tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  * Copyright (c) 2018 Covalent IO, Inc. http://covalent.io
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of version 2 of the GNU General Public
  10  * License as published by the Free Software Foundation.
  11  */
  12
  13 #include <endian.h>
  14 #include <asm/types.h>
  15 #include <linux/types.h>
  16 #include <stdint.h>
  17 #include <stdio.h>
  18 #include <stdlib.h>
  19 #include <unistd.h>
  20 #include <errno.h>
  21 #include <string.h>
  22 #include <stddef.h>
  23 #include <stdbool.h>
  24 #include <sched.h>
  25 #include <limits.h>
  26
  27 #include <sys/capability.h>
  28
  29 #include <linux/unistd.h>
  30 #include <linux/filter.h>
  31 #include <linux/bpf_perf_event.h>
  32 #include <linux/bpf.h>
  33 #include <linux/if_ether.h>
  34
  35 #include <bpf/bpf.h>
  36
  37 #ifdef HAVE_GENHDR
  38 # include "autoconf.h"
  39 #else
  40 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  41 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  42 # endif
  43 #endif
  44 #include "bpf_rlimit.h"
  45 #include "bpf_rand.h"
  46 #include "bpf_util.h"
  47 #include "../../../include/linux/filter.h"
  48
  49 #define MAX_INSNS       BPF_MAXINSNS
  50 #define MAX_FIXUPS      8
  51 #define MAX_NR_MAPS     13
  52 #define POINTER_VALUE   0xcafe4all
  53 #define TEST_DATA_LEN   64
  54
  55 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  56 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  57
  58 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  59 static bool unpriv_disabled = false;
  60
  61 struct bpf_test {
  62         const char *descr;
  63         struct bpf_insn insns[MAX_INSNS];
  64         int fixup_map_hash_8b[MAX_FIXUPS];
  65         int fixup_map_hash_48b[MAX_FIXUPS];
  66         int fixup_map_hash_16b[MAX_FIXUPS];
  67         int fixup_map_array_48b[MAX_FIXUPS];
  68         int fixup_map_sockmap[MAX_FIXUPS];
  69         int fixup_map_sockhash[MAX_FIXUPS];
  70         int fixup_map_xskmap[MAX_FIXUPS];
  71         int fixup_map_stacktrace[MAX_FIXUPS];
  72         int fixup_prog1[MAX_FIXUPS];
  73         int fixup_prog2[MAX_FIXUPS];
  74         int fixup_map_in_map[MAX_FIXUPS];
  75         int fixup_cgroup_storage[MAX_FIXUPS];
  76         int fixup_percpu_cgroup_storage[MAX_FIXUPS];
  77         const char *errstr;
  78         const char *errstr_unpriv;
  79         uint32_t retval;
  80         enum {
  81                 UNDEF,
  82                 ACCEPT,
  83                 REJECT
  84         } result, result_unpriv;
  85         enum bpf_prog_type prog_type;
  86         uint8_t flags;
  87         __u8 data[TEST_DATA_LEN];
  88         void (*fill_helper)(struct bpf_test *self);
  89 };
  90
  91 /* Note we want this to be 64 bit aligned so that the end of our array is
  92  * actually the end of the structure.
  93  */
  94 #define MAX_ENTRIES 11
  95
  96 struct test_val {
  97         unsigned int index;
  98         int foo[MAX_ENTRIES];
  99 };
 100
 101 struct other_val {
 102         long long foo;
 103         long long bar;
 104 };
 105
 106 static void bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
 107 {
 108         /* test: {skb->data[0], vlan_push} x 68 + {skb->data[0], vlan_pop} x 68 */
 109 #define PUSH_CNT 51
 110         unsigned int len = BPF_MAXINSNS;
 111         struct bpf_insn *insn = self->insns;
 112         int i = 0, j, k = 0;
 113
 114         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 115 loop:
 116         for (j = 0; j < PUSH_CNT; j++) {
 117                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 118                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 119                 i++;
 120                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 121                 insn[i++] = BPF_MOV64_IMM(BPF_REG_2, 1);
 122                 insn[i++] = BPF_MOV64_IMM(BPF_REG_3, 2);
 123                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 124                                          BPF_FUNC_skb_vlan_push),
 125                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 126                 i++;
 127         }
 128
 129         for (j = 0; j < PUSH_CNT; j++) {
 130                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 131                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 132                 i++;
 133                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 134                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 135                                          BPF_FUNC_skb_vlan_pop),
 136                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 137                 i++;
 138         }
 139         if (++k < 5)
 140                 goto loop;
 141
 142         for (; i < len - 1; i++)
 143                 insn[i] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 0xbef);
 144         insn[len - 1] = BPF_EXIT_INSN();
 145 }
 146
 147 static void bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 148 {
 149         struct bpf_insn *insn = self->insns;
 150         unsigned int len = BPF_MAXINSNS;
 151         int i = 0;
 152
 153         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 154         insn[i++] = BPF_LD_ABS(BPF_B, 0);
 155         insn[i] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 10, len - i - 2);
 156         i++;
 157         while (i < len - 1)
 158                 insn[i++] = BPF_LD_ABS(BPF_B, 1);
 159         insn[i] = BPF_EXIT_INSN();
 160 }
 161
 162 static void bpf_fill_rand_ld_dw(struct bpf_test *self)
 163 {
 164         struct bpf_insn *insn = self->insns;
 165         uint64_t res = 0;
 166         int i = 0;
 167
 168         insn[i++] = BPF_MOV32_IMM(BPF_REG_0, 0);
 169         while (i < self->retval) {
 170                 uint64_t val = bpf_semi_rand_get();
 171                 struct bpf_insn tmp[2] = { BPF_LD_IMM64(BPF_REG_1, val) };
 172
 173                 res ^= val;
 174                 insn[i++] = tmp[0];
 175                 insn[i++] = tmp[1];
 176                 insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 177         }
 178         insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_0);
 179         insn[i++] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32);
 180         insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 181         insn[i] = BPF_EXIT_INSN();
 182         res ^= (res >> 32);
 183         self->retval = (uint32_t)res;
 184 }
 185
 186 /* BPF_SK_LOOKUP contains 13 instructions, if you need to fix up maps */
 187 #define BPF_SK_LOOKUP                                                   \
 188         /* struct bpf_sock_tuple tuple = {} */                          \
 189         BPF_MOV64_IMM(BPF_REG_2, 0),                                    \
 190         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_2, -8),                  \
 191         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -16),                \
 192         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -24),                \
 193         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -32),                \
 194         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -40),                \
 195         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -48),                \
 196         /* sk = sk_lookup_tcp(ctx, &tuple, sizeof tuple, 0, 0) */       \
 197         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),                           \
 198         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),                         \
 199         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct bpf_sock_tuple)),        \
 200         BPF_MOV64_IMM(BPF_REG_4, 0),                                    \
 201         BPF_MOV64_IMM(BPF_REG_5, 0),                                    \
 202         BPF_EMIT_CALL(BPF_FUNC_sk_lookup_tcp)
 203
 204 static struct bpf_test tests[] = {
 205         {
 206                 "add+sub+mul",
 207                 .insns = {
 208                         BPF_MOV64_IMM(BPF_REG_1, 1),
 209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
 210                         BPF_MOV64_IMM(BPF_REG_2, 3),
 211                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
 212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 213                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 214                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 215                         BPF_EXIT_INSN(),
 216                 },
 217                 .result = ACCEPT,
 218                 .retval = -3,
 219         },
 220         {
 221                 "DIV32 by 0, zero check 1",
 222                 .insns = {
 223                         BPF_MOV32_IMM(BPF_REG_0, 42),
 224                         BPF_MOV32_IMM(BPF_REG_1, 0),
 225                         BPF_MOV32_IMM(BPF_REG_2, 1),
 226                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 227                         BPF_EXIT_INSN(),
 228                 },
 229                 .result = ACCEPT,
 230                 .retval = 42,
 231         },
 232         {
 233                 "DIV32 by 0, zero check 2",
 234                 .insns = {
 235                         BPF_MOV32_IMM(BPF_REG_0, 42),
 236                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 237                         BPF_MOV32_IMM(BPF_REG_2, 1),
 238                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 239                         BPF_EXIT_INSN(),
 240                 },
 241                 .result = ACCEPT,
 242                 .retval = 42,
 243         },
 244         {
 245                 "DIV64 by 0, zero check",
 246                 .insns = {
 247                         BPF_MOV32_IMM(BPF_REG_0, 42),
 248                         BPF_MOV32_IMM(BPF_REG_1, 0),
 249                         BPF_MOV32_IMM(BPF_REG_2, 1),
 250                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 251                         BPF_EXIT_INSN(),
 252                 },
 253                 .result = ACCEPT,
 254                 .retval = 42,
 255         },
 256         {
 257                 "MOD32 by 0, zero check 1",
 258                 .insns = {
 259                         BPF_MOV32_IMM(BPF_REG_0, 42),
 260                         BPF_MOV32_IMM(BPF_REG_1, 0),
 261                         BPF_MOV32_IMM(BPF_REG_2, 1),
 262                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 263                         BPF_EXIT_INSN(),
 264                 },
 265                 .result = ACCEPT,
 266                 .retval = 42,
 267         },
 268         {
 269                 "MOD32 by 0, zero check 2",
 270                 .insns = {
 271                         BPF_MOV32_IMM(BPF_REG_0, 42),
 272                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 273                         BPF_MOV32_IMM(BPF_REG_2, 1),
 274                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 275                         BPF_EXIT_INSN(),
 276                 },
 277                 .result = ACCEPT,
 278                 .retval = 42,
 279         },
 280         {
 281                 "MOD64 by 0, zero check",
 282                 .insns = {
 283                         BPF_MOV32_IMM(BPF_REG_0, 42),
 284                         BPF_MOV32_IMM(BPF_REG_1, 0),
 285                         BPF_MOV32_IMM(BPF_REG_2, 1),
 286                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 287                         BPF_EXIT_INSN(),
 288                 },
 289                 .result = ACCEPT,
 290                 .retval = 42,
 291         },
 292         {
 293                 "DIV32 by 0, zero check ok, cls",
 294                 .insns = {
 295                         BPF_MOV32_IMM(BPF_REG_0, 42),
 296                         BPF_MOV32_IMM(BPF_REG_1, 2),
 297                         BPF_MOV32_IMM(BPF_REG_2, 16),
 298                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 299                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 300                         BPF_EXIT_INSN(),
 301                 },
 302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 303                 .result = ACCEPT,
 304                 .retval = 8,
 305         },
 306         {
 307                 "DIV32 by 0, zero check 1, cls",
 308                 .insns = {
 309                         BPF_MOV32_IMM(BPF_REG_1, 0),
 310                         BPF_MOV32_IMM(BPF_REG_0, 1),
 311                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 312                         BPF_EXIT_INSN(),
 313                 },
 314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 315                 .result = ACCEPT,
 316                 .retval = 0,
 317         },
 318         {
 319                 "DIV32 by 0, zero check 2, cls",
 320                 .insns = {
 321                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 322                         BPF_MOV32_IMM(BPF_REG_0, 1),
 323                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 324                         BPF_EXIT_INSN(),
 325                 },
 326                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 327                 .result = ACCEPT,
 328                 .retval = 0,
 329         },
 330         {
 331                 "DIV64 by 0, zero check, cls",
 332                 .insns = {
 333                         BPF_MOV32_IMM(BPF_REG_1, 0),
 334                         BPF_MOV32_IMM(BPF_REG_0, 1),
 335                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 336                         BPF_EXIT_INSN(),
 337                 },
 338                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 339                 .result = ACCEPT,
 340                 .retval = 0,
 341         },
 342         {
 343                 "MOD32 by 0, zero check ok, cls",
 344                 .insns = {
 345                         BPF_MOV32_IMM(BPF_REG_0, 42),
 346                         BPF_MOV32_IMM(BPF_REG_1, 3),
 347                         BPF_MOV32_IMM(BPF_REG_2, 5),
 348                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 349                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 350                         BPF_EXIT_INSN(),
 351                 },
 352                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 353                 .result = ACCEPT,
 354                 .retval = 2,
 355         },
 356         {
 357                 "MOD32 by 0, zero check 1, cls",
 358                 .insns = {
 359                         BPF_MOV32_IMM(BPF_REG_1, 0),
 360                         BPF_MOV32_IMM(BPF_REG_0, 1),
 361                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 362                         BPF_EXIT_INSN(),
 363                 },
 364                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 365                 .result = ACCEPT,
 366                 .retval = 1,
 367         },
 368         {
 369                 "MOD32 by 0, zero check 2, cls",
 370                 .insns = {
 371                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 372                         BPF_MOV32_IMM(BPF_REG_0, 1),
 373                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 374                         BPF_EXIT_INSN(),
 375                 },
 376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 377                 .result = ACCEPT,
 378                 .retval = 1,
 379         },
 380         {
 381                 "MOD64 by 0, zero check 1, cls",
 382                 .insns = {
 383                         BPF_MOV32_IMM(BPF_REG_1, 0),
 384                         BPF_MOV32_IMM(BPF_REG_0, 2),
 385                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 386                         BPF_EXIT_INSN(),
 387                 },
 388                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 389                 .result = ACCEPT,
 390                 .retval = 2,
 391         },
 392         {
 393                 "MOD64 by 0, zero check 2, cls",
 394                 .insns = {
 395                         BPF_MOV32_IMM(BPF_REG_1, 0),
 396                         BPF_MOV32_IMM(BPF_REG_0, -1),
 397                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 398                         BPF_EXIT_INSN(),
 399                 },
