .insns = {
1615                         BPF_MOV64_IMM(BPF_REG_0, 0),
1616                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1617                                     offsetof(struct __sk_buff, tc_index)),
1618                         BPF_EXIT_INSN(),
1619                 },
1620                 .result = ACCEPT,
1621                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1622         },
1623         {
1624                 "check skb->priority is writeable by SK_SKB",
1625                 .insns = {
1626                         BPF_MOV64_IMM(BPF_REG_0, 0),
1627                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1628                                     offsetof(struct __sk_buff, priority)),
1629                         BPF_EXIT_INSN(),
1630                 },
1631                 .result = ACCEPT,
1632                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1633         },
1634         {
1635                 "direct packet read for SK_SKB",
1636                 .insns = {
1637                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1638                                     offsetof(struct __sk_buff, data)),
1639                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1640                                     offsetof(struct __sk_buff, data_end)),
1641                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1642                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1643                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1644                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1645                         BPF_MOV64_IMM(BPF_REG_0, 0),
1646                         BPF_EXIT_INSN(),
1647                 },
1648                 .result = ACCEPT,
1649                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1650         },
1651         {
1652                 "direct packet write for SK_SKB",
1653                 .insns = {
1654                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1655                                     offsetof(struct __sk_buff, data)),
1656                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1657                                     offsetof(struct __sk_buff, data_end)),
1658                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1660                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1661                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1662                         BPF_MOV64_IMM(BPF_REG_0, 0),
1663                         BPF_EXIT_INSN(),
1664                 },
1665                 .result = ACCEPT,
1666                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1667         },
1668         {
1669                 "overlapping checks for direct packet access SK_SKB",
1670                 .insns = {
1671                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1672                                     offsetof(struct __sk_buff, data)),
1673                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1674                                     offsetof(struct __sk_buff, data_end)),
1675                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1676                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1677                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1678                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1679                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1680                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1681                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1682                         BPF_MOV64_IMM(BPF_REG_0, 0),
1683                         BPF_EXIT_INSN(),
1684                 },
1685                 .result = ACCEPT,
1686                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1687         },
1688         {
1689                 "valid access family in SK_MSG",
1690                 .insns = {
1691                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1692                                     offsetof(struct sk_msg_md, family)),
1693                         BPF_EXIT_INSN(),
1694                 },
1695                 .result = ACCEPT,
1696                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1697         },
1698         {
1699                 "valid access remote_ip4 in SK_MSG",
1700                 .insns = {
1701                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1702                                     offsetof(struct sk_msg_md, remote_ip4)),
1703                         BPF_EXIT_INSN(),
1704                 },
1705                 .result = ACCEPT,
1706                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1707         },
1708         {
1709                 "valid access local_ip4 in SK_MSG",
1710                 .insns = {
1711                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1712                                     offsetof(struct sk_msg_md, local_ip4)),
1713                         BPF_EXIT_INSN(),
1714                 },
1715                 .result = ACCEPT,
1716                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1717         },
1718         {
1719                 "valid access remote_port in SK_MSG",
1720                 .insns = {
1721                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1722                                     offsetof(struct sk_msg_md, remote_port)),
1723                         BPF_EXIT_INSN(),
1724                 },
1725                 .result = ACCEPT,
1726                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1727         },
1728         {
1729                 "valid access local_port in SK_MSG",
1730                 .insns = {
1731                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1732                                     offsetof(struct sk_msg_md, local_port)),
1733                         BPF_EXIT_INSN(),
1734                 },
1735                 .result = ACCEPT,
1736                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1737         },
1738         {
1739                 "valid access remote_ip6 in SK_MSG",
1740                 .insns = {
1741                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1742                                     offsetof(struct sk_msg_md, remote_ip6[0])),
1743                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1744                                     offsetof(struct sk_msg_md, remote_ip6[1])),
1745                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1746                                     offsetof(struct sk_msg_md, remote_ip6[2])),
1747                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1748                                     offsetof(struct sk_msg_md, remote_ip6[3])),
1749                         BPF_EXIT_INSN(),
1750                 },
1751                 .result = ACCEPT,
1752                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1753         },
1754         {
1755                 "valid access local_ip6 in SK_MSG",
1756                 .insns = {
1757                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1758                                     offsetof(struct sk_msg_md, local_ip6[0])),
1759                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1760                                     offsetof(struct sk_msg_md, local_ip6[1])),
1761                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1762                                     offsetof(struct sk_msg_md, local_ip6[2])),
1763                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1764                                     offsetof(struct sk_msg_md, local_ip6[3])),
1765                         BPF_EXIT_INSN(),
1766                 },
1767                 .result = ACCEPT,
1768                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1769         },
1770         {
1771                 "invalid 64B read of family in SK_MSG",
1772                 .insns = {
1773                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1774                                     offsetof(struct sk_msg_md, family)),
1775                         BPF_EXIT_INSN(),
1776                 },
1777                 .errstr = "invalid bpf_context access",
1778                 .result = REJECT,
1779                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1780         },
1781         {
1782                 "invalid read past end of SK_MSG",
1783                 .insns = {
1784                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1785                                     offsetof(struct sk_msg_md, local_port) + 4),
1786                         BPF_EXIT_INSN(),
1787                 },
1788                 .errstr = "R0 !read_ok",
1789                 .result = REJECT,
1790                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1791         },
1792         {
1793                 "invalid read offset in SK_MSG",
1794                 .insns = {
1795                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1796                                     offsetof(struct sk_msg_md, family) + 1),
1797                         BPF_EXIT_INSN(),
1798                 },
1799                 .errstr = "invalid bpf_context access",
1800                 .result = REJECT,
1801                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1802         },
1803         {
1804                 "direct packet read for SK_MSG",
1805                 .insns = {
1806                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1807                                     offsetof(struct sk_msg_md, data)),
1808                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1809                                     offsetof(struct sk_msg_md, data_end)),
1810                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1812                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1813                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1814                         BPF_MOV64_IMM(BPF_REG_0, 0),
1815                         BPF_EXIT_INSN(),
1816                 },
1817                 .result = ACCEPT,
1818                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1819         },
1820         {
1821                 "direct packet write for SK_MSG",
1822                 .insns = {
1823                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1824                                     offsetof(struct sk_msg_md, data)),
1825                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1826                                     offsetof(struct sk_msg_md, data_end)),
1827                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1829                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1830                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1831                         BPF_MOV64_IMM(BPF_REG_0, 0),
1832                         BPF_EXIT_INSN(),
1833                 },
1834                 .result = ACCEPT,
1835                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1836         },
1837         {
1838                 "overlapping checks for direct packet access SK_MSG",
1839                 .insns = {
1840                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1841                                     offsetof(struct sk_msg_md, data)),
1842                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1843                                     offsetof(struct sk_msg_md, data_end)),
1844                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1845                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1846                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1847                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1849                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1850                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1851                         BPF_MOV64_IMM(BPF_REG_0, 0),
1852                         BPF_EXIT_INSN(),
1853                 },
1854                 .result = ACCEPT,
1855                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1856         },
1857         {
1858                 "check skb->mark is not writeable by sockets",
1859                 .insns = {
1860                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1861                                     offsetof(struct __sk_buff, mark)),
1862                         BPF_EXIT_INSN(),
1863                 },
1864                 .errstr = "invalid bpf_context access",
1865                 .errstr_unpriv = "R1 leaks addr",
1866                 .result = REJECT,
1867         },
1868         {
1869                 "check skb->tc_index is not writeable by sockets",
1870                 .insns = {
1871                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1872                                     offsetof(struct __sk_buff, tc_index)),
1873                         BPF_EXIT_INSN(),
1874                 },
1875                 .errstr = "invalid bpf_context access",
1876                 .errstr_unpriv = "R1 leaks addr",
1877                 .result = REJECT,
1878         },
1879         {
1880                 "check cb access: byte",
1881                 .insns = {
1882                         BPF_MOV64_IMM(BPF_REG_0, 0),
1883                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1884                                     offsetof(struct __sk_buff, cb[0])),
1885                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1886                                     offsetof(struct __sk_buff, cb[0]) + 1),
1887                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1888                                     offsetof(struct __sk_buff, cb[0]) + 2),
1889                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1890                                     offsetof(struct __sk_buff, cb[0]) + 3),
1891                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1892                                     offsetof(struct __sk_buff, cb[1])),
1893                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1894                                     offsetof(struct __sk_buff, cb[1]) + 1),
1895                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1896                                     offsetof(struct __sk_buff, cb[1]) + 2),
1897                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1898                                     offsetof(struct __sk_buff, cb[1]) + 3),
1899                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1900                                     offsetof(struct __sk_buff, cb[2])),
1901                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1902                                     offsetof(struct __sk_buff, cb[2]) + 1),
1903                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1904                                     offsetof(struct __sk_buff, cb[2]) + 2),
1905                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1906                                     offsetof(struct __sk_buff, cb[2]) + 3),
1907                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1908                                     offsetof(struct __sk_buff, cb[3])),
1909                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1910                                     offsetof(struct __sk_buff, cb[3]) + 1),
1911                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1912                                     offsetof(struct __sk_buff, cb[3]) + 2),
1913                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1914                                     offsetof(struct __sk_buff, cb[3]) + 3),
1915                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1916                                     offsetof(struct __sk_buff, cb[4])),
1917                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1918                                     offsetof(struct __sk_buff, cb[4]) + 1),
1919                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1920                                     offsetof(struct __sk_buff, cb[4]) + 2),
1921                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1922                                     offsetof(struct __sk_buff, cb[4]) + 3),
1923                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1924                                     offsetof(struct __sk_buff, cb[0])),
1925                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1926                                     offsetof(struct __sk_buff, cb[0]) + 1),
1927                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1928                                     offsetof(struct __sk_buff, cb[0]) + 2),
1929                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1930                                     offsetof(struct __sk_buff, cb[0]) + 3),
1931                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1932                                     offsetof(struct __sk_buff, cb[1])),
1933                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1934                                     offsetof(struct __sk_buff, cb[1]) + 1),
1935                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1936                                     offsetof(struct __sk_buff, cb[1]) + 2),
1937                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1938                                     offsetof(struct __sk_buff, cb[1]) + 3),
1939                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1940                                     offsetof(struct __sk_buff, cb[2])),
1941                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1942                                     offsetof(struct __sk_buff, cb[2]) + 1),
1943                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1944                                     offsetof(struct __sk_buff, cb[2]) + 2),
1945                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1946                                     offsetof(struct __sk_buff, cb[2]) + 3),
1947                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1948                                     offsetof(struct __sk_buff, cb[3])),
1949                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1950                                     offsetof(struct __sk_buff, cb[3]) + 1),
1951                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1952                                     offsetof(struct __sk_buff, cb[3]) + 2),
1953                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1954                                     offsetof(struct __sk_buff, cb[3]) + 3),
1955                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1956                                     offsetof(struct __sk_buff, cb[4])),
1957                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1958                                     offsetof(struct __sk_buff, cb[4]) + 1),
1959                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1960                                     offsetof(struct __sk_buff, cb[4]) + 2),
1961                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1962                                     offsetof(struct __sk_buff, cb[4]) + 3),
1963                         BPF_EXIT_INSN(),
1964                 },
1965                 .result = ACCEPT,
1966         },
1967         {
1968                 "__sk_buff->hash, offset 0, byte store not permitted",
1969                 .insns = {
1970                         BPF_MOV64_IMM(BPF_REG_0, 0),
1971                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1972                                     offsetof(struct __sk_buff, hash)),
1973                         BPF_EXIT_INSN(),
1974                 },
1975                 .errstr = "invalid bpf_context access",
1976                 .result = REJECT,
1977         },
1978         {
1979                 "__sk_buff->tc_index, offset 3, byte store not permitted",
1980                 .insns = {
1981                         BPF_MOV64_IMM(BPF_REG_0, 0),
1982                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1983                                     offsetof(struct __sk_buff, tc_index) + 3),
1984                         BPF_EXIT_INSN(),
1985                 },
1986                 .errstr = "invalid bpf_context access",
1987                 .result = REJECT,
1988         },
1989         {
1990                 "check skb->hash byte load permitted",
1991                 .insns = {
1992                         BPF_MOV64_IMM(BPF_REG_0, 0),
1993 #if __BYTE_ORDER == __LITTLE_ENDIAN
1994                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1995                                     offsetof(struct __sk_buff, hash)),
1996 #else
1997                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1998                                     offsetof(struct __sk_buff, hash) + 3),
1999 #endif
2000                         BPF_EXIT_INSN(),
2001                 },
2002                 .result = ACCEPT,
2003         },
2004         {
2005                 "check skb->hash byte load permitted 1",
2006                 .insns = {
2007                         BPF_MOV64_IMM(BPF_REG_0, 0),
2008                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2009                                     offsetof(struct __sk_buff, hash) + 1),
2010                         BPF_EXIT_INSN(),
2011                 },
2012                 .result = ACCEPT,
2013         },
2014         {
2015                 "check skb->hash byte load permitted 2",
2016                 .insns = {
2017                         BPF_MOV64_IMM(BPF_REG_0, 0),
2018                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2019                                     offsetof(struct __sk_buff, hash) + 2),
2020                         BPF_EXIT_INSN(),
2021                 },
2022                 .result = ACCEPT,
2023         },
2024         {
2025                 "check skb->hash byte load permitted 3",
2026                 .insns = {
2027                         BPF_MOV64_IMM(BPF_REG_0, 0),
2028 #if __BYTE_ORDER == __LITTLE_ENDIAN
2029                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2030                                     offsetof(struct __sk_buff, hash) + 3),
2031 #else
2032                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2033                                     offsetof(struct __sk_buff, hash)),
2034 #endif
2035                         BPF_EXIT_INSN(),
2036                 },
2037                 .result = ACCEPT,
2038         },
2039         {
2040                 "check cb access: byte, wrong type",
2041                 .insns = {
2042                         BPF_MOV64_IMM(BPF_REG_0, 0),
2043                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2044                                     offsetof(struct __sk_buff, cb[0])),
2045                         BPF_EXIT_INSN(),
2046                 },
2047                 .errstr = "invalid bpf_context access",
2048                 .result = REJECT,
2049                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2050         },
2051         {
2052                 "check cb access: half",
2053                 .insns = {
2054                         BPF_MOV64_IMM(BPF_REG_0, 0),
2055                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2056                                     offsetof(struct __sk_buff, cb[0])),
2057                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2058                                     offsetof(struct __sk_buff, cb[0]) + 2),
2059                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2060                                     offsetof(struct __sk_buff, cb[1])),
2061                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2062                                     offsetof(struct __sk_buff, cb[1]) + 2),
2063                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2064                                     offsetof(struct __sk_buff, cb[2])),
2065                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2066                                     offsetof(struct __sk_buff, cb[2]) + 2),
2067                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2068                                     offsetof(struct __sk_buff, cb[3])),
2069                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2070                                     offsetof(struct __sk_buff, cb[3]) + 2),
2071                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2072                                     offsetof(struct __sk_buff, cb[4])),
2073                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2074                                     offsetof(struct __sk_buff, cb[4]) + 2),
2075                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2076                                     offsetof(struct __sk_buff, cb[0])),
2077                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2078                                     offsetof(struct __sk_buff, cb[0]) + 2),
2079                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2080                                     offsetof(struct __sk_buff, cb[1])),
2081                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2082                                     offsetof(struct __sk_buff, cb[1]) + 2),
2083                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2084                                     offsetof(struct __sk_buff, cb[2])),
2085                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2086                                     offsetof(struct __sk_buff, cb[2]) + 2),
2087                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2088                                     offsetof(struct __sk_buff, cb[3])),
2089                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2090                                     offsetof(struct __sk_buff, cb[3]) + 2),
2091                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2092                                     offsetof(struct __sk_buff, cb[4])),
2093                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2094                                     offsetof(struct __sk_buff, cb[4]) + 2),
2095                         BPF_EXIT_INSN(),
2096                 },
2097                 .result = ACCEPT,
2098         },
2099         {
2100                 "check cb access: half, unaligned",
2101                 .insns = {
2102                         BPF_MOV64_IMM(BPF_REG_0, 0),
2103                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2104                                     offsetof(struct __sk_buff, cb[0]) + 1),
2105                         BPF_EXIT_INSN(),
2106                 },
2107                 .errstr = "misaligned context access",
2108                 .result = REJECT,
2109                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2110         },
2111         {
2112                 "check __sk_buff->hash, offset 0, half store not permitted",
2113                 .insns = {
2114                         BPF_MOV64_IMM(BPF_REG_0, 0),
2115                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2116                                     offsetof(struct __sk_buff, hash)),
2117                         BPF_EXIT_INSN(),
2118                 },
2119                 .errstr = "invalid bpf_context access",
2120                 .result = REJECT,
2121         },
2122         {
2123                 "check __sk_buff->tc_index, offset 2, half store not permitted",
2124                 .insns = {
2125                         BPF_MOV64_IMM(BPF_REG_0, 0),
2126                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2127                                     offsetof(struct __sk_buff, tc_index) + 2),
2128                         BPF_EXIT_INSN(),
2129                 },
2130                 .errstr = "invalid bpf_context access",
2131                 .result = REJECT,
2132         },
2133         {
2134                 "check skb->hash half load permitted",
2135                 .insns = {
2136                         BPF_MOV64_IMM(BPF_REG_0, 0),
2137 #if __BYTE_ORDER == __LITTLE_ENDIAN
2138                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2139                                     offsetof(struct __sk_buff, hash)),
2140 #else
2141                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2142                                     offsetof(struct __sk_buff, hash) + 2),
2143 #endif
2144                         BPF_EXIT_INSN(),
2145                 },
2146                 .result = ACCEPT,
2147         },
2148         {
2149                 "check skb->hash half load permitted 2",
2150                 .insns = {
2151                         BPF_MOV64_IMM(BPF_REG_0, 0),
2152 #if __BYTE_ORDER == __LITTLE_ENDIAN
2153                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2154                                     offsetof(struct __sk_buff, hash) + 2),
2155 #else
2156                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2157                                     offsetof(struct __sk_buff, hash)),
2158 #endif
2159                         BPF_EXIT_INSN(),
2160                 },
2161                 .result = ACCEPT,
2162         },
2163         {
2164                 "check skb->hash half load not permitted, unaligned 1",
2165                 .insns = {
2166                         BPF_MOV64_IMM(BPF_REG_0, 0),
2167 #if __BYTE_ORDER == __LITTLE_ENDIAN
2168                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2169                                     offsetof(struct __sk_buff, hash) + 1),
2170 #else
2171                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2172                                     offsetof(struct __sk_buff, hash) + 3),
2173 #endif
2174                         BPF_EXIT_INSN(),
2175                 },
2176                 .errstr = "invalid bpf_context access",
2177                 .result = REJECT,
2178         },
2179         {
2180                 "check skb->hash half load not permitted, unaligned 3",
2181                 .insns = {
2182                         BPF_MOV64_IMM(BPF_REG_0, 0),
2183 #if __BYTE_ORDER == __LITTLE_ENDIAN
2184                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2185                                     offsetof(struct __sk_buff, hash) + 3),
2186 #else
2187                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2188                                     offsetof(struct __sk_buff, hash) + 1),
2189 #endif
2190                         BPF_EXIT_INSN(),
2191                 },
2192                 .errstr = "invalid bpf_context access",
2193                 .result = REJECT,
2194         },
2195         {
2196                 "check cb access: half, wrong type",
2197                 .insns = {
2198                         BPF_MOV64_IMM(BPF_REG_0, 0),
2199                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2200                                     offsetof(struct __sk_buff, cb[0])),
2201                         BPF_EXIT_INSN(),
2202                 },
2203                 .errstr = "invalid bpf_context access",
2204                 .result = REJECT,
2205                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2206         },
2207         {
2208                 "check cb access: word",
2209                 .insns = {
2210                         BPF_MOV64_IMM(BPF_REG_0, 0),
2211                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2212                                     offsetof(struct __sk_buff, cb[0])),
2213                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2214                                     offsetof(struct __sk_buff, cb[1])),
2215                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2216                                     offsetof(struct __sk_buff, cb[2])),
2217                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2218                                     offsetof(struct __sk_buff, cb[3])),
2219                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2220                                     offsetof(struct __sk_buff, cb[4])),
2221                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2222                                     offsetof(struct __sk_buff, cb[0])),
2223                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2224                                     offsetof(struct __sk_buff, cb[1])),
2225                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2226                                     offsetof(struct __sk_buff, cb[2])),
2227                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2228                                     offsetof(struct __sk_buff, cb[3])),
2229                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2230                                     offsetof(struct __sk_buff, cb[4])),
2231                         BPF_EXIT_INSN(),
2232                 },
2233                 .result = ACCEPT,
2234         },
2235         {
2236                 "check cb access: word, unaligned 1",
2237                 .insns = {
2238                         BPF_MOV64_IMM(BPF_REG_0, 0),
2239                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2240                                     offsetof(struct __sk_buff, cb[0]) + 2),
2241                         BPF_EXIT_INSN(),
2242                 },
2243                 .errstr = "misaligned context access",
2244                 .result = REJECT,
2245                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2246         },
2247         {
2248                 "check cb access: word, unaligned 2",
2249                 .insns = {
2250                         BPF_MOV64_IMM(BPF_REG_0, 0),
2251                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2252                                     offsetof(struct __sk_buff, cb[4]) + 1),
2253                         BPF_EXIT_INSN(),
2254                 },
2255                 .errstr = "misaligned context access",
2256                 .result = REJECT,
2257                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2258         },
2259         {
2260                 "check cb access: word, unaligned 3",
2261                 .insns = {
2262                         BPF_MOV64_IMM(BPF_REG_0, 0),
2263                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2264                                     offsetof(struct __sk_buff, cb[4]) + 2),
2265                         BPF_EXIT_INSN(),
2266                 },
2267                 .errstr = "misaligned context access",
2268                 .result = REJECT,
2269                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2270         },
2271         {
2272                 "check cb access: word, unaligned 4",
2273                 .insns = {
2274                         BPF_MOV64_IMM(BPF_REG_0, 0),
2275                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2276                                     offsetof(struct __sk_buff, cb[4]) + 3),
2277                         BPF_EXIT_INSN(),
2278                 },
2279                 .errstr = "misaligned context access",
2280                 .result = REJECT,
2281                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2282         },
2283         {
2284                 "check cb access: double",
2285                 .insns = {
2286                         BPF_MOV64_IMM(BPF_REG_0, 0),
2287                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2288                                     offsetof(struct __sk_buff, cb[0])),
2289                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2290                                     offsetof(struct __sk_buff, cb[2])),
2291                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2292                                     offsetof(struct __sk_buff, cb[0])),
2293                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2294                                     offsetof(struct __sk_buff, cb[2])),
2295                         BPF_EXIT_INSN(),
2296                 },
2297                 .result = ACCEPT,
2298         },
2299         {
2300                 "check cb access: double, unaligned 1",
2301                 .insns = {
2302                         BPF_MOV64_IMM(BPF_REG_0, 0),
2303                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2304                                     offsetof(struct __sk_buff, cb[1])),
2305                         BPF_EXIT_INSN(),
2306                 },
2307                 .errstr = "misaligned context access",
2308                 .result = REJECT,
2309                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2310         },
2311         {
2312                 "check cb access: double, unaligned 2",
2313                 .insns = {
2314                         BPF_MOV64_IMM(BPF_REG_0, 0),
2315                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2316                                     offsetof(struct __sk_buff, cb[3])),
2317                         BPF_EXIT_INSN(),
2318                 },
2319                 .errstr = "misaligned context access",
2320                 .result = REJECT,
2321                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2322         },
2323         {
2324                 "check cb access: double, oob 1",
2325                 .insns = {
2326                         BPF_MOV64_IMM(BPF_REG_0, 0),
2327                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2328                                     offsetof(struct __sk_buff, cb[4])),
2329                         BPF_EXIT_INSN(),
2330                 },
2331                 .errstr = "invalid bpf_context access",
2332                 .result = REJECT,
2333         },
2334         {
2335                 "check cb access: double, oob 2",
2336                 .insns = {
2337                         BPF_MOV64_IMM(BPF_REG_0, 0),
2338                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2339                                     offsetof(struct __sk_buff, cb[4])),
2340                         BPF_EXIT_INSN(),
2341                 },
2342                 .errstr = "invalid bpf_context access",
2343                 .result = REJECT,
2344         },
2345         {
2346                 "check __sk_buff->ifindex dw store not permitted",
2347                 .insns = {
2348                         BPF_MOV64_IMM(BPF_REG_0, 0),
2349                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2350                                     offsetof(struct __sk_buff, ifindex)),
2351                         BPF_EXIT_INSN(),
2352                 },
2353                 .errstr = "invalid bpf_context access",
2354                 .result = REJECT,
2355         },
2356         {
2357                 "check __sk_buff->ifindex dw load not permitted",
2358                 .insns = {
2359                         BPF_MOV64_IMM(BPF_REG_0, 0),
2360                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2361                                     offsetof(struct __sk_buff, ifindex)),
2362                         BPF_EXIT_INSN(),
2363                 },
2364                 .errstr = "invalid bpf_context access",
2365                 .result = REJECT,
2366         },
2367         {
2368                 "check cb access: double, wrong type",
2369                 .insns = {
2370                         BPF_MOV64_IMM(BPF_REG_0, 0),
2371                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2372                                     offsetof(struct __sk_buff, cb[0])),
2373                         BPF_EXIT_INSN(),
2374                 },
2375                 .errstr = "invalid bpf_context access",
2376                 .result = REJECT,
2377                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2378         },
2379         {
2380                 "check out of range skb->cb access",
2381                 .insns = {
2382                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2383                                     offsetof(struct __sk_buff, cb[0]) + 256),
2384                         BPF_EXIT_INSN(),
2385                 },
2386                 .errstr = "invalid bpf_context access",
2387                 .errstr_unpriv = "",
2388                 .result = REJECT,
2389                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2390         },
2391         {
2392                 "write skb fields from socket prog",
2393                 .insns = {
2394                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2395                                     offsetof(struct __sk_buff, cb[4])),
2396                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2397                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2398                                     offsetof(struct __sk_buff, mark)),
2399                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2400                                     offsetof(struct __sk_buff, tc_index)),
2401                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2402                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2403                                     offsetof(struct __sk_buff, cb[0])),
2404                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2405                                     offsetof(struct __sk_buff, cb[2])),
2406                         BPF_EXIT_INSN(),
2407                 },
2408                 .result = ACCEPT,
2409                 .errstr_unpriv = "R1 leaks addr",
2410                 .result_unpriv = REJECT,
2411         },
2412         {
2413                 "write skb fields from tc_cls_act prog",
2414                 .insns = {
2415                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2416                                     offsetof(struct __sk_buff, cb[0])),
2417                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2418                                     offsetof(struct __sk_buff, mark)),
2419                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2420                                     offsetof(struct __sk_buff, tc_index)),
2421                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2422                                     offsetof(struct __sk_buff, tc_index)),
2423                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2424                                     offsetof(struct __sk_buff, cb[3])),
2425                         BPF_EXIT_INSN(),
2426                 },
2427                 .errstr_unpriv = "",
2428                 .result_unpriv = REJECT,
2429                 .result = ACCEPT,
2430                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2431         },
2432         {
2433                 "PTR_TO_STACK store/load",
2434                 .insns = {
2435                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2436                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2437                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2438                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2439                         BPF_EXIT_INSN(),
2440                 },
2441                 .result = ACCEPT,
2442                 .retval = 0xfaceb00c,
2443         },
2444         {
2445                 "PTR_TO_STACK store/load - bad alignment on off",
2446                 .insns = {
2447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2449                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2450                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2451                         BPF_EXIT_INSN(),
2452                 },
2453                 .result = REJECT,
2454                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2455         },
2456         {
2457                 "PTR_TO_STACK store/load - bad alignment on reg",
2458                 .insns = {
2459                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2461                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2462                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2463                         BPF_EXIT_INSN(),
2464                 },
2465                 .result = REJECT,
2466                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2467         },
2468         {
2469                 "PTR_TO_STACK store/load - out of bounds low",
2470                 .insns = {
2471                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2472                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2473                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2474                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2475                         BPF_EXIT_INSN(),
2476                 },
2477                 .result = REJECT,
2478                 .errstr = "invalid stack off=-79992 size=8",
2479                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
2480         },
2481         {
2482                 "PTR_TO_STACK store/load - out of bounds high",
2483                 .insns = {
2484                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2485                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2486                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2487                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2488                         BPF_EXIT_INSN(),
2489                 },
2490                 .result = REJECT,
2491                 .errstr = "invalid stack off=0 size=8",
2492         },
2493         {
2494                 "unpriv: return pointer",
2495                 .insns = {
2496                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2497                         BPF_EXIT_INSN(),
2498                 },
2499                 .result = ACCEPT,
2500                 .result_unpriv = REJECT,
2501                 .errstr_unpriv = "R0 leaks addr",
2502                 .retval = POINTER_VALUE,
2503         },
2504         {
2505                 "unpriv: add const to pointer",
2506                 .insns = {
2507                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2508                         BPF_MOV64_IMM(BPF_REG_0, 0),
2509                         BPF_EXIT_INSN(),
2510                 },
2511                 .result = ACCEPT,
2512         },
2513         {
2514                 "unpriv: add pointer to pointer",
2515                 .insns = {
2516                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2517                         BPF_MOV64_IMM(BPF_REG_0, 0),
2518                         BPF_EXIT_INSN(),
2519                 },
2520                 .result = REJECT,
2521                 .errstr = "R1 pointer += pointer",
2522         },
2523         {
2524                 "unpriv: neg pointer",
2525                 .insns = {
2526                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2527                         BPF_MOV64_IMM(BPF_REG_0, 0),
2528                         BPF_EXIT_INSN(),
2529                 },
2530                 .result = ACCEPT,
2531                 .result_unpriv = REJECT,
2532                 .errstr_unpriv = "R1 pointer arithmetic",
2533         },
2534         {
2535                 "unpriv: cmp pointer with const",
2536                 .insns = {
2537                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2538                         BPF_MOV64_IMM(BPF_REG_0, 0),
2539                         BPF_EXIT_INSN(),
2540                 },
2541                 .result = ACCEPT,
2542                 .result_unpriv = REJECT,
2543                 .errstr_unpriv = "R1 pointer comparison",
2544         },
2545         {
2546                 "unpriv: cmp pointer with pointer",
2547                 .insns = {
2548                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2549                         BPF_MOV64_IMM(BPF_REG_0, 0),
2550                         BPF_EXIT_INSN(),
2551                 },
2552                 .result = ACCEPT,
2553                 .result_unpriv = REJECT,
2554                 .errstr_unpriv = "R10 pointer comparison",
2555         },
2556         {
2557                 "unpriv: check that printk is disallowed",
2558                 .insns = {
2559                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2560                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2561                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2562                         BPF_MOV64_IMM(BPF_REG_2, 8),
2563                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2564                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2565                                      BPF_FUNC_trace_printk),
2566                         BPF_MOV64_IMM(BPF_REG_0, 0),
2567                         BPF_EXIT_INSN(),
2568                 },
2569                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2570                 .result_unpriv = REJECT,
2571                 .result = ACCEPT,
2572         },
2573         {
2574                 "unpriv: pass pointer to helper function",
2575                 .insns = {
2576                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2577                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2578                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2579                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2580                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2581                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2582                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2583                                      BPF_FUNC_map_update_elem),
2584                         BPF_MOV64_IMM(BPF_REG_0, 0),
2585                         BPF_EXIT_INSN(),
2586                 },
2587                 .fixup_map1 = { 3 },
2588                 .errstr_unpriv = "R4 leaks addr",
2589                 .result_unpriv = REJECT,
2590                 .result = ACCEPT,
2591         },
2592         {
2593                 "unpriv: indirectly pass pointer on stack to helper function",
2594                 .insns = {
2595                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2596                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2598                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2599                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2600                                      BPF_FUNC_map_lookup_elem),
2601                         BPF_MOV64_IMM(BPF_REG_0, 0),
2602                         BPF_EXIT_INSN(),
2603                 },
2604                 .fixup_map1 = { 3 },
2605                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2606                 .result = REJECT,
2607         },
2608         {
2609                 "unpriv: mangle pointer on stack 1",
2610                 .insns = {
2611                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2612                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2613                         BPF_MOV64_IMM(BPF_REG_0, 0),
2614                         BPF_EXIT_INSN(),
2615                 },
2616                 .errstr_unpriv = "attempt to corrupt spilled",
2617                 .result_unpriv = REJECT,
2618                 .result = ACCEPT,
2619         },
2620         {
2621                 "unpriv: mangle pointer on stack 2",
2622                 .insns = {
2623                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2624                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2625                         BPF_MOV64_IMM(BPF_REG_0, 0),
2626                         BPF_EXIT_INSN(),
2627                 },
2628                 .errstr_unpriv = "attempt to corrupt spilled",
2629                 .result_unpriv = REJECT,
2630                 .result = ACCEPT,
2631         },
2632         {
2633                 "unpriv: read pointer from stack in small chunks",
2634                 .insns = {
2635                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2636                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2637                         BPF_MOV64_IMM(BPF_REG_0, 0),
2638                         BPF_EXIT_INSN(),
2639                 },
2640                 .errstr = "invalid size",
2641                 .result = REJECT,
2642         },
2643         {
2644                 "unpriv: write pointer into ctx",
2645                 .insns = {
2646                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2647                         BPF_MOV64_IMM(BPF_REG_0, 0),
2648                         BPF_EXIT_INSN(),
2649                 },
2650                 .errstr_unpriv = "R1 leaks addr",
2651                 .result_unpriv = REJECT,
2652                 .errstr = "invalid bpf_context access",
2653                 .result = REJECT,
2654         },
2655         {
2656                 "unpriv: spill/fill of ctx",
2657                 .insns = {
2658                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2660                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2661                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2662                         BPF_MOV64_IMM(BPF_REG_0, 0),
2663                         BPF_EXIT_INSN(),
2664                 },
2665                 .result = ACCEPT,
2666         },
2667         {
2668                 "unpriv: spill/fill of ctx 2",
2669                 .insns = {
2670                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2671                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2672                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2673                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2674                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2675                                      BPF_FUNC_get_hash_recalc),
2676                         BPF_MOV64_IMM(BPF_REG_0, 0),
2677                         BPF_EXIT_INSN(),
2678                 },
2679                 .result = ACCEPT,
2680                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2681         },
2682         {
2683                 "unpriv: spill/fill of ctx 3",
2684                 .insns = {
2685                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2686                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2687                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2688                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2689                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2690                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2691                                      BPF_FUNC_get_hash_recalc),
2692                         BPF_EXIT_INSN(),
2693                 },
2694                 .result = REJECT,
2695                 .errstr = "R1 type=fp expected=ctx",
2696                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2697         },
2698         {
2699                 "unpriv: spill/fill of ctx 4",
2700                 .insns = {
2701                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2703                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2704                         BPF_MOV64_IMM(BPF_REG_0, 1),
2705                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2706                                      BPF_REG_0, -8, 0),
2707                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2708                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2709                                      BPF_FUNC_get_hash_recalc),
2710                         BPF_EXIT_INSN(),
2711                 },
2712                 .result = REJECT,
2713                 .errstr = "R1 type=inv expected=ctx",
2714                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2715         },
2716         {
2717                 "unpriv: spill/fill of different pointers stx",
2718                 .insns = {
2719                         BPF_MOV64_IMM(BPF_REG_3, 42),
2720                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2721                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2722                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2723                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2724                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2725                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2726                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2727                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2728                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2729                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2730                                     offsetof(struct __sk_buff, mark)),
2731                         BPF_MOV64_IMM(BPF_REG_0, 0),
2732                         BPF_EXIT_INSN(),
2733                 },
2734                 .result = REJECT,
2735                 .errstr = "same insn cannot be used with different pointers",
2736                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2737         },
2738         {
2739                 "unpriv: spill/fill of different pointers ldx",
2740                 .insns = {
2741                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2743                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2744                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2746                                       -(__s32)offsetof(struct bpf_perf_event_data,
2747                                                        sample_period) - 8),
2748                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2749                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2750                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2751                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2752                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2753                                     offsetof(struct bpf_perf_event_data,
2754                                              sample_period)),
2755                         BPF_MOV64_IMM(BPF_REG_0, 0),
2756                         BPF_EXIT_INSN(),
2757                 },
2758                 .result = REJECT,
2759                 .errstr = "same insn cannot be used with different pointers",
2760                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2761         },
2762         {
2763                 "unpriv: write pointer into map elem value",
2764                 .insns = {
2765                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2766                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2767                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2768                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2769                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2770                                      BPF_FUNC_map_lookup_elem),
2771                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2772                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2773                         BPF_EXIT_INSN(),
2774                 },
2775                 .fixup_map1 = { 3 },
2776                 .errstr_unpriv = "R0 leaks addr",
2777                 .result_unpriv = REJECT,
2778                 .result = ACCEPT,
2779         },
2780         {
2781                 "alu32: mov u32 const",
2782                 .insns = {
2783                         BPF_MOV32_IMM(BPF_REG_7, 0),
2784                         BPF_ALU32_IMM(BPF_AND, BPF_REG_7, 1),
2785                         BPF_MOV32_REG(BPF_REG_0, BPF_REG_7),
2786                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2787                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
2788                         BPF_EXIT_INSN(),
2789                 },
2790                 .result = ACCEPT,
2791                 .retval = 0,
2792         },
2793         {
2794                 "unpriv: partial copy of pointer",
2795                 .insns = {
2796                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2797                         BPF_MOV64_IMM(BPF_REG_0, 0),
2798                         BPF_EXIT_INSN(),
2799                 },
2800                 .errstr_unpriv = "R10 partial copy",
2801                 .result_unpriv = REJECT,
2802                 .result = ACCEPT,
2803         },
2804         {
2805                 "unpriv: pass pointer to tail_call",
2806                 .insns = {
2807                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2808                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2809                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2810                                      BPF_FUNC_tail_call),
2811                         BPF_MOV64_IMM(BPF_REG_0, 0),
2812                         BPF_EXIT_INSN(),
2813                 },
2814                 .fixup_prog1 = { 1 },
2815                 .errstr_unpriv = "R3 leaks addr into helper",
2816                 .result_unpriv = REJECT,
2817                 .result = ACCEPT,
2818         },
2819         {
2820                 "unpriv: cmp map pointer with zero",
2821                 .insns = {
2822                         BPF_MOV64_IMM(BPF_REG_1, 0),
2823                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2824                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2825                         BPF_MOV64_IMM(BPF_REG_0, 0),
2826                         BPF_EXIT_INSN(),
2827                 },
2828                 .fixup_map1 = { 1 },
2829                 .errstr_unpriv = "R1 pointer comparison",
2830                 .result_unpriv = REJECT,
2831                 .result = ACCEPT,
2832         },
2833         {
2834                 "unpriv: write into frame pointer",
2835                 .insns = {
2836                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2837                         BPF_MOV64_IMM(BPF_REG_0, 0),
2838                         BPF_EXIT_INSN(),
2839                 },
2840                 .errstr = "frame pointer is read only",
2841                 .result = REJECT,
2842         },
2843         {
2844                 "unpriv: spill/fill frame pointer",
2845                 .insns = {
2846                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2847                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2848                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2849                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2850                         BPF_MOV64_IMM(BPF_REG_0, 0),
2851                         BPF_EXIT_INSN(),
2852                 },
2853                 .errstr = "frame pointer is read only",
2854                 .result = REJECT,
2855         },
2856         {
2857                 "unpriv: cmp of frame pointer",
2858                 .insns = {
2859                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2860                         BPF_MOV64_IMM(BPF_REG_0, 0),
2861                         BPF_EXIT_INSN(),
2862                 },
2863                 .errstr_unpriv = "R10 pointer comparison",
2864                 .result_unpriv = REJECT,
2865                 .result = ACCEPT,
2866         },
2867         {
2868                 "unpriv: adding of fp, reg",
2869                 .insns = {
2870                         BPF_MOV64_IMM(BPF_REG_0, 0),
2871                         BPF_MOV64_IMM(BPF_REG_1, 0),
2872                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2873                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2874                         BPF_EXIT_INSN(),
2875                 },
2876                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
2877                 .result_unpriv = REJECT,
2878                 .result = ACCEPT,
2879         },
2880         {
2881                 "unpriv: adding of fp, imm",
2882                 .insns = {
2883                 BPF_MOV64_IMM(BPF_REG_0, 0),
2884                 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2885                 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
2886                 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2887                 BPF_EXIT_INSN(),
2888                 },
2889                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
2890                 .result_unpriv = REJECT,
2891                 .result = ACCEPT,
2892         },
2893         {
2894                 "unpriv: cmp of stack pointer",
2895                 .insns = {
2896                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2897                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2898                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2899                         BPF_MOV64_IMM(BPF_REG_0, 0),
2900                         BPF_EXIT_INSN(),
2901                 },
2902                 .errstr_unpriv = "R2 pointer comparison",
2903                 .result_unpriv = REJECT,
2904                 .result = ACCEPT,
2905         },
2906         {
2907                 "runtime/jit: tail_call within bounds, prog once",
2908                 .insns = {
2909                         BPF_MOV64_IMM(BPF_REG_3, 0),
2910                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2911                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2912                                      BPF_FUNC_tail_call),
2913                         BPF_MOV64_IMM(BPF_REG_0, 1),
2914                         BPF_EXIT_INSN(),
2915                 },
2916                 .fixup_prog1 = { 1 },
2917                 .result = ACCEPT,
2918                 .retval = 42,
2919         },
2920         {
2921                 "runtime/jit: tail_call within bounds, prog loop",
2922                 .insns = {
2923                         BPF_MOV64_IMM(BPF_REG_3, 1),
2924                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2925                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2926                                      BPF_FUNC_tail_call),
2927                         BPF_MOV64_IMM(BPF_REG_0, 1),
2928                         BPF_EXIT_INSN(),
2929                 },
2930                 .fixup_prog1 = { 1 },
2931                 .result = ACCEPT,
2932                 .retval = 41,
2933         },
2934         {
2935                 "runtime/jit: tail_call within bounds, no prog",
2936                 .insns = {
2937                         BPF_MOV64_IMM(BPF_REG_3, 2),
2938                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2940                                      BPF_FUNC_tail_call),
2941                         BPF_MOV64_IMM(BPF_REG_0, 1),
2942                         BPF_EXIT_INSN(),
2943                 },
2944                 .fixup_prog1 = { 1 },
2945                 .result = ACCEPT,
2946                 .retval = 1,
2947         },
2948         {
2949                 "runtime/jit: tail_call out of bounds",
2950                 .insns = {
2951                         BPF_MOV64_IMM(BPF_REG_3, 256),
2952                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2953                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2954                                      BPF_FUNC_tail_call),
2955                         BPF_MOV64_IMM(BPF_REG_0, 2),
2956                         BPF_EXIT_INSN(),
2957                 },
2958                 .fixup_prog1 = { 1 },
2959                 .result = ACCEPT,
2960                 .retval = 2,
2961         },
2962         {
2963                 "runtime/jit: pass negative index to tail_call",
2964                 .insns = {
2965                         BPF_MOV64_IMM(BPF_REG_3, -1),
2966                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2968                                      BPF_FUNC_tail_call),
2969                         BPF_MOV64_IMM(BPF_REG_0, 2),
2970                         BPF_EXIT_INSN(),
2971                 },
2972                 .fixup_prog1 = { 1 },
2973                 .result = ACCEPT,
2974                 .retval = 2,
2975         },
2976         {
2977                 "runtime/jit: pass > 32bit index to tail_call",
2978                 .insns = {
2979                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2980                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2981                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2982                                      BPF_FUNC_tail_call),
2983                         BPF_MOV64_IMM(BPF_REG_0, 2),
2984                         BPF_EXIT_INSN(),
2985                 },
2986                 .fixup_prog1 = { 2 },
2987                 .result = ACCEPT,
2988                 .retval = 42,
2989                 /* Verifier rewrite for unpriv skips tail call here. */
2990                 .retval_unpriv = 2,
2991         },
2992         {
2993                 "stack pointer arithmetic",
2994                 .insns = {
2995                         BPF_MOV64_IMM(BPF_REG_1, 4),
2996                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2997                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2998                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2999                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
3000                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3001                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
3002                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3003                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3004                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3005                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3006                         BPF_MOV64_IMM(BPF_REG_0, 0),
3007                         BPF_EXIT_INSN(),
3008                 },
3009                 .result = ACCEPT,
3010         },
3011         {
3012                 "raw_stack: no skb_load_bytes",
3013                 .insns = {
3014                         BPF_MOV64_IMM(BPF_REG_2, 4),
3015                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3016                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3017                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3018                         BPF_MOV64_IMM(BPF_REG_4, 8),
3019                         /* Call to skb_load_bytes() omitted. */
3020                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3021                         BPF_EXIT_INSN(),
3022                 },
3023                 .result = REJECT,
3024                 .errstr = "invalid read from stack off -8+0 size 8",
3025                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3026         },
3027         {
3028                 "raw_stack: skb_load_bytes, negative len",
3029                 .insns = {
3030                         BPF_MOV64_IMM(BPF_REG_2, 4),
3031                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3032                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3033                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3034                         BPF_MOV64_IMM(BPF_REG_4, -8),
3035                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3036                                      BPF_FUNC_skb_load_bytes),
3037                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3038                         BPF_EXIT_INSN(),
3039                 },
3040                 .result = REJECT,
3041                 .errstr = "R4 min value is negative",
3042                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3043         },
3044         {
3045                 "raw_stack: skb_load_bytes, negative len 2",
3046                 .insns = {
3047                         BPF_MOV64_IMM(BPF_REG_2, 4),
3048                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3049                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3050                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3051                         BPF_MOV64_IMM(BPF_REG_4, ~0),
3052                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3053                                      BPF_FUNC_skb_load_bytes),
3054                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3055                         BPF_EXIT_INSN(),
3056                 },
3057                 .result = REJECT,
3058                 .errstr = "R4 min value is negative",
3059                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3060         },
3061         {
3062                 "raw_stack: skb_load_bytes, zero len",
3063                 .insns = {
3064                         BPF_MOV64_IMM(BPF_REG_2, 4),
3065                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3066                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3067                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3068                         BPF_MOV64_IMM(BPF_REG_4, 0),
3069                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3070                                      BPF_FUNC_skb_load_bytes),
3071                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3072                         BPF_EXIT_INSN(),
3073                 },
3074                 .result = REJECT,
3075                 .errstr = "invalid stack type R3",
3076                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3077         },
3078         {
3079                 "raw_stack: skb_load_bytes, no init",
3080                 .insns = {
3081                         BPF_MOV64_IMM(BPF_REG_2, 4),
3082                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3083                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3084                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3085                         BPF_MOV64_IMM(BPF_REG_4, 8),
3086                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3087                                      BPF_FUNC_skb_load_bytes),
3088                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3089                         BPF_EXIT_INSN(),
3090                 },
3091                 .result = ACCEPT,
3092                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3093         },
3094         {
3095                 "raw_stack: skb_load_bytes, init",
3096                 .insns = {
3097                         BPF_MOV64_IMM(BPF_REG_2, 4),
3098                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3099                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3100                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
3101                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3102                         BPF_MOV64_IMM(BPF_REG_4, 8),
3103                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3104                                      BPF_FUNC_skb_load_bytes),
3105                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3106                         BPF_EXIT_INSN(),
3107                 },
3108                 .result = ACCEPT,
3109                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3110         },
3111         {
3112                 "raw_stack: skb_load_bytes, spilled regs around bounds",
3113                 .insns = {
3114                         BPF_MOV64_IMM(BPF_REG_2, 4),
3115                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3116                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3117                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3118                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3119                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3120                         BPF_MOV64_IMM(BPF_REG_4, 8),
3121                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3122                                      BPF_FUNC_skb_load_bytes),
3123                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3124                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3125                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3126                                     offsetof(struct __sk_buff, mark)),