 400                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 401                 .result = ACCEPT,
 402                 .retval = -1,
 403         },
 404         /* Just make sure that JITs used udiv/umod as otherwise we get
 405          * an exception from INT_MIN/-1 overflow similarly as with div
 406          * by zero.
 407          */
 408         {
 409                 "DIV32 overflow, check 1",
 410                 .insns = {
 411                         BPF_MOV32_IMM(BPF_REG_1, -1),
 412                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 413                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 414                         BPF_EXIT_INSN(),
 415                 },
 416                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 417                 .result = ACCEPT,
 418                 .retval = 0,
 419         },
 420         {
 421                 "DIV32 overflow, check 2",
 422                 .insns = {
 423                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 424                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 425                         BPF_EXIT_INSN(),
 426                 },
 427                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 428                 .result = ACCEPT,
 429                 .retval = 0,
 430         },
 431         {
 432                 "DIV64 overflow, check 1",
 433                 .insns = {
 434                         BPF_MOV64_IMM(BPF_REG_1, -1),
 435                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 436                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 437                         BPF_EXIT_INSN(),
 438                 },
 439                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 440                 .result = ACCEPT,
 441                 .retval = 0,
 442         },
 443         {
 444                 "DIV64 overflow, check 2",
 445                 .insns = {
 446                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 447                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 448                         BPF_EXIT_INSN(),
 449                 },
 450                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 451                 .result = ACCEPT,
 452                 .retval = 0,
 453         },
 454         {
 455                 "MOD32 overflow, check 1",
 456                 .insns = {
 457                         BPF_MOV32_IMM(BPF_REG_1, -1),
 458                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 459                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 460                         BPF_EXIT_INSN(),
 461                 },
 462                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 463                 .result = ACCEPT,
 464                 .retval = INT_MIN,
 465         },
 466         {
 467                 "MOD32 overflow, check 2",
 468                 .insns = {
 469                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 470                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 471                         BPF_EXIT_INSN(),
 472                 },
 473                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 474                 .result = ACCEPT,
 475                 .retval = INT_MIN,
 476         },
 477         {
 478                 "MOD64 overflow, check 1",
 479                 .insns = {
 480                         BPF_MOV64_IMM(BPF_REG_1, -1),
 481                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 482                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 483                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 484                         BPF_MOV32_IMM(BPF_REG_0, 0),
 485                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 486                         BPF_MOV32_IMM(BPF_REG_0, 1),
 487                         BPF_EXIT_INSN(),
 488                 },
 489                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 490                 .result = ACCEPT,
 491                 .retval = 1,
 492         },
 493         {
 494                 "MOD64 overflow, check 2",
 495                 .insns = {
 496                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 497                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 498                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 499                         BPF_MOV32_IMM(BPF_REG_0, 0),
 500                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 501                         BPF_MOV32_IMM(BPF_REG_0, 1),
 502                         BPF_EXIT_INSN(),
 503                 },
 504                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 505                 .result = ACCEPT,
 506                 .retval = 1,
 507         },
 508         {
 509                 "xor32 zero extend check",
 510                 .insns = {
 511                         BPF_MOV32_IMM(BPF_REG_2, -1),
 512                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 513                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 514                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 515                         BPF_MOV32_IMM(BPF_REG_0, 2),
 516                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 517                         BPF_MOV32_IMM(BPF_REG_0, 1),
 518                         BPF_EXIT_INSN(),
 519                 },
 520                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 521                 .result = ACCEPT,
 522                 .retval = 1,
 523         },
 524         {
 525                 "empty prog",
 526                 .insns = {
 527                 },
 528                 .errstr = "unknown opcode 00",
 529                 .result = REJECT,
 530         },
 531         {
 532                 "only exit insn",
 533                 .insns = {
 534                         BPF_EXIT_INSN(),
 535                 },
 536                 .errstr = "R0 !read_ok",
 537                 .result = REJECT,
 538         },
 539         {
 540                 "unreachable",
 541                 .insns = {
 542                         BPF_EXIT_INSN(),
 543                         BPF_EXIT_INSN(),
 544                 },
 545                 .errstr = "unreachable",
 546                 .result = REJECT,
 547         },
 548         {
 549                 "unreachable2",
 550                 .insns = {
 551                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 552                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 553                         BPF_EXIT_INSN(),
 554                 },
 555                 .errstr = "unreachable",
 556                 .result = REJECT,
 557         },
 558         {
 559                 "out of range jump",
 560                 .insns = {
 561                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 562                         BPF_EXIT_INSN(),
 563                 },
 564                 .errstr = "jump out of range",
 565                 .result = REJECT,
 566         },
 567         {
 568                 "out of range jump2",
 569                 .insns = {
 570                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 571                         BPF_EXIT_INSN(),
 572                 },
 573                 .errstr = "jump out of range",
 574                 .result = REJECT,
 575         },
 576         {
 577                 "test1 ld_imm64",
 578                 .insns = {
 579                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 580                         BPF_LD_IMM64(BPF_REG_0, 0),
 581                         BPF_LD_IMM64(BPF_REG_0, 0),
 582                         BPF_LD_IMM64(BPF_REG_0, 1),
 583                         BPF_LD_IMM64(BPF_REG_0, 1),
 584                         BPF_MOV64_IMM(BPF_REG_0, 2),
 585                         BPF_EXIT_INSN(),
 586                 },
 587                 .errstr = "invalid BPF_LD_IMM insn",
 588                 .errstr_unpriv = "R1 pointer comparison",
 589                 .result = REJECT,
 590         },
 591         {
 592                 "test2 ld_imm64",
 593                 .insns = {
 594                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 595                         BPF_LD_IMM64(BPF_REG_0, 0),
 596                         BPF_LD_IMM64(BPF_REG_0, 0),
 597                         BPF_LD_IMM64(BPF_REG_0, 1),
 598                         BPF_LD_IMM64(BPF_REG_0, 1),
 599                         BPF_EXIT_INSN(),
 600                 },
 601                 .errstr = "invalid BPF_LD_IMM insn",
 602                 .errstr_unpriv = "R1 pointer comparison",
 603                 .result = REJECT,
 604         },
 605         {
 606                 "test3 ld_imm64",
 607                 .insns = {
 608                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 609                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 610                         BPF_LD_IMM64(BPF_REG_0, 0),
 611                         BPF_LD_IMM64(BPF_REG_0, 0),
 612                         BPF_LD_IMM64(BPF_REG_0, 1),
 613                         BPF_LD_IMM64(BPF_REG_0, 1),
 614                         BPF_EXIT_INSN(),
 615                 },
 616                 .errstr = "invalid bpf_ld_imm64 insn",
 617                 .result = REJECT,
 618         },
 619         {
 620                 "test4 ld_imm64",
 621                 .insns = {
 622                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 623                         BPF_EXIT_INSN(),
 624                 },
 625                 .errstr = "invalid bpf_ld_imm64 insn",
 626                 .result = REJECT,
 627         },
 628         {
 629                 "test5 ld_imm64",
 630                 .insns = {
 631                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 632                 },
 633                 .errstr = "invalid bpf_ld_imm64 insn",
 634                 .result = REJECT,
 635         },
 636         {
 637                 "test6 ld_imm64",
 638                 .insns = {
 639                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 640                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 641                         BPF_EXIT_INSN(),
 642                 },
 643                 .result = ACCEPT,
 644         },
 645         {
 646                 "test7 ld_imm64",
 647                 .insns = {
 648                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 649                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 650                         BPF_EXIT_INSN(),
 651                 },
 652                 .result = ACCEPT,
 653                 .retval = 1,
 654         },
 655         {
 656                 "test8 ld_imm64",
 657                 .insns = {
 658                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 659                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 660                         BPF_EXIT_INSN(),
 661                 },
 662                 .errstr = "uses reserved fields",
 663                 .result = REJECT,
 664         },
 665         {
 666                 "test9 ld_imm64",
 667                 .insns = {
 668                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 669                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 670                         BPF_EXIT_INSN(),
 671                 },
 672                 .errstr = "invalid bpf_ld_imm64 insn",
 673                 .result = REJECT,
 674         },
 675         {
 676                 "test10 ld_imm64",
 677                 .insns = {
 678                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 679                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 680                         BPF_EXIT_INSN(),
 681                 },
 682                 .errstr = "invalid bpf_ld_imm64 insn",
 683                 .result = REJECT,
 684         },
 685         {
 686                 "test11 ld_imm64",
 687                 .insns = {
 688                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 689                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 690                         BPF_EXIT_INSN(),
 691                 },
 692                 .errstr = "invalid bpf_ld_imm64 insn",
 693                 .result = REJECT,
 694         },
 695         {
 696                 "test12 ld_imm64",
 697                 .insns = {
 698                         BPF_MOV64_IMM(BPF_REG_1, 0),
 699                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 700                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 701                         BPF_EXIT_INSN(),
 702                 },
 703                 .errstr = "not pointing to valid bpf_map",
 704                 .result = REJECT,
 705         },
 706         {
 707                 "test13 ld_imm64",
 708                 .insns = {
 709                         BPF_MOV64_IMM(BPF_REG_1, 0),
 710                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 711                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 712                         BPF_EXIT_INSN(),
 713                 },
 714                 .errstr = "invalid bpf_ld_imm64 insn",
 715                 .result = REJECT,
 716         },
 717         {
 718                 "arsh32 on imm",
 719                 .insns = {
 720                         BPF_MOV64_IMM(BPF_REG_0, 1),
 721                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 722                         BPF_EXIT_INSN(),
 723                 },
 724                 .result = REJECT,
 725                 .errstr = "unknown opcode c4",
 726         },
 727         {
 728                 "arsh32 on reg",
 729                 .insns = {
 730                         BPF_MOV64_IMM(BPF_REG_0, 1),
 731                         BPF_MOV64_IMM(BPF_REG_1, 5),
 732                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 733                         BPF_EXIT_INSN(),
 734                 },
 735                 .result = REJECT,
 736                 .errstr = "unknown opcode cc",
 737         },
 738         {
 739                 "arsh64 on imm",
 740                 .insns = {
 741                         BPF_MOV64_IMM(BPF_REG_0, 1),
 742                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 743                         BPF_EXIT_INSN(),
 744                 },
 745                 .result = ACCEPT,
 746         },
 747         {
 748                 "arsh64 on reg",
 749                 .insns = {
 750                         BPF_MOV64_IMM(BPF_REG_0, 1),
 751                         BPF_MOV64_IMM(BPF_REG_1, 5),
 752                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 753                         BPF_EXIT_INSN(),
 754                 },
 755                 .result = ACCEPT,
 756         },
 757         {
 758                 "no bpf_exit",
 759                 .insns = {
 760                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 761                 },
 762                 .errstr = "not an exit",
 763                 .result = REJECT,
 764         },
 765         {
 766                 "loop (back-edge)",
 767                 .insns = {
 768                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 769                         BPF_EXIT_INSN(),
 770                 },
 771                 .errstr = "back-edge",
 772                 .result = REJECT,
 773         },
 774         {
 775                 "loop2 (back-edge)",
 776                 .insns = {
 777                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 778                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 779                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 780                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 781                         BPF_EXIT_INSN(),
 782                 },
 783                 .errstr = "back-edge",
 784                 .result = REJECT,
 785         },
 786         {
 787                 "conditional loop",
 788                 .insns = {
 789                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 790                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 791                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 792                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 793                         BPF_EXIT_INSN(),
 794                 },
 795                 .errstr = "back-edge",
 796                 .result = REJECT,
 797         },
 798         {
 799                 "read uninitialized register",
 800                 .insns = {
 801                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 802                         BPF_EXIT_INSN(),
 803                 },
 804                 .errstr = "R2 !read_ok",
 805                 .result = REJECT,
 806         },
 807         {
 808                 "read invalid register",
 809                 .insns = {
 810                         BPF_MOV64_REG(BPF_REG_0, -1),
 811                         BPF_EXIT_INSN(),
 812                 },
 813                 .errstr = "R15 is invalid",
 814                 .result = REJECT,
 815         },
 816         {
 817                 "program doesn't init R0 before exit",
 818                 .insns = {
 819                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 820                         BPF_EXIT_INSN(),
 821                 },
 822                 .errstr = "R0 !read_ok",
 823                 .result = REJECT,
 824         },
 825         {
 826                 "program doesn't init R0 before exit in all branches",
 827                 .insns = {
 828                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 829                         BPF_MOV64_IMM(BPF_REG_0, 1),
 830                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 831                         BPF_EXIT_INSN(),
 832                 },
 833                 .errstr = "R0 !read_ok",
 834                 .errstr_unpriv = "R1 pointer comparison",
 835                 .result = REJECT,
 836         },
 837         {
 838                 "stack out of bounds",
 839                 .insns = {
 840                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 841                         BPF_EXIT_INSN(),
 842                 },
 843                 .errstr = "invalid stack",
 844                 .result = REJECT,
 845         },
 846         {
 847                 "invalid call insn1",
 848                 .insns = {
 849                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 850                         BPF_EXIT_INSN(),
 851                 },
 852                 .errstr = "unknown opcode 8d",
 853                 .result = REJECT,
 854         },
 855         {
 856                 "invalid call insn2",
 857                 .insns = {
 858                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 859                         BPF_EXIT_INSN(),
 860                 },
 861                 .errstr = "BPF_CALL uses reserved",
 862                 .result = REJECT,
 863         },
 864         {
 865                 "invalid function call",
 866                 .insns = {
 867                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 868                         BPF_EXIT_INSN(),
 869                 },
 870                 .errstr = "invalid func unknown#1234567",
 871                 .result = REJECT,
 872         },
 873         {
 874                 "uninitialized stack1",
 875                 .insns = {
 876                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 877                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 878                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 879                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 880                                      BPF_FUNC_map_lookup_elem),
 881                         BPF_EXIT_INSN(),
 882                 },
 883                 .fixup_map_hash_8b = { 2 },
 884                 .errstr = "invalid indirect read from stack",
 885                 .result = REJECT,
 886         },
 887         {
 888                 "uninitialized stack2",
 889                 .insns = {
 890                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 891                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 892                         BPF_EXIT_INSN(),
 893                 },
 894                 .errstr = "invalid read from stack",
 895                 .result = REJECT,
 896         },
 897         {
 898                 "invalid fp arithmetic",
 899                 /* If this gets ever changed, make sure JITs can deal with it. */
 900                 .insns = {
 901                         BPF_MOV64_IMM(BPF_REG_0, 0),
 902                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 903                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 904                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 905                         BPF_EXIT_INSN(),
 906                 },
 907                 .errstr = "R1 subtraction from stack pointer",
 908                 .result = REJECT,
 909         },
 910         {
 911                 "non-invalid fp arithmetic",
 912                 .insns = {
 913                         BPF_MOV64_IMM(BPF_REG_0, 0),
 914                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 915                         BPF_EXIT_INSN(),
 916                 },
 917                 .result = ACCEPT,
 918         },
 919         {
 920                 "invalid argument register",
 921                 .insns = {
 922                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 923                                      BPF_FUNC_get_cgroup_classid),
 924                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 925                                      BPF_FUNC_get_cgroup_classid),
 926                         BPF_EXIT_INSN(),
 927                 },
 928                 .errstr = "R1 !read_ok",
 929                 .result = REJECT,
 930                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 931         },
 932         {
 933                 "non-invalid argument register",
 934                 .insns = {
 935                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 936                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 937                                      BPF_FUNC_get_cgroup_classid),
 938                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 940                                      BPF_FUNC_get_cgroup_classid),
 941                         BPF_EXIT_INSN(),
 942                 },
 943                 .result = ACCEPT,
 944                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 945         },
 946         {
 947                 "check valid spill/fill",
 948                 .insns = {
 949                         /* spill R1(ctx) into stack */
 950                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 951                         /* fill it back into R2 */
 952                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 953                         /* should be able to access R0 = *(R2 + 8) */
 954                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 955                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 956                         BPF_EXIT_INSN(),
 957                 },
 958                 .errstr_unpriv = "R0 leaks addr",
 959                 .result = ACCEPT,
 960                 .result_unpriv = REJECT,
 961                 .retval = POINTER_VALUE,
 962         },
 963         {
 964                 "check valid spill/fill, skb mark",
 965                 .insns = {
 966                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 967                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 968                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 969                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 970                                     offsetof(struct __sk_buff, mark)),
 971                         BPF_EXIT_INSN(),
 972                 },
 973                 .result = ACCEPT,
 974                 .result_unpriv = ACCEPT,
 975         },
 976         {
 977                 "check corrupted spill/fill",
 978                 .insns = {
 979                         /* spill R1(ctx) into stack */
 980                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 981                         /* mess up with R1 pointer on stack */
 982                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 983                         /* fill back into R0 should fail */
 984                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 985                         BPF_EXIT_INSN(),
 986                 },
 987                 .errstr_unpriv = "attempt to corrupt spilled",
 988                 .errstr = "corrupted spill",
 989                 .result = REJECT,
 990         },
 991         {
 992                 "invalid src register in STX",
 993                 .insns = {
 994                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 995                         BPF_EXIT_INSN(),
 996                 },
 997                 .errstr = "R15 is invalid",
 998                 .result = REJECT,
 999         },
1000         {
1001                 "invalid dst register in STX",
1002                 .insns = {
1003                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
1004                         BPF_EXIT_INSN(),
1005                 },
1006                 .errstr = "R14 is invalid",
1007                 .result = REJECT,
1008         },
1009         {
1010                 "invalid dst register in ST",
1011                 .insns = {
1012                         BPF_ST_MEM(BPF_B, 14, -1, -1),
1013                         BPF_EXIT_INSN(),
1014                 },
1015                 .errstr = "R14 is invalid",
1016                 .result = REJECT,
1017         },
1018         {
1019                 "invalid src register in LDX",
1020                 .insns = {
1021                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
1022                         BPF_EXIT_INSN(),
1023                 },
1024                 .errstr = "R12 is invalid",
1025                 .result = REJECT,
1026         },
1027         {
1028                 "invalid dst register in LDX",
1029                 .insns = {
1030                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
1031                         BPF_EXIT_INSN(),
1032                 },
1033                 .errstr = "R11 is invalid",
1034                 .result = REJECT,
1035         },
1036         {
1037                 "junk insn",
1038                 .insns = {
1039                         BPF_RAW_INSN(0, 0, 0, 0, 0),
1040                         BPF_EXIT_INSN(),
1041                 },
1042                 .errstr = "unknown opcode 00",
1043                 .result = REJECT,
1044         },
1045         {
1046                 "junk insn2",
1047                 .insns = {
1048                         BPF_RAW_INSN(1, 0, 0, 0, 0),
1049                         BPF_EXIT_INSN(),
1050                 },
1051                 .errstr = "BPF_LDX uses reserved fields",
1052                 .result = REJECT,
1053         },
1054         {
1055                 "junk insn3",
1056                 .insns = {
1057                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
1058                         BPF_EXIT_INSN(),
1059                 },
1060                 .errstr = "unknown opcode ff",
1061                 .result = REJECT,
1062         },
1063         {
1064                 "junk insn4",
1065                 .insns = {
1066                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
1067                         BPF_EXIT_INSN(),
1068                 },
1069                 .errstr = "unknown opcode ff",
1070                 .result = REJECT,
1071         },
1072         {
1073                 "junk insn5",
1074                 .insns = {
1075                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
1076                         BPF_EXIT_INSN(),
1077                 },
1078                 .errstr = "BPF_ALU uses reserved fields",
1079                 .result = REJECT,
1080         },
1081         {
1082                 "misaligned read from stack",
1083                 .insns = {
1084                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1085                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
1086                         BPF_EXIT_INSN(),
1087                 },
1088                 .errstr = "misaligned stack access",
1089                 .result = REJECT,
1090         },
1091         {
1092                 "invalid map_fd for function call",
1093                 .insns = {
1094                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1095                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
1096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1097                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1098                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1099                                      BPF_FUNC_map_delete_elem),
1100                         BPF_EXIT_INSN(),
1101                 },
1102                 .errstr = "fd 0 is not pointing to valid bpf_map",
1103                 .result = REJECT,
1104         },
1105         {
1106                 "don't check return value before access",
1107                 .insns = {
1108                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1109                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1110                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1111                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1112                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1113                                      BPF_FUNC_map_lookup_elem),
1114                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1115                         BPF_EXIT_INSN(),
1116                 },
1117                 .fixup_map_hash_8b = { 3 },
1118                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1119                 .result = REJECT,
1120         },
1121         {
1122                 "access memory with incorrect alignment",
1123                 .insns = {
1124                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1125                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1126                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1127                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1128                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1129                                      BPF_FUNC_map_lookup_elem),
1130                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1131                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1132                         BPF_EXIT_INSN(),
1133                 },
1134                 .fixup_map_hash_8b = { 3 },
1135                 .errstr = "misaligned value access",
1136                 .result = REJECT,
1137                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1138         },
1139         {
1140                 "sometimes access memory with incorrect alignment",
1141                 .insns = {
1142                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1143                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1144                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1145                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1146                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1147                                      BPF_FUNC_map_lookup_elem),
1148                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1149                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1150                         BPF_EXIT_INSN(),
1151                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1152                         BPF_EXIT_INSN(),
1153                 },
1154                 .fixup_map_hash_8b = { 3 },
1155                 .errstr = "R0 invalid mem access",
1156                 .errstr_unpriv = "R0 leaks addr",
1157                 .result = REJECT,
1158                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1159         },
1160         {
1161                 "jump test 1",
1162                 .insns = {