3127                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3128                                     offsetof(struct __sk_buff, priority)),
3129                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3130                         BPF_EXIT_INSN(),
3131                 },
3132                 .result = ACCEPT,
3133                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3134         },
3135         {
3136                 "raw_stack: skb_load_bytes, spilled regs corruption",
3137                 .insns = {
3138                         BPF_MOV64_IMM(BPF_REG_2, 4),
3139                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3140                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3141                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3142                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3143                         BPF_MOV64_IMM(BPF_REG_4, 8),
3144                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3145                                      BPF_FUNC_skb_load_bytes),
3146                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3147                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3148                                     offsetof(struct __sk_buff, mark)),
3149                         BPF_EXIT_INSN(),
3150                 },
3151                 .result = REJECT,
3152                 .errstr = "R0 invalid mem access 'inv'",
3153                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3154         },
3155         {
3156                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
3157                 .insns = {
3158                         BPF_MOV64_IMM(BPF_REG_2, 4),
3159                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3160                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3161                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3162                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3163                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3164                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3165                         BPF_MOV64_IMM(BPF_REG_4, 8),
3166                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3167                                      BPF_FUNC_skb_load_bytes),
3168                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3169                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3170                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3171                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3172                                     offsetof(struct __sk_buff, mark)),
3173                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3174                                     offsetof(struct __sk_buff, priority)),
3175                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3176                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
3177                                     offsetof(struct __sk_buff, pkt_type)),
3178                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3179                         BPF_EXIT_INSN(),
3180                 },
3181                 .result = REJECT,
3182                 .errstr = "R3 invalid mem access 'inv'",
3183                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3184         },
3185         {
3186                 "raw_stack: skb_load_bytes, spilled regs + data",
3187                 .insns = {
3188                         BPF_MOV64_IMM(BPF_REG_2, 4),
3189                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3190                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3191                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3192                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3193                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3194                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3195                         BPF_MOV64_IMM(BPF_REG_4, 8),
3196                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3197                                      BPF_FUNC_skb_load_bytes),
3198                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3199                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3200                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3201                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3202                                     offsetof(struct __sk_buff, mark)),
3203                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3204                                     offsetof(struct __sk_buff, priority)),
3205                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3206                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3207                         BPF_EXIT_INSN(),
3208                 },
3209                 .result = ACCEPT,
3210                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3211         },
3212         {
3213                 "raw_stack: skb_load_bytes, invalid access 1",
3214                 .insns = {
3215                         BPF_MOV64_IMM(BPF_REG_2, 4),
3216                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3217                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
3218                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3219                         BPF_MOV64_IMM(BPF_REG_4, 8),
3220                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3221                                      BPF_FUNC_skb_load_bytes),
3222                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3223                         BPF_EXIT_INSN(),
3224                 },
3225                 .result = REJECT,
3226                 .errstr = "invalid stack type R3 off=-513 access_size=8",
3227                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3228         },
3229         {
3230                 "raw_stack: skb_load_bytes, invalid access 2",
3231                 .insns = {
3232                         BPF_MOV64_IMM(BPF_REG_2, 4),
3233                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3235                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3236                         BPF_MOV64_IMM(BPF_REG_4, 8),
3237                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3238                                      BPF_FUNC_skb_load_bytes),
3239                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3240                         BPF_EXIT_INSN(),
3241                 },
3242                 .result = REJECT,
3243                 .errstr = "invalid stack type R3 off=-1 access_size=8",
3244                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3245         },
3246         {
3247                 "raw_stack: skb_load_bytes, invalid access 3",
3248                 .insns = {
3249                         BPF_MOV64_IMM(BPF_REG_2, 4),
3250                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3251                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
3252                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3253                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3254                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3255                                      BPF_FUNC_skb_load_bytes),
3256                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3257                         BPF_EXIT_INSN(),
3258                 },
3259                 .result = REJECT,
3260                 .errstr = "R4 min value is negative",
3261                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3262         },
3263         {
3264                 "raw_stack: skb_load_bytes, invalid access 4",
3265                 .insns = {
3266                         BPF_MOV64_IMM(BPF_REG_2, 4),
3267                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3268                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3269                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3270                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3271                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3272                                      BPF_FUNC_skb_load_bytes),
3273                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3274                         BPF_EXIT_INSN(),
3275                 },
3276                 .result = REJECT,
3277                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3278                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3279         },
3280         {
3281                 "raw_stack: skb_load_bytes, invalid access 5",
3282                 .insns = {
3283                         BPF_MOV64_IMM(BPF_REG_2, 4),
3284                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3285                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3286                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3287                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3288                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3289                                      BPF_FUNC_skb_load_bytes),
3290                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3291                         BPF_EXIT_INSN(),
3292                 },
3293                 .result = REJECT,
3294                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3295                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3296         },
3297         {
3298                 "raw_stack: skb_load_bytes, invalid access 6",
3299                 .insns = {
3300                         BPF_MOV64_IMM(BPF_REG_2, 4),
3301                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3302                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3303                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3304                         BPF_MOV64_IMM(BPF_REG_4, 0),
3305                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3306                                      BPF_FUNC_skb_load_bytes),
3307                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3308                         BPF_EXIT_INSN(),
3309                 },
3310                 .result = REJECT,
3311                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3312                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3313         },
3314         {
3315                 "raw_stack: skb_load_bytes, large access",
3316                 .insns = {
3317                         BPF_MOV64_IMM(BPF_REG_2, 4),
3318                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3319                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3320                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3321                         BPF_MOV64_IMM(BPF_REG_4, 512),
3322                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3323                                      BPF_FUNC_skb_load_bytes),
3324                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3325                         BPF_EXIT_INSN(),
3326                 },
3327                 .result = ACCEPT,
3328                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3329         },
3330         {
3331                 "context stores via ST",
3332                 .insns = {
3333                         BPF_MOV64_IMM(BPF_REG_0, 0),
3334                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3335                         BPF_EXIT_INSN(),
3336                 },
3337                 .errstr = "BPF_ST stores into R1 context is not allowed",
3338                 .result = REJECT,
3339                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3340         },
3341         {
3342                 "context stores via XADD",
3343                 .insns = {
3344                         BPF_MOV64_IMM(BPF_REG_0, 0),
3345                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3346                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3347                         BPF_EXIT_INSN(),
3348                 },
3349                 .errstr = "BPF_XADD stores into R1 context is not allowed",
3350                 .result = REJECT,
3351                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3352         },
3353         {
3354                 "direct packet access: test1",
3355                 .insns = {
3356                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3357                                     offsetof(struct __sk_buff, data)),
3358                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3359                                     offsetof(struct __sk_buff, data_end)),
3360                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3361                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3362                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3363                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3364                         BPF_MOV64_IMM(BPF_REG_0, 0),
3365                         BPF_EXIT_INSN(),
3366                 },
3367                 .result = ACCEPT,
3368                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3369         },
3370         {
3371                 "direct packet access: test2",
3372                 .insns = {
3373                         BPF_MOV64_IMM(BPF_REG_0, 1),
3374                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3375                                     offsetof(struct __sk_buff, data_end)),
3376                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3377                                     offsetof(struct __sk_buff, data)),
3378                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3379                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3380                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3381                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3382                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3383                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3384                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3385                                     offsetof(struct __sk_buff, data)),
3386                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3387                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3388                                     offsetof(struct __sk_buff, len)),
3389                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3390                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3391                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3392                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3393                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3394                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3395                                     offsetof(struct __sk_buff, data_end)),
3396                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3397                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3398                         BPF_MOV64_IMM(BPF_REG_0, 0),
3399                         BPF_EXIT_INSN(),
3400                 },
3401                 .result = ACCEPT,
3402                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3403         },
3404         {
3405                 "direct packet access: test3",
3406                 .insns = {
3407                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3408                                     offsetof(struct __sk_buff, data)),
3409                         BPF_MOV64_IMM(BPF_REG_0, 0),
3410                         BPF_EXIT_INSN(),
3411                 },
3412                 .errstr = "invalid bpf_context access off=76",
3413                 .result = REJECT,
3414                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3415         },
3416         {
3417                 "direct packet access: test4 (write)",
3418                 .insns = {
3419                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3420                                     offsetof(struct __sk_buff, data)),
3421                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3422                                     offsetof(struct __sk_buff, data_end)),
3423                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3424                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3425                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3426                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3427                         BPF_MOV64_IMM(BPF_REG_0, 0),
3428                         BPF_EXIT_INSN(),
3429                 },
3430                 .result = ACCEPT,
3431                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3432         },
3433         {
3434                 "direct packet access: test5 (pkt_end >= reg, good access)",
3435                 .insns = {
3436                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3437                                     offsetof(struct __sk_buff, data)),
3438                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3439                                     offsetof(struct __sk_buff, data_end)),
3440                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3441                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3442                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3443                         BPF_MOV64_IMM(BPF_REG_0, 1),
3444                         BPF_EXIT_INSN(),
3445                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3446                         BPF_MOV64_IMM(BPF_REG_0, 0),
3447                         BPF_EXIT_INSN(),
3448                 },
3449                 .result = ACCEPT,
3450                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3451         },
3452         {
3453                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3454                 .insns = {
3455                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3456                                     offsetof(struct __sk_buff, data)),
3457                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3458                                     offsetof(struct __sk_buff, data_end)),
3459                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3461                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3462                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3463                         BPF_MOV64_IMM(BPF_REG_0, 1),
3464                         BPF_EXIT_INSN(),
3465                         BPF_MOV64_IMM(BPF_REG_0, 0),
3466                         BPF_EXIT_INSN(),
3467                 },
3468                 .errstr = "invalid access to packet",
3469                 .result = REJECT,
3470                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3471         },
3472         {
3473                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3474                 .insns = {
3475                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3476                                     offsetof(struct __sk_buff, data)),
3477                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3478                                     offsetof(struct __sk_buff, data_end)),
3479                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3480                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3481                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3482                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3483                         BPF_MOV64_IMM(BPF_REG_0, 1),
3484                         BPF_EXIT_INSN(),
3485                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3486                         BPF_MOV64_IMM(BPF_REG_0, 0),
3487                         BPF_EXIT_INSN(),
3488                 },
3489                 .errstr = "invalid access to packet",
3490                 .result = REJECT,
3491                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3492         },
3493         {
3494                 "direct packet access: test8 (double test, variant 1)",
3495                 .insns = {
3496                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3497                                     offsetof(struct __sk_buff, data)),
3498                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3499                                     offsetof(struct __sk_buff, data_end)),
3500                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3501                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3502                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3503                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3504                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3505                         BPF_MOV64_IMM(BPF_REG_0, 1),
3506                         BPF_EXIT_INSN(),
3507                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3508                         BPF_MOV64_IMM(BPF_REG_0, 0),
3509                         BPF_EXIT_INSN(),
3510                 },
3511                 .result = ACCEPT,
3512                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3513         },
3514         {
3515                 "direct packet access: test9 (double test, variant 2)",
3516                 .insns = {
3517                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3518                                     offsetof(struct __sk_buff, data)),
3519                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3520                                     offsetof(struct __sk_buff, data_end)),
3521                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3522                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3523                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3524                         BPF_MOV64_IMM(BPF_REG_0, 1),
3525                         BPF_EXIT_INSN(),
3526                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3527                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3528                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3529                         BPF_MOV64_IMM(BPF_REG_0, 0),
3530                         BPF_EXIT_INSN(),
3531                 },
3532                 .result = ACCEPT,
3533                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3534         },
3535         {
3536                 "direct packet access: test10 (write invalid)",
3537                 .insns = {
3538                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3539                                     offsetof(struct __sk_buff, data)),
3540                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3541                                     offsetof(struct __sk_buff, data_end)),
3542                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3543                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3544                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3545                         BPF_MOV64_IMM(BPF_REG_0, 0),
3546                         BPF_EXIT_INSN(),
3547                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3548                         BPF_MOV64_IMM(BPF_REG_0, 0),
3549                         BPF_EXIT_INSN(),
3550                 },
3551                 .errstr = "invalid access to packet",
3552                 .result = REJECT,
3553                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3554         },
3555         {
3556                 "direct packet access: test11 (shift, good access)",
3557                 .insns = {
3558                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3559                                     offsetof(struct __sk_buff, data)),
3560                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3561                                     offsetof(struct __sk_buff, data_end)),
3562                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3563                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3564                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3565                         BPF_MOV64_IMM(BPF_REG_3, 144),
3566                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3567                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3568                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3569                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3570                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3571                         BPF_MOV64_IMM(BPF_REG_0, 1),
3572                         BPF_EXIT_INSN(),
3573                         BPF_MOV64_IMM(BPF_REG_0, 0),
3574                         BPF_EXIT_INSN(),
3575                 },
3576                 .result = ACCEPT,
3577                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3578                 .retval = 1,
3579         },
3580         {
3581                 "direct packet access: test12 (and, good access)",
3582                 .insns = {
3583                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3584                                     offsetof(struct __sk_buff, data)),
3585                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3586                                     offsetof(struct __sk_buff, data_end)),
3587                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3588                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3589                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3590                         BPF_MOV64_IMM(BPF_REG_3, 144),
3591                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3593                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3594                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3595                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3596                         BPF_MOV64_IMM(BPF_REG_0, 1),
3597                         BPF_EXIT_INSN(),
3598                         BPF_MOV64_IMM(BPF_REG_0, 0),
3599                         BPF_EXIT_INSN(),
3600                 },
3601                 .result = ACCEPT,
3602                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3603                 .retval = 1,
3604         },
3605         {
3606                 "direct packet access: test13 (branches, good access)",
3607                 .insns = {
3608                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3609                                     offsetof(struct __sk_buff, data)),
3610                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3611                                     offsetof(struct __sk_buff, data_end)),
3612                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3614                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3615                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3616                                     offsetof(struct __sk_buff, mark)),
3617                         BPF_MOV64_IMM(BPF_REG_4, 1),
3618                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3619                         BPF_MOV64_IMM(BPF_REG_3, 14),
3620                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3621                         BPF_MOV64_IMM(BPF_REG_3, 24),
3622                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3623                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3624                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3625                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3626                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3627                         BPF_MOV64_IMM(BPF_REG_0, 1),
3628                         BPF_EXIT_INSN(),
3629                         BPF_MOV64_IMM(BPF_REG_0, 0),
3630                         BPF_EXIT_INSN(),
3631                 },
3632                 .result = ACCEPT,
3633                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3634                 .retval = 1,
3635         },
3636         {
3637                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3638                 .insns = {
3639                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3640                                     offsetof(struct __sk_buff, data)),
3641                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3642                                     offsetof(struct __sk_buff, data_end)),
3643                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3644                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3645                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3646                         BPF_MOV64_IMM(BPF_REG_5, 12),
3647                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3648                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3649                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3650                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3651                         BPF_MOV64_IMM(BPF_REG_0, 1),
3652                         BPF_EXIT_INSN(),
3653                         BPF_MOV64_IMM(BPF_REG_0, 0),
3654                         BPF_EXIT_INSN(),
3655                 },
3656                 .result = ACCEPT,
3657                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3658                 .retval = 1,
3659         },
3660         {
3661                 "direct packet access: test15 (spill with xadd)",
3662                 .insns = {
3663                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3664                                     offsetof(struct __sk_buff, data)),
3665                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3666                                     offsetof(struct __sk_buff, data_end)),
3667                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3668                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3669                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3670                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3671                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3672                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3673                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3674                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3675                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3676                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3677                         BPF_MOV64_IMM(BPF_REG_0, 0),
3678                         BPF_EXIT_INSN(),
3679                 },
3680                 .errstr = "R2 invalid mem access 'inv'",
3681                 .result = REJECT,
3682                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3683         },
3684         {
3685                 "direct packet access: test16 (arith on data_end)",
3686                 .insns = {
3687                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3688                                     offsetof(struct __sk_buff, data)),
3689                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3690                                     offsetof(struct __sk_buff, data_end)),
3691                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3693                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3694                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3695                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3696                         BPF_MOV64_IMM(BPF_REG_0, 0),
3697                         BPF_EXIT_INSN(),
3698                 },
3699                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3700                 .result = REJECT,
3701                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3702         },
3703         {
3704                 "direct packet access: test17 (pruning, alignment)",
3705                 .insns = {
3706                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3707                                     offsetof(struct __sk_buff, data)),
3708                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3709                                     offsetof(struct __sk_buff, data_end)),
3710                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3711                                     offsetof(struct __sk_buff, mark)),
3712                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3713                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3714                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3715                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3716                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3717                         BPF_MOV64_IMM(BPF_REG_0, 0),
3718                         BPF_EXIT_INSN(),
3719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3720                         BPF_JMP_A(-6),
3721                 },
3722                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3723                 .result = REJECT,
3724                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3725                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3726         },
3727         {
3728                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3729                 .insns = {
3730                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3731                                     offsetof(struct __sk_buff, data)),
3732                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3733                                     offsetof(struct __sk_buff, data_end)),
3734                         BPF_MOV64_IMM(BPF_REG_0, 8),
3735                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3736                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3737                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3738                         BPF_MOV64_IMM(BPF_REG_0, 0),
3739                         BPF_EXIT_INSN(),
3740                 },
3741                 .result = ACCEPT,
3742                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3743         },
3744         {
3745                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3746                 .insns = {
3747                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3748                                     offsetof(struct __sk_buff, data)),
3749                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3750                                     offsetof(struct __sk_buff, data_end)),
3751                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3752                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3753                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3754                         BPF_MOV64_IMM(BPF_REG_4, 4),
3755                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3756                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3757                         BPF_MOV64_IMM(BPF_REG_0, 0),
3758                         BPF_EXIT_INSN(),
3759                 },
3760                 .result = ACCEPT,
3761                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3762         },
3763         {
3764                 "direct packet access: test20 (x += pkt_ptr, 1)",
3765                 .insns = {
3766                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3767                                     offsetof(struct __sk_buff, data)),
3768                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3769                                     offsetof(struct __sk_buff, data_end)),
3770                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3771                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3772                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3773                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3774                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3775                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3776                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3778                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3779                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3780                         BPF_MOV64_IMM(BPF_REG_0, 0),
3781                         BPF_EXIT_INSN(),
3782                 },
3783                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3784                 .result = ACCEPT,
3785         },
3786         {
3787                 "direct packet access: test21 (x += pkt_ptr, 2)",
3788                 .insns = {
3789                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3790                                     offsetof(struct __sk_buff, data)),
3791                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3792                                     offsetof(struct __sk_buff, data_end)),
3793                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3794                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3795                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3796                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3797                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3798                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3799                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3800                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3801                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3802                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3803                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3804                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3805                         BPF_MOV64_IMM(BPF_REG_0, 0),
3806                         BPF_EXIT_INSN(),
3807                 },
3808                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3809                 .result = ACCEPT,
3810         },
3811         {
3812                 "direct packet access: test22 (x += pkt_ptr, 3)",
3813                 .insns = {
3814                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3815                                     offsetof(struct __sk_buff, data)),
3816                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3817                                     offsetof(struct __sk_buff, data_end)),
3818                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3819                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3820                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3821                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3822                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3823                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3824                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3825                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3826                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3827                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3828                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3829                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3830                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3832                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3833                         BPF_MOV64_IMM(BPF_REG_2, 1),
3834                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3835                         BPF_MOV64_IMM(BPF_REG_0, 0),
3836                         BPF_EXIT_INSN(),
3837                 },
3838                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3839                 .result = ACCEPT,
3840         },
3841         {
3842                 "direct packet access: test23 (x += pkt_ptr, 4)",
3843                 .insns = {
3844                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3845                                     offsetof(struct __sk_buff, data)),
3846                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3847                                     offsetof(struct __sk_buff, data_end)),
3848                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3849                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3850                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3851                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3852                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3853                         BPF_MOV64_IMM(BPF_REG_0, 31),
3854                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3855                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3856                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3857                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3858                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3859                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3860                         BPF_MOV64_IMM(BPF_REG_0, 0),
3861                         BPF_EXIT_INSN(),
3862                 },
3863                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3864                 .result = REJECT,
3865                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3866         },
3867         {
3868                 "direct packet access: test24 (x += pkt_ptr, 5)",
3869                 .insns = {
3870                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3871                                     offsetof(struct __sk_buff, data)),
3872                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3873                                     offsetof(struct __sk_buff, data_end)),
3874                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3875                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3876                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3877                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3878                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3879                         BPF_MOV64_IMM(BPF_REG_0, 64),
3880                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3881                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3882                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3883                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3884                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3885                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3886                         BPF_MOV64_IMM(BPF_REG_0, 0),
3887                         BPF_EXIT_INSN(),
3888                 },
3889                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3890                 .result = ACCEPT,
3891         },
3892         {
3893                 "direct packet access: test25 (marking on <, good access)",
3894                 .insns = {
3895                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3896                                     offsetof(struct __sk_buff, data)),
3897                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3898                                     offsetof(struct __sk_buff, data_end)),
3899                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3900                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3901                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3902                         BPF_MOV64_IMM(BPF_REG_0, 0),
3903                         BPF_EXIT_INSN(),
3904                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3905                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3906                 },
3907                 .result = ACCEPT,
3908                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3909         },
3910         {
3911                 "direct packet access: test26 (marking on <, bad access)",
3912                 .insns = {
3913                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3914                                     offsetof(struct __sk_buff, data)),
3915                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3916                                     offsetof(struct __sk_buff, data_end)),
3917                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3919                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3920                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3921                         BPF_MOV64_IMM(BPF_REG_0, 0),
3922                         BPF_EXIT_INSN(),
3923                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3924                 },
3925                 .result = REJECT,
3926                 .errstr = "invalid access to packet",
3927                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3928         },
3929         {
3930                 "direct packet access: test27 (marking on <=, good access)",
3931                 .insns = {
3932                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3933                                     offsetof(struct __sk_buff, data)),
3934                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3935                                     offsetof(struct __sk_buff, data_end)),
3936                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3937                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3938                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3939                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3940                         BPF_MOV64_IMM(BPF_REG_0, 1),
3941                         BPF_EXIT_INSN(),
3942                 },
3943                 .result = ACCEPT,
3944                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3945                 .retval = 1,
3946         },
3947         {
3948                 "direct packet access: test28 (marking on <=, bad access)",
3949                 .insns = {
3950                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3951                                     offsetof(struct __sk_buff, data)),
3952                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3953                                     offsetof(struct __sk_buff, data_end)),
3954                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3955                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3956                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3957                         BPF_MOV64_IMM(BPF_REG_0, 1),
3958                         BPF_EXIT_INSN(),
3959                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3960                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3961                 },
3962                 .result = REJECT,
3963                 .errstr = "invalid access to packet",
3964                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3965         },
3966         {
3967                 "helper access to packet: test1, valid packet_ptr range",
3968                 .insns = {
3969                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3970                                     offsetof(struct xdp_md, data)),
3971                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3972                                     offsetof(struct xdp_md, data_end)),
3973                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3974                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3975                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3976                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3977                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3978                         BPF_MOV64_IMM(BPF_REG_4, 0),
3979                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3980                                      BPF_FUNC_map_update_elem),
3981                         BPF_MOV64_IMM(BPF_REG_0, 0),
3982                         BPF_EXIT_INSN(),
3983                 },
3984                 .fixup_map1 = { 5 },
3985                 .result_unpriv = ACCEPT,
3986                 .result = ACCEPT,
3987                 .prog_type = BPF_PROG_TYPE_XDP,
3988         },
3989         {
3990                 "helper access to packet: test2, unchecked packet_ptr",
3991                 .insns = {
3992                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3993                                     offsetof(struct xdp_md, data)),
3994                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3995                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3996                                      BPF_FUNC_map_lookup_elem),
3997                         BPF_MOV64_IMM(BPF_REG_0, 0),
3998                         BPF_EXIT_INSN(),
3999                 },
4000                 .fixup_map1 = { 1 },
4001                 .result = REJECT,
4002                 .errstr = "invalid access to packet",
4003                 .prog_type = BPF_PROG_TYPE_XDP,
4004         },
4005         {
4006                 "helper access to packet: test3, variable add",
4007                 .insns = {
4008                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4009                                         offsetof(struct xdp_md, data)),
4010                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4011                                         offsetof(struct xdp_md, data_end)),
4012                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4014                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4015                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4016                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4017                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4018                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4019                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4020                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4021                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4022                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4023                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4024                                      BPF_FUNC_map_lookup_elem),
4025                         BPF_MOV64_IMM(BPF_REG_0, 0),
4026                         BPF_EXIT_INSN(),
4027                 },
4028                 .fixup_map1 = { 11 },
4029                 .result = ACCEPT,
4030                 .prog_type = BPF_PROG_TYPE_XDP,
4031         },
4032         {
4033                 "helper access to packet: test4, packet_ptr with bad range",
4034                 .insns = {
4035                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4036                                     offsetof(struct xdp_md, data)),
4037                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4038                                     offsetof(struct xdp_md, data_end)),
4039                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4041                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4042                         BPF_MOV64_IMM(BPF_REG_0, 0),
4043                         BPF_EXIT_INSN(),
4044                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4045                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4046                                      BPF_FUNC_map_lookup_elem),
4047                         BPF_MOV64_IMM(BPF_REG_0, 0),
4048                         BPF_EXIT_INSN(),
4049                 },
4050                 .fixup_map1 = { 7 },
4051                 .result = REJECT,
4052                 .errstr = "invalid access to packet",
4053                 .prog_type = BPF_PROG_TYPE_XDP,
4054         },
4055         {
4056                 "helper access to packet: test5, packet_ptr with too short range",
4057                 .insns = {
4058                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4059                                     offsetof(struct xdp_md, data)),
4060                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4061                                     offsetof(struct xdp_md, data_end)),
4062                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4063                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4064                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4065                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4066                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4067                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4068                                      BPF_FUNC_map_lookup_elem),
4069                         BPF_MOV64_IMM(BPF_REG_0, 0),
4070                         BPF_EXIT_INSN(),
4071                 },
4072                 .fixup_map1 = { 6 },
4073                 .result = REJECT,
4074                 .errstr = "invalid access to packet",
4075                 .prog_type = BPF_PROG_TYPE_XDP,
4076         },
4077         {
4078                 "helper access to packet: test6, cls valid packet_ptr range",
4079                 .insns = {
4080                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4081                                     offsetof(struct __sk_buff, data)),
4082                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4083                                     offsetof(struct __sk_buff, data_end)),
4084                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4085                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4086                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4087                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4088                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4089                         BPF_MOV64_IMM(BPF_REG_4, 0),
4090                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4091                                      BPF_FUNC_map_update_elem),
4092                         BPF_MOV64_IMM(BPF_REG_0, 0),
4093                         BPF_EXIT_INSN(),
4094                 },
4095                 .fixup_map1 = { 5 },
4096                 .result = ACCEPT,
4097                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4098         },
4099         {
4100                 "helper access to packet: test7, cls unchecked packet_ptr",
4101                 .insns = {
4102                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4103                                     offsetof(struct __sk_buff, data)),
4104                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4105                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4106                                      BPF_FUNC_map_lookup_elem),
4107                         BPF_MOV64_IMM(BPF_REG_0, 0),
4108                         BPF_EXIT_INSN(),
4109                 },
4110                 .fixup_map1 = { 1 },
4111                 .result = REJECT,
4112                 .errstr = "invalid access to packet",
4113                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4114         },
4115         {
4116                 "helper access to packet: test8, cls variable add",
4117                 .insns = {
4118                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4119                                         offsetof(struct __sk_buff, data)),
4120                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4121                                         offsetof(struct __sk_buff, data_end)),
4122                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4123                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4124                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4125                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4126                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4127                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4128                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4129                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4130                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4131                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4132                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4133                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4134                                      BPF_FUNC_map_lookup_elem),
4135                         BPF_MOV64_IMM(BPF_REG_0, 0),
4136                         BPF_EXIT_INSN(),
4137                 },
4138                 .fixup_map1 = { 11 },
4139                 .result = ACCEPT,
4140                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4141         },
4142         {
4143                 "helper access to packet: test9, cls packet_ptr with bad range",
4144                 .insns = {
4145                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4146                                     offsetof(struct __sk_buff, data)),
4147                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4148                                     offsetof(struct __sk_buff, data_end)),
4149                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4150                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4151                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4152                         BPF_MOV64_IMM(BPF_REG_0, 0),
4153                         BPF_EXIT_INSN(),
4154                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4155                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4156                                      BPF_FUNC_map_lookup_elem),
4157                         BPF_MOV64_IMM(BPF_REG_0, 0),
4158                         BPF_EXIT_INSN(),
4159                 },
4160                 .fixup_map1 = { 7 },
4161                 .result = REJECT,
4162                 .errstr = "invalid access to packet",
4163                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4164         },
4165         {
4166                 "helper access to packet: test10, cls packet_ptr with too short range",
4167                 .insns = {
4168                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4169                                     offsetof(struct __sk_buff, data)),
4170                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4171                                     offsetof(struct __sk_buff, data_end)),
4172                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4173                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4174                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4175                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4176                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4177                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4178                                      BPF_FUNC_map_lookup_elem),
4179                         BPF_MOV64_IMM(BPF_REG_0, 0),
4180                         BPF_EXIT_INSN(),
4181                 },
4182                 .fixup_map1 = { 6 },
4183                 .result = REJECT,
4184                 .errstr = "invalid access to packet",
4185                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4186         },
4187         {
4188                 "helper access to packet: test11, cls unsuitable helper 1",
4189                 .insns = {
4190                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4191                                     offsetof(struct __sk_buff, data)),
4192                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4193                                     offsetof(struct __sk_buff, data_end)),
4194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4195                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4196                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
4197                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
4198                         BPF_MOV64_IMM(BPF_REG_2, 0),
4199                         BPF_MOV64_IMM(BPF_REG_4, 42),
4200                         BPF_MOV64_IMM(BPF_REG_5, 0),
4201                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4202                                      BPF_FUNC_skb_store_bytes),
4203                         BPF_MOV64_IMM(BPF_REG_0, 0),
4204                         BPF_EXIT_INSN(),
4205                 },
4206                 .result = REJECT,
4207                 .errstr = "helper access to the packet",
4208                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4209         },
4210         {
4211                 "helper access to packet: test12, cls unsuitable helper 2",
4212                 .insns = {
4213                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4214                                     offsetof(struct __sk_buff, data)),
4215                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4216                                     offsetof(struct __sk_buff, data_end)),
4217                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
4219                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
4220                         BPF_MOV64_IMM(BPF_REG_2, 0),
4221                         BPF_MOV64_IMM(BPF_REG_4, 4),
4222                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4223                                      BPF_FUNC_skb_load_bytes),
4224                         BPF_MOV64_IMM(BPF_REG_0, 0),
4225                         BPF_EXIT_INSN(),
4226                 },
4227                 .result = REJECT,
4228                 .errstr = "helper access to the packet",
4229                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4230         },
4231         {
4232                 "helper access to packet: test13, cls helper ok",
4233                 .insns = {
4234                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4235                                     offsetof(struct __sk_buff, data)),
4236                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4237                                     offsetof(struct __sk_buff, data_end)),
4238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4239                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4241                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4242                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4243                         BPF_MOV64_IMM(BPF_REG_2, 4),
4244                         BPF_MOV64_IMM(BPF_REG_3, 0),
4245                         BPF_MOV64_IMM(BPF_REG_4, 0),
4246                         BPF_MOV64_IMM(BPF_REG_5, 0),
4247                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4248                                      BPF_FUNC_csum_diff),
4249                         BPF_MOV64_IMM(BPF_REG_0, 0),
4250                         BPF_EXIT_INSN(),
4251                 },
4252                 .result = ACCEPT,
4253                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4254         },
4255         {
4256                 "helper access to packet: test14, cls helper ok sub",
4257                 .insns = {
4258                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4259                                     offsetof(struct __sk_buff, data)),
4260                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4261                                     offsetof(struct __sk_buff, data_end)),
4262                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4263                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4264                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4265                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4266                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4267                         BPF_MOV64_IMM(BPF_REG_2, 4),
4268                         BPF_MOV64_IMM(BPF_REG_3, 0),
4269                         BPF_MOV64_IMM(BPF_REG_4, 0),
4270                         BPF_MOV64_IMM(BPF_REG_5, 0),
4271                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4272                                      BPF_FUNC_csum_diff),
4273                         BPF_MOV64_IMM(BPF_REG_0, 0),
4274                         BPF_EXIT_INSN(),
4275                 },
4276                 .result = ACCEPT,
4277                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4278         },
4279         {
4280                 "helper access to packet: test15, cls helper fail sub",
4281                 .insns = {
4282                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4283                                     offsetof(struct __sk_buff, data)),
4284                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4285                                     offsetof(struct __sk_buff, data_end)),
4286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4287                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4288                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4289                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4290                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4291                         BPF_MOV64_IMM(BPF_REG_2, 4),
4292                         BPF_MOV64_IMM(BPF_REG_3, 0),
4293                         BPF_MOV64_IMM(BPF_REG_4, 0),
4294                         BPF_MOV64_IMM(BPF_REG_5, 0),
4295                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4296                                      BPF_FUNC_csum_diff),
4297                         BPF_MOV64_IMM(BPF_REG_0, 0),
4298                         BPF_EXIT_INSN(),
4299                 },
4300                 .result = REJECT,
4301                 .errstr = "invalid access to packet",
4302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4303         },
4304         {
4305                 "helper access to packet: test16, cls helper fail range 1",
4306                 .insns = {
4307                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4308                                     offsetof(struct __sk_buff, data)),
4309                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4310                                     offsetof(struct __sk_buff, data_end)),
4311                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4312                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4313                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4314                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4315                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4316                         BPF_MOV64_IMM(BPF_REG_2, 8),
4317                         BPF_MOV64_IMM(BPF_REG_3, 0),
4318                         BPF_MOV64_IMM(BPF_REG_4, 0),
4319                         BPF_MOV64_IMM(BPF_REG_5, 0),
4320                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4321                                      BPF_FUNC_csum_diff),
4322                         BPF_MOV64_IMM(BPF_REG_0, 0),
4323                         BPF_EXIT_INSN(),
4324                 },
4325                 .result = REJECT,
4326                 .errstr = "invalid access to packet",
4327                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4328         },
4329         {
4330                 "helper access to packet: test17, cls helper fail range 2",
4331                 .insns = {
4332                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4333                                     offsetof(struct __sk_buff, data)),
4334                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4335                                     offsetof(struct __sk_buff, data_end)),
4336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4337                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4338                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4339                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4340                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4341                         BPF_MOV64_IMM(BPF_REG_2, -9),
4342                         BPF_MOV64_IMM(BPF_REG_3, 0),
4343                         BPF_MOV64_IMM(BPF_REG_4, 0),
4344                         BPF_MOV64_IMM(BPF_REG_5, 0),
4345                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4346                                      BPF_FUNC_csum_diff),
4347                         BPF_MOV64_IMM(BPF_REG_0, 0),
4348                         BPF_EXIT_INSN(),
4349                 },
4350                 .result = REJECT,
4351                 .errstr = "R2 min value is negative",
4352                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4353         },
4354         {
4355                 "helper access to packet: test18, cls helper fail range 3",
4356                 .insns = {
4357                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4358                                     offsetof(struct __sk_buff, data)),
4359                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4360                                     offsetof(struct __sk_buff, data_end)),
4361                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4362                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4364                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4365                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4366                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4367                         BPF_MOV64_IMM(BPF_REG_3, 0),
4368                         BPF_MOV64_IMM(BPF_REG_4, 0),
4369                         BPF_MOV64_IMM(BPF_REG_5, 0),
4370                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4371                                      BPF_FUNC_csum_diff),
4372                         BPF_MOV64_IMM(BPF_REG_0, 0),
4373                         BPF_EXIT_INSN(),
4374                 },
4375                 .result = REJECT,
4376                 .errstr = "R2 min value is negative",
4377                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4378         },
4379         {
4380                 "helper access to packet: test19, cls helper range zero",
4381                 .insns = {
4382                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4383                                     offsetof(struct __sk_buff, data)),
4384                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4385                                     offsetof(struct __sk_buff, data_end)),
4386                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4387                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4389                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4390                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4391                         BPF_MOV64_IMM(BPF_REG_2, 0),
4392                         BPF_MOV64_IMM(BPF_REG_3, 0),
4393                         BPF_MOV64_IMM(BPF_REG_4, 0),
4394                         BPF_MOV64_IMM(BPF_REG_5, 0),
4395                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4396                                      BPF_FUNC_csum_diff),
4397                         BPF_MOV64_IMM(BPF_REG_0, 0),
4398                         BPF_EXIT_INSN(),
4399                 },
4400                 .result = ACCEPT,
4401                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4402         },
4403         {
4404                 "helper access to packet: test20, pkt end as input",
4405                 .insns = {
4406                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4407                                     offsetof(struct __sk_buff, data)),
4408                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4409                                     offsetof(struct __sk_buff, data_end)),
4410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4411                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4413                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4414                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4415                         BPF_MOV64_IMM(BPF_REG_2, 4),
4416                         BPF_MOV64_IMM(BPF_REG_3, 0),
4417                         BPF_MOV64_IMM(BPF_REG_4, 0),
4418                         BPF_MOV64_IMM(BPF_REG_5, 0),
4419                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4420                                      BPF_FUNC_csum_diff),
4421                         BPF_MOV64_IMM(BPF_REG_0, 0),
4422                         BPF_EXIT_INSN(),
4423                 },
4424                 .result = REJECT,
4425                 .errstr = "R1 type=pkt_end expected=fp",
4426                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4427         },
4428         {
4429                 "helper access to packet: test21, wrong reg",
4430                 .insns = {
4431                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4432                                     offsetof(struct __sk_buff, data)),
4433                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4434                                     offsetof(struct __sk_buff, data_end)),
4435                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4436                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4437                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4438                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4439                         BPF_MOV64_IMM(BPF_REG_2, 4),
4440                         BPF_MOV64_IMM(BPF_REG_3, 0),
4441                         BPF_MOV64_IMM(BPF_REG_4, 0),
4442                         BPF_MOV64_IMM(BPF_REG_5, 0),
4443                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4444                                      BPF_FUNC_csum_diff),
4445                         BPF_MOV64_IMM(BPF_REG_0, 0),
4446                         BPF_EXIT_INSN(),
4447                 },
4448                 .result = REJECT,
4449                 .errstr = "invalid access to packet",
4450                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4451         },
4452         {
4453                 "valid map access into an array with a constant",
4454                 .insns = {
4455                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4456                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4458                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4459                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4460                                      BPF_FUNC_map_lookup_elem),
4461                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4462                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4463                                    offsetof(struct test_val, foo)),
4464                         BPF_EXIT_INSN(),
4465                 },
4466                 .fixup_map2 = { 3 },
4467                 .errstr_unpriv = "R0 leaks addr",
4468                 .result_unpriv = REJECT,
4469                 .result = ACCEPT,
4470         },
4471         {
4472                 "valid map access into an array with a register",
4473                 .insns = {
4474                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4475                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4476                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4477                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4478                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4479                                      BPF_FUNC_map_lookup_elem),