1163                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1164                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1165                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1166                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1168                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1169                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1170                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1171                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1172                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1175                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1176                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1177                         BPF_MOV64_IMM(BPF_REG_0, 0),
1178                         BPF_EXIT_INSN(),
1179                 },
1180                 .errstr_unpriv = "R1 pointer comparison",
1181                 .result_unpriv = REJECT,
1182                 .result = ACCEPT,
1183         },
1184         {
1185                 "jump test 2",
1186                 .insns = {
1187                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1188                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1189                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1190                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1191                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1192                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1193                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1194                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1195                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1196                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1197                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1198                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1199                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1201                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1202                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1203                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1204                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1205                         BPF_MOV64_IMM(BPF_REG_0, 0),
1206                         BPF_EXIT_INSN(),
1207                 },
1208                 .errstr_unpriv = "R1 pointer comparison",
1209                 .result_unpriv = REJECT,
1210                 .result = ACCEPT,
1211         },
1212         {
1213                 "jump test 3",
1214                 .insns = {
1215                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1216                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1217                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1219                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1220                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1221                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1223                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1224                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1225                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1226                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1227                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1228                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1229                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1231                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1233                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1235                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1237                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1241                                      BPF_FUNC_map_delete_elem),
1242                         BPF_EXIT_INSN(),
1243                 },
1244                 .fixup_map_hash_8b = { 24 },
1245                 .errstr_unpriv = "R1 pointer comparison",
1246                 .result_unpriv = REJECT,
1247                 .result = ACCEPT,
1248                 .retval = -ENOENT,
1249         },
1250         {
1251                 "jump test 4",
1252                 .insns = {
1253                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1258                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1260                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1261                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1262                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1263                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1268                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1269                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1270                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1271                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1272                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1273                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1274                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1275                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1276                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1277                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1278                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1279                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1280                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1281                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1282                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1283                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1284                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1285                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1286                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1287                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1288                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1289                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1290                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1291                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1292                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1293                         BPF_MOV64_IMM(BPF_REG_0, 0),
1294                         BPF_EXIT_INSN(),
1295                 },
1296                 .errstr_unpriv = "R1 pointer comparison",
1297                 .result_unpriv = REJECT,
1298                 .result = ACCEPT,
1299         },
1300         {
1301                 "jump test 5",
1302                 .insns = {
1303                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1304                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1305                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1306                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1307                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1308                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1309                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1310                         BPF_MOV64_IMM(BPF_REG_0, 0),
1311                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1312                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1313                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1314                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1315                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1316                         BPF_MOV64_IMM(BPF_REG_0, 0),
1317                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1318                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1319                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1320                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1321                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1322                         BPF_MOV64_IMM(BPF_REG_0, 0),
1323                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1324                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1325                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1326                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1327                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1328                         BPF_MOV64_IMM(BPF_REG_0, 0),
1329                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1330                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1331                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1332                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1333                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1334                         BPF_MOV64_IMM(BPF_REG_0, 0),
1335                         BPF_EXIT_INSN(),
1336                 },
1337                 .errstr_unpriv = "R1 pointer comparison",
1338                 .result_unpriv = REJECT,
1339                 .result = ACCEPT,
1340         },
1341         {
1342                 "access skb fields ok",
1343                 .insns = {
1344                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1345                                     offsetof(struct __sk_buff, len)),
1346                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1347                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1348                                     offsetof(struct __sk_buff, mark)),
1349                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1350                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1351                                     offsetof(struct __sk_buff, pkt_type)),
1352                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1353                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1354                                     offsetof(struct __sk_buff, queue_mapping)),
1355                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1356                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1357                                     offsetof(struct __sk_buff, protocol)),
1358                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1359                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1360                                     offsetof(struct __sk_buff, vlan_present)),
1361                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1362                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1363                                     offsetof(struct __sk_buff, vlan_tci)),
1364                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1365                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1366                                     offsetof(struct __sk_buff, napi_id)),
1367                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1368                         BPF_EXIT_INSN(),
1369                 },
1370                 .result = ACCEPT,
1371         },
1372         {
1373                 "access skb fields bad1",
1374                 .insns = {
1375                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1376                         BPF_EXIT_INSN(),
1377                 },
1378                 .errstr = "invalid bpf_context access",
1379                 .result = REJECT,
1380         },
1381         {
1382                 "access skb fields bad2",
1383                 .insns = {
1384                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1385                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1386                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1388                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1389                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1390                                      BPF_FUNC_map_lookup_elem),
1391                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1392                         BPF_EXIT_INSN(),
1393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1394                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1395                                     offsetof(struct __sk_buff, pkt_type)),
1396                         BPF_EXIT_INSN(),
1397                 },
1398                 .fixup_map_hash_8b = { 4 },
1399                 .errstr = "different pointers",
1400                 .errstr_unpriv = "R1 pointer comparison",
1401                 .result = REJECT,
1402         },
1403         {
1404                 "access skb fields bad3",
1405                 .insns = {
1406                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1407                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1408                                     offsetof(struct __sk_buff, pkt_type)),
1409                         BPF_EXIT_INSN(),
1410                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1415                                      BPF_FUNC_map_lookup_elem),
1416                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1417                         BPF_EXIT_INSN(),
1418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1419                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1420                 },
1421                 .fixup_map_hash_8b = { 6 },
1422                 .errstr = "different pointers",
1423                 .errstr_unpriv = "R1 pointer comparison",
1424                 .result = REJECT,
1425         },
1426         {
1427                 "access skb fields bad4",
1428                 .insns = {
1429                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1430                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1431                                     offsetof(struct __sk_buff, len)),
1432                         BPF_MOV64_IMM(BPF_REG_0, 0),
1433                         BPF_EXIT_INSN(),
1434                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1435                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1436                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1437                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1438                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1439                                      BPF_FUNC_map_lookup_elem),
1440                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1441                         BPF_EXIT_INSN(),
1442                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1443                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1444                 },
1445                 .fixup_map_hash_8b = { 7 },
1446                 .errstr = "different pointers",
1447                 .errstr_unpriv = "R1 pointer comparison",
1448                 .result = REJECT,
1449         },
1450         {
1451                 "invalid access __sk_buff family",
1452                 .insns = {
1453                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1454                                     offsetof(struct __sk_buff, family)),
1455                         BPF_EXIT_INSN(),
1456                 },
1457                 .errstr = "invalid bpf_context access",
1458                 .result = REJECT,
1459         },
1460         {
1461                 "invalid access __sk_buff remote_ip4",
1462                 .insns = {
1463                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1464                                     offsetof(struct __sk_buff, remote_ip4)),
1465                         BPF_EXIT_INSN(),
1466                 },
1467                 .errstr = "invalid bpf_context access",
1468                 .result = REJECT,
1469         },
1470         {
1471                 "invalid access __sk_buff local_ip4",
1472                 .insns = {
1473                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1474                                     offsetof(struct __sk_buff, local_ip4)),
1475                         BPF_EXIT_INSN(),
1476                 },
1477                 .errstr = "invalid bpf_context access",
1478                 .result = REJECT,
1479         },
1480         {
1481                 "invalid access __sk_buff remote_ip6",
1482                 .insns = {
1483                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1484                                     offsetof(struct __sk_buff, remote_ip6)),
1485                         BPF_EXIT_INSN(),
1486                 },
1487                 .errstr = "invalid bpf_context access",
1488                 .result = REJECT,
1489         },
1490         {
1491                 "invalid access __sk_buff local_ip6",
1492                 .insns = {
1493                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1494                                     offsetof(struct __sk_buff, local_ip6)),
1495                         BPF_EXIT_INSN(),
1496                 },
1497                 .errstr = "invalid bpf_context access",
1498                 .result = REJECT,
1499         },
1500         {
1501                 "invalid access __sk_buff remote_port",
1502                 .insns = {
1503                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1504                                     offsetof(struct __sk_buff, remote_port)),
1505                         BPF_EXIT_INSN(),
1506                 },
1507                 .errstr = "invalid bpf_context access",
1508                 .result = REJECT,
1509         },
1510         {
1511                 "invalid access __sk_buff remote_port",
1512                 .insns = {
1513                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1514                                     offsetof(struct __sk_buff, local_port)),
1515                         BPF_EXIT_INSN(),
1516                 },
1517                 .errstr = "invalid bpf_context access",
1518                 .result = REJECT,
1519         },
1520         {
1521                 "valid access __sk_buff family",
1522                 .insns = {
1523                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1524                                     offsetof(struct __sk_buff, family)),
1525                         BPF_EXIT_INSN(),
1526                 },
1527                 .result = ACCEPT,
1528                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1529         },
1530         {
1531                 "valid access __sk_buff remote_ip4",
1532                 .insns = {
1533                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1534                                     offsetof(struct __sk_buff, remote_ip4)),
1535                         BPF_EXIT_INSN(),
1536                 },
1537                 .result = ACCEPT,
1538                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1539         },
1540         {
1541                 "valid access __sk_buff local_ip4",
1542                 .insns = {
1543                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1544                                     offsetof(struct __sk_buff, local_ip4)),
1545                         BPF_EXIT_INSN(),
1546                 },
1547                 .result = ACCEPT,
1548                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1549         },
1550         {
1551                 "valid access __sk_buff remote_ip6",
1552                 .insns = {
1553                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1554                                     offsetof(struct __sk_buff, remote_ip6[0])),
1555                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1556                                     offsetof(struct __sk_buff, remote_ip6[1])),
1557                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1558                                     offsetof(struct __sk_buff, remote_ip6[2])),
1559                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1560                                     offsetof(struct __sk_buff, remote_ip6[3])),
1561                         BPF_EXIT_INSN(),
1562                 },
1563                 .result = ACCEPT,
1564                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1565         },
1566         {
1567                 "valid access __sk_buff local_ip6",
1568                 .insns = {
1569                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1570                                     offsetof(struct __sk_buff, local_ip6[0])),
1571                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1572                                     offsetof(struct __sk_buff, local_ip6[1])),
1573                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1574                                     offsetof(struct __sk_buff, local_ip6[2])),
1575                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1576                                     offsetof(struct __sk_buff, local_ip6[3])),
1577                         BPF_EXIT_INSN(),
1578                 },
1579                 .result = ACCEPT,
1580                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1581         },
1582         {
1583                 "valid access __sk_buff remote_port",
1584                 .insns = {
1585                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1586                                     offsetof(struct __sk_buff, remote_port)),
1587                         BPF_EXIT_INSN(),
1588                 },
1589                 .result = ACCEPT,
1590                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1591         },
1592         {
1593                 "valid access __sk_buff remote_port",
1594                 .insns = {
1595                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1596                                     offsetof(struct __sk_buff, local_port)),
1597                         BPF_EXIT_INSN(),
1598                 },
1599                 .result = ACCEPT,
1600                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1601         },
1602         {
1603                 "invalid access of tc_classid for SK_SKB",
1604                 .insns = {
1605                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1606                                     offsetof(struct __sk_buff, tc_classid)),
1607                         BPF_EXIT_INSN(),
1608                 },
1609                 .result = REJECT,
1610                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1611                 .errstr = "invalid bpf_context access",
1612         },
1613         {
1614                 "invalid access of skb->mark for SK_SKB",
1615                 .insns = {
1616                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1617                                     offsetof(struct __sk_buff, mark)),
1618                         BPF_EXIT_INSN(),
1619                 },
1620                 .result =  REJECT,
1621                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1622                 .errstr = "invalid bpf_context access",
1623         },
1624         {
1625                 "check skb->mark is not writeable by SK_SKB",
1626                 .insns = {
1627                         BPF_MOV64_IMM(BPF_REG_0, 0),
1628                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1629                                     offsetof(struct __sk_buff, mark)),
1630                         BPF_EXIT_INSN(),
1631                 },
1632                 .result =  REJECT,
1633                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1634                 .errstr = "invalid bpf_context access",
1635         },
1636         {
1637                 "check skb->tc_index is writeable by SK_SKB",
1638                 .insns = {
1639                         BPF_MOV64_IMM(BPF_REG_0, 0),
1640                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1641                                     offsetof(struct __sk_buff, tc_index)),
1642                         BPF_EXIT_INSN(),
1643                 },
1644                 .result = ACCEPT,
1645                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1646         },
1647         {
1648                 "check skb->priority is writeable by SK_SKB",
1649                 .insns = {
1650                         BPF_MOV64_IMM(BPF_REG_0, 0),
1651                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1652                                     offsetof(struct __sk_buff, priority)),
1653                         BPF_EXIT_INSN(),
1654                 },
1655                 .result = ACCEPT,
1656                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1657         },
1658         {
1659                 "direct packet read for SK_SKB",
1660                 .insns = {
1661                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1662                                     offsetof(struct __sk_buff, data)),
1663                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1664                                     offsetof(struct __sk_buff, data_end)),
1665                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1666                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1667                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1668                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1669                         BPF_MOV64_IMM(BPF_REG_0, 0),
1670                         BPF_EXIT_INSN(),
1671                 },
1672                 .result = ACCEPT,
1673                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1674         },
1675         {
1676                 "direct packet write for SK_SKB",
1677                 .insns = {
1678                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1679                                     offsetof(struct __sk_buff, data)),
1680                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1681                                     offsetof(struct __sk_buff, data_end)),
1682                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1683                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1684                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1685                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1686                         BPF_MOV64_IMM(BPF_REG_0, 0),
1687                         BPF_EXIT_INSN(),
1688                 },
1689                 .result = ACCEPT,
1690                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1691         },
1692         {
1693                 "overlapping checks for direct packet access SK_SKB",
1694                 .insns = {
1695                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1696                                     offsetof(struct __sk_buff, data)),
1697                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1698                                     offsetof(struct __sk_buff, data_end)),
1699                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1701                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1702                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1703                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1704                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1705                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1706                         BPF_MOV64_IMM(BPF_REG_0, 0),
1707                         BPF_EXIT_INSN(),
1708                 },
1709                 .result = ACCEPT,
1710                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1711         },
1712         {
1713                 "valid access family in SK_MSG",
1714                 .insns = {
1715                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1716                                     offsetof(struct sk_msg_md, family)),
1717                         BPF_EXIT_INSN(),
1718                 },
1719                 .result = ACCEPT,
1720                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1721         },
1722         {
1723                 "valid access remote_ip4 in SK_MSG",
1724                 .insns = {
1725                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1726                                     offsetof(struct sk_msg_md, remote_ip4)),
1727                         BPF_EXIT_INSN(),
1728                 },
1729                 .result = ACCEPT,
1730                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1731         },
1732         {
1733                 "valid access local_ip4 in SK_MSG",
1734                 .insns = {
1735                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1736                                     offsetof(struct sk_msg_md, local_ip4)),
1737                         BPF_EXIT_INSN(),
1738                 },
1739                 .result = ACCEPT,
1740                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1741         },
1742         {
1743                 "valid access remote_port in SK_MSG",
1744                 .insns = {
1745                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1746                                     offsetof(struct sk_msg_md, remote_port)),
1747                         BPF_EXIT_INSN(),
1748                 },
1749                 .result = ACCEPT,
1750                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1751         },
1752         {
1753                 "valid access local_port in SK_MSG",
1754                 .insns = {
1755                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1756                                     offsetof(struct sk_msg_md, local_port)),
1757                         BPF_EXIT_INSN(),
1758                 },
1759                 .result = ACCEPT,
1760                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1761         },
1762         {
1763                 "valid access remote_ip6 in SK_MSG",
1764                 .insns = {
1765                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1766                                     offsetof(struct sk_msg_md, remote_ip6[0])),
1767                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1768                                     offsetof(struct sk_msg_md, remote_ip6[1])),
1769                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1770                                     offsetof(struct sk_msg_md, remote_ip6[2])),
1771                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1772                                     offsetof(struct sk_msg_md, remote_ip6[3])),
1773                         BPF_EXIT_INSN(),
1774                 },
1775                 .result = ACCEPT,
1776                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1777         },
1778         {
1779                 "valid access local_ip6 in SK_MSG",
1780                 .insns = {
1781                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1782                                     offsetof(struct sk_msg_md, local_ip6[0])),
1783                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1784                                     offsetof(struct sk_msg_md, local_ip6[1])),
1785                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1786                                     offsetof(struct sk_msg_md, local_ip6[2])),
1787                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1788                                     offsetof(struct sk_msg_md, local_ip6[3])),
1789                         BPF_EXIT_INSN(),
1790                 },
1791                 .result = ACCEPT,
1792                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1793         },
1794         {
1795                 "invalid 64B read of family in SK_MSG",
1796                 .insns = {
1797                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1798                                     offsetof(struct sk_msg_md, family)),
1799                         BPF_EXIT_INSN(),
1800                 },
1801                 .errstr = "invalid bpf_context access",
1802                 .result = REJECT,
1803                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1804         },
1805         {