4480                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4481                         BPF_MOV64_IMM(BPF_REG_1, 4),
4482                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4483                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4484                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4485                                    offsetof(struct test_val, foo)),
4486                         BPF_EXIT_INSN(),
4487                 },
4488                 .fixup_map2 = { 3 },
4489                 .errstr_unpriv = "R0 leaks addr",
4490                 .result_unpriv = REJECT,
4491                 .result = ACCEPT,
4492                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4493         },
4494         {
4495                 "valid map access into an array with a variable",
4496                 .insns = {
4497                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4498                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4500                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4501                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4502                                      BPF_FUNC_map_lookup_elem),
4503                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4504                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4505                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4506                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4507                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4508                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4509                                    offsetof(struct test_val, foo)),
4510                         BPF_EXIT_INSN(),
4511                 },
4512                 .fixup_map2 = { 3 },
4513                 .errstr_unpriv = "R0 leaks addr",
4514                 .result_unpriv = REJECT,
4515                 .result = ACCEPT,
4516                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4517         },
4518         {
4519                 "valid map access into an array with a signed variable",
4520                 .insns = {
4521                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4522                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4524                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4526                                      BPF_FUNC_map_lookup_elem),
4527                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4528                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4529                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4530                         BPF_MOV32_IMM(BPF_REG_1, 0),
4531                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4532                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4533                         BPF_MOV32_IMM(BPF_REG_1, 0),
4534                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4535                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4536                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4537                                    offsetof(struct test_val, foo)),
4538                         BPF_EXIT_INSN(),
4539                 },
4540                 .fixup_map2 = { 3 },
4541                 .errstr_unpriv = "R0 leaks addr",
4542                 .result_unpriv = REJECT,
4543                 .result = ACCEPT,
4544                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4545         },
4546         {
4547                 "invalid map access into an array with a constant",
4548                 .insns = {
4549                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4550                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4551                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4552                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4553                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4554                                      BPF_FUNC_map_lookup_elem),
4555                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4556                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4557                                    offsetof(struct test_val, foo)),
4558                         BPF_EXIT_INSN(),
4559                 },
4560                 .fixup_map2 = { 3 },
4561                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4562                 .result = REJECT,
4563         },
4564         {
4565                 "invalid map access into an array with a register",
4566                 .insns = {
4567                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4568                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4569                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4570                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4571                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4572                                      BPF_FUNC_map_lookup_elem),
4573                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4574                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4575                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4576                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4577                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4578                                    offsetof(struct test_val, foo)),
4579                         BPF_EXIT_INSN(),
4580                 },
4581                 .fixup_map2 = { 3 },
4582                 .errstr = "R0 min value is outside of the array range",
4583                 .result = REJECT,
4584                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4585         },
4586         {
4587                 "invalid map access into an array with a variable",
4588                 .insns = {
4589                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4590                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4591                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4592                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4593                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4594                                      BPF_FUNC_map_lookup_elem),
4595                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4596                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4597                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4598                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4599                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4600                                    offsetof(struct test_val, foo)),
4601                         BPF_EXIT_INSN(),
4602                 },
4603                 .fixup_map2 = { 3 },
4604                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4605                 .result = REJECT,
4606                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4607         },
4608         {
4609                 "invalid map access into an array with no floor check",
4610                 .insns = {
4611                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4612                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4614                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4615                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4616                                      BPF_FUNC_map_lookup_elem),
4617                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4618                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4619                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4620                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4621                         BPF_MOV32_IMM(BPF_REG_1, 0),
4622                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4623                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4624                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4625                                    offsetof(struct test_val, foo)),
4626                         BPF_EXIT_INSN(),
4627                 },
4628                 .fixup_map2 = { 3 },
4629                 .errstr_unpriv = "R0 leaks addr",
4630                 .errstr = "R0 unbounded memory access",
4631                 .result_unpriv = REJECT,
4632                 .result = REJECT,
4633                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4634         },
4635         {
4636                 "invalid map access into an array with a invalid max check",
4637                 .insns = {
4638                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4639                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4640                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4641                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4642                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4643                                      BPF_FUNC_map_lookup_elem),
4644                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4645                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4646                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4647                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4648                         BPF_MOV32_IMM(BPF_REG_1, 0),
4649                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4650                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4651                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4652                                    offsetof(struct test_val, foo)),
4653                         BPF_EXIT_INSN(),
4654                 },
4655                 .fixup_map2 = { 3 },
4656                 .errstr_unpriv = "R0 leaks addr",
4657                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4658                 .result_unpriv = REJECT,
4659                 .result = REJECT,
4660                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4661         },
4662         {
4663                 "invalid map access into an array with a invalid max check",
4664                 .insns = {
4665                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4666                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4667                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4668                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4670                                      BPF_FUNC_map_lookup_elem),
4671                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4672                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4673                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4674                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4675                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4676                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4677                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4678                                      BPF_FUNC_map_lookup_elem),
4679                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4680                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4681                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4682                                     offsetof(struct test_val, foo)),
4683                         BPF_EXIT_INSN(),
4684                 },
4685                 .fixup_map2 = { 3, 11 },
4686                 .errstr = "R0 pointer += pointer",
4687                 .result = REJECT,
4688                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4689         },
4690         {
4691                 "valid cgroup storage access",
4692                 .insns = {
4693                         BPF_MOV64_IMM(BPF_REG_2, 0),
4694                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4695                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4696                                      BPF_FUNC_get_local_storage),
4697                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4698                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4699                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4700                         BPF_EXIT_INSN(),
4701                 },
4702                 .fixup_cgroup_storage = { 1 },
4703                 .result = ACCEPT,
4704                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4705         },
4706         {
4707                 "invalid cgroup storage access 1",
4708                 .insns = {
4709                         BPF_MOV64_IMM(BPF_REG_2, 0),
4710                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4711                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4712                                      BPF_FUNC_get_local_storage),
4713                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4714                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4715                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4716                         BPF_EXIT_INSN(),
4717                 },
4718                 .fixup_map1 = { 1 },
4719                 .result = REJECT,
4720                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
4721                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4722         },
4723         {
4724                 "invalid cgroup storage access 2",
4725                 .insns = {
4726                         BPF_MOV64_IMM(BPF_REG_2, 0),
4727                         BPF_LD_MAP_FD(BPF_REG_1, 1),
4728                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4729                                      BPF_FUNC_get_local_storage),
4730                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4731                         BPF_EXIT_INSN(),
4732                 },
4733                 .result = REJECT,
4734                 .errstr = "fd 1 is not pointing to valid bpf_map",
4735                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4736         },
4737         {
4738                 "invalid per-cgroup storage access 3",
4739                 .insns = {
4740                         BPF_MOV64_IMM(BPF_REG_2, 0),
4741                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4742                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4743                                      BPF_FUNC_get_local_storage),
4744                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
4745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4746                         BPF_MOV64_IMM(BPF_REG_0, 0),
4747                         BPF_EXIT_INSN(),
4748                 },
4749                 .fixup_cgroup_storage = { 1 },
4750                 .result = REJECT,
4751                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
4752                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4753         },
4754         {
4755                 "invalid cgroup storage access 4",
4756                 .insns = {
4757                         BPF_MOV64_IMM(BPF_REG_2, 0),
4758                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4759                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4760                                      BPF_FUNC_get_local_storage),
4761                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
4762                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4763                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4764                         BPF_EXIT_INSN(),
4765                 },
4766                 .fixup_cgroup_storage = { 1 },
4767                 .result = REJECT,
4768                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
4769                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4770         },
4771         {
4772                 "invalid cgroup storage access 5",
4773                 .insns = {
4774                         BPF_MOV64_IMM(BPF_REG_2, 7),
4775                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4776                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4777                                      BPF_FUNC_get_local_storage),
4778                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4779                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4780                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4781                         BPF_EXIT_INSN(),
4782                 },
4783                 .fixup_cgroup_storage = { 1 },
4784                 .result = REJECT,
4785                 .errstr = "get_local_storage() doesn't support non-zero flags",
4786                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4787         },
4788         {
4789                 "invalid cgroup storage access 6",
4790                 .insns = {
4791                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
4792                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4793                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4794                                      BPF_FUNC_get_local_storage),
4795                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4796                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4797                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4798                         BPF_EXIT_INSN(),
4799                 },
4800                 .fixup_cgroup_storage = { 1 },
4801                 .result = REJECT,
4802                 .errstr = "get_local_storage() doesn't support non-zero flags",
4803                 .errstr_unpriv = "R2 leaks addr into helper function",
4804                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4805         },
4806         {
4807                 "multiple registers share map_lookup_elem result",
4808                 .insns = {
4809                         BPF_MOV64_IMM(BPF_REG_1, 10),
4810                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4811                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4812                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4813                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4814                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4815                                      BPF_FUNC_map_lookup_elem),
4816                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4817                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4818                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4819                         BPF_EXIT_INSN(),
4820                 },
4821                 .fixup_map1 = { 4 },
4822                 .result = ACCEPT,
4823                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4824         },
4825         {
4826                 "alu ops on ptr_to_map_value_or_null, 1",
4827                 .insns = {
4828                         BPF_MOV64_IMM(BPF_REG_1, 10),
4829                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4830                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4832                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4833                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4834                                      BPF_FUNC_map_lookup_elem),
4835                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4836                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4838                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4839                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4840                         BPF_EXIT_INSN(),
4841                 },
4842                 .fixup_map1 = { 4 },
4843                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4844                 .result = REJECT,
4845                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4846         },
4847         {
4848                 "alu ops on ptr_to_map_value_or_null, 2",
4849                 .insns = {
4850                         BPF_MOV64_IMM(BPF_REG_1, 10),
4851                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4856                                      BPF_FUNC_map_lookup_elem),
4857                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4858                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4859                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4860                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4861                         BPF_EXIT_INSN(),
4862                 },
4863                 .fixup_map1 = { 4 },
4864                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4865                 .result = REJECT,
4866                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4867         },
4868         {
4869                 "alu ops on ptr_to_map_value_or_null, 3",
4870                 .insns = {
4871                         BPF_MOV64_IMM(BPF_REG_1, 10),
4872                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4873                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4874                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4875                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4876                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4877                                      BPF_FUNC_map_lookup_elem),
4878                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4879                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4880                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4881                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4882                         BPF_EXIT_INSN(),
4883                 },
4884                 .fixup_map1 = { 4 },
4885                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4886                 .result = REJECT,
4887                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4888         },
4889         {
4890                 "invalid memory access with multiple map_lookup_elem calls",
4891                 .insns = {
4892                         BPF_MOV64_IMM(BPF_REG_1, 10),
4893                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4894                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4895                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4896                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4897                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4898                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4899                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4900                                      BPF_FUNC_map_lookup_elem),
4901                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4902                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4903                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4904                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4905                                      BPF_FUNC_map_lookup_elem),
4906                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4907                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4908                         BPF_EXIT_INSN(),
4909                 },
4910                 .fixup_map1 = { 4 },
4911                 .result = REJECT,
4912                 .errstr = "R4 !read_ok",
4913                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4914         },
4915         {
4916                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4917                 .insns = {
4918                         BPF_MOV64_IMM(BPF_REG_1, 10),
4919                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4920                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4921                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4922                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4923                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4924                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4925                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4926                                      BPF_FUNC_map_lookup_elem),
4927                         BPF_MOV64_IMM(BPF_REG_2, 10),
4928                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4929                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4930                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4931                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4932                                      BPF_FUNC_map_lookup_elem),
4933                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4934                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4935                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4936                         BPF_EXIT_INSN(),
4937                 },
4938                 .fixup_map1 = { 4 },
4939                 .result = ACCEPT,
4940                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4941         },
4942         {
4943                 "invalid map access from else condition",
4944                 .insns = {
4945                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4946                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4947                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4948                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4949                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4950                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4951                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4952                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4954                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4955                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4956                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4957                         BPF_EXIT_INSN(),
4958                 },
4959                 .fixup_map2 = { 3 },
4960                 .errstr = "R0 unbounded memory access",
4961                 .result = REJECT,
4962                 .errstr_unpriv = "R0 leaks addr",
4963                 .result_unpriv = REJECT,
4964                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4965         },
4966         {
4967                 "constant register |= constant should keep constant type",
4968                 .insns = {
4969                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4970                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4971                         BPF_MOV64_IMM(BPF_REG_2, 34),
4972                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4973                         BPF_MOV64_IMM(BPF_REG_3, 0),
4974                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4975                         BPF_EXIT_INSN(),
4976                 },
4977                 .result = ACCEPT,
4978                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4979         },
4980         {
4981                 "constant register |= constant should not bypass stack boundary checks",
4982                 .insns = {
4983                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4985                         BPF_MOV64_IMM(BPF_REG_2, 34),
4986                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4987                         BPF_MOV64_IMM(BPF_REG_3, 0),
4988                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4989                         BPF_EXIT_INSN(),
4990                 },
4991                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4992                 .result = REJECT,
4993                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4994         },
4995         {
4996                 "constant register |= constant register should keep constant type",
4997                 .insns = {
4998                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4999                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5000                         BPF_MOV64_IMM(BPF_REG_2, 34),
5001                         BPF_MOV64_IMM(BPF_REG_4, 13),
5002                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5003                         BPF_MOV64_IMM(BPF_REG_3, 0),
5004                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5005                         BPF_EXIT_INSN(),
5006                 },
5007                 .result = ACCEPT,
5008                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5009         },
5010         {
5011                 "constant register |= constant register should not bypass stack boundary checks",
5012                 .insns = {
5013                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5015                         BPF_MOV64_IMM(BPF_REG_2, 34),
5016                         BPF_MOV64_IMM(BPF_REG_4, 24),
5017                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5018                         BPF_MOV64_IMM(BPF_REG_3, 0),
5019                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5020                         BPF_EXIT_INSN(),
5021                 },
5022                 .errstr = "invalid stack type R1 off=-48 access_size=58",
5023                 .result = REJECT,
5024                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5025         },
5026         {
5027                 "invalid direct packet write for LWT_IN",
5028                 .insns = {
5029                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5030                                     offsetof(struct __sk_buff, data)),
5031                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5032                                     offsetof(struct __sk_buff, data_end)),
5033                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5034                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5035                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5036                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5037                         BPF_MOV64_IMM(BPF_REG_0, 0),
5038                         BPF_EXIT_INSN(),
5039                 },
5040                 .errstr = "cannot write into packet",
5041                 .result = REJECT,
5042                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5043         },
5044         {
5045                 "invalid direct packet write for LWT_OUT",
5046                 .insns = {
5047                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5048                                     offsetof(struct __sk_buff, data)),
5049                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5050                                     offsetof(struct __sk_buff, data_end)),
5051                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5052                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5053                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5054                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5055                         BPF_MOV64_IMM(BPF_REG_0, 0),
5056                         BPF_EXIT_INSN(),
5057                 },
5058                 .errstr = "cannot write into packet",
5059                 .result = REJECT,
5060                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5061         },
5062         {
5063                 "direct packet write for LWT_XMIT",
5064                 .insns = {
5065                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5066                                     offsetof(struct __sk_buff, data)),
5067                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5068                                     offsetof(struct __sk_buff, data_end)),
5069                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5071                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5072                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5073                         BPF_MOV64_IMM(BPF_REG_0, 0),
5074                         BPF_EXIT_INSN(),
5075                 },
5076                 .result = ACCEPT,
5077                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5078         },
5079         {
5080                 "direct packet read for LWT_IN",
5081                 .insns = {
5082                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5083                                     offsetof(struct __sk_buff, data)),
5084                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5085                                     offsetof(struct __sk_buff, data_end)),
5086                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5087                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5088                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5089                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5090                         BPF_MOV64_IMM(BPF_REG_0, 0),
5091                         BPF_EXIT_INSN(),
5092                 },
5093                 .result = ACCEPT,
5094                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5095         },
5096         {
5097                 "direct packet read for LWT_OUT",
5098                 .insns = {
5099                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5100                                     offsetof(struct __sk_buff, data)),
5101                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5102                                     offsetof(struct __sk_buff, data_end)),
5103                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5105                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5106                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5107                         BPF_MOV64_IMM(BPF_REG_0, 0),
5108                         BPF_EXIT_INSN(),
5109                 },
5110                 .result = ACCEPT,
5111                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5112         },
5113         {
5114                 "direct packet read for LWT_XMIT",
5115                 .insns = {
5116                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5117                                     offsetof(struct __sk_buff, data)),
5118                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5119                                     offsetof(struct __sk_buff, data_end)),
5120                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5121                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5122                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5123                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5124                         BPF_MOV64_IMM(BPF_REG_0, 0),
5125                         BPF_EXIT_INSN(),
5126                 },
5127                 .result = ACCEPT,
5128                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5129         },
5130         {
5131                 "overlapping checks for direct packet access",
5132                 .insns = {
5133                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5134                                     offsetof(struct __sk_buff, data)),
5135                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5136                                     offsetof(struct __sk_buff, data_end)),
5137                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5139                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
5140                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
5141                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
5142                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
5143                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
5144                         BPF_MOV64_IMM(BPF_REG_0, 0),
5145                         BPF_EXIT_INSN(),
5146                 },
5147                 .result = ACCEPT,
5148                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5149         },
5150         {
5151                 "make headroom for LWT_XMIT",
5152                 .insns = {
5153                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5154                         BPF_MOV64_IMM(BPF_REG_2, 34),
5155                         BPF_MOV64_IMM(BPF_REG_3, 0),
5156                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5157                         /* split for s390 to succeed */
5158                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5159                         BPF_MOV64_IMM(BPF_REG_2, 42),
5160                         BPF_MOV64_IMM(BPF_REG_3, 0),
5161                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5162                         BPF_MOV64_IMM(BPF_REG_0, 0),
5163                         BPF_EXIT_INSN(),
5164                 },
5165                 .result = ACCEPT,
5166                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5167         },
5168         {
5169                 "invalid access of tc_classid for LWT_IN",
5170                 .insns = {
5171                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5172                                     offsetof(struct __sk_buff, tc_classid)),
5173                         BPF_EXIT_INSN(),
5174                 },
5175                 .result = REJECT,
5176                 .errstr = "invalid bpf_context access",
5177         },
5178         {
5179                 "invalid access of tc_classid for LWT_OUT",
5180                 .insns = {
5181                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5182                                     offsetof(struct __sk_buff, tc_classid)),
5183                         BPF_EXIT_INSN(),
5184                 },
5185                 .result = REJECT,
5186                 .errstr = "invalid bpf_context access",
5187         },
5188         {
5189                 "invalid access of tc_classid for LWT_XMIT",
5190                 .insns = {
5191                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5192                                     offsetof(struct __sk_buff, tc_classid)),
5193                         BPF_EXIT_INSN(),
5194                 },
5195                 .result = REJECT,
5196                 .errstr = "invalid bpf_context access",
5197         },
5198         {
5199                 "leak pointer into ctx 1",
5200                 .insns = {
5201                         BPF_MOV64_IMM(BPF_REG_0, 0),
5202                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5203                                     offsetof(struct __sk_buff, cb[0])),
5204                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5205                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
5206                                       offsetof(struct __sk_buff, cb[0])),
5207                         BPF_EXIT_INSN(),
5208                 },
5209                 .fixup_map1 = { 2 },
5210                 .errstr_unpriv = "R2 leaks addr into mem",
5211                 .result_unpriv = REJECT,
5212                 .result = REJECT,
5213                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5214         },
5215         {
5216                 "leak pointer into ctx 2",
5217                 .insns = {
5218                         BPF_MOV64_IMM(BPF_REG_0, 0),
5219                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5220                                     offsetof(struct __sk_buff, cb[0])),
5221                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
5222                                       offsetof(struct __sk_buff, cb[0])),
5223                         BPF_EXIT_INSN(),
5224                 },
5225                 .errstr_unpriv = "R10 leaks addr into mem",
5226                 .result_unpriv = REJECT,
5227                 .result = REJECT,
5228                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5229         },
5230         {
5231                 "leak pointer into ctx 3",
5232                 .insns = {
5233                         BPF_MOV64_IMM(BPF_REG_0, 0),
5234                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5235                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
5236                                       offsetof(struct __sk_buff, cb[0])),
5237                         BPF_EXIT_INSN(),
5238                 },
5239                 .fixup_map1 = { 1 },
5240                 .errstr_unpriv = "R2 leaks addr into ctx",
5241                 .result_unpriv = REJECT,
5242                 .result = ACCEPT,
5243         },
5244         {
5245                 "leak pointer into map val",
5246                 .insns = {
5247                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5248                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5249                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5251                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5252                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5253                                      BPF_FUNC_map_lookup_elem),
5254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5255                         BPF_MOV64_IMM(BPF_REG_3, 0),
5256                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
5257                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
5258                         BPF_MOV64_IMM(BPF_REG_0, 0),
5259                         BPF_EXIT_INSN(),
5260                 },
5261                 .fixup_map1 = { 4 },
5262                 .errstr_unpriv = "R6 leaks addr into mem",
5263                 .result_unpriv = REJECT,
5264                 .result = ACCEPT,
5265         },
5266         {
5267                 "helper access to map: full range",
5268                 .insns = {
5269                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5271                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5272                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5273                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5274                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5275                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5276                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5277                         BPF_MOV64_IMM(BPF_REG_3, 0),
5278                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5279                         BPF_EXIT_INSN(),
5280                 },
5281                 .fixup_map2 = { 3 },
5282                 .result = ACCEPT,
5283                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5284         },
5285         {
5286                 "helper access to map: partial range",
5287                 .insns = {
5288                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5289                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5290                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5291                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5292                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5293                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5294                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5295                         BPF_MOV64_IMM(BPF_REG_2, 8),
5296                         BPF_MOV64_IMM(BPF_REG_3, 0),
5297                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5298                         BPF_EXIT_INSN(),
5299                 },
5300                 .fixup_map2 = { 3 },
5301                 .result = ACCEPT,
5302                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5303         },
5304         {
5305                 "helper access to map: empty range",
5306                 .insns = {
5307                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5308                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5309                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5310                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5311                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5312                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5313                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5314                         BPF_MOV64_IMM(BPF_REG_2, 0),
5315                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5316                         BPF_EXIT_INSN(),
5317                 },
5318                 .fixup_map2 = { 3 },
5319                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
5320                 .result = REJECT,
5321                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5322         },
5323         {
5324                 "helper access to map: out-of-bound range",
5325                 .insns = {
5326                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5327                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5328                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5329                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5330                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5331                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5332                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5333                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
5334                         BPF_MOV64_IMM(BPF_REG_3, 0),
5335                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5336                         BPF_EXIT_INSN(),
5337                 },
5338                 .fixup_map2 = { 3 },
5339                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
5340                 .result = REJECT,
5341                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5342         },
5343         {
5344                 "helper access to map: negative range",
5345                 .insns = {
5346                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5348                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5349                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5350                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5351                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5352                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5353                         BPF_MOV64_IMM(BPF_REG_2, -8),
5354                         BPF_MOV64_IMM(BPF_REG_3, 0),
5355                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5356                         BPF_EXIT_INSN(),
5357                 },
5358                 .fixup_map2 = { 3 },
5359                 .errstr = "R2 min value is negative",
5360                 .result = REJECT,
5361                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5362         },
5363         {
5364                 "helper access to adjusted map (via const imm): full range",
5365                 .insns = {
5366                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5367                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5368                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5369                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5370                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5371                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5372                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5373                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5374                                 offsetof(struct test_val, foo)),
5375                         BPF_MOV64_IMM(BPF_REG_2,
5376                                 sizeof(struct test_val) -
5377                                 offsetof(struct test_val, foo)),
5378                         BPF_MOV64_IMM(BPF_REG_3, 0),
5379                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5380                         BPF_EXIT_INSN(),
5381                 },
5382                 .fixup_map2 = { 3 },
5383                 .result = ACCEPT,
5384                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5385         },
5386         {
5387                 "helper access to adjusted map (via const imm): partial range",
5388                 .insns = {
5389                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5390                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5391                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5392                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5393                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5394                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5395                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5396                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5397                                 offsetof(struct test_val, foo)),
5398                         BPF_MOV64_IMM(BPF_REG_2, 8),
5399                         BPF_MOV64_IMM(BPF_REG_3, 0),
5400                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5401                         BPF_EXIT_INSN(),
5402                 },
5403                 .fixup_map2 = { 3 },
5404                 .result = ACCEPT,
5405                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5406         },
5407         {
5408                 "helper access to adjusted map (via const imm): empty range",
5409                 .insns = {
5410                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5412                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5414                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5415                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5416                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5417                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5418                                 offsetof(struct test_val, foo)),
5419                         BPF_MOV64_IMM(BPF_REG_2, 0),
5420                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5421                         BPF_EXIT_INSN(),
5422                 },
5423                 .fixup_map2 = { 3 },
5424                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5425                 .result = REJECT,
5426                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5427         },
5428         {
5429                 "helper access to adjusted map (via const imm): out-of-bound range",
5430                 .insns = {
5431                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5433                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5434                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5435                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5436                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5437                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5438                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5439                                 offsetof(struct test_val, foo)),
5440                         BPF_MOV64_IMM(BPF_REG_2,
5441                                 sizeof(struct test_val) -
5442                                 offsetof(struct test_val, foo) + 8),
5443                         BPF_MOV64_IMM(BPF_REG_3, 0),
5444                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5445                         BPF_EXIT_INSN(),
5446                 },
5447                 .fixup_map2 = { 3 },
5448                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5449                 .result = REJECT,
5450                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5451         },
5452         {
5453                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5454                 .insns = {
5455                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5457                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5458                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5459                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5460                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5461                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5462                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5463                                 offsetof(struct test_val, foo)),
5464                         BPF_MOV64_IMM(BPF_REG_2, -8),
5465                         BPF_MOV64_IMM(BPF_REG_3, 0),
5466                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5467                         BPF_EXIT_INSN(),
5468                 },
5469                 .fixup_map2 = { 3 },
5470                 .errstr = "R2 min value is negative",
5471                 .result = REJECT,
5472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5473         },
5474         {
5475                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5476                 .insns = {
5477                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5479                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5480                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5481                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5482                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5483                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5485                                 offsetof(struct test_val, foo)),
5486                         BPF_MOV64_IMM(BPF_REG_2, -1),
5487                         BPF_MOV64_IMM(BPF_REG_3, 0),
5488                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5489                         BPF_EXIT_INSN(),
5490                 },
5491                 .fixup_map2 = { 3 },
5492                 .errstr = "R2 min value is negative",
5493                 .result = REJECT,
5494                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5495         },
5496         {
5497                 "helper access to adjusted map (via const reg): full range",
5498                 .insns = {
5499                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5501                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5502                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5503                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5504                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5505                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5506                         BPF_MOV64_IMM(BPF_REG_3,
5507                                 offsetof(struct test_val, foo)),
5508                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5509                         BPF_MOV64_IMM(BPF_REG_2,
5510                                 sizeof(struct test_val) -
5511                                 offsetof(struct test_val, foo)),
5512                         BPF_MOV64_IMM(BPF_REG_3, 0),
5513                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5514                         BPF_EXIT_INSN(),
5515                 },
5516                 .fixup_map2 = { 3 },
5517                 .result = ACCEPT,
5518                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5519         },
5520         {
5521                 "helper access to adjusted map (via const reg): partial range",
5522                 .insns = {
5523                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5524                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5525                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5526                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5527                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5528                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5529                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5530                         BPF_MOV64_IMM(BPF_REG_3,
5531                                 offsetof(struct test_val, foo)),
5532                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5533                         BPF_MOV64_IMM(BPF_REG_2, 8),
5534                         BPF_MOV64_IMM(BPF_REG_3, 0),
5535                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5536                         BPF_EXIT_INSN(),
5537                 },
5538                 .fixup_map2 = { 3 },
5539                 .result = ACCEPT,
5540                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5541         },
5542         {
5543                 "helper access to adjusted map (via const reg): empty range",
5544                 .insns = {
5545                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5546                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5547                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5548                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5549                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5550                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5551                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5552                         BPF_MOV64_IMM(BPF_REG_3, 0),
5553                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5554                         BPF_MOV64_IMM(BPF_REG_2, 0),
5555                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5556                         BPF_EXIT_INSN(),
5557                 },
5558                 .fixup_map2 = { 3 },
5559                 .errstr = "R1 min value is outside of the array range",
5560                 .result = REJECT,
5561                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5562         },
5563         {
5564                 "helper access to adjusted map (via const reg): out-of-bound range",
5565                 .insns = {
5566                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5567                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5568                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5569                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5570                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5571                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5572                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5573                         BPF_MOV64_IMM(BPF_REG_3,
5574                                 offsetof(struct test_val, foo)),
5575                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5576                         BPF_MOV64_IMM(BPF_REG_2,
5577                                 sizeof(struct test_val) -
5578                                 offsetof(struct test_val, foo) + 8),
5579                         BPF_MOV64_IMM(BPF_REG_3, 0),
5580                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5581                         BPF_EXIT_INSN(),
5582                 },
5583                 .fixup_map2 = { 3 },
5584                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5585                 .result = REJECT,
5586                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5587         },
5588         {
5589                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
5590                 .insns = {
5591                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5593                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5594                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5595                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5596                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5597                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5598                         BPF_MOV64_IMM(BPF_REG_3,
5599                                 offsetof(struct test_val, foo)),
5600                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5601                         BPF_MOV64_IMM(BPF_REG_2, -8),
5602                         BPF_MOV64_IMM(BPF_REG_3, 0),
5603                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5604                         BPF_EXIT_INSN(),
5605                 },
5606                 .fixup_map2 = { 3 },
5607                 .errstr = "R2 min value is negative",
5608                 .result = REJECT,
5609                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5610         },
5611         {
5612                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
5613                 .insns = {
5614                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5615                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5616                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5617                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5618                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5619                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5620                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5621                         BPF_MOV64_IMM(BPF_REG_3,
5622                                 offsetof(struct test_val, foo)),
5623                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5624                         BPF_MOV64_IMM(BPF_REG_2, -1),
5625                         BPF_MOV64_IMM(BPF_REG_3, 0),
5626                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5627                         BPF_EXIT_INSN(),
5628                 },
5629                 .fixup_map2 = { 3 },
5630                 .errstr = "R2 min value is negative",
5631                 .result = REJECT,
5632                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5633         },
5634         {
5635                 "helper access to adjusted map (via variable): full range",
5636                 .insns = {
5637                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5638                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5639                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5640                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5641                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5642                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5643                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5644                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5645                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5646                                 offsetof(struct test_val, foo), 4),
5647                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5648                         BPF_MOV64_IMM(BPF_REG_2,
5649                                 sizeof(struct test_val) -
5650                                 offsetof(struct test_val, foo)),
5651                         BPF_MOV64_IMM(BPF_REG_3, 0),
5652                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5653                         BPF_EXIT_INSN(),
5654                 },
5655                 .fixup_map2 = { 3 },
5656                 .result = ACCEPT,
5657                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5658         },
5659         {
5660                 "helper access to adjusted map (via variable): partial range",
5661                 .insns = {
5662                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5664                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5665                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5666                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5667                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5668                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5669                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5670                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5671                                 offsetof(struct test_val, foo), 4),
5672                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5673                         BPF_MOV64_IMM(BPF_REG_2, 8),
5674                         BPF_MOV64_IMM(BPF_REG_3, 0),
5675                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5676                         BPF_EXIT_INSN(),
5677                 },
5678                 .fixup_map2 = { 3 },
5679                 .result = ACCEPT,
5680                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5681         },
5682         {
5683                 "helper access to adjusted map (via variable): empty range",
5684                 .insns = {
5685                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5686                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5687                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5688                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5689                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5690                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5691                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5692                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5693                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5694                                 offsetof(struct test_val, foo), 3),
5695                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5696                         BPF_MOV64_IMM(BPF_REG_2, 0),
5697                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5698                         BPF_EXIT_INSN(),
5699                 },
5700                 .fixup_map2 = { 3 },
5701                 .errstr = "R1 min value is outside of the array range",
5702                 .result = REJECT,
5703                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5704         },
5705         {
5706                 "helper access to adjusted map (via variable): no max check",
5707                 .insns = {
5708                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5709                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5710                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5711                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5712                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5713                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5714                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5715                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5716                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5717                         BPF_MOV64_IMM(BPF_REG_2, 1),
5718                         BPF_MOV64_IMM(BPF_REG_3, 0),
5719                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5720                         BPF_EXIT_INSN(),
5721                 },
5722                 .fixup_map2 = { 3 },
5723                 .errstr = "R1 unbounded memory access",
5724                 .result = REJECT,
5725                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5726         },
5727         {
5728                 "helper access to adjusted map (via variable): wrong max check",
5729                 .insns = {
5730                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5731                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5732                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5733                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5734                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5735                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5736                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5737                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5738                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5739                                 offsetof(struct test_val, foo), 4),
5740                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5741                         BPF_MOV64_IMM(BPF_REG_2,
5742                                 sizeof(struct test_val) -
5743                                 offsetof(struct test_val, foo) + 1),
5744                         BPF_MOV64_IMM(BPF_REG_3, 0),
5745                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5746                         BPF_EXIT_INSN(),
5747                 },
5748                 .fixup_map2 = { 3 },
5749                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
5750                 .result = REJECT,
5751                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5752         },
5753         {
5754                 "helper access to map: bounds check using <, good access",
5755                 .insns = {
5756                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5757                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5758                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5759                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5760                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5761                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5762                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5763                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5764                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
5765                         BPF_MOV64_IMM(BPF_REG_0, 0),
5766                         BPF_EXIT_INSN(),
5767                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5768                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5769                         BPF_MOV64_IMM(BPF_REG_0, 0),
5770                         BPF_EXIT_INSN(),
5771                 },
5772                 .fixup_map2 = { 3 },
5773                 .result = ACCEPT,
5774                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5775         },
5776         {
5777                 "helper access to map: bounds check using <, bad access",
5778                 .insns = {
5779                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5780                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5781                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5782                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5783                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5784                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5785                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5786                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5787                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
5788                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5789                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5790                         BPF_MOV64_IMM(BPF_REG_0, 0),
5791                         BPF_EXIT_INSN(),
5792                         BPF_MOV64_IMM(BPF_REG_0, 0),
5793                         BPF_EXIT_INSN(),
5794                 },
5795                 .fixup_map2 = { 3 },
5796                 .result = REJECT,
5797                 .errstr = "R1 unbounded memory access",
5798                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5799         },
5800         {
5801                 "helper access to map: bounds check using <=, good access",
5802                 .insns = {
5803                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5804                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5805                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5806                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5807                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5808                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5810                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5811                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
5812                         BPF_MOV64_IMM(BPF_REG_0, 0),
5813                         BPF_EXIT_INSN(),
5814                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5815                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5816                         BPF_MOV64_IMM(BPF_REG_0, 0),
5817                         BPF_EXIT_INSN(),
5818                 },
5819                 .fixup_map2 = { 3 },
5820                 .result = ACCEPT,
5821                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5822         },
5823         {
5824                 "helper access to map: bounds check using <=, bad access",
5825                 .insns = {
5826                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5827                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5828                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5829                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5830                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5831                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5832                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5833                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5834                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5835                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5836                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5837                         BPF_MOV64_IMM(BPF_REG_0, 0),
5838                         BPF_EXIT_INSN(),
5839                         BPF_MOV64_IMM(BPF_REG_0, 0),
5840                         BPF_EXIT_INSN(),
5841                 },
5842                 .fixup_map2 = { 3 },
5843                 .result = REJECT,
5844                 .errstr = "R1 unbounded memory access",
5845                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5846         },
5847         {
5848                 "helper access to map: bounds check using s<, good access",
5849                 .insns = {
5850                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5851                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5852                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5853                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5854                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5855                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5856                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5857                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5858                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5859                         BPF_MOV64_IMM(BPF_REG_0, 0),
5860                         BPF_EXIT_INSN(),
5861                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5862                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5863                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5864                         BPF_MOV64_IMM(BPF_REG_0, 0),
5865                         BPF_EXIT_INSN(),
5866                 },
5867                 .fixup_map2 = { 3 },
5868                 .result = ACCEPT,
5869                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5870         },
5871         {
5872                 "helper access to map: bounds check using s<, good access 2",
5873                 .insns = {
5874                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5876                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5877                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5878                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5879                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5880                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5881                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5882                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5883                         BPF_MOV64_IMM(BPF_REG_0, 0),