1806                 "invalid read past end of SK_MSG",
1807                 .insns = {
1808                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1809                                     offsetof(struct sk_msg_md, local_port) + 4),
1810                         BPF_EXIT_INSN(),
1811                 },
1812                 .errstr = "R0 !read_ok",
1813                 .result = REJECT,
1814                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1815         },
1816         {
1817                 "invalid read offset in SK_MSG",
1818                 .insns = {
1819                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1820                                     offsetof(struct sk_msg_md, family) + 1),
1821                         BPF_EXIT_INSN(),
1822                 },
1823                 .errstr = "invalid bpf_context access",
1824                 .result = REJECT,
1825                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1826         },
1827         {
1828                 "direct packet read for SK_MSG",
1829                 .insns = {
1830                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1831                                     offsetof(struct sk_msg_md, data)),
1832                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1833                                     offsetof(struct sk_msg_md, data_end)),
1834                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1836                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1837                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1838                         BPF_MOV64_IMM(BPF_REG_0, 0),
1839                         BPF_EXIT_INSN(),
1840                 },
1841                 .result = ACCEPT,
1842                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1843         },
1844         {
1845                 "direct packet write for SK_MSG",
1846                 .insns = {
1847                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1848                                     offsetof(struct sk_msg_md, data)),
1849                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1850                                     offsetof(struct sk_msg_md, data_end)),
1851                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1853                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1854                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1855                         BPF_MOV64_IMM(BPF_REG_0, 0),
1856                         BPF_EXIT_INSN(),
1857                 },
1858                 .result = ACCEPT,
1859                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1860         },
1861         {
1862                 "overlapping checks for direct packet access SK_MSG",
1863                 .insns = {
1864                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1865                                     offsetof(struct sk_msg_md, data)),
1866                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1867                                     offsetof(struct sk_msg_md, data_end)),
1868                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1869                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1870                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1871                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1872                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1873                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1874                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1875                         BPF_MOV64_IMM(BPF_REG_0, 0),
1876                         BPF_EXIT_INSN(),
1877                 },
1878                 .result = ACCEPT,
1879                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1880         },
1881         {
1882                 "check skb->mark is not writeable by sockets",
1883                 .insns = {
1884                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1885                                     offsetof(struct __sk_buff, mark)),
1886                         BPF_EXIT_INSN(),
1887                 },
1888                 .errstr = "invalid bpf_context access",
1889                 .errstr_unpriv = "R1 leaks addr",
1890                 .result = REJECT,
1891         },
1892         {
1893                 "check skb->tc_index is not writeable by sockets",
1894                 .insns = {
1895                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1896                                     offsetof(struct __sk_buff, tc_index)),
1897                         BPF_EXIT_INSN(),
1898                 },
1899                 .errstr = "invalid bpf_context access",
1900                 .errstr_unpriv = "R1 leaks addr",
1901                 .result = REJECT,
1902         },
1903         {
1904                 "check cb access: byte",
1905                 .insns = {
1906                         BPF_MOV64_IMM(BPF_REG_0, 0),
1907                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1908                                     offsetof(struct __sk_buff, cb[0])),
1909                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1910                                     offsetof(struct __sk_buff, cb[0]) + 1),
1911                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1912                                     offsetof(struct __sk_buff, cb[0]) + 2),
1913                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1914                                     offsetof(struct __sk_buff, cb[0]) + 3),
1915                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1916                                     offsetof(struct __sk_buff, cb[1])),
1917                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1918                                     offsetof(struct __sk_buff, cb[1]) + 1),
1919                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1920                                     offsetof(struct __sk_buff, cb[1]) + 2),
1921                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1922                                     offsetof(struct __sk_buff, cb[1]) + 3),
1923                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1924                                     offsetof(struct __sk_buff, cb[2])),
1925                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1926                                     offsetof(struct __sk_buff, cb[2]) + 1),
1927                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1928                                     offsetof(struct __sk_buff, cb[2]) + 2),
1929                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1930                                     offsetof(struct __sk_buff, cb[2]) + 3),
1931                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1932                                     offsetof(struct __sk_buff, cb[3])),
1933                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1934                                     offsetof(struct __sk_buff, cb[3]) + 1),
1935                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1936                                     offsetof(struct __sk_buff, cb[3]) + 2),
1937                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1938                                     offsetof(struct __sk_buff, cb[3]) + 3),
1939                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1940                                     offsetof(struct __sk_buff, cb[4])),
1941                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1942                                     offsetof(struct __sk_buff, cb[4]) + 1),
1943                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1944                                     offsetof(struct __sk_buff, cb[4]) + 2),
1945                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1946                                     offsetof(struct __sk_buff, cb[4]) + 3),
1947                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1948                                     offsetof(struct __sk_buff, cb[0])),
1949                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1950                                     offsetof(struct __sk_buff, cb[0]) + 1),
1951                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1952                                     offsetof(struct __sk_buff, cb[0]) + 2),
1953                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1954                                     offsetof(struct __sk_buff, cb[0]) + 3),
1955                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1956                                     offsetof(struct __sk_buff, cb[1])),
1957                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1958                                     offsetof(struct __sk_buff, cb[1]) + 1),
1959                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1960                                     offsetof(struct __sk_buff, cb[1]) + 2),
1961                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1962                                     offsetof(struct __sk_buff, cb[1]) + 3),
1963                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1964                                     offsetof(struct __sk_buff, cb[2])),
1965                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1966                                     offsetof(struct __sk_buff, cb[2]) + 1),
1967                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1968                                     offsetof(struct __sk_buff, cb[2]) + 2),
1969                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1970                                     offsetof(struct __sk_buff, cb[2]) + 3),
1971                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1972                                     offsetof(struct __sk_buff, cb[3])),
1973                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1974                                     offsetof(struct __sk_buff, cb[3]) + 1),
1975                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1976                                     offsetof(struct __sk_buff, cb[3]) + 2),
1977                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1978                                     offsetof(struct __sk_buff, cb[3]) + 3),
1979                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1980                                     offsetof(struct __sk_buff, cb[4])),
1981                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1982                                     offsetof(struct __sk_buff, cb[4]) + 1),
1983                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1984                                     offsetof(struct __sk_buff, cb[4]) + 2),
1985                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1986                                     offsetof(struct __sk_buff, cb[4]) + 3),
1987                         BPF_EXIT_INSN(),
1988                 },
1989                 .result = ACCEPT,
1990         },
1991         {
1992                 "__sk_buff->hash, offset 0, byte store not permitted",
1993                 .insns = {
1994                         BPF_MOV64_IMM(BPF_REG_0, 0),
1995                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1996                                     offsetof(struct __sk_buff, hash)),
1997                         BPF_EXIT_INSN(),
1998                 },
1999                 .errstr = "invalid bpf_context access",
2000                 .result = REJECT,
2001         },
2002         {
2003                 "__sk_buff->tc_index, offset 3, byte store not permitted",
2004                 .insns = {
2005                         BPF_MOV64_IMM(BPF_REG_0, 0),
2006                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2007                                     offsetof(struct __sk_buff, tc_index) + 3),
2008                         BPF_EXIT_INSN(),
2009                 },
2010                 .errstr = "invalid bpf_context access",
2011                 .result = REJECT,
2012         },
2013         {
2014                 "check skb->hash byte load permitted",
2015                 .insns = {
2016                         BPF_MOV64_IMM(BPF_REG_0, 0),
2017 #if __BYTE_ORDER == __LITTLE_ENDIAN
2018                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2019                                     offsetof(struct __sk_buff, hash)),
2020 #else
2021                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2022                                     offsetof(struct __sk_buff, hash) + 3),
2023 #endif
2024                         BPF_EXIT_INSN(),
2025                 },
2026                 .result = ACCEPT,
2027         },
2028         {
2029                 "check skb->hash byte load not permitted 1",
2030                 .insns = {
2031                         BPF_MOV64_IMM(BPF_REG_0, 0),
2032                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2033                                     offsetof(struct __sk_buff, hash) + 1),
2034                         BPF_EXIT_INSN(),
2035                 },
2036                 .errstr = "invalid bpf_context access",
2037                 .result = REJECT,
2038         },
2039         {
2040                 "check skb->hash byte load not permitted 2",
2041                 .insns = {
2042                         BPF_MOV64_IMM(BPF_REG_0, 0),
2043                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2044                                     offsetof(struct __sk_buff, hash) + 2),
2045                         BPF_EXIT_INSN(),
2046                 },
2047                 .errstr = "invalid bpf_context access",
2048                 .result = REJECT,
2049         },
2050         {
2051                 "check skb->hash byte load not permitted 3",
2052                 .insns = {
2053                         BPF_MOV64_IMM(BPF_REG_0, 0),
2054 #if __BYTE_ORDER == __LITTLE_ENDIAN
2055                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2056                                     offsetof(struct __sk_buff, hash) + 3),
2057 #else
2058                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2059                                     offsetof(struct __sk_buff, hash)),
2060 #endif
2061                         BPF_EXIT_INSN(),
2062                 },
2063                 .errstr = "invalid bpf_context access",
2064                 .result = REJECT,
2065         },
2066         {
2067                 "check cb access: byte, wrong type",
2068                 .insns = {
2069                         BPF_MOV64_IMM(BPF_REG_0, 0),
2070                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2071                                     offsetof(struct __sk_buff, cb[0])),
2072                         BPF_EXIT_INSN(),
2073                 },
2074                 .errstr = "invalid bpf_context access",
2075                 .result = REJECT,
2076                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2077         },
2078         {
2079                 "check cb access: half",
2080                 .insns = {
2081                         BPF_MOV64_IMM(BPF_REG_0, 0),
2082                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2083                                     offsetof(struct __sk_buff, cb[0])),
2084                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2085                                     offsetof(struct __sk_buff, cb[0]) + 2),
2086                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2087                                     offsetof(struct __sk_buff, cb[1])),
2088                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2089                                     offsetof(struct __sk_buff, cb[1]) + 2),
2090                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2091                                     offsetof(struct __sk_buff, cb[2])),
2092                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2093                                     offsetof(struct __sk_buff, cb[2]) + 2),
2094                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2095                                     offsetof(struct __sk_buff, cb[3])),
2096                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2097                                     offsetof(struct __sk_buff, cb[3]) + 2),
2098                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2099                                     offsetof(struct __sk_buff, cb[4])),
2100                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2101                                     offsetof(struct __sk_buff, cb[4]) + 2),
2102                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2103                                     offsetof(struct __sk_buff, cb[0])),
2104                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2105                                     offsetof(struct __sk_buff, cb[0]) + 2),
2106                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2107                                     offsetof(struct __sk_buff, cb[1])),
2108                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2109                                     offsetof(struct __sk_buff, cb[1]) + 2),
2110                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2111                                     offsetof(struct __sk_buff, cb[2])),
2112                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2113                                     offsetof(struct __sk_buff, cb[2]) + 2),
2114                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2115                                     offsetof(struct __sk_buff, cb[3])),
2116                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2117                                     offsetof(struct __sk_buff, cb[3]) + 2),
2118                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2119                                     offsetof(struct __sk_buff, cb[4])),
2120                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2121                                     offsetof(struct __sk_buff, cb[4]) + 2),
2122                         BPF_EXIT_INSN(),
2123                 },
2124                 .result = ACCEPT,
2125         },
2126         {
2127                 "check cb access: half, unaligned",
2128                 .insns = {
2129                         BPF_MOV64_IMM(BPF_REG_0, 0),
2130                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2131                                     offsetof(struct __sk_buff, cb[0]) + 1),
2132                         BPF_EXIT_INSN(),
2133                 },
2134                 .errstr = "misaligned context access",
2135                 .result = REJECT,
2136                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2137         },
2138         {
2139                 "check __sk_buff->hash, offset 0, half store not permitted",
2140                 .insns = {
2141                         BPF_MOV64_IMM(BPF_REG_0, 0),
2142                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2143                                     offsetof(struct __sk_buff, hash)),
2144                         BPF_EXIT_INSN(),
2145                 },
2146                 .errstr = "invalid bpf_context access",
2147                 .result = REJECT,
2148         },
2149         {
2150                 "check __sk_buff->tc_index, offset 2, half store not permitted",
2151                 .insns = {
2152                         BPF_MOV64_IMM(BPF_REG_0, 0),
2153                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2154                                     offsetof(struct __sk_buff, tc_index) + 2),
2155                         BPF_EXIT_INSN(),
2156                 },
2157                 .errstr = "invalid bpf_context access",
2158                 .result = REJECT,
2159         },
2160         {
2161                 "check skb->hash half load permitted",
2162                 .insns = {
2163                         BPF_MOV64_IMM(BPF_REG_0, 0),
2164 #if __BYTE_ORDER == __LITTLE_ENDIAN
2165                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2166                                     offsetof(struct __sk_buff, hash)),
2167 #else
2168                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2169                                     offsetof(struct __sk_buff, hash) + 2),
2170 #endif
2171                         BPF_EXIT_INSN(),
2172                 },
2173                 .result = ACCEPT,
2174         },
2175         {
2176                 "check skb->hash half load not permitted",
2177                 .insns = {
2178                         BPF_MOV64_IMM(BPF_REG_0, 0),
2179 #if __BYTE_ORDER == __LITTLE_ENDIAN
2180                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2181                                     offsetof(struct __sk_buff, hash) + 2),
2182 #else
2183                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2184                                     offsetof(struct __sk_buff, hash)),
2185 #endif
2186                         BPF_EXIT_INSN(),
2187                 },
2188                 .errstr = "invalid bpf_context access",
2189                 .result = REJECT,
2190         },
2191         {
2192                 "check cb access: half, wrong type",
2193                 .insns = {
2194                         BPF_MOV64_IMM(BPF_REG_0, 0),
2195                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2196                                     offsetof(struct __sk_buff, cb[0])),
2197                         BPF_EXIT_INSN(),
2198                 },
2199                 .errstr = "invalid bpf_context access",
2200                 .result = REJECT,
2201                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2202         },
2203         {
2204                 "check cb access: word",
2205                 .insns = {
2206                         BPF_MOV64_IMM(BPF_REG_0, 0),
2207                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2208                                     offsetof(struct __sk_buff, cb[0])),
2209                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2210                                     offsetof(struct __sk_buff, cb[1])),
2211                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2212                                     offsetof(struct __sk_buff, cb[2])),
2213                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2214                                     offsetof(struct __sk_buff, cb[3])),
2215                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2216                                     offsetof(struct __sk_buff, cb[4])),
2217                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2218                                     offsetof(struct __sk_buff, cb[0])),
2219                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2220                                     offsetof(struct __sk_buff, cb[1])),
2221                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2222                                     offsetof(struct __sk_buff, cb[2])),
2223                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2224                                     offsetof(struct __sk_buff, cb[3])),
2225                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2226                                     offsetof(struct __sk_buff, cb[4])),
2227                         BPF_EXIT_INSN(),
2228                 },
2229                 .result = ACCEPT,
2230         },
2231         {
2232                 "check cb access: word, unaligned 1",
2233                 .insns = {
2234                         BPF_MOV64_IMM(BPF_REG_0, 0),
2235                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2236                                     offsetof(struct __sk_buff, cb[0]) + 2),
2237                         BPF_EXIT_INSN(),
2238                 },
2239                 .errstr = "misaligned context access",
2240                 .result = REJECT,
2241                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2242         },
2243         {
2244                 "check cb access: word, unaligned 2",
2245                 .insns = {
2246                         BPF_MOV64_IMM(BPF_REG_0, 0),
2247                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2248                                     offsetof(struct __sk_buff, cb[4]) + 1),
2249                         BPF_EXIT_INSN(),
2250                 },
2251                 .errstr = "misaligned context access",
2252                 .result = REJECT,
2253                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2254         },
2255         {
2256                 "check cb access: word, unaligned 3",
2257                 .insns = {
2258                         BPF_MOV64_IMM(BPF_REG_0, 0),
2259                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2260                                     offsetof(struct __sk_buff, cb[4]) + 2),
2261                         BPF_EXIT_INSN(),
2262                 },
2263                 .errstr = "misaligned context access",
2264                 .result = REJECT,
2265                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2266         },
2267         {
2268                 "check cb access: word, unaligned 4",
2269                 .insns = {
2270                         BPF_MOV64_IMM(BPF_REG_0, 0),
2271                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2272                                     offsetof(struct __sk_buff, cb[4]) + 3),
2273                         BPF_EXIT_INSN(),
2274                 },
2275                 .errstr = "misaligned context access",
2276                 .result = REJECT,
2277                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2278         },
2279         {
2280                 "check cb access: double",
2281                 .insns = {
2282                         BPF_MOV64_IMM(BPF_REG_0, 0),
2283                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2284                                     offsetof(struct __sk_buff, cb[0])),
2285                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2286                                     offsetof(struct __sk_buff, cb[2])),
2287                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2288                                     offsetof(struct __sk_buff, cb[0])),
2289                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2290                                     offsetof(struct __sk_buff, cb[2])),
2291                         BPF_EXIT_INSN(),
2292                 },
2293                 .result = ACCEPT,
2294         },
2295         {
2296                 "check cb access: double, unaligned 1",
2297                 .insns = {
2298                         BPF_MOV64_IMM(BPF_REG_0, 0),
2299                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2300                                     offsetof(struct __sk_buff, cb[1])),
2301                         BPF_EXIT_INSN(),
2302                 },
2303                 .errstr = "misaligned context access",
2304                 .result = REJECT,
2305                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2306         },
2307         {
2308                 "check cb access: double, unaligned 2",
2309                 .insns = {
2310                         BPF_MOV64_IMM(BPF_REG_0, 0),
2311                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2312                                     offsetof(struct __sk_buff, cb[3])),
2313                         BPF_EXIT_INSN(),
2314                 },
2315                 .errstr = "misaligned context access",
2316                 .result = REJECT,
2317                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2318         },
2319         {
2320                 "check cb access: double, oob 1",
2321                 .insns = {
2322                         BPF_MOV64_IMM(BPF_REG_0, 0),
2323                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2324                                     offsetof(struct __sk_buff, cb[4])),
2325                         BPF_EXIT_INSN(),
2326                 },
2327                 .errstr = "invalid bpf_context access",
2328                 .result = REJECT,
2329         },
2330         {
2331                 "check cb access: double, oob 2",
2332                 .insns = {
2333                         BPF_MOV64_IMM(BPF_REG_0, 0),
2334                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2335                                     offsetof(struct __sk_buff, cb[4])),
2336                         BPF_EXIT_INSN(),
2337                 },
2338                 .errstr = "invalid bpf_context access",
2339                 .result = REJECT,
2340         },
2341         {
2342                 "check __sk_buff->ifindex dw store not permitted",
2343                 .insns = {
2344                         BPF_MOV64_IMM(BPF_REG_0, 0),
2345                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2346                                     offsetof(struct __sk_buff, ifindex)),
2347                         BPF_EXIT_INSN(),
2348                 },
2349                 .errstr = "invalid bpf_context access",
2350                 .result = REJECT,
2351         },
2352         {
2353                 "check __sk_buff->ifindex dw load not permitted",
2354                 .insns = {
2355                         BPF_MOV64_IMM(BPF_REG_0, 0),
2356                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2357                                     offsetof(struct __sk_buff, ifindex)),
2358                         BPF_EXIT_INSN(),
2359                 },
2360                 .errstr = "invalid bpf_context access",
2361                 .result = REJECT,
2362         },
2363         {
2364                 "check cb access: double, wrong type",
2365                 .insns = {
2366                         BPF_MOV64_IMM(BPF_REG_0, 0),
2367                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2368                                     offsetof(struct __sk_buff, cb[0])),
2369                         BPF_EXIT_INSN(),
2370                 },
2371                 .errstr = "invalid bpf_context access",
2372                 .result = REJECT,
2373                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2374         },
2375         {
2376                 "check out of range skb->cb access",
2377                 .insns = {
2378                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2379                                     offsetof(struct __sk_buff, cb[0]) + 256),
2380                         BPF_EXIT_INSN(),
2381                 },
2382                 .errstr = "invalid bpf_context access",
2383                 .errstr_unpriv = "",
2384                 .result = REJECT,
2385                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2386         },
2387         {
2388                 "write skb fields from socket prog",
2389                 .insns = {
2390                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2391                                     offsetof(struct __sk_buff, cb[4])),
2392                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2393                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2394                                     offsetof(struct __sk_buff, mark)),
2395                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2396                                     offsetof(struct __sk_buff, tc_index)),
2397                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2398                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2399                                     offsetof(struct __sk_buff, cb[0])),
2400                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2401                                     offsetof(struct __sk_buff, cb[2])),
2402                         BPF_EXIT_INSN(),
2403                 },
2404                 .result = ACCEPT,
2405                 .errstr_unpriv = "R1 leaks addr",
2406                 .result_unpriv = REJECT,
2407         },
2408         {
2409                 "write skb fields from tc_cls_act prog",
2410                 .insns = {
2411                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2412                                     offsetof(struct __sk_buff, cb[0])),
2413                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2414                                     offsetof(struct __sk_buff, mark)),