5884                         BPF_EXIT_INSN(),
5885                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5886                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5887                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5888                         BPF_MOV64_IMM(BPF_REG_0, 0),
5889                         BPF_EXIT_INSN(),
5890                 },
5891                 .fixup_map2 = { 3 },
5892                 .result = ACCEPT,
5893                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5894         },
5895         {
5896                 "helper access to map: bounds check using s<, bad access",
5897                 .insns = {
5898                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5899                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5900                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5901                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5902                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5903                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5904                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5905                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5906                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5907                         BPF_MOV64_IMM(BPF_REG_0, 0),
5908                         BPF_EXIT_INSN(),
5909                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5910                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5911                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5912                         BPF_MOV64_IMM(BPF_REG_0, 0),
5913                         BPF_EXIT_INSN(),
5914                 },
5915                 .fixup_map2 = { 3 },
5916                 .result = REJECT,
5917                 .errstr = "R1 min value is negative",
5918                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5919         },
5920         {
5921                 "helper access to map: bounds check using s<=, good access",
5922                 .insns = {
5923                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5924                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5925                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5926                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5927                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5928                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5929                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5930                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5931                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5932                         BPF_MOV64_IMM(BPF_REG_0, 0),
5933                         BPF_EXIT_INSN(),
5934                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5935                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5936                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5937                         BPF_MOV64_IMM(BPF_REG_0, 0),
5938                         BPF_EXIT_INSN(),
5939                 },
5940                 .fixup_map2 = { 3 },
5941                 .result = ACCEPT,
5942                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5943         },
5944         {
5945                 "helper access to map: bounds check using s<=, good access 2",
5946                 .insns = {
5947                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5948                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5949                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5950                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5951                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5952                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5953                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5954                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5955                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5956                         BPF_MOV64_IMM(BPF_REG_0, 0),
5957                         BPF_EXIT_INSN(),
5958                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5959                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5960                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5961                         BPF_MOV64_IMM(BPF_REG_0, 0),
5962                         BPF_EXIT_INSN(),
5963                 },
5964                 .fixup_map2 = { 3 },
5965                 .result = ACCEPT,
5966                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5967         },
5968         {
5969                 "helper access to map: bounds check using s<=, bad access",
5970                 .insns = {
5971                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5972                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5973                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5974                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5975                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5976                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5977                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5978                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5979                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5980                         BPF_MOV64_IMM(BPF_REG_0, 0),
5981                         BPF_EXIT_INSN(),
5982                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5983                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5984                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5985                         BPF_MOV64_IMM(BPF_REG_0, 0),
5986                         BPF_EXIT_INSN(),
5987                 },
5988                 .fixup_map2 = { 3 },
5989                 .result = REJECT,
5990                 .errstr = "R1 min value is negative",
5991                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5992         },
5993         {
5994                 "map lookup helper access to map",
5995                 .insns = {
5996                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5997                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5998                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5999                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6000                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6001                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6002                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6003                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6004                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6005                         BPF_EXIT_INSN(),
6006                 },
6007                 .fixup_map3 = { 3, 8 },
6008                 .result = ACCEPT,
6009                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6010         },
6011         {
6012                 "map update helper access to map",
6013                 .insns = {
6014                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6015                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6016                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6017                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6018                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6019                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6020                         BPF_MOV64_IMM(BPF_REG_4, 0),
6021                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6022                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6023                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6024                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6025                         BPF_EXIT_INSN(),
6026                 },
6027                 .fixup_map3 = { 3, 10 },
6028                 .result = ACCEPT,
6029                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6030         },
6031         {
6032                 "map update helper access to map: wrong size",
6033                 .insns = {
6034                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6035                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6036                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6037                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6038                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6039                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6040                         BPF_MOV64_IMM(BPF_REG_4, 0),
6041                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6042                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6043                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6044                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6045                         BPF_EXIT_INSN(),
6046                 },
6047                 .fixup_map1 = { 3 },
6048                 .fixup_map3 = { 10 },
6049                 .result = REJECT,
6050                 .errstr = "invalid access to map value, value_size=8 off=0 size=16",
6051                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6052         },
6053         {
6054                 "map helper access to adjusted map (via const imm)",
6055                 .insns = {
6056                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6058                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6059                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6060                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6061                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6062                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6063                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6064                                       offsetof(struct other_val, bar)),
6065                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6066                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6067                         BPF_EXIT_INSN(),
6068                 },
6069                 .fixup_map3 = { 3, 9 },
6070                 .result = ACCEPT,
6071                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6072         },
6073         {
6074                 "map helper access to adjusted map (via const imm): out-of-bound 1",
6075                 .insns = {
6076                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6077                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6078                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6079                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6080                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6081                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6082                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6083                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6084                                       sizeof(struct other_val) - 4),
6085                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6086                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6087                         BPF_EXIT_INSN(),
6088                 },
6089                 .fixup_map3 = { 3, 9 },
6090                 .result = REJECT,
6091                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6092                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6093         },
6094         {
6095                 "map helper access to adjusted map (via const imm): out-of-bound 2",
6096                 .insns = {
6097                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6099                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6100                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6101                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6102                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6103                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6105                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6106                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6107                         BPF_EXIT_INSN(),
6108                 },
6109                 .fixup_map3 = { 3, 9 },
6110                 .result = REJECT,
6111                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6112                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6113         },
6114         {
6115                 "map helper access to adjusted map (via const reg)",
6116                 .insns = {
6117                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6118                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6119                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6120                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6121                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6122                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6123                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6124                         BPF_MOV64_IMM(BPF_REG_3,
6125                                       offsetof(struct other_val, bar)),
6126                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6127                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6128                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6129                         BPF_EXIT_INSN(),
6130                 },
6131                 .fixup_map3 = { 3, 10 },
6132                 .result = ACCEPT,
6133                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6134         },
6135         {
6136                 "map helper access to adjusted map (via const reg): out-of-bound 1",
6137                 .insns = {
6138                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6139                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6140                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6141                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6142                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6143                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6144                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6145                         BPF_MOV64_IMM(BPF_REG_3,
6146                                       sizeof(struct other_val) - 4),
6147                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6148                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6149                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6150                         BPF_EXIT_INSN(),
6151                 },
6152                 .fixup_map3 = { 3, 10 },
6153                 .result = REJECT,
6154                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6155                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6156         },
6157         {
6158                 "map helper access to adjusted map (via const reg): out-of-bound 2",
6159                 .insns = {
6160                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6162                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6163                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6164                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6165                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6166                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6167                         BPF_MOV64_IMM(BPF_REG_3, -4),
6168                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6169                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6170                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6171                         BPF_EXIT_INSN(),
6172                 },
6173                 .fixup_map3 = { 3, 10 },
6174                 .result = REJECT,
6175                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6176                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6177         },
6178         {
6179                 "map helper access to adjusted map (via variable)",
6180                 .insns = {
6181                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6182                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6183                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6184                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6185                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6186                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6187                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6188                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6189                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6190                                     offsetof(struct other_val, bar), 4),
6191                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6192                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6193                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6194                         BPF_EXIT_INSN(),
6195                 },
6196                 .fixup_map3 = { 3, 11 },
6197                 .result = ACCEPT,
6198                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6199         },
6200         {
6201                 "map helper access to adjusted map (via variable): no max check",
6202                 .insns = {
6203                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6204                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6205                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6206                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6207                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6208                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6209                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6210                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6211                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6212                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6213                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6214                         BPF_EXIT_INSN(),
6215                 },
6216                 .fixup_map3 = { 3, 10 },
6217                 .result = REJECT,
6218                 .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
6219                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6220         },
6221         {
6222                 "map helper access to adjusted map (via variable): wrong max check",
6223                 .insns = {
6224                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6225                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6226                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6227                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6228                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6229                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6230                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6231                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6232                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6233                                     offsetof(struct other_val, bar) + 1, 4),
6234                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6235                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6236                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6237                         BPF_EXIT_INSN(),
6238                 },
6239                 .fixup_map3 = { 3, 11 },
6240                 .result = REJECT,
6241                 .errstr = "invalid access to map value, value_size=16 off=9 size=8",
6242                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6243         },
6244         {
6245                 "map element value is preserved across register spilling",
6246                 .insns = {
6247                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6248                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6249                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6250                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6251                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6252                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6253                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6254                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6255                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6256                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6257                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6258                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6259                         BPF_EXIT_INSN(),
6260                 },
6261                 .fixup_map2 = { 3 },
6262                 .errstr_unpriv = "R0 leaks addr",
6263                 .result = ACCEPT,
6264                 .result_unpriv = REJECT,
6265         },
6266         {
6267                 "map element value or null is marked on register spilling",
6268                 .insns = {
6269                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6271                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6272                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6273                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6274                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6275                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
6276                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6277                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6278                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6279                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6280                         BPF_EXIT_INSN(),
6281                 },
6282                 .fixup_map2 = { 3 },
6283                 .errstr_unpriv = "R0 leaks addr",
6284                 .result = ACCEPT,
6285                 .result_unpriv = REJECT,
6286         },
6287         {
6288                 "map element value store of cleared call register",
6289                 .insns = {
6290                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6291                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6292                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6293                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6294                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6295                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
6296                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
6297                         BPF_EXIT_INSN(),
6298                 },
6299                 .fixup_map2 = { 3 },
6300                 .errstr_unpriv = "R1 !read_ok",
6301                 .errstr = "R1 !read_ok",
6302                 .result = REJECT,
6303                 .result_unpriv = REJECT,
6304         },
6305         {
6306                 "map element value with unaligned store",
6307                 .insns = {
6308                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6309                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6310                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6311                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6312                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6313                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
6314                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6315                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6316                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
6317                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
6318                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6319                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
6320                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
6321                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
6322                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
6323                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
6324                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
6325                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
6326                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
6327                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
6328                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
6329                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
6330                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
6331                         BPF_EXIT_INSN(),
6332                 },
6333                 .fixup_map2 = { 3 },
6334                 .errstr_unpriv = "R0 leaks addr",
6335                 .result = ACCEPT,
6336                 .result_unpriv = REJECT,
6337                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6338         },
6339         {
6340                 "map element value with unaligned load",
6341                 .insns = {
6342                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6343                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6344                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6345                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6346                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6347                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6348                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6349                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
6350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6351                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6352                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
6353                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6354                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
6355                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
6356                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
6357                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6358                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
6359                         BPF_EXIT_INSN(),
6360                 },
6361                 .fixup_map2 = { 3 },
6362                 .errstr_unpriv = "R0 leaks addr",
6363                 .result = ACCEPT,
6364                 .result_unpriv = REJECT,
6365                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6366         },
6367         {
6368                 "map element value illegal alu op, 1",
6369                 .insns = {
6370                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6371                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6372                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6373                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6374                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6375                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6376                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
6377                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6378                         BPF_EXIT_INSN(),
6379                 },
6380                 .fixup_map2 = { 3 },
6381                 .errstr = "R0 bitwise operator &= on pointer",
6382                 .result = REJECT,
6383         },
6384         {
6385                 "map element value illegal alu op, 2",
6386                 .insns = {
6387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6389                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6390                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6391                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6392                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6393                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
6394                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6395                         BPF_EXIT_INSN(),
6396                 },
6397                 .fixup_map2 = { 3 },
6398                 .errstr = "R0 32-bit pointer arithmetic prohibited",
6399                 .result = REJECT,
6400         },
6401         {
6402                 "map element value illegal alu op, 3",
6403                 .insns = {
6404                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6406                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6407                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6408                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6409                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6410                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
6411                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6412                         BPF_EXIT_INSN(),
6413                 },
6414                 .fixup_map2 = { 3 },
6415                 .errstr = "R0 pointer arithmetic with /= operator",
6416                 .result = REJECT,
6417         },
6418         {
6419                 "map element value illegal alu op, 4",
6420                 .insns = {
6421                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6422                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6423                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6424                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6425                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6426                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6427                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
6428                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6429                         BPF_EXIT_INSN(),
6430                 },
6431                 .fixup_map2 = { 3 },
6432                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
6433                 .errstr = "invalid mem access 'inv'",
6434                 .result = REJECT,
6435                 .result_unpriv = REJECT,
6436         },
6437         {
6438                 "map element value illegal alu op, 5",
6439                 .insns = {
6440                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6441                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6442                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6443                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6444                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6445                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6446                         BPF_MOV64_IMM(BPF_REG_3, 4096),
6447                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6449                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6450                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
6451                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
6452                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6453                         BPF_EXIT_INSN(),
6454                 },
6455                 .fixup_map2 = { 3 },
6456                 .errstr = "R0 invalid mem access 'inv'",
6457                 .result = REJECT,
6458         },
6459         {
6460                 "map element value is preserved across register spilling",
6461                 .insns = {
6462                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6463                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6464                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6465                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6466                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6467                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6468                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
6469                                 offsetof(struct test_val, foo)),
6470                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6471                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6472                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6473                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6474                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6475                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6476                         BPF_EXIT_INSN(),
6477                 },
6478                 .fixup_map2 = { 3 },
6479                 .errstr_unpriv = "R0 leaks addr",
6480                 .result = ACCEPT,
6481                 .result_unpriv = REJECT,
6482                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6483         },
6484         {
6485                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
6486                 .insns = {
6487                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6488                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6489                         BPF_MOV64_IMM(BPF_REG_0, 0),
6490                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6491                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6492                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6493                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6494                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6495                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6496                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6497                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6498                         BPF_MOV64_IMM(BPF_REG_2, 16),
6499                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6500                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6501                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6502                         BPF_MOV64_IMM(BPF_REG_4, 0),
6503                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6504                         BPF_MOV64_IMM(BPF_REG_3, 0),
6505                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6506                         BPF_MOV64_IMM(BPF_REG_0, 0),
6507                         BPF_EXIT_INSN(),
6508                 },
6509                 .result = ACCEPT,
6510                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6511         },
6512         {
6513                 "helper access to variable memory: stack, bitwise AND, zero included",
6514                 .insns = {
6515                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6516                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6517                         BPF_MOV64_IMM(BPF_REG_2, 16),
6518                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6519                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6520                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6521                         BPF_MOV64_IMM(BPF_REG_3, 0),
6522                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6523                         BPF_EXIT_INSN(),
6524                 },
6525                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6526                 .result = REJECT,
6527                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6528         },
6529         {
6530                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
6531                 .insns = {
6532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6533                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6534                         BPF_MOV64_IMM(BPF_REG_2, 16),
6535                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6536                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6537                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
6538                         BPF_MOV64_IMM(BPF_REG_4, 0),
6539                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6540                         BPF_MOV64_IMM(BPF_REG_3, 0),
6541                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6542                         BPF_MOV64_IMM(BPF_REG_0, 0),
6543                         BPF_EXIT_INSN(),
6544                 },
6545                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6546                 .result = REJECT,
6547                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6548         },
6549         {
6550                 "helper access to variable memory: stack, JMP, correct bounds",
6551                 .insns = {
6552                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6554                         BPF_MOV64_IMM(BPF_REG_0, 0),
6555                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6556                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6557                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6558                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6559                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6560                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6561                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6562                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6563                         BPF_MOV64_IMM(BPF_REG_2, 16),
6564                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6565                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6566                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
6567                         BPF_MOV64_IMM(BPF_REG_4, 0),
6568                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6569                         BPF_MOV64_IMM(BPF_REG_3, 0),
6570                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6571                         BPF_MOV64_IMM(BPF_REG_0, 0),
6572                         BPF_EXIT_INSN(),
6573                 },
6574                 .result = ACCEPT,
6575                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6576         },
6577         {
6578                 "helper access to variable memory: stack, JMP (signed), correct bounds",
6579                 .insns = {
6580                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6581                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6582                         BPF_MOV64_IMM(BPF_REG_0, 0),
6583                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6584                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6585                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6586                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6587                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6588                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6589                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6590                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6591                         BPF_MOV64_IMM(BPF_REG_2, 16),
6592                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6593                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6594                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
6595                         BPF_MOV64_IMM(BPF_REG_4, 0),
6596                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6597                         BPF_MOV64_IMM(BPF_REG_3, 0),
6598                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6599                         BPF_MOV64_IMM(BPF_REG_0, 0),
6600                         BPF_EXIT_INSN(),
6601                 },
6602                 .result = ACCEPT,
6603                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6604         },
6605         {
6606                 "helper access to variable memory: stack, JMP, bounds + offset",
6607                 .insns = {
6608                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6609                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6610                         BPF_MOV64_IMM(BPF_REG_2, 16),
6611                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6612                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6613                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
6614                         BPF_MOV64_IMM(BPF_REG_4, 0),
6615                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
6616                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
6617                         BPF_MOV64_IMM(BPF_REG_3, 0),
6618                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6619                         BPF_MOV64_IMM(BPF_REG_0, 0),
6620                         BPF_EXIT_INSN(),
6621                 },
6622                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6623                 .result = REJECT,
6624                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6625         },
6626         {
6627                 "helper access to variable memory: stack, JMP, wrong max",
6628                 .insns = {
6629                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6630                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6631                         BPF_MOV64_IMM(BPF_REG_2, 16),
6632                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6633                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6634                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
6635                         BPF_MOV64_IMM(BPF_REG_4, 0),
6636                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6637                         BPF_MOV64_IMM(BPF_REG_3, 0),
6638                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6639                         BPF_MOV64_IMM(BPF_REG_0, 0),
6640                         BPF_EXIT_INSN(),
6641                 },
6642                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6643                 .result = REJECT,
6644                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6645         },
6646         {
6647                 "helper access to variable memory: stack, JMP, no max check",
6648                 .insns = {
6649                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6650                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6651                         BPF_MOV64_IMM(BPF_REG_2, 16),
6652                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6653                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6654                         BPF_MOV64_IMM(BPF_REG_4, 0),
6655                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6656                         BPF_MOV64_IMM(BPF_REG_3, 0),
6657                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6658                         BPF_MOV64_IMM(BPF_REG_0, 0),
6659                         BPF_EXIT_INSN(),
6660                 },
6661                 /* because max wasn't checked, signed min is negative */
6662                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
6663                 .result = REJECT,
6664                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6665         },
6666         {
6667                 "helper access to variable memory: stack, JMP, no min check",
6668                 .insns = {
6669                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6670                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6671                         BPF_MOV64_IMM(BPF_REG_2, 16),
6672                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6673                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6674                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
6675                         BPF_MOV64_IMM(BPF_REG_3, 0),
6676                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6677                         BPF_MOV64_IMM(BPF_REG_0, 0),
6678                         BPF_EXIT_INSN(),
6679                 },
6680                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6681                 .result = REJECT,
6682                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6683         },
6684         {
6685                 "helper access to variable memory: stack, JMP (signed), no min check",
6686                 .insns = {
6687                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6689                         BPF_MOV64_IMM(BPF_REG_2, 16),
6690                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6691                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6692                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
6693                         BPF_MOV64_IMM(BPF_REG_3, 0),
6694                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6695                         BPF_MOV64_IMM(BPF_REG_0, 0),
6696                         BPF_EXIT_INSN(),
6697                 },
6698                 .errstr = "R2 min value is negative",
6699                 .result = REJECT,
6700                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6701         },
6702         {
6703                 "helper access to variable memory: map, JMP, correct bounds",
6704                 .insns = {
6705                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6706                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6707                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6708                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6709                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6710                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6711                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6712                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6713                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6714                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6715                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6716                                 sizeof(struct test_val), 4),
6717                         BPF_MOV64_IMM(BPF_REG_4, 0),
6718                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6719                         BPF_MOV64_IMM(BPF_REG_3, 0),
6720                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6721                         BPF_MOV64_IMM(BPF_REG_0, 0),
6722                         BPF_EXIT_INSN(),
6723                 },
6724                 .fixup_map2 = { 3 },
6725                 .result = ACCEPT,
6726                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6727         },
6728         {
6729                 "helper access to variable memory: map, JMP, wrong max",
6730                 .insns = {
6731                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6732                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6733                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6734                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6735                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6736                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6737                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6738                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6739                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6740                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6741                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6742                                 sizeof(struct test_val) + 1, 4),
6743                         BPF_MOV64_IMM(BPF_REG_4, 0),
6744                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6745                         BPF_MOV64_IMM(BPF_REG_3, 0),
6746                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6747                         BPF_MOV64_IMM(BPF_REG_0, 0),
6748                         BPF_EXIT_INSN(),
6749                 },
6750                 .fixup_map2 = { 3 },
6751                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
6752                 .result = REJECT,
6753                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6754         },
6755         {
6756                 "helper access to variable memory: map adjusted, JMP, correct bounds",
6757                 .insns = {
6758                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6759                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6760                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6761                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6762                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6763                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6764                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6765                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6766                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6767                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6768                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6769                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6770                                 sizeof(struct test_val) - 20, 4),
6771                         BPF_MOV64_IMM(BPF_REG_4, 0),
6772                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6773                         BPF_MOV64_IMM(BPF_REG_3, 0),
6774                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6775                         BPF_MOV64_IMM(BPF_REG_0, 0),
6776                         BPF_EXIT_INSN(),
6777                 },
6778                 .fixup_map2 = { 3 },
6779                 .result = ACCEPT,
6780                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6781         },
6782         {
6783                 "helper access to variable memory: map adjusted, JMP, wrong max",
6784                 .insns = {
6785                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6787                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6788                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6789                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6790                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6791                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6792                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6793                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6794                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6795                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6796                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6797                                 sizeof(struct test_val) - 19, 4),
6798                         BPF_MOV64_IMM(BPF_REG_4, 0),
6799                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6800                         BPF_MOV64_IMM(BPF_REG_3, 0),
6801                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6802                         BPF_MOV64_IMM(BPF_REG_0, 0),
6803                         BPF_EXIT_INSN(),
6804                 },
6805                 .fixup_map2 = { 3 },
6806                 .errstr = "R1 min value is outside of the array range",
6807                 .result = REJECT,
6808                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6809         },
6810         {
6811                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6812                 .insns = {
6813                         BPF_MOV64_IMM(BPF_REG_1, 0),
6814                         BPF_MOV64_IMM(BPF_REG_2, 0),
6815                         BPF_MOV64_IMM(BPF_REG_3, 0),
6816                         BPF_MOV64_IMM(BPF_REG_4, 0),
6817                         BPF_MOV64_IMM(BPF_REG_5, 0),
6818                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6819                         BPF_EXIT_INSN(),
6820                 },
6821                 .result = ACCEPT,
6822                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6823         },
6824         {
6825                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6826                 .insns = {
6827                         BPF_MOV64_IMM(BPF_REG_1, 0),
6828                         BPF_MOV64_IMM(BPF_REG_2, 1),
6829                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6830                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6831                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6832                         BPF_MOV64_IMM(BPF_REG_3, 0),
6833                         BPF_MOV64_IMM(BPF_REG_4, 0),
6834                         BPF_MOV64_IMM(BPF_REG_5, 0),
6835                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6836                         BPF_EXIT_INSN(),
6837                 },
6838                 .errstr = "R1 type=inv expected=fp",
6839                 .result = REJECT,
6840                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6841         },
6842         {
6843                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6844                 .insns = {
6845                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6846                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6847                         BPF_MOV64_IMM(BPF_REG_2, 0),
6848                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6849                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
6850                         BPF_MOV64_IMM(BPF_REG_3, 0),
6851                         BPF_MOV64_IMM(BPF_REG_4, 0),
6852                         BPF_MOV64_IMM(BPF_REG_5, 0),
6853                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6854                         BPF_EXIT_INSN(),
6855                 },
6856                 .result = ACCEPT,
6857                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6858         },
6859         {
6860                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6861                 .insns = {
6862                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6863                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6864                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6865                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6866                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6867                                      BPF_FUNC_map_lookup_elem),
6868                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6869                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6870                         BPF_MOV64_IMM(BPF_REG_2, 0),
6871                         BPF_MOV64_IMM(BPF_REG_3, 0),
6872                         BPF_MOV64_IMM(BPF_REG_4, 0),
6873                         BPF_MOV64_IMM(BPF_REG_5, 0),
6874                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6875                         BPF_EXIT_INSN(),
6876                 },
6877                 .fixup_map1 = { 3 },
6878                 .result = ACCEPT,
6879                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6880         },
6881         {
6882                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6883                 .insns = {
6884                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6885                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6886                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6887                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6888                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6889                                      BPF_FUNC_map_lookup_elem),
6890                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6891                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6892                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
6893                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6895                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6896                         BPF_MOV64_IMM(BPF_REG_3, 0),
6897                         BPF_MOV64_IMM(BPF_REG_4, 0),
6898                         BPF_MOV64_IMM(BPF_REG_5, 0),
6899                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6900                         BPF_EXIT_INSN(),
6901                 },
6902                 .fixup_map1 = { 3 },
6903                 .result = ACCEPT,
6904                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6905         },
6906         {
6907                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6908                 .insns = {
6909                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6910                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6911                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6912                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6913                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6914                                      BPF_FUNC_map_lookup_elem),
6915                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6916                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6917                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6918                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6919                         BPF_MOV64_IMM(BPF_REG_3, 0),
6920                         BPF_MOV64_IMM(BPF_REG_4, 0),
6921                         BPF_MOV64_IMM(BPF_REG_5, 0),
6922                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6923                         BPF_EXIT_INSN(),
6924                 },
6925                 .fixup_map1 = { 3 },
6926                 .result = ACCEPT,
6927                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6928         },
6929         {
6930                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
6931                 .insns = {
6932                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6933                                     offsetof(struct __sk_buff, data)),
6934                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6935                                     offsetof(struct __sk_buff, data_end)),
6936                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
6937                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6938                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
6939                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
6940                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
6941                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6942                         BPF_MOV64_IMM(BPF_REG_3, 0),
6943                         BPF_MOV64_IMM(BPF_REG_4, 0),
6944                         BPF_MOV64_IMM(BPF_REG_5, 0),
6945                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6946                         BPF_EXIT_INSN(),
6947                 },
6948                 .result = ACCEPT,
6949                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6950                 .retval = 0 /* csum_diff of 64-byte packet */,
6951         },
6952         {
6953                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6954                 .insns = {
6955                         BPF_MOV64_IMM(BPF_REG_1, 0),
6956                         BPF_MOV64_IMM(BPF_REG_2, 0),
6957                         BPF_MOV64_IMM(BPF_REG_3, 0),
6958                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6959                         BPF_EXIT_INSN(),
6960                 },
6961                 .errstr = "R1 type=inv expected=fp",
6962                 .result = REJECT,
6963                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6964         },
6965         {
6966                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6967                 .insns = {
6968                         BPF_MOV64_IMM(BPF_REG_1, 0),
6969                         BPF_MOV64_IMM(BPF_REG_2, 1),
6970                         BPF_MOV64_IMM(BPF_REG_3, 0),
6971                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6972                         BPF_EXIT_INSN(),
6973                 },
6974                 .errstr = "R1 type=inv expected=fp",
6975                 .result = REJECT,
6976                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6977         },
6978         {
6979                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6980                 .insns = {
6981                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6982                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6983                         BPF_MOV64_IMM(BPF_REG_2, 0),
6984                         BPF_MOV64_IMM(BPF_REG_3, 0),
6985                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6986                         BPF_EXIT_INSN(),
6987                 },
6988                 .result = ACCEPT,
6989                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6990         },
6991         {
6992                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6993                 .insns = {
6994                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6995                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6997                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6998                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6999                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7000                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7001                         BPF_MOV64_IMM(BPF_REG_2, 0),
7002                         BPF_MOV64_IMM(BPF_REG_3, 0),
7003                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7004                         BPF_EXIT_INSN(),
7005                 },
7006                 .fixup_map1 = { 3 },
7007                 .result = ACCEPT,
7008                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7009         },
7010         {
7011                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7012                 .insns = {
7013                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7014                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7015                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7016                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7017                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7018                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7019                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7020                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7021                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7023                         BPF_MOV64_IMM(BPF_REG_3, 0),
7024                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7025                         BPF_EXIT_INSN(),
7026                 },
7027                 .fixup_map1 = { 3 },
7028                 .result = ACCEPT,
7029                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7030         },
7031         {
7032                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7033                 .insns = {
7034                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7035                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7036                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7037                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7038                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7039                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7040                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7041                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7042                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
7043                         BPF_MOV64_IMM(BPF_REG_3, 0),
7044                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7045                         BPF_EXIT_INSN(),
7046                 },
7047                 .fixup_map1 = { 3 },
7048                 .result = ACCEPT,
7049                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7050         },
7051         {
7052                 "helper access to variable memory: 8 bytes leak",
7053                 .insns = {
7054                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7055                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7056                         BPF_MOV64_IMM(BPF_REG_0, 0),
7057                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7058                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7059                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7060                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7061                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7062                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7063                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7064                         BPF_MOV64_IMM(BPF_REG_2, 1),
7065                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7066                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7067                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
7068                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7069                         BPF_MOV64_IMM(BPF_REG_3, 0),
7070                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7071                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7072                         BPF_EXIT_INSN(),
7073                 },
7074                 .errstr = "invalid indirect read from stack off -64+32 size 64",
7075                 .result = REJECT,
7076                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7077         },
7078         {
7079                 "helper access to variable memory: 8 bytes no leak (init memory)",
7080                 .insns = {
7081                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7082                         BPF_MOV64_IMM(BPF_REG_0, 0),
7083                         BPF_MOV64_IMM(BPF_REG_0, 0),
7084                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7085                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7086                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7087                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7088                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7089                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7090                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7091                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7092                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7093                         BPF_MOV64_IMM(BPF_REG_2, 0),
7094                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
7095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
7096                         BPF_MOV64_IMM(BPF_REG_3, 0),
7097                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7098                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7099                         BPF_EXIT_INSN(),
7100                 },
7101                 .result = ACCEPT,
7102                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7103         },
7104         {
7105                 "invalid and of negative number",
7106                 .insns = {
7107                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7108                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7109                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7110                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7111                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7112                                      BPF_FUNC_map_lookup_elem),
7113                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7114                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7115                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
7116                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
7117                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7118                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7119                                    offsetof(struct test_val, foo)),
7120                         BPF_EXIT_INSN(),
7121                 },
7122                 .fixup_map2 = { 3 },
7123                 .errstr = "R0 max value is outside of the array range",
7124                 .result = REJECT,
7125                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7126         },
7127         {
7128                 "invalid range check",
7129                 .insns = {
7130                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7131                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7132                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7133                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7134                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7135                                      BPF_FUNC_map_lookup_elem),
7136                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
7137                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7138                         BPF_MOV64_IMM(BPF_REG_9, 1),
7139                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
7140                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
7141                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
7142                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
7143                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
7144                         BPF_MOV32_IMM(BPF_REG_3, 1),
7145                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
7146                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
7147                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
7148                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
7149                         BPF_MOV64_REG(BPF_REG_0, 0),
7150                         BPF_EXIT_INSN(),
7151                 },
7152                 .fixup_map2 = { 3 },
7153                 .errstr = "R0 max value is outside of the array range",
7154                 .result = REJECT,
7155                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7156         },
7157         {
7158                 "map in map access",
7159                 .insns = {
7160                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7161                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7162                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7163                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7164                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7165                                      BPF_FUNC_map_lookup_elem),
7166                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7167                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7168                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7169                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7170                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7171                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7172                                      BPF_FUNC_map_lookup_elem),
7173                         BPF_MOV64_IMM(BPF_REG_0, 0),
7174                         BPF_EXIT_INSN(),
7175                 },
7176                 .fixup_map_in_map = { 3 },
7177                 .result = ACCEPT,
7178         },
7179         {
7180                 "invalid inner map pointer",
7181                 .insns = {
7182                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7183                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7184                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7185                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7186                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7187                                      BPF_FUNC_map_lookup_elem),
7188                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7189                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7190                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7191                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7192                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7193                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7194                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7195                                      BPF_FUNC_map_lookup_elem),
7196                         BPF_MOV64_IMM(BPF_REG_0, 0),
7197                         BPF_EXIT_INSN(),
7198                 },
7199                 .fixup_map_in_map = { 3 },
7200                 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
7201                 .result = REJECT,
7202         },
7203         {
7204                 "forgot null checking on the inner map pointer",
7205                 .insns = {
7206                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7207                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7208                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7209                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7210                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7211                                      BPF_FUNC_map_lookup_elem),
7212                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7213                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7214                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7215                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7216                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7217                                      BPF_FUNC_map_lookup_elem),
7218                         BPF_MOV64_IMM(BPF_REG_0, 0),
7219                         BPF_EXIT_INSN(),
7220                 },
7221                 .fixup_map_in_map = { 3 },
7222                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
7223                 .result = REJECT,
7224         },
7225         {
7226                 "ld_abs: check calling conv, r1",
7227                 .insns = {
7228                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7229                         BPF_MOV64_IMM(BPF_REG_1, 0),
7230                         BPF_LD_ABS(BPF_W, -0x200000),
7231                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7232                         BPF_EXIT_INSN(),
7233                 },
7234                 .errstr = "R1 !read_ok",
7235                 .result = REJECT,
7236         },
7237         {
7238                 "ld_abs: check calling conv, r2",
7239                 .insns = {
7240                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7241                         BPF_MOV64_IMM(BPF_REG_2, 0),
7242                         BPF_LD_ABS(BPF_W, -0x200000),
7243                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7244                         BPF_EXIT_INSN(),
7245                 },
7246                 .errstr = "R2 !read_ok",
7247                 .result = REJECT,
7248         },
7249         {
7250                 "ld_abs: check calling conv, r3",
7251                 .insns = {
7252                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7253                         BPF_MOV64_IMM(BPF_REG_3, 0),
7254                         BPF_LD_ABS(BPF_W, -0x200000),
7255                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7256                         BPF_EXIT_INSN(),
7257                 },
7258                 .errstr = "R3 !read_ok",
7259                 .result = REJECT,
7260         },
7261         {
7262                 "ld_abs: check calling conv, r4",
7263                 .insns = {
7264                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7265                         BPF_MOV64_IMM(BPF_REG_4, 0),
7266                         BPF_LD_ABS(BPF_W, -0x200000),
7267                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7268                         BPF_EXIT_INSN(),
7269                 },
7270                 .errstr = "R4 !read_ok",
7271                 .result = REJECT,
7272         },
7273         {
7274                 "ld_abs: check calling conv, r5",
7275                 .insns = {
7276                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7277                         BPF_MOV64_IMM(BPF_REG_5, 0),
7278                         BPF_LD_ABS(BPF_W, -0x200000),
7279                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7280                         BPF_EXIT_INSN(),
7281                 },
7282                 .errstr = "R5 !read_ok",
7283                 .result = REJECT,
7284         },
7285         {
7286                 "ld_abs: check calling conv, r7",
7287                 .insns = {
7288                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7289                         BPF_MOV64_IMM(BPF_REG_7, 0),
7290                         BPF_LD_ABS(BPF_W, -0x200000),
7291                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7292                         BPF_EXIT_INSN(),
7293                 },
7294                 .result = ACCEPT,
7295         },
7296         {
7297                 "ld_abs: tests on r6 and skb data reload helper",
7298                 .insns = {
7299                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7300                         BPF_LD_ABS(BPF_B, 0),
7301                         BPF_LD_ABS(BPF_H, 0),
7302                         BPF_LD_ABS(BPF_W, 0),
7303                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
7304                         BPF_MOV64_IMM(BPF_REG_6, 0),
7305                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
7306                         BPF_MOV64_IMM(BPF_REG_2, 1),
7307                         BPF_MOV64_IMM(BPF_REG_3, 2),
7308                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7309                                      BPF_FUNC_skb_vlan_push),
7310                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
7311                         BPF_LD_ABS(BPF_B, 0),
7312                         BPF_LD_ABS(BPF_H, 0),
7313                         BPF_LD_ABS(BPF_W, 0),
7314                         BPF_MOV64_IMM(BPF_REG_0, 42),
7315                         BPF_EXIT_INSN(),
7316                 },
7317                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7318                 .result = ACCEPT,
7319                 .retval = 42 /* ultimate return value */,
7320         },
7321         {
7322                 "ld_ind: check calling conv, r1",
7323                 .insns = {
7324                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7325                         BPF_MOV64_IMM(BPF_REG_1, 1),
7326                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
7327                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7328                         BPF_EXIT_INSN(),
7329                 },
7330                 .errstr = "R1 !read_ok",
7331                 .result = REJECT,
7332         },
7333         {
7334                 "ld_ind: check calling conv, r2",
7335                 .insns = {
7336                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7337                         BPF_MOV64_IMM(BPF_REG_2, 1),
7338                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
7339                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7340                         BPF_EXIT_INSN(),
7341                 },
7342                 .errstr = "R2 !read_ok",
7343                 .result = REJECT,
7344         },
7345         {
7346                 "ld_ind: check calling conv, r3",
7347                 .insns = {
7348                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7349                         BPF_MOV64_IMM(BPF_REG_3, 1),
7350                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
7351                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7352                         BPF_EXIT_INSN(),
7353                 },
7354                 .errstr = "R3 !read_ok",
7355                 .result = REJECT,
7356         },
7357         {
7358                 "ld_ind: check calling conv, r4",
7359                 .insns = {
7360                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7361                         BPF_MOV64_IMM(BPF_REG_4, 1),
7362                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
7363                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7364                         BPF_EXIT_INSN(),
7365                 },
7366                 .errstr = "R4 !read_ok",
7367                 .result = REJECT,
7368         },
7369         {
7370                 "ld_ind: check calling conv, r5",
7371                 .insns = {
7372                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7373                         BPF_MOV64_IMM(BPF_REG_5, 1),
7374                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
7375                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7376                         BPF_EXIT_INSN(),
7377                 },
7378                 .errstr = "R5 !read_ok",
7379                 .result = REJECT,
7380         },
7381         {
7382                 "ld_ind: check calling conv, r7",
7383                 .insns = {
7384                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7385                         BPF_MOV64_IMM(BPF_REG_7, 1),
7386                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
7387                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7388                         BPF_EXIT_INSN(),
7389                 },
7390                 .result = ACCEPT,
7391                 .retval = 1,
7392         },
7393         {
7394                 "check bpf_perf_event_data->sample_period byte load permitted",
7395                 .insns = {
7396                         BPF_MOV64_IMM(BPF_REG_0, 0),
7397 #if __BYTE_ORDER == __LITTLE_ENDIAN
7398                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7399                                     offsetof(struct bpf_perf_event_data, sample_period)),
7400 #else
7401                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7402                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
7403 #endif
7404                         BPF_EXIT_INSN(),
7405                 },
7406                 .result = ACCEPT,
7407                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7408         },
7409         {
7410                 "check bpf_perf_event_data->sample_period half load permitted",
7411                 .insns = {
7412                         BPF_MOV64_IMM(BPF_REG_0, 0),
7413 #if __BYTE_ORDER == __LITTLE_ENDIAN
7414                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7415                                     offsetof(struct bpf_perf_event_data, sample_period)),
7416 #else
7417                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7418                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
7419 #endif
7420                         BPF_EXIT_INSN(),
7421                 },
7422                 .result = ACCEPT,
7423                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7424         },
7425         {
7426                 "check bpf_perf_event_data->sample_period word load permitted",
7427                 .insns = {
7428                         BPF_MOV64_IMM(BPF_REG_0, 0),
7429 #if __BYTE_ORDER == __LITTLE_ENDIAN
7430                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7431                                     offsetof(struct bpf_perf_event_data, sample_period)),
7432 #else
7433                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7434                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
7435 #endif
7436                         BPF_EXIT_INSN(),
7437                 },
7438                 .result = ACCEPT,
7439                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7440         },
7441         {
7442                 "check bpf_perf_event_data->sample_period dword load permitted",
7443                 .insns = {
7444                         BPF_MOV64_IMM(BPF_REG_0, 0),
7445                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
7446                                     offsetof(struct bpf_perf_event_data, sample_period)),
7447                         BPF_EXIT_INSN(),
7448                 },
7449                 .result = ACCEPT,
7450                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7451         },
7452         {
7453                 "check skb->data half load not permitted",
7454                 .insns = {
7455                         BPF_MOV64_IMM(BPF_REG_0, 0),
7456 #if __BYTE_ORDER == __LITTLE_ENDIAN
7457                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7458                                     offsetof(struct __sk_buff, data)),
7459 #else
7460                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7461                                     offsetof(struct __sk_buff, data) + 2),
7462 #endif
7463                         BPF_EXIT_INSN(),
7464                 },
7465                 .result = REJECT,
7466                 .errstr = "invalid bpf_context access",
7467         },
7468         {
7469                 "check skb->tc_classid half load not permitted for lwt prog",
7470                 .insns = {
7471                         BPF_MOV64_IMM(BPF_REG_0, 0),
7472 #if __BYTE_ORDER == __LITTLE_ENDIAN
7473                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7474                                     offsetof(struct __sk_buff, tc_classid)),
7475 #else
7476                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7477                                     offsetof(struct __sk_buff, tc_classid) + 2),
7478 #endif
7479                         BPF_EXIT_INSN(),
7480                 },
7481                 .result = REJECT,
7482                 .errstr = "invalid bpf_context access",
7483                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7484         },
7485         {
7486                 "bounds checks mixing signed and unsigned, positive bounds",
7487                 .insns = {
7488                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7489                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7490                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7491                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7492                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7493                                      BPF_FUNC_map_lookup_elem),
7494                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7495                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7496                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7497                         BPF_MOV64_IMM(BPF_REG_2, 2),
7498                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
7499                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
7500                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7501                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7502                         BPF_MOV64_IMM(BPF_REG_0, 0),
7503                         BPF_EXIT_INSN(),
7504                 },
7505                 .fixup_map1 = { 3 },
7506                 .errstr = "unbounded min value",
7507                 .result = REJECT,
7508         },
7509         {
7510                 "bounds checks mixing signed and unsigned",
7511                 .insns = {
7512                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7513                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7514                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7515                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7516                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7517                                      BPF_FUNC_map_lookup_elem),
7518                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7519                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7520                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7521                         BPF_MOV64_IMM(BPF_REG_2, -1),
7522                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7523                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7524                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7525                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7526                         BPF_MOV64_IMM(BPF_REG_0, 0),
7527                         BPF_EXIT_INSN(),
7528                 },
7529                 .fixup_map1 = { 3 },
7530                 .errstr = "unbounded min value",
7531                 .result = REJECT,
7532         },
7533         {
7534                 "bounds checks mixing signed and unsigned, variant 2",
7535                 .insns = {
7536                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7537                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7538                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7539                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7540                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7541                                      BPF_FUNC_map_lookup_elem),
7542                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7543                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7544                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7545                         BPF_MOV64_IMM(BPF_REG_2, -1),
7546                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7547                         BPF_MOV64_IMM(BPF_REG_8, 0),
7548                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
7549                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7550                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7551                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7552                         BPF_MOV64_IMM(BPF_REG_0, 0),
7553                         BPF_EXIT_INSN(),
7554                 },
7555                 .fixup_map1 = { 3 },
7556                 .errstr = "unbounded min value",
7557                 .result = REJECT,
7558         },
7559         {
7560                 "bounds checks mixing signed and unsigned, variant 3",
7561                 .insns = {
7562                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7563                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7564                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7565                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7566                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7567                                      BPF_FUNC_map_lookup_elem),
7568                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7569                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7570                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7571                         BPF_MOV64_IMM(BPF_REG_2, -1),
7572                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
7573                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
7574                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7575                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7576                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7577                         BPF_MOV64_IMM(BPF_REG_0, 0),
7578                         BPF_EXIT_INSN(),
7579                 },
7580                 .fixup_map1 = { 3 },
7581                 .errstr = "unbounded min value",
7582                 .result = REJECT,
7583         },
7584         {
7585                 "bounds checks mixing signed and unsigned, variant 4",
7586                 .insns = {
7587                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7588                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7590                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7591                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7592                                      BPF_FUNC_map_lookup_elem),
7593                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7594                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7595                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7596                         BPF_MOV64_IMM(BPF_REG_2, 1),
7597                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
7598                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7599                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7600                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7601                         BPF_MOV64_IMM(BPF_REG_0, 0),
7602                         BPF_EXIT_INSN(),
7603                 },
7604                 .fixup_map1 = { 3 },
7605                 .result = ACCEPT,
7606         },
7607         {
7608                 "bounds checks mixing signed and unsigned, variant 5",
7609                 .insns = {
7610                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7611                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7612                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7613                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7614                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7615                                      BPF_FUNC_map_lookup_elem),
7616                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7617                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7618                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7619                         BPF_MOV64_IMM(BPF_REG_2, -1),
7620                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7621                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
7622                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
7623                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7624                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7625                         BPF_MOV64_IMM(BPF_REG_0, 0),
7626                         BPF_EXIT_INSN(),
7627                 },
7628                 .fixup_map1 = { 3 },
7629                 .errstr = "unbounded min value",
7630                 .result = REJECT,
7631         },
7632         {
7633                 "bounds checks mixing signed and unsigned, variant 6",
7634                 .insns = {
7635                         BPF_MOV64_IMM(BPF_REG_2, 0),
7636                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
7637                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
7638                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7639                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
7640                         BPF_MOV64_IMM(BPF_REG_6, -1),
7641                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
7642                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
7643                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
7644                         BPF_MOV64_IMM(BPF_REG_5, 0),
7645                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
7646                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7647                                      BPF_FUNC_skb_load_bytes),
7648                         BPF_MOV64_IMM(BPF_REG_0, 0),
7649                         BPF_EXIT_INSN(),
7650                 },
7651                 .errstr = "R4 min value is negative, either use unsigned",
7652                 .result = REJECT,
7653         },
7654         {
7655                 "bounds checks mixing signed and unsigned, variant 7",
7656                 .insns = {
7657                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7658                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7660                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7661                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7662                                      BPF_FUNC_map_lookup_elem),
7663                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7664                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7665                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7666                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
7667                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7668                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7669                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7670                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7671                         BPF_MOV64_IMM(BPF_REG_0, 0),
7672                         BPF_EXIT_INSN(),
7673                 },
7674                 .fixup_map1 = { 3 },
7675                 .result = ACCEPT,
7676         },
7677         {
7678                 "bounds checks mixing signed and unsigned, variant 8",
7679                 .insns = {
7680                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7681                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7682                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7683                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7684                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7685                                      BPF_FUNC_map_lookup_elem),
7686                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7687                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7688                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7689                         BPF_MOV64_IMM(BPF_REG_2, -1),
7690                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7691                         BPF_MOV64_IMM(BPF_REG_0, 0),
7692                         BPF_EXIT_INSN(),
7693                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7694                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7695                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7696                         BPF_MOV64_IMM(BPF_REG_0, 0),
7697                         BPF_EXIT_INSN(),
7698                 },
7699                 .fixup_map1 = { 3 },
7700                 .errstr = "unbounded min value",
7701                 .result = REJECT,
7702         },
7703         {
7704                 "bounds checks mixing signed and unsigned, variant 9",
7705                 .insns = {
7706                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7707                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7709                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7710                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7711                                      BPF_FUNC_map_lookup_elem),
7712                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7713                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7714                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7715                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
7716                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7717                         BPF_MOV64_IMM(BPF_REG_0, 0),
7718                         BPF_EXIT_INSN(),
7719                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7720                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7721                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7722                         BPF_MOV64_IMM(BPF_REG_0, 0),
7723                         BPF_EXIT_INSN(),
7724                 },
7725                 .fixup_map1 = { 3 },
7726                 .result = ACCEPT,
7727         },
7728         {
7729                 "bounds checks mixing signed and unsigned, variant 10",
7730                 .insns = {
7731                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7732                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7733                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7734                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7735                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7736                                      BPF_FUNC_map_lookup_elem),
7737                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7738                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7739                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7740                         BPF_MOV64_IMM(BPF_REG_2, 0),
7741                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7742                         BPF_MOV64_IMM(BPF_REG_0, 0),
7743                         BPF_EXIT_INSN(),
7744                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7745                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7746                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7747                         BPF_MOV64_IMM(BPF_REG_0, 0),
7748                         BPF_EXIT_INSN(),
7749                 },
7750                 .fixup_map1 = { 3 },
7751                 .errstr = "unbounded min value",
7752                 .result = REJECT,
7753         },
7754         {
7755                 "bounds checks mixing signed and unsigned, variant 11",
7756                 .insns = {
7757                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7758                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7759                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7760                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7761                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7762                                      BPF_FUNC_map_lookup_elem),
7763                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7764                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7765                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7766                         BPF_MOV64_IMM(BPF_REG_2, -1),
7767                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7768                         /* Dead branch. */
7769                         BPF_MOV64_IMM(BPF_REG_0, 0),
7770                         BPF_EXIT_INSN(),
7771                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7772                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7773                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7774                         BPF_MOV64_IMM(BPF_REG_0, 0),
7775                         BPF_EXIT_INSN(),
7776                 },
7777                 .fixup_map1 = { 3 },
7778                 .errstr = "unbounded min value",
7779                 .result = REJECT,
7780         },
7781         {
7782                 "bounds checks mixing signed and unsigned, variant 12",
7783                 .insns = {
7784                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7785                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7787                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7788                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7789                                      BPF_FUNC_map_lookup_elem),
7790                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7791                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7792                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7793                         BPF_MOV64_IMM(BPF_REG_2, -6),
7794                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7795                         BPF_MOV64_IMM(BPF_REG_0, 0),
7796                         BPF_EXIT_INSN(),
7797                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7798                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7799                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7800                         BPF_MOV64_IMM(BPF_REG_0, 0),
7801                         BPF_EXIT_INSN(),
7802                 },
7803                 .fixup_map1 = { 3 },
7804                 .errstr = "unbounded min value",
7805                 .result = REJECT,
7806         },
7807         {
7808                 "bounds checks mixing signed and unsigned, variant 13",
7809                 .insns = {
7810                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7811                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7812                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7813                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7814                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7815                                      BPF_FUNC_map_lookup_elem),
7816                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7817                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7818                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7819                         BPF_MOV64_IMM(BPF_REG_2, 2),
7820                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7821                         BPF_MOV64_IMM(BPF_REG_7, 1),
7822                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
7823                         BPF_MOV64_IMM(BPF_REG_0, 0),
7824                         BPF_EXIT_INSN(),
7825                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
7826                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
7827                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
7828                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7829                         BPF_MOV64_IMM(BPF_REG_0, 0),
7830                         BPF_EXIT_INSN(),
7831                 },
7832                 .fixup_map1 = { 3 },
7833                 .errstr = "unbounded min value",
7834                 .result = REJECT,
7835         },
7836         {
7837                 "bounds checks mixing signed and unsigned, variant 14",
7838                 .insns = {
7839                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
7840                                     offsetof(struct __sk_buff, mark)),
7841                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7842                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7843                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7844                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7845                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7846                                      BPF_FUNC_map_lookup_elem),
7847                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7848                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7849                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7850                         BPF_MOV64_IMM(BPF_REG_2, -1),
7851                         BPF_MOV64_IMM(BPF_REG_8, 2),
7852                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
7853                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
7854                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7855                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7856                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7857                         BPF_MOV64_IMM(BPF_REG_0, 0),
7858                         BPF_EXIT_INSN(),
7859                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
7860                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
7861                 },
7862                 .fixup_map1 = { 4 },
7863                 .errstr = "unbounded min value",
7864                 .result = REJECT,
7865         },
7866         {
7867                 "bounds checks mixing signed and unsigned, variant 15",
7868                 .insns = {
7869                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7870                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7871                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7872                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7873                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7874                                      BPF_FUNC_map_lookup_elem),
7875                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7876                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7877                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7878                         BPF_MOV64_IMM(BPF_REG_2, -6),
7879                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7880                         BPF_MOV64_IMM(BPF_REG_0, 0),
7881                         BPF_EXIT_INSN(),
7882                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7883                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
7884                         BPF_MOV64_IMM(BPF_REG_0, 0),
7885                         BPF_EXIT_INSN(),
7886                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7887                         BPF_MOV64_IMM(BPF_REG_0, 0),
7888                         BPF_EXIT_INSN(),
7889                 },
7890                 .fixup_map1 = { 3 },
7891                 .errstr = "unbounded min value",
7892                 .result = REJECT,
7893                 .result_unpriv = REJECT,
7894         },
7895         {
7896                 "subtraction bounds (map value) variant 1",
7897                 .insns = {
7898                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7899                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7900                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7901                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7902                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7903                                      BPF_FUNC_map_lookup_elem),
7904                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7905                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7906                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
7907                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7908                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
7909                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7910                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
7911                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7912                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7913                         BPF_EXIT_INSN(),
7914                         BPF_MOV64_IMM(BPF_REG_0, 0),
7915                         BPF_EXIT_INSN(),
7916                 },
7917                 .fixup_map1 = { 3 },
7918                 .errstr = "R0 max value is outside of the array range",
7919                 .result = REJECT,
7920         },
7921         {
7922                 "subtraction bounds (map value) variant 2",
7923                 .insns = {
7924                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7925                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7926                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7927                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7928                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7929                                      BPF_FUNC_map_lookup_elem),
7930                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7931                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7932                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
7933                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7934                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
7935                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7936                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7937                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7938                         BPF_EXIT_INSN(),
7939                         BPF_MOV64_IMM(BPF_REG_0, 0),
7940                         BPF_EXIT_INSN(),
7941                 },
7942                 .fixup_map1 = { 3 },
7943                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
7944                 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
7945                 .result = REJECT,
7946         },
7947         {
7948                 "bounds check based on zero-extended MOV",
7949                 .insns = {
7950                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7951                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7953                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7954                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7955                                      BPF_FUNC_map_lookup_elem),
7956                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7957                         /* r2 = 0x0000'0000'ffff'ffff */
7958                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
7959                         /* r2 = 0 */
7960                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7961                         /* no-op */
7962                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7963                         /* access at offset 0 */
7964                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7965                         /* exit */
7966                         BPF_MOV64_IMM(BPF_REG_0, 0),
7967                         BPF_EXIT_INSN(),
7968                 },
7969                 .fixup_map1 = { 3 },
7970                 .result = ACCEPT
7971         },
7972         {
7973                 "bounds check based on sign-extended MOV. test1",
7974                 .insns = {
7975                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7976                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7978                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7979                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7980                                      BPF_FUNC_map_lookup_elem),
7981                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7982                         /* r2 = 0xffff'ffff'ffff'ffff */
7983                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7984                         /* r2 = 0xffff'ffff */
7985                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7986                         /* r0 = <oob pointer> */
7987                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7988                         /* access to OOB pointer */
7989                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7990                         /* exit */
7991                         BPF_MOV64_IMM(BPF_REG_0, 0),
7992                         BPF_EXIT_INSN(),
7993                 },
7994                 .fixup_map1 = { 3 },
7995                 .errstr = "map_value pointer and 4294967295",
7996                 .result = REJECT
7997         },
7998         {
7999                 "bounds check based on sign-extended MOV. test2",
8000                 .insns = {
8001                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8002                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8003                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8004                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8005                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8006                                      BPF_FUNC_map_lookup_elem),
8007                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8008                         /* r2 = 0xffff'ffff'ffff'ffff */
8009                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
8010                         /* r2 = 0xfff'ffff */
8011                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
8012                         /* r0 = <oob pointer> */
8013                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8014                         /* access to OOB pointer */
8015                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8016                         /* exit */
8017                         BPF_MOV64_IMM(BPF_REG_0, 0),
8018                         BPF_EXIT_INSN(),
8019                 },
8020                 .fixup_map1 = { 3 },
8021                 .errstr = "R0 min value is outside of the array range",
8022                 .result = REJECT
8023         },
8024         {
8025                 "bounds check based on reg_off + var_off + insn_off. test1",
8026                 .insns = {
8027                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8028                                     offsetof(struct __sk_buff, mark)),
8029                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8032                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8033                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8034                                      BPF_FUNC_map_lookup_elem),
8035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8036                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8037                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
8038                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8039                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8040                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8041                         BPF_MOV64_IMM(BPF_REG_0, 0),
8042                         BPF_EXIT_INSN(),
8043                 },
8044                 .fixup_map1 = { 4 },
8045                 .errstr = "value_size=8 off=1073741825",
8046                 .result = REJECT,
8047                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8048         },
8049         {
8050                 "bounds check based on reg_off + var_off + insn_off. test2",
8051                 .insns = {
8052                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8053                                     offsetof(struct __sk_buff, mark)),
8054                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8055                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8057                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8058                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8059                                      BPF_FUNC_map_lookup_elem),
8060                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8061                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8062                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
8063                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8064                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8065                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8066                         BPF_MOV64_IMM(BPF_REG_0, 0),
8067                         BPF_EXIT_INSN(),
8068                 },
8069                 .fixup_map1 = { 4 },
8070                 .errstr = "value 1073741823",
8071                 .result = REJECT,
8072                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8073         },
8074         {
8075                 "bounds check after truncation of non-boundary-crossing range",
8076                 .insns = {
8077                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8078                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8080                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8081                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8082                                      BPF_FUNC_map_lookup_elem),
8083                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8084                         /* r1 = [0x00, 0xff] */
8085                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8086                         BPF_MOV64_IMM(BPF_REG_2, 1),
8087                         /* r2 = 0x10'0000'0000 */
8088                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
8089                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
8090                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8091                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
8092                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8093                         /* r1 = [0x00, 0xff] */
8094                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
8095                         /* r1 = 0 */
8096                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8097                         /* no-op */
8098                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8099                         /* access at offset 0 */
8100                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8101                         /* exit */
8102                         BPF_MOV64_IMM(BPF_REG_0, 0),
8103                         BPF_EXIT_INSN(),
8104                 },
8105                 .fixup_map1 = { 3 },
8106                 .result = ACCEPT
8107         },
8108         {
8109                 "bounds check after truncation of boundary-crossing range (1)",
8110                 .insns = {
8111                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8112                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8113                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8114                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8115                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8116                                      BPF_FUNC_map_lookup_elem),
8117                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8118                         /* r1 = [0x00, 0xff] */
8119                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8120                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8121                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8122                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8123                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8124                          *      [0x0000'0000, 0x0000'007f]
8125                          */
8126                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
8127                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8128                         /* r1 = [0x00, 0xff] or
8129                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8130                          */
8131                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8132                         /* r1 = 0 or
8133                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8134                          */
8135                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8136                         /* no-op or OOB pointer computation */
8137                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8138                         /* potentially OOB access */
8139                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8140                         /* exit */
8141                         BPF_MOV64_IMM(BPF_REG_0, 0),
8142                         BPF_EXIT_INSN(),
8143                 },
8144                 .fixup_map1 = { 3 },
8145                 /* not actually fully unbounded, but the bound is very high */
8146                 .errstr = "R0 unbounded memory access",
8147                 .result = REJECT
8148         },
8149         {
8150                 "bounds check after truncation of boundary-crossing range (2)",
8151                 .insns = {
8152                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8153                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8154                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8155                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8156                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8157                                      BPF_FUNC_map_lookup_elem),
8158                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8159                         /* r1 = [0x00, 0xff] */
8160                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8162                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8163                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8164                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8165                          *      [0x0000'0000, 0x0000'007f]
8166                          * difference to previous test: truncation via MOV32
8167                          * instead of ALU32.
8168                          */
8169                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
8170                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8171                         /* r1 = [0x00, 0xff] or
8172                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8173                          */
8174                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8175                         /* r1 = 0 or
8176                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8177                          */
8178                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8179                         /* no-op or OOB pointer computation */
8180                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8181                         /* potentially OOB access */
8182                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8183                         /* exit */
8184                         BPF_MOV64_IMM(BPF_REG_0, 0),
8185                         BPF_EXIT_INSN(),
8186                 },
8187                 .fixup_map1 = { 3 },
8188                 /* not actually fully unbounded, but the bound is very high */
8189                 .errstr = "R0 unbounded memory access",
8190                 .result = REJECT
8191         },
8192         {
8193                 "bounds check after wrapping 32-bit addition",
8194                 .insns = {
8195                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8196                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8198                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8199                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8200                                      BPF_FUNC_map_lookup_elem),
8201                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
8202                         /* r1 = 0x7fff'ffff */
8203                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
8204                         /* r1 = 0xffff'fffe */
8205                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8206                         /* r1 = 0 */
8207                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
8208                         /* no-op */
8209                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8210                         /* access at offset 0 */
8211                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8212                         /* exit */
8213                         BPF_MOV64_IMM(BPF_REG_0, 0),
8214                         BPF_EXIT_INSN(),
8215                 },
8216                 .fixup_map1 = { 3 },
8217                 .result = ACCEPT
8218         },
8219         {
8220                 "bounds check after shift with oversized count operand",
8221                 .insns = {
8222                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8223                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8224                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8225                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8226                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8227                                      BPF_FUNC_map_lookup_elem),
8228                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8229                         BPF_MOV64_IMM(BPF_REG_2, 32),
8230                         BPF_MOV64_IMM(BPF_REG_1, 1),
8231                         /* r1 = (u32)1 << (u32)32 = ? */
8232                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
8233                         /* r1 = [0x0000, 0xffff] */
8234                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
8235                         /* computes unknown pointer, potentially OOB */
8236                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8237                         /* potentially OOB access */
8238                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8239                         /* exit */
8240                         BPF_MOV64_IMM(BPF_REG_0, 0),
8241                         BPF_EXIT_INSN(),
8242                 },
8243                 .fixup_map1 = { 3 },
8244                 .errstr = "R0 max value is outside of the array range",
8245                 .result = REJECT
8246         },
8247         {
8248                 "bounds check after right shift of maybe-negative number",
8249                 .insns = {
8250                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8251                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8253                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8254                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8255                                      BPF_FUNC_map_lookup_elem),
8256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8257                         /* r1 = [0x00, 0xff] */
8258                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8259                         /* r1 = [-0x01, 0xfe] */
8260                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
8261                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
8262                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8263                         /* r1 = 0 or 0xffff'ffff'ffff */
8264                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8265                         /* computes unknown pointer, potentially OOB */
8266                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8267                         /* potentially OOB access */
8268                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8269                         /* exit */
8270                         BPF_MOV64_IMM(BPF_REG_0, 0),
8271                         BPF_EXIT_INSN(),
8272                 },
8273                 .fixup_map1 = { 3 },
8274                 .errstr = "R0 unbounded memory access",
8275                 .result = REJECT
8276         },
8277         {
8278                 "bounds check map access with off+size signed 32bit overflow. test1",
8279                 .insns = {
8280                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8281                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8282                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8283                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8284                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8285                                      BPF_FUNC_map_lookup_elem),
8286                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8287                         BPF_EXIT_INSN(),
8288                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
8289                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8290                         BPF_JMP_A(0),
8291                         BPF_EXIT_INSN(),
8292                 },
8293                 .fixup_map1 = { 3 },
8294                 .errstr = "map_value pointer and 2147483646",
8295                 .result = REJECT
8296         },
8297         {
8298                 "bounds check map access with off+size signed 32bit overflow. test2",
8299                 .insns = {
8300                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8301                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8302                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8303                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8304                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8305                                      BPF_FUNC_map_lookup_elem),
8306                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8307                         BPF_EXIT_INSN(),
8308                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8309                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8310                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8311                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8312                         BPF_JMP_A(0),
8313                         BPF_EXIT_INSN(),
8314                 },
8315                 .fixup_map1 = { 3 },
8316                 .errstr = "pointer offset 1073741822",
8317                 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
8318                 .result = REJECT
8319         },
8320         {
8321                 "bounds check map access with off+size signed 32bit overflow. test3",
8322                 .insns = {
8323                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8324                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8325                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8326                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8327                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8328                                      BPF_FUNC_map_lookup_elem),
8329                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8330                         BPF_EXIT_INSN(),
8331                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8332                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8333                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8334                         BPF_JMP_A(0),
8335                         BPF_EXIT_INSN(),
8336                 },
8337                 .fixup_map1 = { 3 },
8338                 .errstr = "pointer offset -1073741822",
8339                 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
8340                 .result = REJECT
8341         },
8342         {
8343                 "bounds check map access with off+size signed 32bit overflow. test4",
8344                 .insns = {
8345                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8346                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8348                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8349                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8350                                      BPF_FUNC_map_lookup_elem),
8351                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8352                         BPF_EXIT_INSN(),
8353                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
8354                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
8355                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8356                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8357                         BPF_JMP_A(0),
8358                         BPF_EXIT_INSN(),
8359                 },
8360                 .fixup_map1 = { 3 },
8361                 .errstr = "map_value pointer and 1000000000000",
8362                 .result = REJECT
8363         },
8364         {
8365                 "pointer/scalar confusion in state equality check (way 1)",
8366                 .insns = {
8367                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8368                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8369                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8370                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8371                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8372                                      BPF_FUNC_map_lookup_elem),
8373                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
8374                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8375                         BPF_JMP_A(1),
8376                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8377                         BPF_JMP_A(0),
8378                         BPF_EXIT_INSN(),
8379                 },
8380                 .fixup_map1 = { 3 },
8381                 .result = ACCEPT,
8382                 .retval = POINTER_VALUE,
8383                 .result_unpriv = REJECT,
8384                 .errstr_unpriv = "R0 leaks addr as return value"
8385         },
8386         {
8387                 "pointer/scalar confusion in state equality check (way 2)",
8388                 .insns = {
8389                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8390                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8392                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8393                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8394                                      BPF_FUNC_map_lookup_elem),
8395                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
8396                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8397                         BPF_JMP_A(1),
8398                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8399                         BPF_EXIT_INSN(),
8400                 },
8401                 .fixup_map1 = { 3 },
8402                 .result = ACCEPT,
8403                 .retval = POINTER_VALUE,
8404                 .result_unpriv = REJECT,
8405                 .errstr_unpriv = "R0 leaks addr as return value"
8406         },
8407         {
8408                 "variable-offset ctx access",
8409                 .insns = {
8410                         /* Get an unknown value */
8411                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8412                         /* Make it small and 4-byte aligned */
8413                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8414                         /* add it to skb.  We now have either &skb->len or
8415                          * &skb->pkt_type, but we don't know which
8416                          */
8417                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8418                         /* dereference it */
8419                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
8420                         BPF_EXIT_INSN(),
8421                 },
8422                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
8423                 .result = REJECT,
8424                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8425         },
8426         {
8427                 "variable-offset stack access",
8428                 .insns = {
8429                         /* Fill the top 8 bytes of the stack */
8430                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8431                         /* Get an unknown value */
8432                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8433                         /* Make it small and 4-byte aligned */
8434                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8435                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8436                         /* add it to fp.  We now have either fp-4 or fp-8, but
8437                          * we don't know which
8438                          */
8439                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8440                         /* dereference it */
8441                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
8442                         BPF_EXIT_INSN(),
8443                 },
8444                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
8445                 .result = REJECT,
8446                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8447         },
8448         {
8449                 "indirect variable-offset stack access",
8450                 .insns = {
8451                         /* Fill the top 8 bytes of the stack */
8452                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8453                         /* Get an unknown value */
8454                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8455                         /* Make it small and 4-byte aligned */
8456                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8457                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8458                         /* add it to fp.  We now have either fp-4 or fp-8, but
8459                          * we don't know which
8460                          */
8461                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8462                         /* dereference it indirectly */
8463                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8464                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8465                                      BPF_FUNC_map_lookup_elem),
8466                         BPF_MOV64_IMM(BPF_REG_0, 0),
8467                         BPF_EXIT_INSN(),
8468                 },
8469                 .fixup_map1 = { 5 },
8470                 .errstr = "variable stack read R2",
8471                 .result = REJECT,
8472                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8473         },
8474         {
8475                 "direct stack access with 32-bit wraparound. test1",
8476                 .insns = {
8477                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8480                         BPF_MOV32_IMM(BPF_REG_0, 0),
8481                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8482                         BPF_EXIT_INSN()
8483                 },
8484                 .errstr = "fp pointer and 2147483647",
8485                 .result = REJECT
8486         },
8487         {
8488                 "direct stack access with 32-bit wraparound. test2",
8489                 .insns = {
8490                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8491                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8492                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8493                         BPF_MOV32_IMM(BPF_REG_0, 0),
8494                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8495                         BPF_EXIT_INSN()
8496                 },
8497                 .errstr = "fp pointer and 1073741823",
8498                 .result = REJECT
8499         },
8500         {
8501                 "direct stack access with 32-bit wraparound. test3",
8502                 .insns = {
8503                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8504                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8505                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8506                         BPF_MOV32_IMM(BPF_REG_0, 0),
8507                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8508                         BPF_EXIT_INSN()
8509                 },
8510                 .errstr = "fp pointer offset 1073741822",
8511                 .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
8512                 .result = REJECT
8513         },
8514         {
8515                 "liveness pruning and write screening",
8516                 .insns = {
8517                         /* Get an unknown value */
8518                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8519                         /* branch conditions teach us nothing about R2 */
8520                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8521                         BPF_MOV64_IMM(BPF_REG_0, 0),
8522                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8523                         BPF_MOV64_IMM(BPF_REG_0, 0),
8524                         BPF_EXIT_INSN(),
8525                 },
8526                 .errstr = "R0 !read_ok",
8527                 .result = REJECT,
8528                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8529         },
8530         {
8531                 "varlen_map_value_access pruning",
8532                 .insns = {
8533                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8534                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8536                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8537                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8538                                      BPF_FUNC_map_lookup_elem),
8539                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8540                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
8541                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
8542                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
8543                         BPF_MOV32_IMM(BPF_REG_1, 0),
8544                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
8545                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8546                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
8547                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
8548                                    offsetof(struct test_val, foo)),
8549                         BPF_EXIT_INSN(),
8550                 },
8551                 .fixup_map2 = { 3 },
8552                 .errstr_unpriv = "R0 leaks addr",
8553                 .errstr = "R0 unbounded memory access",
8554                 .result_unpriv = REJECT,
8555                 .result = REJECT,
8556                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8557         },
8558         {
8559                 "invalid 64-bit BPF_END",
8560                 .insns = {
8561                         BPF_MOV32_IMM(BPF_REG_0, 0),
8562                         {
8563                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
8564                                 .dst_reg = BPF_REG_0,
8565                                 .src_reg = 0,
8566                                 .off   = 0,
8567                                 .imm   = 32,
8568                         },
8569                         BPF_EXIT_INSN(),
8570                 },
8571                 .errstr = "unknown opcode d7",
8572                 .result = REJECT,
8573         },
8574         {
8575                 "XDP, using ifindex from netdev",
8576                 .insns = {
8577                         BPF_MOV64_IMM(BPF_REG_0, 0),
8578                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8579                                     offsetof(struct xdp_md, ingress_ifindex)),
8580                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
8581                         BPF_MOV64_IMM(BPF_REG_0, 1),
8582                         BPF_EXIT_INSN(),
8583                 },
8584                 .result = ACCEPT,
8585                 .prog_type = BPF_PROG_TYPE_XDP,
8586                 .retval = 1,
8587         },
8588         {
8589                 "meta access, test1",
8590                 .insns = {
8591                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8592                                     offsetof(struct xdp_md, data_meta)),
8593                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8594                                     offsetof(struct xdp_md, data)),
8595                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8596                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8597                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8598                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8599                         BPF_MOV64_IMM(BPF_REG_0, 0),
8600                         BPF_EXIT_INSN(),
8601                 },
8602                 .result = ACCEPT,
8603                 .prog_type = BPF_PROG_TYPE_XDP,
8604         },
8605         {
8606                 "meta access, test2",
8607                 .insns = {
8608                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8609                                     offsetof(struct xdp_md, data_meta)),
8610                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8611                                     offsetof(struct xdp_md, data)),
8612                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8613                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
8614                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8615                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8616                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8617                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8618                         BPF_MOV64_IMM(BPF_REG_0, 0),
8619                         BPF_EXIT_INSN(),
8620                 },
8621                 .result = REJECT,
8622                 .errstr = "invalid access to packet, off=-8",
8623                 .prog_type = BPF_PROG_TYPE_XDP,
8624         },
8625         {
8626                 "meta access, test3",
8627                 .insns = {
8628                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8629                                     offsetof(struct xdp_md, data_meta)),
8630                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8631                                     offsetof(struct xdp_md, data_end)),
8632                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8634                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8635                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8636                         BPF_MOV64_IMM(BPF_REG_0, 0),
8637                         BPF_EXIT_INSN(),
8638                 },
8639                 .result = REJECT,
8640                 .errstr = "invalid access to packet",
8641                 .prog_type = BPF_PROG_TYPE_XDP,
8642         },
8643         {
8644                 "meta access, test4",
8645                 .insns = {
8646                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8647                                     offsetof(struct xdp_md, data_meta)),
8648                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8649                                     offsetof(struct xdp_md, data_end)),
8650                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8651                                     offsetof(struct xdp_md, data)),
8652                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
8653                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8654                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8655                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8656                         BPF_MOV64_IMM(BPF_REG_0, 0),
8657                         BPF_EXIT_INSN(),
8658                 },
8659                 .result = REJECT,
8660                 .errstr = "invalid access to packet",
8661                 .prog_type = BPF_PROG_TYPE_XDP,
8662         },
8663         {
8664                 "meta access, test5",
8665                 .insns = {
8666                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8667                                     offsetof(struct xdp_md, data_meta)),
8668                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8669                                     offsetof(struct xdp_md, data)),
8670                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8671                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8672                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
8673                         BPF_MOV64_IMM(BPF_REG_2, -8),
8674                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8675                                      BPF_FUNC_xdp_adjust_meta),
8676                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8677                         BPF_MOV64_IMM(BPF_REG_0, 0),
8678                         BPF_EXIT_INSN(),
8679                 },
8680                 .result = REJECT,
8681                 .errstr = "R3 !read_ok",
8682                 .prog_type = BPF_PROG_TYPE_XDP,
8683         },
8684         {
8685                 "meta access, test6",
8686                 .insns = {
8687                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8688                                     offsetof(struct xdp_md, data_meta)),
8689                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8690                                     offsetof(struct xdp_md, data)),
8691                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8693                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8694                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8695                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
8696                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8697                         BPF_MOV64_IMM(BPF_REG_0, 0),
8698                         BPF_EXIT_INSN(),
8699                 },
8700                 .result = REJECT,
8701                 .errstr = "invalid access to packet",
8702                 .prog_type = BPF_PROG_TYPE_XDP,
8703         },
8704         {
8705                 "meta access, test7",
8706                 .insns = {
8707                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8708                                     offsetof(struct xdp_md, data_meta)),
8709                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8710                                     offsetof(struct xdp_md, data)),
8711                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8712                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8713                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8714                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8715                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8716                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8717                         BPF_MOV64_IMM(BPF_REG_0, 0),
8718                         BPF_EXIT_INSN(),
8719                 },
8720                 .result = ACCEPT,
8721                 .prog_type = BPF_PROG_TYPE_XDP,
8722         },
8723         {
8724                 "meta access, test8",
8725                 .insns = {
8726                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8727                                     offsetof(struct xdp_md, data_meta)),
8728                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8729                                     offsetof(struct xdp_md, data)),
8730                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8731                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8732                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8733                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8734                         BPF_MOV64_IMM(BPF_REG_0, 0),
8735                         BPF_EXIT_INSN(),
8736                 },
8737                 .result = ACCEPT,
8738                 .prog_type = BPF_PROG_TYPE_XDP,
8739         },
8740         {
8741                 "meta access, test9",
8742                 .insns = {
8743                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8744                                     offsetof(struct xdp_md, data_meta)),
8745                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8746                                     offsetof(struct xdp_md, data)),
8747                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8748                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8749                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8750                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8751                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8752                         BPF_MOV64_IMM(BPF_REG_0, 0),
8753                         BPF_EXIT_INSN(),
8754                 },
8755                 .result = REJECT,
8756                 .errstr = "invalid access to packet",
8757                 .prog_type = BPF_PROG_TYPE_XDP,
8758         },
8759         {
8760                 "meta access, test10",
8761                 .insns = {
8762                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8763                                     offsetof(struct xdp_md, data_meta)),
8764                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8765                                     offsetof(struct xdp_md, data)),
8766                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8767                                     offsetof(struct xdp_md, data_end)),
8768                         BPF_MOV64_IMM(BPF_REG_5, 42),
8769                         BPF_MOV64_IMM(BPF_REG_6, 24),
8770                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8771                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8772                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8773                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8774                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
8775                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8776                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8778                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
8779                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
8780                         BPF_MOV64_IMM(BPF_REG_0, 0),
8781                         BPF_EXIT_INSN(),
8782                 },
8783                 .result = REJECT,
8784                 .errstr = "invalid access to packet",
8785                 .prog_type = BPF_PROG_TYPE_XDP,
8786         },
8787         {
8788                 "meta access, test11",
8789                 .insns = {
8790                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8791                                     offsetof(struct xdp_md, data_meta)),
8792                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8793                                     offsetof(struct xdp_md, data)),
8794                         BPF_MOV64_IMM(BPF_REG_5, 42),
8795                         BPF_MOV64_IMM(BPF_REG_6, 24),
8796                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8797                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8798                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8799                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8800                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
8801                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8802                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8803                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8804                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
8805                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
8806                         BPF_MOV64_IMM(BPF_REG_0, 0),
8807                         BPF_EXIT_INSN(),
8808                 },
8809                 .result = ACCEPT,
8810                 .prog_type = BPF_PROG_TYPE_XDP,
8811         },
8812         {
8813                 "meta access, test12",
8814                 .insns = {
8815                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8816                                     offsetof(struct xdp_md, data_meta)),
8817                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8818                                     offsetof(struct xdp_md, data)),
8819                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8820                                     offsetof(struct xdp_md, data_end)),
8821                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8822                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8823                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
8824                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8825                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8826                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8827                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
8828                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8829                         BPF_MOV64_IMM(BPF_REG_0, 0),
8830                         BPF_EXIT_INSN(),
8831                 },
8832                 .result = ACCEPT,
8833                 .prog_type = BPF_PROG_TYPE_XDP,
8834         },
8835         {
8836                 "arithmetic ops make PTR_TO_CTX unusable",
8837                 .insns = {
8838                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
8839                                       offsetof(struct __sk_buff, data) -
8840                                       offsetof(struct __sk_buff, mark)),
8841                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8842                                     offsetof(struct __sk_buff, mark)),
8843                         BPF_EXIT_INSN(),
8844                 },
8845                 .errstr = "dereference of modified ctx ptr",
8846                 .result = REJECT,
8847                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8848         },
8849         {
8850                 "pkt_end - pkt_start is allowed",
8851                 .insns = {
8852                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8853                                     offsetof(struct __sk_buff, data_end)),
8854                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8855                                     offsetof(struct __sk_buff, data)),
8856                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
8857                         BPF_EXIT_INSN(),
8858                 },
8859                 .result = ACCEPT,
8860                 .retval = TEST_DATA_LEN,
8861                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8862         },
8863         {
8864                 "XDP pkt read, pkt_end mangling, bad access 1",
8865                 .insns = {
8866                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8867                                     offsetof(struct xdp_md, data)),
8868                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8869                                     offsetof(struct xdp_md, data_end)),
8870                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8871                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8872                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
8873                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8874                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8875                         BPF_MOV64_IMM(BPF_REG_0, 0),
8876                         BPF_EXIT_INSN(),
8877                 },
8878                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8879                 .result = REJECT,
8880                 .prog_type = BPF_PROG_TYPE_XDP,
8881         },
8882         {
8883                 "XDP pkt read, pkt_end mangling, bad access 2",
8884                 .insns = {
8885                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8886                                     offsetof(struct xdp_md, data)),
8887                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8888                                     offsetof(struct xdp_md, data_end)),
8889                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8891                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
8892                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8893                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8894                         BPF_MOV64_IMM(BPF_REG_0, 0),
8895                         BPF_EXIT_INSN(),
8896                 },
8897                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8898                 .result = REJECT,
8899                 .prog_type = BPF_PROG_TYPE_XDP,
8900         },
8901         {
8902                 "XDP pkt read, pkt_data' > pkt_end, good access",
8903                 .insns = {
8904                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8905                                     offsetof(struct xdp_md, data)),
8906                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8907                                     offsetof(struct xdp_md, data_end)),
8908                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8909                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8910                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8911                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8912                         BPF_MOV64_IMM(BPF_REG_0, 0),
8913                         BPF_EXIT_INSN(),
8914                 },
8915                 .result = ACCEPT,
8916                 .prog_type = BPF_PROG_TYPE_XDP,
8917         },
8918         {
8919                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
8920                 .insns = {
8921                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8922                                     offsetof(struct xdp_md, data)),
8923                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8924                                     offsetof(struct xdp_md, data_end)),
8925                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8926                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8927                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8928                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8929                         BPF_MOV64_IMM(BPF_REG_0, 0),
8930                         BPF_EXIT_INSN(),
8931                 },
8932                 .errstr = "R1 offset is outside of the packet",
8933                 .result = REJECT,
8934                 .prog_type = BPF_PROG_TYPE_XDP,
8935                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8936         },
8937         {
8938                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
8939                 .insns = {
8940                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8941                                     offsetof(struct xdp_md, data)),
8942                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8943                                     offsetof(struct xdp_md, data_end)),
8944                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8945                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8946                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8947                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8948                         BPF_MOV64_IMM(BPF_REG_0, 0),
8949                         BPF_EXIT_INSN(),
8950                 },
8951                 .errstr = "R1 offset is outside of the packet",
8952                 .result = REJECT,
8953                 .prog_type = BPF_PROG_TYPE_XDP,
8954         },
8955         {
8956                 "XDP pkt read, pkt_end > pkt_data', good access",
8957                 .insns = {
8958                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8959                                     offsetof(struct xdp_md, data)),
8960                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8961                                     offsetof(struct xdp_md, data_end)),
8962                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8963                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8964                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8965                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8966                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8967                         BPF_MOV64_IMM(BPF_REG_0, 0),
8968                         BPF_EXIT_INSN(),
8969                 },
8970                 .result = ACCEPT,
8971                 .prog_type = BPF_PROG_TYPE_XDP,
8972                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8973         },
8974         {
8975                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
8976                 .insns = {
8977                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8978                                     offsetof(struct xdp_md, data)),
8979                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8980                                     offsetof(struct xdp_md, data_end)),
8981                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8982                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8983                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8984                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8985                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8986                         BPF_MOV64_IMM(BPF_REG_0, 0),
8987                         BPF_EXIT_INSN(),
8988                 },
8989                 .errstr = "R1 offset is outside of the packet",
8990                 .result = REJECT,
8991                 .prog_type = BPF_PROG_TYPE_XDP,
8992         },
8993         {
8994                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
8995                 .insns = {
8996                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8997                                     offsetof(struct xdp_md, data)),
8998                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8999                                     offsetof(struct xdp_md, data_end)),
9000                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9001                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9002                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9003                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9004                         BPF_MOV64_IMM(BPF_REG_0, 0),
9005                         BPF_EXIT_INSN(),
9006                 },
9007                 .errstr = "R1 offset is outside of the packet",
9008                 .result = REJECT,
9009                 .prog_type = BPF_PROG_TYPE_XDP,
9010         },
9011         {
9012                 "XDP pkt read, pkt_data' < pkt_end, good access",
9013                 .insns = {
9014                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9015                                     offsetof(struct xdp_md, data)),
9016                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9017                                     offsetof(struct xdp_md, data_end)),
9018                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9019                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9020                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9021                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9022                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9023                         BPF_MOV64_IMM(BPF_REG_0, 0),
9024                         BPF_EXIT_INSN(),
9025                 },
9026                 .result = ACCEPT,
9027                 .prog_type = BPF_PROG_TYPE_XDP,
9028                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9029         },
9030         {
9031                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
9032                 .insns = {
9033                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9034                                     offsetof(struct xdp_md, data)),
9035                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9036                                     offsetof(struct xdp_md, data_end)),
9037                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9038                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9039                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9040                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9041                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9042                         BPF_MOV64_IMM(BPF_REG_0, 0),
9043                         BPF_EXIT_INSN(),
9044                 },
9045                 .errstr = "R1 offset is outside of the packet",
9046                 .result = REJECT,
9047                 .prog_type = BPF_PROG_TYPE_XDP,
9048         },
9049         {
9050                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
9051                 .insns = {
9052                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9053                                     offsetof(struct xdp_md, data)),
9054                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9055                                     offsetof(struct xdp_md, data_end)),
9056                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9058                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9059                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9060                         BPF_MOV64_IMM(BPF_REG_0, 0),
9061                         BPF_EXIT_INSN(),
9062                 },
9063                 .errstr = "R1 offset is outside of the packet",
9064                 .result = REJECT,
9065                 .prog_type = BPF_PROG_TYPE_XDP,
9066         },
9067         {
9068                 "XDP pkt read, pkt_end < pkt_data', good access",
9069                 .insns = {
9070                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9071                                     offsetof(struct xdp_md, data)),
9072                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9073                                     offsetof(struct xdp_md, data_end)),
9074                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9076                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9077                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9078                         BPF_MOV64_IMM(BPF_REG_0, 0),
9079                         BPF_EXIT_INSN(),
9080                 },
9081                 .result = ACCEPT,
9082                 .prog_type = BPF_PROG_TYPE_XDP,
9083         },
9084         {
9085                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
9086                 .insns = {
9087                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9088                                     offsetof(struct xdp_md, data)),
9089                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9090                                     offsetof(struct xdp_md, data_end)),
9091                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9092                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9093                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9094                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9095                         BPF_MOV64_IMM(BPF_REG_0, 0),
9096                         BPF_EXIT_INSN(),
9097                 },
9098                 .errstr = "R1 offset is outside of the packet",
9099                 .result = REJECT,
9100                 .prog_type = BPF_PROG_TYPE_XDP,
9101                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9102         },
9103         {
9104                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
9105                 .insns = {
9106                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9107                                     offsetof(struct xdp_md, data)),
9108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9109                                     offsetof(struct xdp_md, data_end)),
9110                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9112                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9113                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9114                         BPF_MOV64_IMM(BPF_REG_0, 0),
9115                         BPF_EXIT_INSN(),
9116                 },
9117                 .errstr = "R1 offset is outside of the packet",
9118                 .result = REJECT,
9119                 .prog_type = BPF_PROG_TYPE_XDP,
9120         },
9121         {
9122                 "XDP pkt read, pkt_data' >= pkt_end, good access",
9123                 .insns = {
9124                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9125                                     offsetof(struct xdp_md, data)),
9126                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9127                                     offsetof(struct xdp_md, data_end)),
9128                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9129                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9130                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9131                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9132                         BPF_MOV64_IMM(BPF_REG_0, 0),
9133                         BPF_EXIT_INSN(),
9134                 },
9135                 .result = ACCEPT,
9136                 .prog_type = BPF_PROG_TYPE_XDP,
9137                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9138         },
9139         {
9140                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
9141                 .insns = {
9142                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9143                                     offsetof(struct xdp_md, data)),
9144                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9145                                     offsetof(struct xdp_md, data_end)),
9146                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9147                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9148                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9149                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9150                         BPF_MOV64_IMM(BPF_REG_0, 0),
9151                         BPF_EXIT_INSN(),
9152                 },
9153                 .errstr = "R1 offset is outside of the packet",
9154                 .result = REJECT,
9155                 .prog_type = BPF_PROG_TYPE_XDP,
9156         },
9157         {
9158                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
9159                 .insns = {
9160                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9161                                     offsetof(struct xdp_md, data)),
9162                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9163                                     offsetof(struct xdp_md, data_end)),
9164                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9165                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9166                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9167                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9168                         BPF_MOV64_IMM(BPF_REG_0, 0),
9169                         BPF_EXIT_INSN(),
9170                 },
9171                 .errstr = "R1 offset is outside of the packet",
9172                 .result = REJECT,
9173                 .prog_type = BPF_PROG_TYPE_XDP,
9174                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9175         },
9176         {
9177                 "XDP pkt read, pkt_end >= pkt_data', good access",
9178                 .insns = {
9179                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9180                                     offsetof(struct xdp_md, data)),
9181                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9182                                     offsetof(struct xdp_md, data_end)),
9183                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9184                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9185                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9186                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9187                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9188                         BPF_MOV64_IMM(BPF_REG_0, 0),
9189                         BPF_EXIT_INSN(),
9190                 },
9191                 .result = ACCEPT,
9192                 .prog_type = BPF_PROG_TYPE_XDP,
9193         },
9194         {
9195                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
9196                 .insns = {
9197                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9198                                     offsetof(struct xdp_md, data)),
9199                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9200                                     offsetof(struct xdp_md, data_end)),
9201                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9202                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9203                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9204                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9205                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9206                         BPF_MOV64_IMM(BPF_REG_0, 0),
9207                         BPF_EXIT_INSN(),
9208                 },
9209                 .errstr = "R1 offset is outside of the packet",
9210                 .result = REJECT,
9211                 .prog_type = BPF_PROG_TYPE_XDP,
9212                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9213         },
9214         {
9215                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
9216                 .insns = {
9217                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9218                                     offsetof(struct xdp_md, data)),
9219                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9220                                     offsetof(struct xdp_md, data_end)),
9221                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9223                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9224                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9225                         BPF_MOV64_IMM(BPF_REG_0, 0),
9226                         BPF_EXIT_INSN(),
9227                 },
9228                 .errstr = "R1 offset is outside of the packet",
9229                 .result = REJECT,
9230                 .prog_type = BPF_PROG_TYPE_XDP,
9231         },
9232         {
9233                 "XDP pkt read, pkt_data' <= pkt_end, good access",
9234                 .insns = {
9235                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9236                                     offsetof(struct xdp_md, data)),
9237                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9238                                     offsetof(struct xdp_md, data_end)),
9239                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9241                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9242                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9243                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9244                         BPF_MOV64_IMM(BPF_REG_0, 0),
9245                         BPF_EXIT_INSN(),
9246                 },
9247                 .result = ACCEPT,
9248                 .prog_type = BPF_PROG_TYPE_XDP,
9249         },
9250         {
9251                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
9252                 .insns = {
9253                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9254                                     offsetof(struct xdp_md, data)),
9255                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9256                                     offsetof(struct xdp_md, data_end)),
9257                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9258                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9259                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9260                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9261                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9262                         BPF_MOV64_IMM(BPF_REG_0, 0),
9263                         BPF_EXIT_INSN(),
9264                 },
9265                 .errstr = "R1 offset is outside of the packet",
9266                 .result = REJECT,
9267                 .prog_type = BPF_PROG_TYPE_XDP,
9268                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9269         },
9270         {
9271                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
9272                 .insns = {
9273                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9274                                     offsetof(struct xdp_md, data)),
9275                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9276                                     offsetof(struct xdp_md, data_end)),
9277                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9278                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9279                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9280                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9281                         BPF_MOV64_IMM(BPF_REG_0, 0),
9282                         BPF_EXIT_INSN(),
9283                 },
9284                 .errstr = "R1 offset is outside of the packet",
9285                 .result = REJECT,
9286                 .prog_type = BPF_PROG_TYPE_XDP,
9287         },
9288         {
9289                 "XDP pkt read, pkt_end <= pkt_data', good access",
9290                 .insns = {
9291                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9292                                     offsetof(struct xdp_md, data)),
9293                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9294                                     offsetof(struct xdp_md, data_end)),
9295                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9296                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9297                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9298                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9299                         BPF_MOV64_IMM(BPF_REG_0, 0),
9300                         BPF_EXIT_INSN(),
9301                 },
9302                 .result = ACCEPT,
9303                 .prog_type = BPF_PROG_TYPE_XDP,
9304                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9305         },
9306         {
9307                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
9308                 .insns = {
9309                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9310                                     offsetof(struct xdp_md, data)),
9311                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9312                                     offsetof(struct xdp_md, data_end)),
9313                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9314                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9315                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9316                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9317                         BPF_MOV64_IMM(BPF_REG_0, 0),
9318                         BPF_EXIT_INSN(),
9319                 },
9320                 .errstr = "R1 offset is outside of the packet",
9321                 .result = REJECT,
9322                 .prog_type = BPF_PROG_TYPE_XDP,
9323         },
9324         {
9325                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
9326                 .insns = {
9327                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9328                                     offsetof(struct xdp_md, data)),
9329                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9330                                     offsetof(struct xdp_md, data_end)),
9331                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9332                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9333                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9334                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9335                         BPF_MOV64_IMM(BPF_REG_0, 0),
9336                         BPF_EXIT_INSN(),
9337                 },
9338                 .errstr = "R1 offset is outside of the packet",
9339                 .result = REJECT,
9340                 .prog_type = BPF_PROG_TYPE_XDP,
9341                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9342         },
9343         {
9344                 "XDP pkt read, pkt_meta' > pkt_data, good access",
9345                 .insns = {
9346                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9347                                     offsetof(struct xdp_md, data_meta)),
9348                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9349                                     offsetof(struct xdp_md, data)),
9350                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9351                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9352                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9353                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9354                         BPF_MOV64_IMM(BPF_REG_0, 0),
9355                         BPF_EXIT_INSN(),
9356                 },
9357                 .result = ACCEPT,
9358                 .prog_type = BPF_PROG_TYPE_XDP,
9359         },
9360         {
9361                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
9362                 .insns = {
9363                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9364                                     offsetof(struct xdp_md, data_meta)),
9365                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9366                                     offsetof(struct xdp_md, data)),
9367                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9368                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9369                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9370                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9371                         BPF_MOV64_IMM(BPF_REG_0, 0),
9372                         BPF_EXIT_INSN(),
9373                 },
9374                 .errstr = "R1 offset is outside of the packet",
9375                 .result = REJECT,
9376                 .prog_type = BPF_PROG_TYPE_XDP,
9377                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9378         },
9379         {
9380                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
9381                 .insns = {
9382                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9383                                     offsetof(struct xdp_md, data_meta)),
9384                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9385                                     offsetof(struct xdp_md, data)),
9386                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9388                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9389                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9390                         BPF_MOV64_IMM(BPF_REG_0, 0),
9391                         BPF_EXIT_INSN(),
9392                 },
9393                 .errstr = "R1 offset is outside of the packet",
9394                 .result = REJECT,
9395                 .prog_type = BPF_PROG_TYPE_XDP,
9396         },
9397         {
9398                 "XDP pkt read, pkt_data > pkt_meta', good access",
9399                 .insns = {
9400                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9401                                     offsetof(struct xdp_md, data_meta)),
9402                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9403                                     offsetof(struct xdp_md, data)),
9404                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9406                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9407                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9408                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9409                         BPF_MOV64_IMM(BPF_REG_0, 0),
9410                         BPF_EXIT_INSN(),
9411                 },
9412                 .result = ACCEPT,
9413                 .prog_type = BPF_PROG_TYPE_XDP,
9414                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9415         },
9416         {
9417                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
9418                 .insns = {
9419                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9420                                     offsetof(struct xdp_md, data_meta)),
9421                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9422                                     offsetof(struct xdp_md, data)),
9423                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9424                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9425                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9426                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9427                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9428                         BPF_MOV64_IMM(BPF_REG_0, 0),
9429                         BPF_EXIT_INSN(),
9430                 },
9431                 .errstr = "R1 offset is outside of the packet",
9432                 .result = REJECT,
9433                 .prog_type = BPF_PROG_TYPE_XDP,
9434         },
9435         {
9436                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
9437                 .insns = {
9438                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9439                                     offsetof(struct xdp_md, data_meta)),
9440                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9441                                     offsetof(struct xdp_md, data)),
9442                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9444                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9445                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9446                         BPF_MOV64_IMM(BPF_REG_0, 0),
9447                         BPF_EXIT_INSN(),
9448                 },
9449                 .errstr = "R1 offset is outside of the packet",
9450                 .result = REJECT,
9451                 .prog_type = BPF_PROG_TYPE_XDP,
9452         },
9453         {
9454                 "XDP pkt read, pkt_meta' < pkt_data, good access",
9455                 .insns = {
9456                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9457                                     offsetof(struct xdp_md, data_meta)),
9458                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9459                                     offsetof(struct xdp_md, data)),
9460                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9462                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9463                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9464                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9465                         BPF_MOV64_IMM(BPF_REG_0, 0),
9466                         BPF_EXIT_INSN(),
9467                 },
9468                 .result = ACCEPT,
9469                 .prog_type = BPF_PROG_TYPE_XDP,
9470                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9471         },
9472         {
9473                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
9474                 .insns = {
9475                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9476                                     offsetof(struct xdp_md, data_meta)),
9477                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9478                                     offsetof(struct xdp_md, data)),
9479                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9480                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9481                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9482                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9483                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9484                         BPF_MOV64_IMM(BPF_REG_0, 0),
9485                         BPF_EXIT_INSN(),
9486                 },
9487                 .errstr = "R1 offset is outside of the packet",
9488                 .result = REJECT,
9489                 .prog_type = BPF_PROG_TYPE_XDP,
9490         },
9491         {
9492                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
9493                 .insns = {
9494                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9495                                     offsetof(struct xdp_md, data_meta)),
9496                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9497                                     offsetof(struct xdp_md, data)),
9498                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9500                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9501                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9502                         BPF_MOV64_IMM(BPF_REG_0, 0),
9503                         BPF_EXIT_INSN(),
9504                 },
9505                 .errstr = "R1 offset is outside of the packet",
9506                 .result = REJECT,
9507                 .prog_type = BPF_PROG_TYPE_XDP,
9508         },
9509         {
9510                 "XDP pkt read, pkt_data < pkt_meta', good access",
9511                 .insns = {
9512                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9513                                     offsetof(struct xdp_md, data_meta)),
9514                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9515                                     offsetof(struct xdp_md, data)),
9516                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9518                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9519                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9520                         BPF_MOV64_IMM(BPF_REG_0, 0),
9521                         BPF_EXIT_INSN(),
9522                 },
9523                 .result = ACCEPT,
9524                 .prog_type = BPF_PROG_TYPE_XDP,
9525         },
9526         {
9527                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
9528                 .insns = {
9529                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9530                                     offsetof(struct xdp_md, data_meta)),
9531                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9532                                     offsetof(struct xdp_md, data)),
9533                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9535                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9536                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9537                         BPF_MOV64_IMM(BPF_REG_0, 0),
9538                         BPF_EXIT_INSN(),
9539                 },
9540                 .errstr = "R1 offset is outside of the packet",
9541                 .result = REJECT,
9542                 .prog_type = BPF_PROG_TYPE_XDP,
9543                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9544         },
9545         {
9546                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
9547                 .insns = {
9548                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9549                                     offsetof(struct xdp_md, data_meta)),
9550                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9551                                     offsetof(struct xdp_md, data)),
9552                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9554                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9555                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9556                         BPF_MOV64_IMM(BPF_REG_0, 0),
9557                         BPF_EXIT_INSN(),
9558                 },
9559                 .errstr = "R1 offset is outside of the packet",
9560                 .result = REJECT,
9561                 .prog_type = BPF_PROG_TYPE_XDP,
9562         },
9563         {
9564                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
9565                 .insns = {
9566                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9567                                     offsetof(struct xdp_md, data_meta)),
9568                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9569                                     offsetof(struct xdp_md, data)),
9570                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9571                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9572                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9573                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9574                         BPF_MOV64_IMM(BPF_REG_0, 0),
9575                         BPF_EXIT_INSN(),
9576                 },
9577                 .result = ACCEPT,
9578                 .prog_type = BPF_PROG_TYPE_XDP,
9579                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9580         },
9581         {
9582                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
9583                 .insns = {
9584                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9585                                     offsetof(struct xdp_md, data_meta)),
9586                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9587                                     offsetof(struct xdp_md, data)),
9588                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9590                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9591                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9592                         BPF_MOV64_IMM(BPF_REG_0, 0),
9593                         BPF_EXIT_INSN(),
9594                 },
9595                 .errstr = "R1 offset is outside of the packet",
9596                 .result = REJECT,
9597                 .prog_type = BPF_PROG_TYPE_XDP,
9598         },
9599         {
9600                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
9601                 .insns = {
9602                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9603                                     offsetof(struct xdp_md, data_meta)),
9604                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9605                                     offsetof(struct xdp_md, data)),
9606                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9607                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9608                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9609                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9610                         BPF_MOV64_IMM(BPF_REG_0, 0),
9611                         BPF_EXIT_INSN(),
9612                 },
9613                 .errstr = "R1 offset is outside of the packet",
9614                 .result = REJECT,
9615                 .prog_type = BPF_PROG_TYPE_XDP,
9616                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9617         },
9618         {
9619                 "XDP pkt read, pkt_data >= pkt_meta', good access",
9620                 .insns = {
9621                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9622                                     offsetof(struct xdp_md, data_meta)),
9623                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9624                                     offsetof(struct xdp_md, data)),
9625                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9627                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9628                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9629                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9630                         BPF_MOV64_IMM(BPF_REG_0, 0),
9631                         BPF_EXIT_INSN(),
9632                 },
9633                 .result = ACCEPT,
9634                 .prog_type = BPF_PROG_TYPE_XDP,
9635         },
9636         {
9637                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
9638                 .insns = {
9639                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9640                                     offsetof(struct xdp_md, data_meta)),
9641                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9642                                     offsetof(struct xdp_md, data)),
9643                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9644                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9645                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9646                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9647                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9648                         BPF_MOV64_IMM(BPF_REG_0, 0),
9649                         BPF_EXIT_INSN(),
9650                 },
9651                 .errstr = "R1 offset is outside of the packet",
9652                 .result = REJECT,
9653                 .prog_type = BPF_PROG_TYPE_XDP,
9654                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9655         },
9656         {
9657                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
9658                 .insns = {
9659                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9660                                     offsetof(struct xdp_md, data_meta)),
9661                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9662                                     offsetof(struct xdp_md, data)),
9663                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9664                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9665                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9666                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9667                         BPF_MOV64_IMM(BPF_REG_0, 0),
9668                         BPF_EXIT_INSN(),
9669                 },
9670                 .errstr = "R1 offset is outside of the packet",
9671                 .result = REJECT,
9672                 .prog_type = BPF_PROG_TYPE_XDP,
9673         },
9674         {
9675                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
9676                 .insns = {
9677                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9678                                     offsetof(struct xdp_md, data_meta)),
9679                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9680                                     offsetof(struct xdp_md, data)),
9681                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9682                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9683                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9684                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9685                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9686                         BPF_MOV64_IMM(BPF_REG_0, 0),
9687                         BPF_EXIT_INSN(),
9688                 },
9689                 .result = ACCEPT,
9690                 .prog_type = BPF_PROG_TYPE_XDP,
9691         },
9692         {
9693                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
9694                 .insns = {
9695                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9696                                     offsetof(struct xdp_md, data_meta)),
9697                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9698                                     offsetof(struct xdp_md, data)),
9699                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9701                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9702                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9703                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9704                         BPF_MOV64_IMM(BPF_REG_0, 0),
9705                         BPF_EXIT_INSN(),
9706                 },
9707                 .errstr = "R1 offset is outside of the packet",
9708                 .result = REJECT,
9709                 .prog_type = BPF_PROG_TYPE_XDP,
9710                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9711         },
9712         {
9713                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
9714                 .insns = {
9715                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9716                                     offsetof(struct xdp_md, data_meta)),
9717                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9718                                     offsetof(struct xdp_md, data)),
9719                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9720                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9721                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9722                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9723                         BPF_MOV64_IMM(BPF_REG_0, 0),
9724                         BPF_EXIT_INSN(),
9725                 },
9726                 .errstr = "R1 offset is outside of the packet",
9727                 .result = REJECT,
9728                 .prog_type = BPF_PROG_TYPE_XDP,
9729         },
9730         {
9731                 "XDP pkt read, pkt_data <= pkt_meta', good access",
9732                 .insns = {
9733                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9734                                     offsetof(struct xdp_md, data_meta)),
9735                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9736                                     offsetof(struct xdp_md, data)),
9737                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9739                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9740                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9741                         BPF_MOV64_IMM(BPF_REG_0, 0),
9742                         BPF_EXIT_INSN(),
9743                 },
9744                 .result = ACCEPT,
9745                 .prog_type = BPF_PROG_TYPE_XDP,
9746                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9747         },
9748         {
9749                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
9750                 .insns = {
9751                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9752                                     offsetof(struct xdp_md, data_meta)),
9753                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9754                                     offsetof(struct xdp_md, data)),
9755                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9756                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9757                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9758                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9759                         BPF_MOV64_IMM(BPF_REG_0, 0),
9760                         BPF_EXIT_INSN(),
9761                 },
9762                 .errstr = "R1 offset is outside of the packet",
9763                 .result = REJECT,
9764                 .prog_type = BPF_PROG_TYPE_XDP,
9765         },
9766         {
9767                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
9768                 .insns = {
9769                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9770                                     offsetof(struct xdp_md, data_meta)),
9771                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9772                                     offsetof(struct xdp_md, data)),
9773                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9775                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9776                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9777                         BPF_MOV64_IMM(BPF_REG_0, 0),
9778                         BPF_EXIT_INSN(),
9779                 },
9780                 .errstr = "R1 offset is outside of the packet",
9781                 .result = REJECT,
9782                 .prog_type = BPF_PROG_TYPE_XDP,
9783                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9784         },
9785         {
9786                 "check deducing bounds from const, 1",
9787                 .insns = {
9788                         BPF_MOV64_IMM(BPF_REG_0, 1),
9789                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
9790                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9791                         BPF_EXIT_INSN(),
9792                 },
9793                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9794                 .errstr = "R0 tried to subtract pointer from scalar",
9795                 .result = REJECT,
9796         },
9797         {
9798                 "check deducing bounds from const, 2",
9799                 .insns = {
9800                         BPF_MOV64_IMM(BPF_REG_0, 1),
9801                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9802                         BPF_EXIT_INSN(),
9803                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
9804                         BPF_EXIT_INSN(),
9805                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9806                         BPF_EXIT_INSN(),
9807                 },
9808                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9809                 .result_unpriv = REJECT,
9810                 .result = ACCEPT,
9811                 .retval = 1,
9812         },
9813         {
9814                 "check deducing bounds from const, 3",
9815                 .insns = {
9816                         BPF_MOV64_IMM(BPF_REG_0, 0),
9817                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9818                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9819                         BPF_EXIT_INSN(),
9820                 },
9821                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9822                 .errstr = "R0 tried to subtract pointer from scalar",
9823                 .result = REJECT,
9824         },
9825         {
9826                 "check deducing bounds from const, 4",
9827                 .insns = {
9828                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9829                         BPF_MOV64_IMM(BPF_REG_0, 0),
9830                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
9831                         BPF_EXIT_INSN(),
9832                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9833                         BPF_EXIT_INSN(),
9834                         BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0),
9835                         BPF_EXIT_INSN(),
9836                 },
9837                 .errstr_unpriv = "R6 has pointer with unsupported alu operation",
9838                 .result_unpriv = REJECT,
9839                 .result = ACCEPT,
9840         },
9841         {
9842                 "check deducing bounds from const, 5",
9843                 .insns = {
9844                         BPF_MOV64_IMM(BPF_REG_0, 0),
9845                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9846                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9847                         BPF_EXIT_INSN(),
9848                 },
9849                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9850                 .errstr = "R0 tried to subtract pointer from scalar",
9851                 .result = REJECT,
9852         },
9853         {
9854                 "check deducing bounds from const, 6",
9855                 .insns = {
9856                         BPF_MOV64_IMM(BPF_REG_0, 0),
9857                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9858                         BPF_EXIT_INSN(),
9859                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9860                         BPF_EXIT_INSN(),
9861                 },
9862                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9863                 .errstr = "R0 tried to subtract pointer from scalar",
9864                 .result = REJECT,
9865         },
9866         {
9867                 "check deducing bounds from const, 7",
9868                 .insns = {
9869                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9870                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9871                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9872                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9873                                     offsetof(struct __sk_buff, mark)),
9874                         BPF_EXIT_INSN(),
9875                 },
9876                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9877                 .errstr = "dereference of modified ctx ptr",
9878                 .result = REJECT,
9879         },
9880         {
9881                 "check deducing bounds from const, 8",
9882                 .insns = {
9883                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9884                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9885                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
9886                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9887                                     offsetof(struct __sk_buff, mark)),
9888                         BPF_EXIT_INSN(),
9889                 },
9890                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9891                 .errstr = "dereference of modified ctx ptr",
9892                 .result = REJECT,
9893         },
9894         {
9895                 "check deducing bounds from const, 9",
9896                 .insns = {
9897                         BPF_MOV64_IMM(BPF_REG_0, 0),
9898                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9899                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9900                         BPF_EXIT_INSN(),
9901                 },
9902                 .errstr_unpriv = "R1 has pointer with unsupported alu operation",
9903                 .errstr = "R0 tried to subtract pointer from scalar",
9904                 .result = REJECT,
9905         },
9906         {
9907                 "check deducing bounds from const, 10",
9908                 .insns = {
9909                         BPF_MOV64_IMM(BPF_REG_0, 0),
9910                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9911                         /* Marks reg as unknown. */
9912                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
9913                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9914                         BPF_EXIT_INSN(),
9915                 },
9916                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
9917                 .result = REJECT,
9918         },
9919         {
9920                 "bpf_exit with invalid return code. test1",
9921                 .insns = {
9922                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9923                         BPF_EXIT_INSN(),
9924                 },
9925                 .errstr = "R0 has value (0x0; 0xffffffff)",
9926                 .result = REJECT,
9927                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9928         },
9929         {
9930                 "bpf_exit with invalid return code. test2",
9931                 .insns = {
9932                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9933                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
9934                         BPF_EXIT_INSN(),
9935                 },
9936                 .result = ACCEPT,
9937                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9938         },
9939         {
9940                 "bpf_exit with invalid return code. test3",
9941                 .insns = {
9942                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9943                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
9944                         BPF_EXIT_INSN(),
9945                 },
9946                 .errstr = "R0 has value (0x0; 0x3)",
9947                 .result = REJECT,
9948                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9949         },
9950         {
9951                 "bpf_exit with invalid return code. test4",
9952                 .insns = {
9953                         BPF_MOV64_IMM(BPF_REG_0, 1),
9954                         BPF_EXIT_INSN(),
9955                 },
9956                 .result = ACCEPT,
9957                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9958         },
9959         {
9960                 "bpf_exit with invalid return code. test5",
9961                 .insns = {
9962                         BPF_MOV64_IMM(BPF_REG_0, 2),
9963                         BPF_EXIT_INSN(),
9964                 },
9965                 .errstr = "R0 has value (0x2; 0x0)",
9966                 .result = REJECT,
9967                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9968         },
9969         {
9970                 "bpf_exit with invalid return code. test6",
9971                 .insns = {
9972                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9973                         BPF_EXIT_INSN(),
9974                 },
9975                 .errstr = "R0 is not a known value (ctx)",
9976                 .result = REJECT,
9977                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9978         },
9979         {
9980                 "bpf_exit with invalid return code. test7",
9981                 .insns = {
9982                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9983                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
9984                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
9985                         BPF_EXIT_INSN(),
9986                 },
9987                 .errstr = "R0 has unknown scalar value",
9988                 .result = REJECT,
9989                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9990         },
9991         {
9992                 "calls: basic sanity",
9993                 .insns = {
9994                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9995                         BPF_MOV64_IMM(BPF_REG_0, 1),
9996                         BPF_EXIT_INSN(),
9997                         BPF_MOV64_IMM(BPF_REG_0, 2),
9998                         BPF_EXIT_INSN(),
9999                 },
10000                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10001                 .result = ACCEPT,
10002         },
10003         {
10004                 "calls: not on unpriviledged",
10005                 .insns = {
10006                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10007                         BPF_MOV64_IMM(BPF_REG_0, 1),
10008                         BPF_EXIT_INSN(),
10009                         BPF_MOV64_IMM(BPF_REG_0, 2),
10010                         BPF_EXIT_INSN(),
10011                 },
10012                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
10013                 .result_unpriv = REJECT,
10014                 .result = ACCEPT,
10015                 .retval = 1,
10016         },
10017         {
10018                 "calls: div by 0 in subprog",
10019                 .insns = {
10020                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10021                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10022                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10023                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10024                                     offsetof(struct __sk_buff, data_end)),
10025                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10026                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10027                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10028                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10029                         BPF_MOV64_IMM(BPF_REG_0, 1),
10030                         BPF_EXIT_INSN(),
10031                         BPF_MOV32_IMM(BPF_REG_2, 0),
10032                         BPF_MOV32_IMM(BPF_REG_3, 1),
10033                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
10034                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10035                                     offsetof(struct __sk_buff, data)),
10036                         BPF_EXIT_INSN(),
10037                 },
10038                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10039                 .result = ACCEPT,
10040                 .retval = 1,
10041         },
10042         {
10043                 "calls: multiple ret types in subprog 1",
10044                 .insns = {
10045                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10046                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10047                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10048                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10049                                     offsetof(struct __sk_buff, data_end)),
10050                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10051                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10052                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10053                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10054                         BPF_MOV64_IMM(BPF_REG_0, 1),
10055                         BPF_EXIT_INSN(),
10056                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10057                                     offsetof(struct __sk_buff, data)),
10058                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10059                         BPF_MOV32_IMM(BPF_REG_0, 42),
10060                         BPF_EXIT_INSN(),
10061                 },
10062                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10063                 .result = REJECT,
10064                 .errstr = "R0 invalid mem access 'inv'",
10065         },
10066         {
10067                 "calls: multiple ret types in subprog 2",
10068                 .insns = {
10069                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10070                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10071                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10072                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10073                                     offsetof(struct __sk_buff, data_end)),
10074                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10076                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10077                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10078                         BPF_MOV64_IMM(BPF_REG_0, 1),
10079                         BPF_EXIT_INSN(),
10080                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10081                                     offsetof(struct __sk_buff, data)),
10082                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10083                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
10084                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10085                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10087                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10088                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10089                                      BPF_FUNC_map_lookup_elem),
10090                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10091                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
10092                                     offsetof(struct __sk_buff, data)),
10093                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
10094                         BPF_EXIT_INSN(),
10095                 },
10096                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10097                 .fixup_map1 = { 16 },
10098                 .result = REJECT,
10099                 .errstr = "R0 min value is outside of the array range",
10100         },
10101         {
10102                 "calls: overlapping caller/callee",
10103                 .insns = {
10104                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
10105                         BPF_MOV64_IMM(BPF_REG_0, 1),
10106                         BPF_EXIT_INSN(),
10107                 },
10108                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10109                 .errstr = "last insn is not an exit or jmp",
10110                 .result = REJECT,
10111         },
10112         {
10113                 "calls: wrong recursive calls",
10114                 .insns = {
10115                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10116                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10117                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10118                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10119                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10120                         BPF_MOV64_IMM(BPF_REG_0, 1),
10121                         BPF_EXIT_INSN(),
10122                 },
10123                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10124                 .errstr = "jump out of range",
10125                 .result = REJECT,
10126         },
10127         {
10128                 "calls: wrong src reg",
10129                 .insns = {
10130                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
10131                         BPF_MOV64_IMM(BPF_REG_0, 1),
10132                         BPF_EXIT_INSN(),
10133                 },
10134                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10135                 .errstr = "BPF_CALL uses reserved fields",
10136                 .result = REJECT,
10137         },
10138         {
10139                 "calls: wrong off value",
10140                 .insns = {
10141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
10142                         BPF_MOV64_IMM(BPF_REG_0, 1),
10143                         BPF_EXIT_INSN(),
10144                         BPF_MOV64_IMM(BPF_REG_0, 2),
10145                         BPF_EXIT_INSN(),
10146                 },
10147                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10148                 .errstr = "BPF_CALL uses reserved fields",
10149                 .result = REJECT,
10150         },
10151         {
10152                 "calls: jump back loop",
10153                 .insns = {
10154                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10155                         BPF_MOV64_IMM(BPF_REG_0, 1),
10156                         BPF_EXIT_INSN(),
10157                 },
10158                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10159                 .errstr = "back-edge from insn 0 to 0",
10160                 .result = REJECT,
10161         },
10162         {
10163                 "calls: conditional call",
10164                 .insns = {
10165                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10166                                     offsetof(struct __sk_buff, mark)),
10167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10168                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10169                         BPF_MOV64_IMM(BPF_REG_0, 1),
10170                         BPF_EXIT_INSN(),
10171                         BPF_MOV64_IMM(BPF_REG_0, 2),
10172                         BPF_EXIT_INSN(),
10173                 },
10174                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10175                 .errstr = "jump out of range",
10176                 .result = REJECT,
10177         },
10178         {
10179                 "calls: conditional call 2",
10180                 .insns = {
10181                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10182                                     offsetof(struct __sk_buff, mark)),
10183                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10184                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10185                         BPF_MOV64_IMM(BPF_REG_0, 1),
10186                         BPF_EXIT_INSN(),
10187                         BPF_MOV64_IMM(BPF_REG_0, 2),
10188                         BPF_EXIT_INSN(),
10189                         BPF_MOV64_IMM(BPF_REG_0, 3),
10190                         BPF_EXIT_INSN(),
10191                 },
10192                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10193                 .result = ACCEPT,
10194         },
10195         {
10196                 "calls: conditional call 3",
10197                 .insns = {
10198                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10199                                     offsetof(struct __sk_buff, mark)),
10200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10201                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10202                         BPF_MOV64_IMM(BPF_REG_0, 1),
10203                         BPF_EXIT_INSN(),
10204                         BPF_MOV64_IMM(BPF_REG_0, 1),
10205                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10206                         BPF_MOV64_IMM(BPF_REG_0, 3),
10207                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10208                 },
10209                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10210                 .errstr = "back-edge from insn",
10211                 .result = REJECT,
10212         },
10213         {
10214                 "calls: conditional call 4",
10215                 .insns = {
10216                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10217                                     offsetof(struct __sk_buff, mark)),
10218                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10219                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10220                         BPF_MOV64_IMM(BPF_REG_0, 1),
10221                         BPF_EXIT_INSN(),
10222                         BPF_MOV64_IMM(BPF_REG_0, 1),
10223                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
10224                         BPF_MOV64_IMM(BPF_REG_0, 3),
10225                         BPF_EXIT_INSN(),
10226                 },
10227                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10228                 .result = ACCEPT,
10229         },
10230         {
10231                 "calls: conditional call 5",
10232                 .insns = {
10233                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10234                                     offsetof(struct __sk_buff, mark)),
10235                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10236                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10237                         BPF_MOV64_IMM(BPF_REG_0, 1),
10238                         BPF_EXIT_INSN(),
10239                         BPF_MOV64_IMM(BPF_REG_0, 1),
10240                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10241                         BPF_MOV64_IMM(BPF_REG_0, 3),
10242                         BPF_EXIT_INSN(),
10243                 },
10244                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10245                 .errstr = "back-edge from insn",
10246                 .result = REJECT,
10247         },
10248         {
10249                 "calls: conditional call 6",
10250                 .insns = {
10251                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10252                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
10253                         BPF_EXIT_INSN(),
10254                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10255                                     offsetof(struct __sk_buff, mark)),
10256                         BPF_EXIT_INSN(),
10257                 },
10258                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10259                 .errstr = "back-edge from insn",
10260                 .result = REJECT,
10261         },
10262         {
10263                 "calls: using r0 returned by callee",
10264                 .insns = {
10265                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10266                         BPF_EXIT_INSN(),
10267                         BPF_MOV64_IMM(BPF_REG_0, 2),
10268                         BPF_EXIT_INSN(),
10269                 },
10270                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10271                 .result = ACCEPT,
10272         },
10273         {
10274                 "calls: using uninit r0 from callee",
10275                 .insns = {
10276                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10277                         BPF_EXIT_INSN(),
10278                         BPF_EXIT_INSN(),
10279                 },
10280                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10281                 .errstr = "!read_ok",
10282                 .result = REJECT,
10283         },
10284         {
10285                 "calls: callee is using r1",
10286                 .insns = {
10287                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10288                         BPF_EXIT_INSN(),
10289                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10290                                     offsetof(struct __sk_buff, len)),
10291                         BPF_EXIT_INSN(),
10292                 },
10293                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
10294                 .result = ACCEPT,
10295                 .retval = TEST_DATA_LEN,
10296         },
10297         {
10298                 "calls: callee using args1",
10299                 .insns = {
10300                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10301                         BPF_EXIT_INSN(),
10302                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10303                         BPF_EXIT_INSN(),
10304                 },
10305                 .errstr_unpriv = "allowed for root only",
10306                 .result_unpriv = REJECT,
10307                 .result = ACCEPT,
10308                 .retval = POINTER_VALUE,
10309         },
10310         {
10311                 "calls: callee using wrong args2",
10312                 .insns = {
10313                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10314                         BPF_EXIT_INSN(),
10315                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10316                         BPF_EXIT_INSN(),
10317                 },
10318                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10319                 .errstr = "R2 !read_ok",
10320                 .result = REJECT,
10321         },
10322         {
10323                 "calls: callee using two args",
10324                 .insns = {
10325                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10326                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
10327                                     offsetof(struct __sk_buff, len)),
10328                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
10329                                     offsetof(struct __sk_buff, len)),
10330                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10331                         BPF_EXIT_INSN(),
10332                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10333                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
10334                         BPF_EXIT_INSN(),
10335                 },
10336                 .errstr_unpriv = "allowed for root only",
10337                 .result_unpriv = REJECT,
10338                 .result = ACCEPT,
10339                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
10340         },
10341         {
10342                 "calls: callee changing pkt pointers",
10343                 .insns = {
10344                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
10345                                     offsetof(struct xdp_md, data)),
10346                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
10347                                     offsetof(struct xdp_md, data_end)),
10348                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
10349                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
10350                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
10351                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10352                         /* clear_all_pkt_pointers() has to walk all frames
10353                          * to make sure that pkt pointers in the caller
10354                          * are cleared when callee is calling a helper that
10355                          * adjusts packet size
10356                          */
10357                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10358                         BPF_MOV32_IMM(BPF_REG_0, 0),
10359                         BPF_EXIT_INSN(),
10360                         BPF_MOV64_IMM(BPF_REG_2, 0),
10361                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10362                                      BPF_FUNC_xdp_adjust_head),
10363                         BPF_EXIT_INSN(),
10364                 },
10365                 .result = REJECT,
10366                 .errstr = "R6 invalid mem access 'inv'",
10367                 .prog_type = BPF_PROG_TYPE_XDP,
10368         },
10369         {
10370                 "calls: two calls with args",
10371                 .insns = {
10372                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10373                         BPF_EXIT_INSN(),
10374                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10375                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10376                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10377                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10378                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10379                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10380                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10381                         BPF_EXIT_INSN(),
10382                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10383                                     offsetof(struct __sk_buff, len)),
10384                         BPF_EXIT_INSN(),
10385                 },
10386                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10387                 .result = ACCEPT,
10388                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
10389         },
10390         {
10391                 "calls: calls with stack arith",
10392                 .insns = {
10393                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10394                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10395                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10396                         BPF_EXIT_INSN(),
10397                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10398                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10399                         BPF_EXIT_INSN(),
10400                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10401                         BPF_MOV64_IMM(BPF_REG_0, 42),
10402                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10403                         BPF_EXIT_INSN(),
10404                 },
10405                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10406                 .result = ACCEPT,
10407                 .retval = 42,
10408         },
10409         {
10410                 "calls: calls with misaligned stack access",
10411                 .insns = {
10412                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10413                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10415                         BPF_EXIT_INSN(),
10416                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
10417                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10418                         BPF_EXIT_INSN(),
10419                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10420                         BPF_MOV64_IMM(BPF_REG_0, 42),
10421                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10422                         BPF_EXIT_INSN(),
10423                 },
10424                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10425                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
10426                 .errstr = "misaligned stack access",
10427                 .result = REJECT,
10428         },
10429         {
10430                 "calls: calls control flow, jump test",
10431                 .insns = {
10432                         BPF_MOV64_IMM(BPF_REG_0, 42),
10433                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10434                         BPF_MOV64_IMM(BPF_REG_0, 43),
10435                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10436                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10437                         BPF_EXIT_INSN(),
10438                 },
10439                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10440                 .result = ACCEPT,
10441                 .retval = 43,
10442         },
10443         {
10444                 "calls: calls control flow, jump test 2",
10445                 .insns = {
10446                         BPF_MOV64_IMM(BPF_REG_0, 42),
10447                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10448                         BPF_MOV64_IMM(BPF_REG_0, 43),
10449                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10450                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10451                         BPF_EXIT_INSN(),
10452                 },
10453                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10454                 .errstr = "jump out of range from insn 1 to 4",
10455                 .result = REJECT,
10456         },
10457         {
10458                 "calls: two calls with bad jump",
10459                 .insns = {
10460                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10461                         BPF_EXIT_INSN(),
10462                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10463                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10464                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10465                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10467                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10468                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10469                         BPF_EXIT_INSN(),
10470                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10471                                     offsetof(struct __sk_buff, len)),
10472                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
10473                         BPF_EXIT_INSN(),
10474                 },
10475                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10476                 .errstr = "jump out of range from insn 11 to 9",
10477                 .result = REJECT,
10478         },
10479         {
10480                 "calls: recursive call. test1",
10481                 .insns = {
10482                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10483                         BPF_EXIT_INSN(),
10484                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10485                         BPF_EXIT_INSN(),
10486                 },
10487                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10488                 .errstr = "back-edge",
10489                 .result = REJECT,
10490         },
10491         {
10492                 "calls: recursive call. test2",
10493                 .insns = {
10494                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10495                         BPF_EXIT_INSN(),
10496                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10497                         BPF_EXIT_INSN(),
10498                 },
10499                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10500                 .errstr = "back-edge",
10501                 .result = REJECT,
10502         },
10503         {
10504                 "calls: unreachable code",
10505                 .insns = {
10506                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10507                         BPF_EXIT_INSN(),
10508                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10509                         BPF_EXIT_INSN(),
10510                         BPF_MOV64_IMM(BPF_REG_0, 0),
10511                         BPF_EXIT_INSN(),
10512                         BPF_MOV64_IMM(BPF_REG_0, 0),
10513                         BPF_EXIT_INSN(),
10514                 },
10515                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10516                 .errstr = "unreachable insn 6",
10517                 .result = REJECT,
10518         },
10519         {
10520                 "calls: invalid call",
10521                 .insns = {
10522                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10523                         BPF_EXIT_INSN(),
10524                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
10525                         BPF_EXIT_INSN(),
10526                 },
10527                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10528                 .errstr = "invalid destination",
10529                 .result = REJECT,
10530         },
10531         {
10532                 "calls: invalid call 2",
10533                 .insns = {
10534                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10535                         BPF_EXIT_INSN(),
10536                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
10537                         BPF_EXIT_INSN(),
10538                 },
10539                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10540                 .errstr = "invalid destination",
10541                 .result = REJECT,
10542         },
10543         {
10544                 "calls: jumping across function bodies. test1",
10545                 .insns = {
10546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10547                         BPF_MOV64_IMM(BPF_REG_0, 0),
10548                         BPF_EXIT_INSN(),
10549                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
10550                         BPF_EXIT_INSN(),
10551                 },
10552                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10553                 .errstr = "jump out of range",
10554                 .result = REJECT,
10555         },
10556         {
10557                 "calls: jumping across function bodies. test2",
10558                 .insns = {
10559                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
10560                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10561                         BPF_MOV64_IMM(BPF_REG_0, 0),
10562                         BPF_EXIT_INSN(),
10563                         BPF_EXIT_INSN(),
10564                 },
10565                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10566                 .errstr = "jump out of range",
10567                 .result = REJECT,
10568         },
10569         {
10570                 "calls: call without exit",
10571                 .insns = {
10572                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10573                         BPF_EXIT_INSN(),
10574                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10575                         BPF_EXIT_INSN(),
10576                         BPF_MOV64_IMM(BPF_REG_0, 0),
10577                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
10578                 },
10579                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10580                 .errstr = "not an exit",
10581                 .result = REJECT,
10582         },
10583         {
10584                 "calls: call into middle of ld_imm64",
10585                 .insns = {
10586                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10587                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10588                         BPF_MOV64_IMM(BPF_REG_0, 0),
10589                         BPF_EXIT_INSN(),
10590                         BPF_LD_IMM64(BPF_REG_0, 0),
10591                         BPF_EXIT_INSN(),
10592                 },
10593                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10594                 .errstr = "last insn",
10595                 .result = REJECT,
10596         },
10597         {
10598                 "calls: call into middle of other call",
10599                 .insns = {
10600                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10601                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10602                         BPF_MOV64_IMM(BPF_REG_0, 0),
10603                         BPF_EXIT_INSN(),
10604                         BPF_MOV64_IMM(BPF_REG_0, 0),
10605                         BPF_MOV64_IMM(BPF_REG_0, 0),
10606                         BPF_EXIT_INSN(),
10607                 },
10608                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10609                 .errstr = "last insn",
10610                 .result = REJECT,
10611         },
10612         {
10613                 "calls: ld_abs with changing ctx data in callee",
10614                 .insns = {
10615                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10616                         BPF_LD_ABS(BPF_B, 0),
10617                         BPF_LD_ABS(BPF_H, 0),
10618                         BPF_LD_ABS(BPF_W, 0),
10619                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
10620                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10621                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
10622                         BPF_LD_ABS(BPF_B, 0),
10623                         BPF_LD_ABS(BPF_H, 0),
10624                         BPF_LD_ABS(BPF_W, 0),
10625                         BPF_EXIT_INSN(),
10626                         BPF_MOV64_IMM(BPF_REG_2, 1),
10627                         BPF_MOV64_IMM(BPF_REG_3, 2),
10628                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10629                                      BPF_FUNC_skb_vlan_push),
10630                         BPF_EXIT_INSN(),
10631                 },
10632                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10633                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
10634                 .result = REJECT,
10635         },
10636         {
10637                 "calls: two calls with bad fallthrough",
10638                 .insns = {
10639                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10640                         BPF_EXIT_INSN(),
10641                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10642                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10643                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10644                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10645                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10646                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10647                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10648                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
10649                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10650                                     offsetof(struct __sk_buff, len)),
10651                         BPF_EXIT_INSN(),
10652                 },
10653                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10654                 .errstr = "not an exit",
10655                 .result = REJECT,
10656         },
10657         {
10658                 "calls: two calls with stack read",
10659                 .insns = {
10660                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10661                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10662                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10663                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10664                         BPF_EXIT_INSN(),
10665                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10666                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10667                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10668                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10670                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10671                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10672                         BPF_EXIT_INSN(),
10673                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10674                         BPF_EXIT_INSN(),
10675                 },
10676                 .prog_type = BPF_PROG_TYPE_XDP,
10677                 .result = ACCEPT,
10678         },
10679         {
10680                 "calls: two calls with stack write",
10681                 .insns = {
10682                         /* main prog */
10683                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10684                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10685                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10686                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10688                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10689                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10690                         BPF_EXIT_INSN(),
10691
10692                         /* subprog 1 */
10693                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10694                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10695                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
10696                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
10697                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10698                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10699                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
10700                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
10701                         /* write into stack frame of main prog */
10702                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10703                         BPF_EXIT_INSN(),
10704
10705                         /* subprog 2 */
10706                         /* read from stack frame of main prog */
10707                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10708                         BPF_EXIT_INSN(),
10709                 },
10710                 .prog_type = BPF_PROG_TYPE_XDP,
10711                 .result = ACCEPT,
10712         },
10713         {
10714                 "calls: stack overflow using two frames (pre-call access)",
10715                 .insns = {
10716                         /* prog 1 */
10717                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10718                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
10719                         BPF_EXIT_INSN(),
10720
10721                         /* prog 2 */
10722                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10723                         BPF_MOV64_IMM(BPF_REG_0, 0),
10724                         BPF_EXIT_INSN(),
10725                 },
10726                 .prog_type = BPF_PROG_TYPE_XDP,
10727                 .errstr = "combined stack size",
10728                 .result = REJECT,
10729         },
10730         {
10731                 "calls: stack overflow using two frames (post-call access)",
10732                 .insns = {
10733                         /* prog 1 */
10734                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
10735                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10736                         BPF_EXIT_INSN(),
10737
10738                         /* prog 2 */
10739                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10740                         BPF_MOV64_IMM(BPF_REG_0, 0),
10741                         BPF_EXIT_INSN(),
10742                 },
10743                 .prog_type = BPF_PROG_TYPE_XDP,
10744                 .errstr = "combined stack size",
10745                 .result = REJECT,
10746         },
10747         {
10748                 "calls: stack depth check using three frames. test1",
10749                 .insns = {
10750                         /* main */
10751                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10752                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10753                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10754                         BPF_MOV64_IMM(BPF_REG_0, 0),
10755                         BPF_EXIT_INSN(),
10756                         /* A */
10757                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10758                         BPF_EXIT_INSN(),
10759                         /* B */
10760                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10761                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10762                         BPF_EXIT_INSN(),
10763                 },
10764                 .prog_type = BPF_PROG_TYPE_XDP,
10765                 /* stack_main=32, stack_A=256, stack_B=64
10766                  * and max(main+A, main+A+B) < 512
10767                  */
10768                 .result = ACCEPT,
10769         },
10770         {
10771                 "calls: stack depth check using three frames. test2",
10772                 .insns = {
10773                         /* main */
10774                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10775                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10776                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10777                         BPF_MOV64_IMM(BPF_REG_0, 0),
10778                         BPF_EXIT_INSN(),
10779                         /* A */
10780                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10781                         BPF_EXIT_INSN(),
10782                         /* B */
10783                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10784                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10785                         BPF_EXIT_INSN(),
10786                 },
10787                 .prog_type = BPF_PROG_TYPE_XDP,
10788                 /* stack_main=32, stack_A=64, stack_B=256
10789                  * and max(main+A, main+A+B) < 512
10790                  */
10791                 .result = ACCEPT,
10792         },
10793         {
10794                 "calls: stack depth check using three frames. test3",
10795                 .insns = {
10796                         /* main */
10797                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10798                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10799                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10800                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
10801                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
10802                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10803                         BPF_MOV64_IMM(BPF_REG_0, 0),
10804                         BPF_EXIT_INSN(),
10805                         /* A */
10806                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
10807                         BPF_EXIT_INSN(),
10808                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
10809                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10810                         /* B */
10811                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
10812                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
10813                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10814                         BPF_EXIT_INSN(),
10815                 },
10816                 .prog_type = BPF_PROG_TYPE_XDP,
10817                 /* stack_main=64, stack_A=224, stack_B=256
10818                  * and max(main+A, main+A+B) > 512
10819                  */
10820                 .errstr = "combined stack",
10821                 .result = REJECT,
10822         },
10823         {
10824                 "calls: stack depth check using three frames. test4",
10825                 /* void main(void) {
10826                  *   func1(0);
10827                  *   func1(1);
10828                  *   func2(1);
10829                  * }
10830                  * void func1(int alloc_or_recurse) {
10831                  *   if (alloc_or_recurse) {
10832                  *     frame_pointer[-300] = 1;
10833                  *   } else {
10834                  *     func2(alloc_or_recurse);
10835                  *   }
10836                  * }
10837                  * void func2(int alloc_or_recurse) {
10838                  *   if (alloc_or_recurse) {
10839                  *     frame_pointer[-300] = 1;
10840                  *   }
10841                  * }
10842                  */
10843                 .insns = {
10844                         /* main */
10845                         BPF_MOV64_IMM(BPF_REG_1, 0),
10846                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10847                         BPF_MOV64_IMM(BPF_REG_1, 1),
10848                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10849                         BPF_MOV64_IMM(BPF_REG_1, 1),
10850                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
10851                         BPF_MOV64_IMM(BPF_REG_0, 0),
10852                         BPF_EXIT_INSN(),
10853                         /* A */
10854                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
10855                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10856                         BPF_EXIT_INSN(),
10857                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10858                         BPF_EXIT_INSN(),
10859                         /* B */
10860                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10861                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10862                         BPF_EXIT_INSN(),
10863                 },
10864                 .prog_type = BPF_PROG_TYPE_XDP,
10865                 .result = REJECT,
10866                 .errstr = "combined stack",
10867         },
10868         {
10869                 "calls: stack depth check using three frames. test5",
10870                 .insns = {
10871                         /* main */
10872                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
10873                         BPF_EXIT_INSN(),
10874                         /* A */
10875                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10876                         BPF_EXIT_INSN(),
10877                         /* B */
10878                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
10879                         BPF_EXIT_INSN(),
10880                         /* C */
10881                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
10882                         BPF_EXIT_INSN(),
10883                         /* D */
10884                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
10885                         BPF_EXIT_INSN(),
10886                         /* E */
10887                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
10888                         BPF_EXIT_INSN(),
10889                         /* F */
10890                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
10891                         BPF_EXIT_INSN(),
10892                         /* G */
10893                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
10894                         BPF_EXIT_INSN(),
10895                         /* H */
10896                         BPF_MOV64_IMM(BPF_REG_0, 0),
10897                         BPF_EXIT_INSN(),
10898                 },
10899                 .prog_type = BPF_PROG_TYPE_XDP,
10900                 .errstr = "call stack",
10901                 .result = REJECT,
10902         },
10903         {
10904                 "calls: spill into caller stack frame",
10905                 .insns = {
10906                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10907                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10908                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10909                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10910                         BPF_EXIT_INSN(),
10911                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
10912                         BPF_MOV64_IMM(BPF_REG_0, 0),
10913                         BPF_EXIT_INSN(),
10914                 },
10915                 .prog_type = BPF_PROG_TYPE_XDP,
10916                 .errstr = "cannot spill",
10917                 .result = REJECT,
10918         },
10919         {
10920                 "calls: write into caller stack frame",
10921                 .insns = {
10922                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10923                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10924                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10925                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10926                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10927                         BPF_EXIT_INSN(),
10928                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
10929                         BPF_MOV64_IMM(BPF_REG_0, 0),
10930                         BPF_EXIT_INSN(),
10931                 },
10932                 .prog_type = BPF_PROG_TYPE_XDP,
10933                 .result = ACCEPT,
10934                 .retval = 42,
10935         },
10936         {
10937                 "calls: write into callee stack frame",
10938                 .insns = {
10939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10940                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
10941                         BPF_EXIT_INSN(),
10942                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
10943                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
10944                         BPF_EXIT_INSN(),
10945                 },
10946                 .prog_type = BPF_PROG_TYPE_XDP,
10947                 .errstr = "cannot return stack pointer",
10948                 .result = REJECT,
10949         },
10950         {
10951                 "calls: two calls with stack write and void return",
10952                 .insns = {
10953                         /* main prog */
10954                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10955                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10956                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10957                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10958                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10959                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10960                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10961                         BPF_EXIT_INSN(),
10962
10963                         /* subprog 1 */
10964                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10965                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10966                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10967                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10968                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10969                         BPF_EXIT_INSN(),
10970
10971                         /* subprog 2 */
10972                         /* write into stack frame of main prog */
10973                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
10974                         BPF_EXIT_INSN(), /* void return */
10975                 },
10976                 .prog_type = BPF_PROG_TYPE_XDP,
10977                 .result = ACCEPT,
10978         },
10979         {
10980                 "calls: ambiguous return value",
10981                 .insns = {
10982                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10983                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10984                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10985                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10986                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10987                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10988                         BPF_EXIT_INSN(),
10989                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10990                         BPF_MOV64_IMM(BPF_REG_0, 0),
10991                         BPF_EXIT_INSN(),
10992                 },
10993                 .errstr_unpriv = "allowed for root only",
10994                 .result_unpriv = REJECT,
10995                 .errstr = "R0 !read_ok",
10996                 .result = REJECT,
10997         },
10998         {
10999                 "calls: two calls that return map_value",
11000                 .insns = {
11001                         /* main prog */
11002                         /* pass fp-16, fp-8 into a function */
11003                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11004                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11005                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11007                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
11008
11009                         /* fetch map_value_ptr from the stack of this function */
11010                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11011                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11012                         /* write into map value */
11013                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11014                         /* fetch secound map_value_ptr from the stack */
11015                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11016                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11017                         /* write into map value */
11018                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11019                         BPF_MOV64_IMM(BPF_REG_0, 0),
11020                         BPF_EXIT_INSN(),
11021
11022                         /* subprog 1 */
11023                         /* call 3rd function twice */
11024                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11025                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11026                         /* first time with fp-8 */
11027                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11028                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11029                         /* second time with fp-16 */
11030                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11031                         BPF_EXIT_INSN(),
11032
11033                         /* subprog 2 */
11034                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11035                         /* lookup from map */
11036                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11037                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11038                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11039                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11040                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11041                                      BPF_FUNC_map_lookup_elem),
11042                         /* write map_value_ptr into stack frame of main prog */
11043                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11044                         BPF_MOV64_IMM(BPF_REG_0, 0),
11045                         BPF_EXIT_INSN(), /* return 0 */
11046                 },
11047                 .prog_type = BPF_PROG_TYPE_XDP,
11048                 .fixup_map1 = { 23 },
11049                 .result = ACCEPT,
11050         },
11051         {
11052                 "calls: two calls that return map_value with bool condition",
11053                 .insns = {
11054                         /* main prog */
11055                         /* pass fp-16, fp-8 into a function */
11056                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11058                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11059                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11060                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11061                         BPF_MOV64_IMM(BPF_REG_0, 0),
11062                         BPF_EXIT_INSN(),
11063
11064                         /* subprog 1 */
11065                         /* call 3rd function twice */
11066                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11067                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11068                         /* first time with fp-8 */
11069                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11070                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11071                         /* fetch map_value_ptr from the stack of this function */
11072                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11073                         /* write into map value */
11074                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11075                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11076                         /* second time with fp-16 */
11077                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11078                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11079                         /* fetch secound map_value_ptr from the stack */
11080                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11081                         /* write into map value */
11082                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11083                         BPF_EXIT_INSN(),
11084
11085                         /* subprog 2 */
11086                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11087                         /* lookup from map */
11088                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11089                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11090                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11091                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11092                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11093                                      BPF_FUNC_map_lookup_elem),
11094                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11095                         BPF_MOV64_IMM(BPF_REG_0, 0),
11096                         BPF_EXIT_INSN(), /* return 0 */
11097                         /* write map_value_ptr into stack frame of main prog */
11098                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11099                         BPF_MOV64_IMM(BPF_REG_0, 1),
11100                         BPF_EXIT_INSN(), /* return 1 */
11101                 },
11102                 .prog_type = BPF_PROG_TYPE_XDP,
11103                 .fixup_map1 = { 23 },
11104                 .result = ACCEPT,
11105         },
11106         {
11107                 "calls: two calls that return map_value with incorrect bool check",
11108                 .insns = {
11109                         /* main prog */
11110                         /* pass fp-16, fp-8 into a function */
11111                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11112                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11113                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11115                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11116                         BPF_MOV64_IMM(BPF_REG_0, 0),
11117                         BPF_EXIT_INSN(),
11118
11119                         /* subprog 1 */
11120                         /* call 3rd function twice */
11121                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11122                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11123                         /* first time with fp-8 */
11124                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11125                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11126                         /* fetch map_value_ptr from the stack of this function */
11127                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11128                         /* write into map value */
11129                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11130                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11131                         /* second time with fp-16 */
11132                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11133                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11134                         /* fetch secound map_value_ptr from the stack */
11135                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11136                         /* write into map value */
11137                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11138                         BPF_EXIT_INSN(),
11139
11140                         /* subprog 2 */
11141                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11142                         /* lookup from map */
11143                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11144                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11145                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11146                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11147                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11148                                      BPF_FUNC_map_lookup_elem),
11149                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11150                         BPF_MOV64_IMM(BPF_REG_0, 0),
11151                         BPF_EXIT_INSN(), /* return 0 */
11152                         /* write map_value_ptr into stack frame of main prog */
11153                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11154                         BPF_MOV64_IMM(BPF_REG_0, 1),
11155                         BPF_EXIT_INSN(), /* return 1 */
11156                 },
11157                 .prog_type = BPF_PROG_TYPE_XDP,
11158                 .fixup_map1 = { 23 },
11159                 .result = REJECT,
11160                 .errstr = "invalid read from stack off -16+0 size 8",
11161         },
11162         {
11163                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
11164                 .insns = {
11165                         /* main prog */
11166                         /* pass fp-16, fp-8 into a function */
11167                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11168                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11169                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11171                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11172                         BPF_MOV64_IMM(BPF_REG_0, 0),
11173                         BPF_EXIT_INSN(),
11174
11175                         /* subprog 1 */
11176                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11177                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11178                         /* 1st lookup from map */
11179                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11180                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11181                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11182                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11183                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11184                                      BPF_FUNC_map_lookup_elem),
11185                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11186                         BPF_MOV64_IMM(BPF_REG_8, 0),
11187                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11188                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11189                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11190                         BPF_MOV64_IMM(BPF_REG_8, 1),
11191
11192                         /* 2nd lookup from map */
11193                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11195                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11196                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11197                                      BPF_FUNC_map_lookup_elem),
11198                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11199                         BPF_MOV64_IMM(BPF_REG_9, 0),
11200                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11201                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11202                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11203                         BPF_MOV64_IMM(BPF_REG_9, 1),
11204
11205                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11206                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11207                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11208                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11209                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11210                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11211                         BPF_EXIT_INSN(),
11212
11213                         /* subprog 2 */
11214                         /* if arg2 == 1 do *arg1 = 0 */
11215                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11216                         /* fetch map_value_ptr from the stack of this function */
11217                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11218                         /* write into map value */
11219                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11220
11221                         /* if arg4 == 1 do *arg3 = 0 */
11222                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11223                         /* fetch map_value_ptr from the stack of this function */
11224                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11225                         /* write into map value */
11226                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11227                         BPF_EXIT_INSN(),
11228                 },
11229                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11230                 .fixup_map1 = { 12, 22 },
11231                 .result = REJECT,
11232                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11233         },
11234         {
11235                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
11236                 .insns = {
11237                         /* main prog */
11238                         /* pass fp-16, fp-8 into a function */
11239                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11241                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11242                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11243                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11244                         BPF_MOV64_IMM(BPF_REG_0, 0),
11245                         BPF_EXIT_INSN(),
11246
11247                         /* subprog 1 */
11248                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11249                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11250                         /* 1st lookup from map */
11251                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11252                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11253                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11254                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11255                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11256                                      BPF_FUNC_map_lookup_elem),
11257                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11258                         BPF_MOV64_IMM(BPF_REG_8, 0),
11259                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11260                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11261                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11262                         BPF_MOV64_IMM(BPF_REG_8, 1),
11263
11264                         /* 2nd lookup from map */
11265                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11266                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11267                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11268                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11269                                      BPF_FUNC_map_lookup_elem),
11270                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11271                         BPF_MOV64_IMM(BPF_REG_9, 0),
11272                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11273                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11274                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11275                         BPF_MOV64_IMM(BPF_REG_9, 1),
11276
11277                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11278                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11279                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11280                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11281                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11282                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11283                         BPF_EXIT_INSN(),
11284
11285                         /* subprog 2 */
11286                         /* if arg2 == 1 do *arg1 = 0 */
11287                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11288                         /* fetch map_value_ptr from the stack of this function */
11289                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11290                         /* write into map value */
11291                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11292
11293                         /* if arg4 == 1 do *arg3 = 0 */
11294                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11295                         /* fetch map_value_ptr from the stack of this function */
11296                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11297                         /* write into map value */
11298                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11299                         BPF_EXIT_INSN(),
11300                 },
11301                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11302                 .fixup_map1 = { 12, 22 },
11303                 .result = ACCEPT,
11304         },
11305         {
11306                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
11307                 .insns = {
11308                         /* main prog */
11309                         /* pass fp-16, fp-8 into a function */
11310                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11311                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11312                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11313                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11314                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11315                         BPF_MOV64_IMM(BPF_REG_0, 0),
11316                         BPF_EXIT_INSN(),
11317
11318                         /* subprog 1 */
11319                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11320                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11321                         /* 1st lookup from map */
11322                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
11323                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11324                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11325                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11326                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11327                                      BPF_FUNC_map_lookup_elem),
11328                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11329                         BPF_MOV64_IMM(BPF_REG_8, 0),
11330                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11331                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11332                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11333                         BPF_MOV64_IMM(BPF_REG_8, 1),
11334
11335                         /* 2nd lookup from map */
11336                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11337                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11338                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11339                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11340                                      BPF_FUNC_map_lookup_elem),
11341                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11342                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
11343                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11344                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11345                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11346                         BPF_MOV64_IMM(BPF_REG_9, 1),
11347
11348                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11349                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
11350                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11351                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11352                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11353                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
11354                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
11355
11356                         /* subprog 2 */
11357                         /* if arg2 == 1 do *arg1 = 0 */
11358                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11359                         /* fetch map_value_ptr from the stack of this function */
11360                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11361                         /* write into map value */
11362                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11363
11364                         /* if arg4 == 1 do *arg3 = 0 */
11365                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11366                         /* fetch map_value_ptr from the stack of this function */
11367                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11368                         /* write into map value */
11369                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11370                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
11371                 },
11372                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11373                 .fixup_map1 = { 12, 22 },
11374                 .result = REJECT,
11375                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11376         },
11377         {
11378                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
11379                 .insns = {
11380                         /* main prog */
11381                         /* pass fp-16, fp-8 into a function */
11382                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11383                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11386                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11387                         BPF_MOV64_IMM(BPF_REG_0, 0),
11388                         BPF_EXIT_INSN(),
11389
11390                         /* subprog 1 */
11391                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11392                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11393                         /* 1st lookup from map */
11394                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11395                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11396                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11397                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11398                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11399                                      BPF_FUNC_map_lookup_elem),
11400                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11401                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11402                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11403                         BPF_MOV64_IMM(BPF_REG_8, 0),
11404                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11405                         BPF_MOV64_IMM(BPF_REG_8, 1),
11406
11407                         /* 2nd lookup from map */
11408                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11409                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11410                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11411                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11412                                      BPF_FUNC_map_lookup_elem),
11413                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11414                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11415                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11416                         BPF_MOV64_IMM(BPF_REG_9, 0),
11417                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11418                         BPF_MOV64_IMM(BPF_REG_9, 1),
11419
11420                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11421                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11422                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11423                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11424                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11425                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11426                         BPF_EXIT_INSN(),
11427
11428                         /* subprog 2 */
11429                         /* if arg2 == 1 do *arg1 = 0 */
11430                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11431                         /* fetch map_value_ptr from the stack of this function */
11432                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11433                         /* write into map value */
11434                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11435
11436                         /* if arg4 == 1 do *arg3 = 0 */
11437                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11438                         /* fetch map_value_ptr from the stack of this function */
11439                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11440                         /* write into map value */
11441                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11442                         BPF_EXIT_INSN(),
11443                 },
11444                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11445                 .fixup_map1 = { 12, 22 },
11446                 .result = ACCEPT,
11447         },
11448         {
11449                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
11450                 .insns = {
11451                         /* main prog */
11452                         /* pass fp-16, fp-8 into a function */
11453                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11454                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11455                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11457                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11458                         BPF_MOV64_IMM(BPF_REG_0, 0),
11459                         BPF_EXIT_INSN(),
11460
11461                         /* subprog 1 */
11462                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11463                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11464                         /* 1st lookup from map */
11465                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11466                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11467                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11468                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11469                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11470                                      BPF_FUNC_map_lookup_elem),
11471                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11472                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11473                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11474                         BPF_MOV64_IMM(BPF_REG_8, 0),
11475                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11476                         BPF_MOV64_IMM(BPF_REG_8, 1),
11477
11478                         /* 2nd lookup from map */
11479                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11480                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11481                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11482                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11483                                      BPF_FUNC_map_lookup_elem),
11484                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11485                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11486                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11487                         BPF_MOV64_IMM(BPF_REG_9, 0),
11488                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11489                         BPF_MOV64_IMM(BPF_REG_9, 1),
11490
11491                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11492                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11493                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11494                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11495                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11496                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11497                         BPF_EXIT_INSN(),
11498
11499                         /* subprog 2 */
11500                         /* if arg2 == 1 do *arg1 = 0 */
11501                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11502                         /* fetch map_value_ptr from the stack of this function */
11503                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11504                         /* write into map value */
11505                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11506
11507                         /* if arg4 == 0 do *arg3 = 0 */
11508                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
11509                         /* fetch map_value_ptr from the stack of this function */
11510                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11511                         /* write into map value */
11512                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11513                         BPF_EXIT_INSN(),
11514                 },
11515                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11516                 .fixup_map1 = { 12, 22 },
11517                 .result = REJECT,
11518                 .errstr = "R0 invalid mem access 'inv'",
11519         },
11520         {
11521                 "calls: pkt_ptr spill into caller stack",
11522                 .insns = {
11523                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11524                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11526                         BPF_EXIT_INSN(),
11527
11528                         /* subprog 1 */
11529                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11530                                     offsetof(struct __sk_buff, data)),
11531                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11532                                     offsetof(struct __sk_buff, data_end)),
11533                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11535                         /* spill unchecked pkt_ptr into stack of caller */
11536                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11537                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11538                         /* now the pkt range is verified, read pkt_ptr from stack */
11539                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11540                         /* write 4 bytes into packet */
11541                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11542                         BPF_EXIT_INSN(),
11543                 },
11544                 .result = ACCEPT,
11545                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11546                 .retval = POINTER_VALUE,
11547         },
11548         {
11549                 "calls: pkt_ptr spill into caller stack 2",
11550                 .insns = {
11551                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11553                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11554                         /* Marking is still kept, but not in all cases safe. */
11555                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11556                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11557                         BPF_EXIT_INSN(),
11558
11559                         /* subprog 1 */
11560                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11561                                     offsetof(struct __sk_buff, data)),
11562                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11563                                     offsetof(struct __sk_buff, data_end)),
11564                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11565                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11566                         /* spill unchecked pkt_ptr into stack of caller */
11567                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11568                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11569                         /* now the pkt range is verified, read pkt_ptr from stack */
11570                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11571                         /* write 4 bytes into packet */
11572                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11573                         BPF_EXIT_INSN(),
11574                 },
11575                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11576                 .errstr = "invalid access to packet",
11577                 .result = REJECT,
11578         },
11579         {
11580                 "calls: pkt_ptr spill into caller stack 3",
11581                 .insns = {
11582                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11583                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11584                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11585                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11586                         /* Marking is still kept and safe here. */
11587                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11588                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11589                         BPF_EXIT_INSN(),
11590
11591                         /* subprog 1 */
11592                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11593                                     offsetof(struct __sk_buff, data)),
11594                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11595                                     offsetof(struct __sk_buff, data_end)),
11596                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11598                         /* spill unchecked pkt_ptr into stack of caller */
11599                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11600                         BPF_MOV64_IMM(BPF_REG_5, 0),
11601                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11602                         BPF_MOV64_IMM(BPF_REG_5, 1),
11603                         /* now the pkt range is verified, read pkt_ptr from stack */
11604                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11605                         /* write 4 bytes into packet */
11606                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11607                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11608                         BPF_EXIT_INSN(),
11609                 },
11610                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11611                 .result = ACCEPT,
11612                 .retval = 1,
11613         },
11614         {
11615                 "calls: pkt_ptr spill into caller stack 4",
11616                 .insns = {
11617                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11618                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11619                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11620                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11621                         /* Check marking propagated. */
11622                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11623                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11624                         BPF_EXIT_INSN(),
11625
11626                         /* subprog 1 */
11627                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11628                                     offsetof(struct __sk_buff, data)),
11629                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11630                                     offsetof(struct __sk_buff, data_end)),
11631                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11632                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11633                         /* spill unchecked pkt_ptr into stack of caller */
11634                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11635                         BPF_MOV64_IMM(BPF_REG_5, 0),
11636                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11637                         BPF_MOV64_IMM(BPF_REG_5, 1),
11638                         /* don't read back pkt_ptr from stack here */
11639                         /* write 4 bytes into packet */
11640                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11641                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11642                         BPF_EXIT_INSN(),
11643                 },
11644                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11645                 .result = ACCEPT,
11646                 .retval = 1,
11647         },
11648         {
11649                 "calls: pkt_ptr spill into caller stack 5",
11650                 .insns = {
11651                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11652                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11653                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
11654                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11655                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11656                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11657                         BPF_EXIT_INSN(),
11658
11659                         /* subprog 1 */
11660                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11661                                     offsetof(struct __sk_buff, data)),
11662                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11663                                     offsetof(struct __sk_buff, data_end)),
11664                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11665                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11666                         BPF_MOV64_IMM(BPF_REG_5, 0),
11667                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11668                         /* spill checked pkt_ptr into stack of caller */
11669                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11670                         BPF_MOV64_IMM(BPF_REG_5, 1),
11671                         /* don't read back pkt_ptr from stack here */
11672                         /* write 4 bytes into packet */
11673                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11674                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11675                         BPF_EXIT_INSN(),
11676                 },
11677                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11678                 .errstr = "same insn cannot be used with different",
11679                 .result = REJECT,
11680         },
11681         {
11682                 "calls: pkt_ptr spill into caller stack 6",
11683                 .insns = {
11684                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11685                                     offsetof(struct __sk_buff, data_end)),
11686                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11688                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11689                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11690                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11691                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11692                         BPF_EXIT_INSN(),
11693
11694                         /* subprog 1 */
11695                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11696                                     offsetof(struct __sk_buff, data)),
11697                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11698                                     offsetof(struct __sk_buff, data_end)),
11699                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11701                         BPF_MOV64_IMM(BPF_REG_5, 0),
11702                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11703                         /* spill checked pkt_ptr into stack of caller */
11704                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11705                         BPF_MOV64_IMM(BPF_REG_5, 1),
11706                         /* don't read back pkt_ptr from stack here */
11707                         /* write 4 bytes into packet */
11708                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11709                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11710                         BPF_EXIT_INSN(),
11711                 },
11712                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11713                 .errstr = "R4 invalid mem access",
11714                 .result = REJECT,
11715         },
11716         {
11717                 "calls: pkt_ptr spill into caller stack 7",
11718                 .insns = {
11719                         BPF_MOV64_IMM(BPF_REG_2, 0),
11720                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11721                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11722                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11723                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11724                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11725                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11726                         BPF_EXIT_INSN(),
11727
11728                         /* subprog 1 */
11729                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11730                                     offsetof(struct __sk_buff, data)),
11731                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11732                                     offsetof(struct __sk_buff, data_end)),
11733                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11734                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11735                         BPF_MOV64_IMM(BPF_REG_5, 0),
11736                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11737                         /* spill checked pkt_ptr into stack of caller */
11738                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11739                         BPF_MOV64_IMM(BPF_REG_5, 1),
11740                         /* don't read back pkt_ptr from stack here */
11741                         /* write 4 bytes into packet */
11742                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11743                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11744                         BPF_EXIT_INSN(),
11745                 },
11746                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11747                 .errstr = "R4 invalid mem access",
11748                 .result = REJECT,
11749         },
11750         {
11751                 "calls: pkt_ptr spill into caller stack 8",
11752                 .insns = {
11753                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11754                                     offsetof(struct __sk_buff, data)),
11755                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11756                                     offsetof(struct __sk_buff, data_end)),
11757                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11758                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11759                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11760                         BPF_EXIT_INSN(),
11761                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11762                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11763                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11764                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11765                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11766                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11767                         BPF_EXIT_INSN(),
11768
11769                         /* subprog 1 */
11770                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11771                                     offsetof(struct __sk_buff, data)),
11772                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11773                                     offsetof(struct __sk_buff, data_end)),
11774                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11775                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11776                         BPF_MOV64_IMM(BPF_REG_5, 0),
11777                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11778                         /* spill checked pkt_ptr into stack of caller */
11779                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11780                         BPF_MOV64_IMM(BPF_REG_5, 1),
11781                         /* don't read back pkt_ptr from stack here */
11782                         /* write 4 bytes into packet */
11783                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11784                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11785                         BPF_EXIT_INSN(),
11786                 },
11787                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11788                 .result = ACCEPT,
11789         },
11790         {
11791                 "calls: pkt_ptr spill into caller stack 9",
11792                 .insns = {
11793                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11794                                     offsetof(struct __sk_buff, data)),
11795                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11796                                     offsetof(struct __sk_buff, data_end)),
11797                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11798                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11799                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11800                         BPF_EXIT_INSN(),
11801                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11802                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11803                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11804                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11805                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11806                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11807                         BPF_EXIT_INSN(),
11808
11809                         /* subprog 1 */
11810                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11811                                     offsetof(struct __sk_buff, data)),
11812                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11813                                     offsetof(struct __sk_buff, data_end)),
11814                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11816                         BPF_MOV64_IMM(BPF_REG_5, 0),
11817                         /* spill unchecked pkt_ptr into stack of caller */
11818                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11819                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11820                         BPF_MOV64_IMM(BPF_REG_5, 1),
11821                         /* don't read back pkt_ptr from stack here */
11822                         /* write 4 bytes into packet */
11823                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11824                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11825                         BPF_EXIT_INSN(),
11826                 },
11827                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11828                 .errstr = "invalid access to packet",
11829                 .result = REJECT,
11830         },
11831         {
11832                 "calls: caller stack init to zero or map_value_or_null",
11833                 .insns = {
11834                         BPF_MOV64_IMM(BPF_REG_0, 0),
11835                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11836                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11838                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11839                         /* fetch map_value_or_null or const_zero from stack */
11840                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11841                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11842                         /* store into map_value */
11843                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
11844                         BPF_EXIT_INSN(),
11845
11846                         /* subprog 1 */
11847                         /* if (ctx == 0) return; */
11848                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
11849                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
11850                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
11851                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11853                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11854                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11856                                      BPF_FUNC_map_lookup_elem),
11857                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11858                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11859                         BPF_EXIT_INSN(),
11860                 },
11861                 .fixup_map1 = { 13 },
11862                 .result = ACCEPT,
11863                 .prog_type = BPF_PROG_TYPE_XDP,
11864         },
11865         {
11866                 "calls: stack init to zero and pruning",
11867                 .insns = {
11868                         /* first make allocated_stack 16 byte */
11869                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
11870                         /* now fork the execution such that the false branch
11871                          * of JGT insn will be verified second and it skisp zero
11872                          * init of fp-8 stack slot. If stack liveness marking
11873                          * is missing live_read marks from call map_lookup
11874                          * processing then pruning will incorrectly assume
11875                          * that fp-8 stack slot was unused in the fall-through
11876                          * branch and will accept the program incorrectly
11877                          */
11878                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
11879                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11880                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
11881                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11882                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11883                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11884                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11885                                      BPF_FUNC_map_lookup_elem),
11886                         BPF_EXIT_INSN(),
11887                 },
11888                 .fixup_map2 = { 6 },
11889                 .errstr = "invalid indirect read from stack off -8+0 size 8",
11890                 .result = REJECT,
11891                 .prog_type = BPF_PROG_TYPE_XDP,
11892         },
11893         {
11894                 "calls: two calls returning different map pointers for lookup (hash, array)",
11895                 .insns = {
11896                         /* main prog */
11897                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11898                         BPF_CALL_REL(11),
11899                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11900                         BPF_CALL_REL(12),
11901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11902                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11903                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11904                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11905                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11906                                      BPF_FUNC_map_lookup_elem),
11907                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11908                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11909                                    offsetof(struct test_val, foo)),
11910                         BPF_MOV64_IMM(BPF_REG_0, 1),
11911                         BPF_EXIT_INSN(),
11912                         /* subprog 1 */
11913                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11914                         BPF_EXIT_INSN(),
11915                         /* subprog 2 */
11916                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11917                         BPF_EXIT_INSN(),
11918                 },
11919                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11920                 .fixup_map2 = { 13 },
11921                 .fixup_map4 = { 16 },
11922                 .result = ACCEPT,
11923                 .retval = 1,
11924         },
11925         {
11926                 "calls: two calls returning different map pointers for lookup (hash, map in map)",
11927                 .insns = {
11928                         /* main prog */
11929                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11930                         BPF_CALL_REL(11),
11931                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11932                         BPF_CALL_REL(12),
11933                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11934                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11935                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11936                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11937                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11938                                      BPF_FUNC_map_lookup_elem),
11939                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11940                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11941                                    offsetof(struct test_val, foo)),
11942                         BPF_MOV64_IMM(BPF_REG_0, 1),
11943                         BPF_EXIT_INSN(),
11944                         /* subprog 1 */
11945                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11946                         BPF_EXIT_INSN(),
11947                         /* subprog 2 */
11948                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11949                         BPF_EXIT_INSN(),
11950                 },
11951                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11952                 .fixup_map_in_map = { 16 },
11953                 .fixup_map4 = { 13 },
11954                 .result = REJECT,
11955                 .errstr = "R0 invalid mem access 'map_ptr'",
11956         },
11957         {
11958                 "cond: two branches returning different map pointers for lookup (tail, tail)",
11959                 .insns = {
11960                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11961                                     offsetof(struct __sk_buff, mark)),
11962                         BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
11963                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11964                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11965                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11966                         BPF_MOV64_IMM(BPF_REG_3, 7),
11967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11968                                      BPF_FUNC_tail_call),
11969                         BPF_MOV64_IMM(BPF_REG_0, 1),
11970                         BPF_EXIT_INSN(),
11971                 },
11972                 .fixup_prog1 = { 5 },
11973                 .fixup_prog2 = { 2 },
11974                 .result_unpriv = REJECT,
11975                 .errstr_unpriv = "tail_call abusing map_ptr",
11976                 .result = ACCEPT,
11977                 .retval = 42,
11978         },
11979         {
11980                 "cond: two branches returning same map pointers for lookup (tail, tail)",
11981                 .insns = {
11982                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11983                                     offsetof(struct __sk_buff, mark)),
11984                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
11985                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11986                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11987                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11988                         BPF_MOV64_IMM(BPF_REG_3, 7),
11989                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11990                                      BPF_FUNC_tail_call),
11991                         BPF_MOV64_IMM(BPF_REG_0, 1),
11992                         BPF_EXIT_INSN(),
11993                 },
11994                 .fixup_prog2 = { 2, 5 },
11995                 .result_unpriv = ACCEPT,
11996                 .result = ACCEPT,
11997                 .retval = 42,
11998         },
11999         {
12000                 "search pruning: all branches should be verified (nop operation)",
12001                 .insns = {
12002                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12003                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12004                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12005                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12006                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12007                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
12008                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12009                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12010                         BPF_MOV64_IMM(BPF_REG_4, 0),
12011                         BPF_JMP_A(1),
12012                         BPF_MOV64_IMM(BPF_REG_4, 1),
12013                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12014                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12015                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12016                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
12017                         BPF_MOV64_IMM(BPF_REG_6, 0),
12018                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
12019                         BPF_EXIT_INSN(),
12020                 },
12021                 .fixup_map1 = { 3 },
12022                 .errstr = "R6 invalid mem access 'inv'",
12023                 .result = REJECT,
12024                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12025         },
12026         {
12027                 "search pruning: all branches should be verified (invalid stack access)",
12028                 .insns = {
12029                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12031                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12032                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12033                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12034                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
12035                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12036                         BPF_MOV64_IMM(BPF_REG_4, 0),
12037                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12038                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12039                         BPF_JMP_A(1),
12040                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
12041                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12042                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12043                         BPF_EXIT_INSN(),
12044                 },
12045                 .fixup_map1 = { 3 },
12046                 .errstr = "invalid read from stack off -16+0 size 8",
12047                 .result = REJECT,
12048                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12049         },
12050         {
12051                 "jit: lsh, rsh, arsh by 1",
12052                 .insns = {
12053                         BPF_MOV64_IMM(BPF_REG_0, 1),
12054                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
12055                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
12056                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
12057                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
12058                         BPF_EXIT_INSN(),
12059                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
12060                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
12061                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
12062                         BPF_EXIT_INSN(),
12063                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
12064                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
12065                         BPF_EXIT_INSN(),
12066                         BPF_MOV64_IMM(BPF_REG_0, 2),
12067                         BPF_EXIT_INSN(),
12068                 },
12069                 .result = ACCEPT,
12070                 .retval = 2,
12071         },
12072         {
12073                 "jit: mov32 for ldimm64, 1",
12074                 .insns = {
12075                         BPF_MOV64_IMM(BPF_REG_0, 2),
12076                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
12077                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
12078                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
12079                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12080                         BPF_MOV64_IMM(BPF_REG_0, 1),
12081                         BPF_EXIT_INSN(),
12082                 },
12083                 .result = ACCEPT,
12084                 .retval = 2,
12085         },
12086         {
12087                 "jit: mov32 for ldimm64, 2",
12088                 .insns = {
12089                         BPF_MOV64_IMM(BPF_REG_0, 1),
12090                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
12091                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
12092                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12093                         BPF_MOV64_IMM(BPF_REG_0, 2),
12094                         BPF_EXIT_INSN(),
12095                 },
12096                 .result = ACCEPT,
12097                 .retval = 2,
12098         },
12099         {
12100                 "jit: various mul tests",
12101                 .insns = {
12102                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12103                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12104                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
12105                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12106                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12107                         BPF_MOV64_IMM(BPF_REG_0, 1),
12108                         BPF_EXIT_INSN(),
12109                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12110                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12111                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12112                         BPF_MOV64_IMM(BPF_REG_0, 1),
12113                         BPF_EXIT_INSN(),
12114                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
12115                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12116                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12117                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12118                         BPF_MOV64_IMM(BPF_REG_0, 1),
12119                         BPF_EXIT_INSN(),
12120                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12121                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12122                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12123                         BPF_MOV64_IMM(BPF_REG_0, 1),
12124                         BPF_EXIT_INSN(),
12125                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
12126                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
12127                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12128                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
12129                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
12130                         BPF_MOV64_IMM(BPF_REG_0, 1),
12131                         BPF_EXIT_INSN(),
12132                         BPF_MOV64_IMM(BPF_REG_0, 2),
12133                         BPF_EXIT_INSN(),
12134                 },
12135                 .result = ACCEPT,
12136                 .retval = 2,
12137         },
12138         {
12139                 "xadd/w check unaligned stack",
12140                 .insns = {
12141                         BPF_MOV64_IMM(BPF_REG_0, 1),
12142                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12143                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
12144                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12145                         BPF_EXIT_INSN(),
12146                 },
12147                 .result = REJECT,
12148                 .errstr = "misaligned stack access off",
12149                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12150         },
12151         {
12152                 "xadd/w check unaligned map",
12153                 .insns = {
12154                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12155                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12156                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12157                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12158                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12159                                      BPF_FUNC_map_lookup_elem),
12160                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
12161                         BPF_EXIT_INSN(),
12162                         BPF_MOV64_IMM(BPF_REG_1, 1),
12163                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
12164                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
12165                         BPF_EXIT_INSN(),
12166                 },
12167                 .fixup_map1 = { 3 },
12168                 .result = REJECT,
12169                 .errstr = "misaligned value access off",
12170                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12171         },
12172         {
12173                 "xadd/w check unaligned pkt",
12174                 .insns = {
12175                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12176                                     offsetof(struct xdp_md, data)),
12177                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12178                                     offsetof(struct xdp_md, data_end)),
12179                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
12180                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
12181                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
12182                         BPF_MOV64_IMM(BPF_REG_0, 99),
12183                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
12184                         BPF_MOV64_IMM(BPF_REG_0, 1),
12185                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12186                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
12187                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
12188                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
12189                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
12190                         BPF_EXIT_INSN(),
12191                 },
12192                 .result = REJECT,
12193                 .errstr = "BPF_XADD stores into R2 packet",
12194                 .prog_type = BPF_PROG_TYPE_XDP,
12195         },
12196         {
12197                 "xadd/w check whether src/dst got mangled, 1",
12198                 .insns = {
12199                         BPF_MOV64_IMM(BPF_REG_0, 1),
12200                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12201                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12202                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12203                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12204                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12205                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12206                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12207                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12208                         BPF_EXIT_INSN(),
12209                         BPF_MOV64_IMM(BPF_REG_0, 42),
12210                         BPF_EXIT_INSN(),
12211                 },
12212                 .result = ACCEPT,
12213                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12214                 .retval = 3,
12215         },
12216         {
12217                 "xadd/w check whether src/dst got mangled, 2",
12218                 .insns = {
12219                         BPF_MOV64_IMM(BPF_REG_0, 1),
12220                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12221                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12222                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12223                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12224                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12225                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12226                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12227                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
12228                         BPF_EXIT_INSN(),
12229                         BPF_MOV64_IMM(BPF_REG_0, 42),
12230                         BPF_EXIT_INSN(),
12231                 },
12232                 .result = ACCEPT,
12233                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12234                 .retval = 3,
12235         },
12236         {
12237                 "bpf_get_stack return R0 within range",
12238                 .insns = {
12239                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12240                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12241                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12242                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12243                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12244                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12245                                      BPF_FUNC_map_lookup_elem),
12246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
12247                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
12248                         BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)/2),
12249                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12250                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12251                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)/2),
12252                         BPF_MOV64_IMM(BPF_REG_4, 256),
12253                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12254                         BPF_MOV64_IMM(BPF_REG_1, 0),
12255                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
12256                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
12257                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
12258                         BPF_JMP_REG(BPF_JSLT, BPF_REG_8, BPF_REG_1, 16),
12259                         BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
12260                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12261                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
12262                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
12263                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
12264                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
12265                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12266                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
12267                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12268                         BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)/2),
12269                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
12270                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
12271                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12272                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
12273                         BPF_MOV64_IMM(BPF_REG_4, 0),
12274                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12275                         BPF_EXIT_INSN(),
12276                 },
12277                 .fixup_map2 = { 4 },
12278                 .result = ACCEPT,
12279                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12280         },
12281         {
12282                 "ld_abs: invalid op 1",
12283                 .insns = {
12284                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12285                         BPF_LD_ABS(BPF_DW, 0),
12286                         BPF_EXIT_INSN(),
12287                 },
12288                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12289                 .result = REJECT,
12290                 .errstr = "unknown opcode",
12291         },
12292         {
12293                 "ld_abs: invalid op 2",
12294                 .insns = {
12295                         BPF_MOV32_IMM(BPF_REG_0, 256),
12296                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12297                         BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
12298                         BPF_EXIT_INSN(),
12299                 },
12300                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12301                 .result = REJECT,
12302                 .errstr = "unknown opcode",
12303         },
12304         {
12305                 "ld_abs: nmap reduced",
12306                 .insns = {
12307                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12308                         BPF_LD_ABS(BPF_H, 12),
12309                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
12310                         BPF_LD_ABS(BPF_H, 12),
12311                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
12312                         BPF_MOV32_IMM(BPF_REG_0, 18),
12313                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
12314                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
12315                         BPF_LD_IND(BPF_W, BPF_REG_7, 14),
12316                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
12317                         BPF_MOV32_IMM(BPF_REG_0, 280971478),
12318                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12319                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12320                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
12321                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12322                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
12323                         BPF_LD_ABS(BPF_H, 12),
12324                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
12325                         BPF_MOV32_IMM(BPF_REG_0, 22),
12326                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12327                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12328                         BPF_LD_IND(BPF_H, BPF_REG_7, 14),
12329                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
12330                         BPF_MOV32_IMM(BPF_REG_0, 17366),
12331                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
12332                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
12333                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
12334                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12335                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12336                         BPF_MOV32_IMM(BPF_REG_0, 256),
12337                         BPF_EXIT_INSN(),
12338                         BPF_MOV32_IMM(BPF_REG_0, 0),
12339                         BPF_EXIT_INSN(),
12340                 },
12341                 .data = {
12342                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
12343                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
12344                         0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
12345                 },
12346                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12347                 .result = ACCEPT,
12348                 .retval = 256,
12349         },
12350         {
12351                 "ld_abs: div + abs, test 1",
12352                 .insns = {
12353                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12354                         BPF_LD_ABS(BPF_B, 3),
12355                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12356                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12357                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12358                         BPF_LD_ABS(BPF_B, 4),
12359                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12360                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12361                         BPF_EXIT_INSN(),
12362                 },
12363                 .data = {
12364                         10, 20, 30, 40, 50,
12365                 },
12366                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12367                 .result = ACCEPT,
12368                 .retval = 10,
12369         },
12370         {
12371                 "ld_abs: div + abs, test 2",
12372                 .insns = {
12373                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12374                         BPF_LD_ABS(BPF_B, 3),
12375                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12376                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12377                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12378                         BPF_LD_ABS(BPF_B, 128),
12379                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12380                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12381                         BPF_EXIT_INSN(),
12382                 },
12383                 .data = {
12384                         10, 20, 30, 40, 50,
12385                 },
12386                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12387                 .result = ACCEPT,
12388                 .retval = 0,
12389         },
12390         {
12391                 "ld_abs: div + abs, test 3",
12392                 .insns = {
12393                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12394                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12395                         BPF_LD_ABS(BPF_B, 3),
12396                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12397                         BPF_EXIT_INSN(),
12398                 },
12399                 .data = {
12400                         10, 20, 30, 40, 50,
12401                 },
12402                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12403                 .result = ACCEPT,
12404                 .retval = 0,
12405         },
12406         {
12407                 "ld_abs: div + abs, test 4",
12408                 .insns = {
12409                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12410                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12411                         BPF_LD_ABS(BPF_B, 256),
12412                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12413                         BPF_EXIT_INSN(),
12414                 },
12415                 .data = {
12416                         10, 20, 30, 40, 50,
12417                 },
12418                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12419                 .result = ACCEPT,
12420                 .retval = 0,
12421         },
12422         {
12423                 "ld_abs: vlan + abs, test 1",
12424                 .insns = { },
12425                 .data = {
12426                         0x34,
12427                 },
12428                 .fill_helper = bpf_fill_ld_abs_vlan_push_pop,
12429                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12430                 .result = ACCEPT,
12431                 .retval = 0xbef,
12432         },
12433         {
12434                 "ld_abs: vlan + abs, test 2",
12435                 .insns = {
12436                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12437                         BPF_LD_ABS(BPF_B, 0),
12438                         BPF_LD_ABS(BPF_H, 0),
12439                         BPF_LD_ABS(BPF_W, 0),
12440                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
12441                         BPF_MOV64_IMM(BPF_REG_6, 0),
12442                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12443                         BPF_MOV64_IMM(BPF_REG_2, 1),
12444                         BPF_MOV64_IMM(BPF_REG_3, 2),
12445                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12446                                      BPF_FUNC_skb_vlan_push),
12447                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
12448                         BPF_LD_ABS(BPF_B, 0),
12449                         BPF_LD_ABS(BPF_H, 0),
12450                         BPF_LD_ABS(BPF_W, 0),
12451                         BPF_MOV64_IMM(BPF_REG_0, 42),
12452                         BPF_EXIT_INSN(),
12453                 },
12454                 .data = {
12455                         0x34,
12456                 },
12457                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12458                 .result = ACCEPT,
12459                 .retval = 42,
12460         },
12461         {
12462                 "ld_abs: jump around ld_abs",
12463                 .insns = { },
12464                 .data = {
12465                         10, 11,
12466                 },
12467                 .fill_helper = bpf_fill_jump_around_ld_abs,
12468                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12469                 .result = ACCEPT,
12470                 .retval = 10,
12471         },
12472         {
12473                 "ld_dw: xor semi-random 64 bit imms, test 1",
12474                 .insns = { },
12475                 .data = { },
12476                 .fill_helper = bpf_fill_rand_ld_dw,
12477                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12478                 .result = ACCEPT,
12479                 .retval = 4090,
12480         },
12481         {
12482                 "ld_dw: xor semi-random 64 bit imms, test 2",
12483                 .insns = { },
12484                 .data = { },
12485                 .fill_helper = bpf_fill_rand_ld_dw,
12486                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12487                 .result = ACCEPT,
12488                 .retval = 2047,
12489         },
12490         {
12491                 "ld_dw: xor semi-random 64 bit imms, test 3",
12492                 .insns = { },
12493                 .data = { },
12494                 .fill_helper = bpf_fill_rand_ld_dw,
12495                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12496                 .result = ACCEPT,
12497                 .retval = 511,
12498         },
12499         {
12500                 "ld_dw: xor semi-random 64 bit imms, test 4",
12501                 .insns = { },
12502                 .data = { },
12503                 .fill_helper = bpf_fill_rand_ld_dw,
12504                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12505                 .result = ACCEPT,
12506                 .retval = 5,
12507         },
12508         {
12509                 "pass unmodified ctx pointer to helper",
12510                 .insns = {
12511                         BPF_MOV64_IMM(BPF_REG_2, 0),
12512                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12513                                      BPF_FUNC_csum_update),
12514                         BPF_MOV64_IMM(BPF_REG_0, 0),
12515                         BPF_EXIT_INSN(),
12516                 },
12517                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12518                 .result = ACCEPT,
12519         },
12520         {
12521                 "pass modified ctx pointer to helper, 1",
12522                 .insns = {
12523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12524                         BPF_MOV64_IMM(BPF_REG_2, 0),
12525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12526                                      BPF_FUNC_csum_update),
12527                         BPF_MOV64_IMM(BPF_REG_0, 0),
12528                         BPF_EXIT_INSN(),
12529                 },
12530                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12531                 .result = REJECT,
12532                 .errstr = "dereference of modified ctx ptr",
12533         },
12534         {
12535                 "pass modified ctx pointer to helper, 2",
12536                 .insns = {
12537                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12538                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12539                                      BPF_FUNC_get_socket_cookie),
12540                         BPF_MOV64_IMM(BPF_REG_0, 0),
12541                         BPF_EXIT_INSN(),
12542                 },
12543                 .result_unpriv = REJECT,
12544                 .result = REJECT,
12545                 .errstr_unpriv = "dereference of modified ctx ptr",
12546                 .errstr = "dereference of modified ctx ptr",
12547         },
12548         {
12549                 "pass modified ctx pointer to helper, 3",
12550                 .insns = {
12551                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
12552                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
12553                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
12554                         BPF_MOV64_IMM(BPF_REG_2, 0),
12555                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12556                                      BPF_FUNC_csum_update),
12557                         BPF_MOV64_IMM(BPF_REG_0, 0),
12558                         BPF_EXIT_INSN(),
12559                 },
12560                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12561                 .result = REJECT,
12562                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
12563         },
12564         {
12565                 "mov64 src == dst",
12566                 .insns = {
12567                         BPF_MOV64_IMM(BPF_REG_2, 0),
12568                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
12569                         // Check bounds are OK
12570                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12571                         BPF_MOV64_IMM(BPF_REG_0, 0),
12572                         BPF_EXIT_INSN(),
12573                 },
12574                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12575                 .result = ACCEPT,
12576         },
12577         {
12578                 "mov64 src != dst",
12579                 .insns = {
12580                         BPF_MOV64_IMM(BPF_REG_3, 0),
12581                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
12582                         // Check bounds are OK
12583                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12584                         BPF_MOV64_IMM(BPF_REG_0, 0),
12585                         BPF_EXIT_INSN(),
12586                 },
12587                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12588                 .result = ACCEPT,
12589         },
12590         {
12591                 "calls: ctx read at start of subprog",
12592                 .insns = {
12593                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12594                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
12595                         BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
12596                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12597                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
12598                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12599                         BPF_EXIT_INSN(),
12600                         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
12601                         BPF_MOV64_IMM(BPF_REG_0, 0),
12602                         BPF_EXIT_INSN(),
12603                 },
12604                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
12605                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
12606                 .result_unpriv = REJECT,
12607                 .result = ACCEPT,
12608         },
12609 };
12610
12611 static int probe_filter_length(const struct bpf_insn *fp)
12612 {
12613         int len;
12614
12615         for (len = MAX_INSNS - 1; len > 0; --len)
12616                 if (fp[len].code != 0 || fp[len].imm != 0)
12617                         break;
12618         return len + 1;
12619 }
12620
12621 static int create_map(uint32_t type, uint32_t size_key,
12622                       uint32_t size_value, uint32_t max_elem)
12623 {
12624         int fd;
12625
12626         fd = bpf_create_map(type, size_key, size_value, max_elem,
12627                             type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);
12628         if (fd < 0)
12629                 printf("Failed to create hash map '%s'!\n", strerror(errno));
12630
12631         return fd;
12632 }
12633
12634 static int create_prog_dummy1(enum bpf_map_type prog_type)
12635 {
12636         struct bpf_insn prog[] = {
12637                 BPF_MOV64_IMM(BPF_REG_0, 42),
12638                 BPF_EXIT_INSN(),
12639         };
12640
12641         return bpf_load_program(prog_type, prog,
12642                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12643 }
12644
12645 static int create_prog_dummy2(enum bpf_map_type prog_type, int mfd, int idx)
12646 {
12647         struct bpf_insn prog[] = {
12648                 BPF_MOV64_IMM(BPF_REG_3, idx),
12649                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
12650                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12651                              BPF_FUNC_tail_call),
12652                 BPF_MOV64_IMM(BPF_REG_0, 41),
12653                 BPF_EXIT_INSN(),
12654         };
12655
12656         return bpf_load_program(prog_type, prog,
12657                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12658 }
12659
12660 static int create_prog_array(enum bpf_map_type prog_type, uint32_t max_elem,
12661                              int p1key)
12662 {
12663         int p2key = 1;
12664         int mfd, p1fd, p2fd;
12665
12666         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
12667                              sizeof(int), max_elem, 0);
12668         if (mfd < 0) {
12669                 printf("Failed to create prog array '%s'!\n", strerror(errno));
12670                 return -1;
12671         }
12672
12673         p1fd = create_prog_dummy1(prog_type);
12674         p2fd = create_prog_dummy2(prog_type, mfd, p2key);
12675         if (p1fd < 0 || p2fd < 0)
12676                 goto out;
12677         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
12678                 goto out;
12679         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
12680                 goto out;
12681         close(p2fd);
12682         close(p1fd);
12683
12684         return mfd;
12685 out:
12686         close(p2fd);
12687         close(p1fd);
12688         close(mfd);
12689         return -1;
12690 }
12691
12692 static int create_map_in_map(void)
12693 {
12694         int inner_map_fd, outer_map_fd;
12695
12696         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12697                                       sizeof(int), 1, 0);
12698         if (inner_map_fd < 0) {
12699                 printf("Failed to create array '%s'!\n", strerror(errno));
12700                 return inner_map_fd;
12701         }
12702
12703         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
12704                                              sizeof(int), inner_map_fd, 1, 0);
12705         if (outer_map_fd < 0)
12706                 printf("Failed to create array of maps '%s'!\n",
12707                        strerror(errno));
12708
12709         close(inner_map_fd);
12710
12711         return outer_map_fd;
12712 }
12713
12714 static int create_cgroup_storage(void)
12715 {
12716         int fd;
12717
12718         fd = bpf_create_map(BPF_MAP_TYPE_CGROUP_STORAGE,
12719                             sizeof(struct bpf_cgroup_storage_key),
12720                             TEST_DATA_LEN, 0, 0);
12721         if (fd < 0)
12722                 printf("Failed to create array '%s'!\n", strerror(errno));
12723
12724         return fd;
12725 }
12726
12727 static char bpf_vlog[UINT_MAX >> 8];
12728
12729 static void do_test_fixup(struct bpf_test *test, enum bpf_map_type prog_type,
12730                           struct bpf_insn *prog, int *map_fds)
12731 {
12732         int *fixup_map1 = test->fixup_map1;
12733         int *fixup_map2 = test->fixup_map2;
12734         int *fixup_map3 = test->fixup_map3;
12735         int *fixup_map4 = test->fixup_map4;
12736         int *fixup_prog1 = test->fixup_prog1;
12737         int *fixup_prog2 = test->fixup_prog2;
12738         int *fixup_map_in_map = test->fixup_map_in_map;
12739         int *fixup_cgroup_storage = test->fixup_cgroup_storage;
12740
12741         if (test->fill_helper)
12742                 test->fill_helper(test);
12743
12744         /* Allocating HTs with 1 elem is fine here, since we only test
12745          * for verifier and not do a runtime lookup, so the only thing
12746          * that really matters is value size in this case.
12747          */
12748         if (*fixup_map1) {
12749                 map_fds[0] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12750                                         sizeof(long long), 1);
12751                 do {
12752                         prog[*fixup_map1].imm = map_fds[0];
12753                         fixup_map1++;
12754                 } while (*fixup_map1);
12755         }
12756
12757         if (*fixup_map2) {
12758                 map_fds[1] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12759                                         sizeof(struct test_val), 1);
12760                 do {
12761                         prog[*fixup_map2].imm = map_fds[1];
12762                         fixup_map2++;
12763                 } while (*fixup_map2);
12764         }
12765
12766         if (*fixup_map3) {
12767                 map_fds[2] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12768                                         sizeof(struct other_val), 1);
12769                 do {
12770                         prog[*fixup_map3].imm = map_fds[2];
12771                         fixup_map3++;
12772                 } while (*fixup_map3);
12773         }
12774
12775         if (*fixup_map4) {
12776                 map_fds[3] = create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12777                                         sizeof(struct test_val), 1);
12778                 do {
12779                         prog[*fixup_map4].imm = map_fds[3];
12780                         fixup_map4++;
12781                 } while (*fixup_map4);
12782         }
12783
12784         if (*fixup_prog1) {
12785                 map_fds[4] = create_prog_array(prog_type, 4, 0);
12786                 do {
12787                         prog[*fixup_prog1].imm = map_fds[4];
12788                         fixup_prog1++;
12789                 } while (*fixup_prog1);
12790         }
12791
12792         if (*fixup_prog2) {
12793                 map_fds[5] = create_prog_array(prog_type, 8, 7);
12794                 do {
12795                         prog[*fixup_prog2].imm = map_fds[5];
12796                         fixup_prog2++;
12797                 } while (*fixup_prog2);
12798         }
12799
12800         if (*fixup_map_in_map) {
12801                 map_fds[6] = create_map_in_map();
12802                 do {
12803                         prog[*fixup_map_in_map].imm = map_fds[6];
12804                         fixup_map_in_map++;
12805                 } while (*fixup_map_in_map);
12806         }
12807
12808         if (*fixup_cgroup_storage) {
12809                 map_fds[7] = create_cgroup_storage();
12810                 do {
12811                         prog[*fixup_cgroup_storage].imm = map_fds[7];
12812                         fixup_cgroup_storage++;
12813                 } while (*fixup_cgroup_storage);
12814         }
12815 }
12816
12817 static int set_admin(bool admin)
12818 {
12819         cap_t caps;
12820         const cap_value_t cap_val = CAP_SYS_ADMIN;
12821         int ret = -1;
12822
12823         caps = cap_get_proc();
12824         if (!caps) {
12825                 perror("cap_get_proc");
12826                 return -1;
12827         }
12828         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
12829                                 admin ? CAP_SET : CAP_CLEAR)) {
12830                 perror("cap_set_flag");
12831                 goto out;
12832         }
12833         if (cap_set_proc(caps)) {
12834                 perror("cap_set_proc");
12835                 goto out;
12836         }
12837         ret = 0;
12838 out:
12839         if (cap_free(caps))
12840                 perror("cap_free");
12841         return ret;
12842 }
12843
12844 static void do_test_single(struct bpf_test *test, bool unpriv,
12845                            int *passes, int *errors)
12846 {
12847         int fd_prog, expected_ret, reject_from_alignment;
12848         int prog_len, prog_type = test->prog_type;
12849         struct bpf_insn *prog = test->insns;
12850         int map_fds[MAX_NR_MAPS];
12851         const char *expected_err;
12852         uint32_t expected_val;
12853         uint32_t retval;
12854         int i, err;
12855
12856         for (i = 0; i < MAX_NR_MAPS; i++)
12857                 map_fds[i] = -1;
12858
12859         if (!prog_type)
12860                 prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
12861         do_test_fixup(test, prog_type, prog, map_fds);
12862         prog_len = probe_filter_length(prog);
12863
12864         fd_prog = bpf_verify_program(prog_type, prog, prog_len,
12865                                      test->flags & F_LOAD_WITH_STRICT_ALIGNMENT ?
12866                                      BPF_F_STRICT_ALIGNMENT : 0,
12867                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
12868
12869         expected_ret = unpriv && test->result_unpriv != UNDEF ?
12870                        test->result_unpriv : test->result;
12871         expected_err = unpriv && test->errstr_unpriv ?
12872                        test->errstr_unpriv : test->errstr;
12873         expected_val = unpriv && test->retval_unpriv ?
12874                        test->retval_unpriv : test->retval;
12875
12876         reject_from_alignment = fd_prog < 0 &&
12877                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
12878                                 strstr(bpf_vlog, "misaligned");
12879 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
12880         if (reject_from_alignment) {
12881                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
12882                        strerror(errno));
12883                 goto fail_log;
12884         }
12885 #endif
12886         if (expected_ret == ACCEPT) {
12887                 if (fd_prog < 0 && !reject_from_alignment) {
12888                         printf("FAIL\nFailed to load prog '%s'!\n",
12889                                strerror(errno));
12890                         goto fail_log;
12891                 }
12892         } else {
12893                 if (fd_prog >= 0) {
12894                         printf("FAIL\nUnexpected success to load!\n");
12895                         goto fail_log;
12896                 }
12897                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
12898                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
12899                               expected_err, bpf_vlog);
12900                         goto fail_log;
12901                 }
12902         }
12903
12904         if (fd_prog >= 0) {
12905                 __u8 tmp[TEST_DATA_LEN << 2];
12906                 __u32 size_tmp = sizeof(tmp);
12907
12908                 if (unpriv)
12909                         set_admin(true);
12910                 err = bpf_prog_test_run(fd_prog, 1, test->data,
12911                                         sizeof(test->data), tmp, &size_tmp,
12912                                         &retval, NULL);
12913                 if (unpriv)
12914                         set_admin(false);
12915                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
12916                         printf("Unexpected bpf_prog_test_run error\n");
12917                         goto fail_log;
12918                 }
12919                 if (!err && retval != expected_val &&
12920                     expected_val != POINTER_VALUE) {
12921                         printf("FAIL retval %d != %d\n", retval, expected_val);
12922                         goto fail_log;
12923                 }
12924         }
12925         (*passes)++;
12926         printf("OK%s\n", reject_from_alignment ?
12927                " (NOTE: reject due to unknown alignment)" : "");
12928 close_fds:
12929         close(fd_prog);
12930         for (i = 0; i < MAX_NR_MAPS; i++)
12931                 close(map_fds[i]);
12932         sched_yield();
12933         return;
12934 fail_log:
12935         (*errors)++;
12936         printf("%s", bpf_vlog);
12937         goto close_fds;
12938 }
12939
12940 static bool is_admin(void)
12941 {
12942         cap_t caps;
12943         cap_flag_value_t sysadmin = CAP_CLEAR;
12944         const cap_value_t cap_val = CAP_SYS_ADMIN;
12945
12946 #ifdef CAP_IS_SUPPORTED
12947         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
12948                 perror("cap_get_flag");
12949                 return false;
12950         }
12951 #endif
12952         caps = cap_get_proc();
12953         if (!caps) {
12954                 perror("cap_get_proc");
12955                 return false;
12956         }
12957         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
12958                 perror("cap_get_flag");
12959         if (cap_free(caps))
12960                 perror("cap_free");
12961         return (sysadmin == CAP_SET);
12962 }
12963
12964 static void get_unpriv_disabled()
12965 {
12966         char buf[2];
12967         FILE *fd;
12968
12969         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
12970         if (!fd) {
12971                 perror("fopen /proc/sys/"UNPRIV_SYSCTL);
12972                 unpriv_disabled = true;
12973                 return;
12974         }
12975         if (fgets(buf, 2, fd) == buf && atoi(buf))
12976                 unpriv_disabled = true;
12977         fclose(fd);
12978 }
12979
12980 static bool test_as_unpriv(struct bpf_test *test)
12981 {
12982         return !test->prog_type ||
12983                test->prog_type == BPF_PROG_TYPE_SOCKET_FILTER ||
12984                test->prog_type == BPF_PROG_TYPE_CGROUP_SKB;
12985 }
12986
12987 static int do_test(bool unpriv, unsigned int from, unsigned int to)
12988 {
12989         int i, passes = 0, errors = 0, skips = 0;
12990
12991         for (i = from; i < to; i++) {
12992                 struct bpf_test *test = &tests[i];
12993
12994                 /* Program types that are not supported by non-root we
12995                  * skip right away.
12996                  */
12997                 if (test_as_unpriv(test) && unpriv_disabled) {
12998                         printf("#%d/u %s SKIP\n", i, test->descr);
12999                         skips++;
13000                 } else if (test_as_unpriv(test)) {
13001                         if (!unpriv)
13002                                 set_admin(false);
13003                         printf("#%d/u %s ", i, test->descr);
13004                         do_test_single(test, true, &passes, &errors);
13005                         if (!unpriv)
13006                                 set_admin(true);
13007                 }
13008
13009                 if (unpriv) {
13010                         printf("#%d/p %s SKIP\n", i, test->descr);
13011                         skips++;
13012                 } else {
13013                         printf("#%d/p %s ", i, test->descr);
13014                         do_test_single(test, false, &passes, &errors);
13015                 }
13016         }
13017
13018         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
13019                skips, errors);
13020         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
13021 }
13022
13023 int main(int argc, char **argv)
13024 {
13025         unsigned int from = 0, to = ARRAY_SIZE(tests);
13026         bool unpriv = !is_admin();
13027
13028         if (argc == 3) {
13029                 unsigned int l = atoi(argv[argc - 2]);
13030                 unsigned int u = atoi(argv[argc - 1]);
13031
13032                 if (l < to && u < to) {
13033                         from = l;
13034                         to   = u + 1;
13035                 }
13036         } else if (argc == 2) {
13037                 unsigned int t = atoi(argv[argc - 1]);
13038
13039                 if (t < to) {
13040                         from = t;
13041                         to   = t + 1;
13042                 }
13043         }
13044
13045         get_unpriv_disabled();
13046         if (unpriv && unpriv_disabled) {
13047                 printf("Cannot run as unprivileged user with sysctl %s.\n",
13048                        UNPRIV_SYSCTL);
13049                 return EXIT_FAILURE;
13050         }
13051
13052         bpf_semi_rand_init();
13053         return do_test(unpriv, from, to);
13054 }