2415                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2416                                     offsetof(struct __sk_buff, tc_index)),
2417                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2418                                     offsetof(struct __sk_buff, tc_index)),
2419                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2420                                     offsetof(struct __sk_buff, cb[3])),
2421                         BPF_EXIT_INSN(),
2422                 },
2423                 .errstr_unpriv = "",
2424                 .result_unpriv = REJECT,
2425                 .result = ACCEPT,
2426                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2427         },
2428         {
2429                 "PTR_TO_STACK store/load",
2430                 .insns = {
2431                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2433                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2434                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2435                         BPF_EXIT_INSN(),
2436                 },
2437                 .result = ACCEPT,
2438                 .retval = 0xfaceb00c,
2439         },
2440         {
2441                 "PTR_TO_STACK store/load - bad alignment on off",
2442                 .insns = {
2443                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2445                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2446                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2447                         BPF_EXIT_INSN(),
2448                 },
2449                 .result = REJECT,
2450                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2451         },
2452         {
2453                 "PTR_TO_STACK store/load - bad alignment on reg",
2454                 .insns = {
2455                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2457                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2458                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2459                         BPF_EXIT_INSN(),
2460                 },
2461                 .result = REJECT,
2462                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2463         },
2464         {
2465                 "PTR_TO_STACK store/load - out of bounds low",
2466                 .insns = {
2467                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2468                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2469                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2470                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2471                         BPF_EXIT_INSN(),
2472                 },
2473                 .result = REJECT,
2474                 .errstr = "invalid stack off=-79992 size=8",
2475         },
2476         {
2477                 "PTR_TO_STACK store/load - out of bounds high",
2478                 .insns = {
2479                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2480                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2481                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2482                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2483                         BPF_EXIT_INSN(),
2484                 },
2485                 .result = REJECT,
2486                 .errstr = "invalid stack off=0 size=8",
2487         },
2488         {
2489                 "unpriv: return pointer",
2490                 .insns = {
2491                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2492                         BPF_EXIT_INSN(),
2493                 },
2494                 .result = ACCEPT,
2495                 .result_unpriv = REJECT,
2496                 .errstr_unpriv = "R0 leaks addr",
2497                 .retval = POINTER_VALUE,
2498         },
2499         {
2500                 "unpriv: add const to pointer",
2501                 .insns = {
2502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2503                         BPF_MOV64_IMM(BPF_REG_0, 0),
2504                         BPF_EXIT_INSN(),
2505                 },
2506                 .result = ACCEPT,
2507         },
2508         {
2509                 "unpriv: add pointer to pointer",
2510                 .insns = {
2511                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2512                         BPF_MOV64_IMM(BPF_REG_0, 0),
2513                         BPF_EXIT_INSN(),
2514                 },
2515                 .result = REJECT,
2516                 .errstr = "R1 pointer += pointer",
2517         },
2518         {
2519                 "unpriv: neg pointer",
2520                 .insns = {
2521                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2522                         BPF_MOV64_IMM(BPF_REG_0, 0),
2523                         BPF_EXIT_INSN(),
2524                 },
2525                 .result = ACCEPT,
2526                 .result_unpriv = REJECT,
2527                 .errstr_unpriv = "R1 pointer arithmetic",
2528         },
2529         {
2530                 "unpriv: cmp pointer with const",
2531                 .insns = {
2532                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2533                         BPF_MOV64_IMM(BPF_REG_0, 0),
2534                         BPF_EXIT_INSN(),
2535                 },
2536                 .result = ACCEPT,
2537                 .result_unpriv = REJECT,
2538                 .errstr_unpriv = "R1 pointer comparison",
2539         },
2540         {
2541                 "unpriv: cmp pointer with pointer",
2542                 .insns = {
2543                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2544                         BPF_MOV64_IMM(BPF_REG_0, 0),
2545                         BPF_EXIT_INSN(),
2546                 },
2547                 .result = ACCEPT,
2548                 .result_unpriv = REJECT,
2549                 .errstr_unpriv = "R10 pointer comparison",
2550         },
2551         {
2552                 "unpriv: check that printk is disallowed",
2553                 .insns = {
2554                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2555                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2557                         BPF_MOV64_IMM(BPF_REG_2, 8),
2558                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2559                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2560                                      BPF_FUNC_trace_printk),
2561                         BPF_MOV64_IMM(BPF_REG_0, 0),
2562                         BPF_EXIT_INSN(),
2563                 },
2564                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2565                 .result_unpriv = REJECT,
2566                 .result = ACCEPT,
2567         },
2568         {
2569                 "unpriv: pass pointer to helper function",
2570                 .insns = {
2571                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2572                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2573                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2574                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2575                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2576                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2577                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2578                                      BPF_FUNC_map_update_elem),
2579                         BPF_MOV64_IMM(BPF_REG_0, 0),
2580                         BPF_EXIT_INSN(),
2581                 },
2582                 .fixup_map_hash_8b = { 3 },
2583                 .errstr_unpriv = "R4 leaks addr",
2584                 .result_unpriv = REJECT,
2585                 .result = ACCEPT,
2586         },
2587         {
2588                 "unpriv: indirectly pass pointer on stack to helper function",
2589                 .insns = {
2590                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2591                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2593                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2594                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2595                                      BPF_FUNC_map_lookup_elem),
2596                         BPF_MOV64_IMM(BPF_REG_0, 0),
2597                         BPF_EXIT_INSN(),
2598                 },
2599                 .fixup_map_hash_8b = { 3 },
2600                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2601                 .result = REJECT,
2602         },
2603         {
2604                 "unpriv: mangle pointer on stack 1",
2605                 .insns = {
2606                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2607                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2608                         BPF_MOV64_IMM(BPF_REG_0, 0),
2609                         BPF_EXIT_INSN(),
2610                 },
2611                 .errstr_unpriv = "attempt to corrupt spilled",
2612                 .result_unpriv = REJECT,
2613                 .result = ACCEPT,
2614         },
2615         {
2616                 "unpriv: mangle pointer on stack 2",
2617                 .insns = {
2618                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2619                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2620                         BPF_MOV64_IMM(BPF_REG_0, 0),
2621                         BPF_EXIT_INSN(),
2622                 },
2623                 .errstr_unpriv = "attempt to corrupt spilled",
2624                 .result_unpriv = REJECT,
2625                 .result = ACCEPT,
2626         },
2627         {
2628                 "unpriv: read pointer from stack in small chunks",
2629                 .insns = {
2630                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2631                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2632                         BPF_MOV64_IMM(BPF_REG_0, 0),
2633                         BPF_EXIT_INSN(),
2634                 },
2635                 .errstr = "invalid size",
2636                 .result = REJECT,
2637         },
2638         {
2639                 "unpriv: write pointer into ctx",
2640                 .insns = {
2641                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2642                         BPF_MOV64_IMM(BPF_REG_0, 0),
2643                         BPF_EXIT_INSN(),
2644                 },
2645                 .errstr_unpriv = "R1 leaks addr",
2646                 .result_unpriv = REJECT,
2647                 .errstr = "invalid bpf_context access",
2648                 .result = REJECT,
2649         },
2650         {
2651                 "unpriv: spill/fill of ctx",
2652                 .insns = {
2653                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2654                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2655                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2656                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2657                         BPF_MOV64_IMM(BPF_REG_0, 0),
2658                         BPF_EXIT_INSN(),
2659                 },
2660                 .result = ACCEPT,
2661         },
2662         {
2663                 "unpriv: spill/fill of ctx 2",
2664                 .insns = {
2665                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2666                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2667                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2668                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2669                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2670                                      BPF_FUNC_get_hash_recalc),
2671                         BPF_MOV64_IMM(BPF_REG_0, 0),
2672                         BPF_EXIT_INSN(),
2673                 },
2674                 .result = ACCEPT,
2675                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2676         },
2677         {
2678                 "unpriv: spill/fill of ctx 3",
2679                 .insns = {
2680                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2681                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2682                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2683                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2684                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2685                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2686                                      BPF_FUNC_get_hash_recalc),
2687                         BPF_EXIT_INSN(),
2688                 },
2689                 .result = REJECT,
2690                 .errstr = "R1 type=fp expected=ctx",
2691                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2692         },
2693         {
2694                 "unpriv: spill/fill of ctx 4",
2695                 .insns = {
2696                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2697                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2698                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2699                         BPF_MOV64_IMM(BPF_REG_0, 1),
2700                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2701                                      BPF_REG_0, -8, 0),
2702                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2703                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2704                                      BPF_FUNC_get_hash_recalc),
2705                         BPF_EXIT_INSN(),
2706                 },
2707                 .result = REJECT,
2708                 .errstr = "R1 type=inv expected=ctx",
2709                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2710         },
2711         {
2712                 "unpriv: spill/fill of different pointers stx",
2713                 .insns = {
2714                         BPF_MOV64_IMM(BPF_REG_3, 42),
2715                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2717                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2718                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2720                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2721                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2722                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2723                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2724                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2725                                     offsetof(struct __sk_buff, mark)),
2726                         BPF_MOV64_IMM(BPF_REG_0, 0),
2727                         BPF_EXIT_INSN(),
2728                 },
2729                 .result = REJECT,
2730                 .errstr = "same insn cannot be used with different pointers",
2731                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2732         },
2733         {
2734                 "unpriv: spill/fill of different pointers stx - ctx and sock",
2735                 .insns = {
2736                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2737                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2738                         BPF_SK_LOOKUP,
2739                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2740                         /* u64 foo; */
2741                         /* void *target = &foo; */
2742                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2743                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2744                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2745                         /* if (skb == NULL) *target = sock; */
2746                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2747                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2748                         /* else *target = skb; */
2749                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2750                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2751                         /* struct __sk_buff *skb = *target; */
2752                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2753                         /* skb->mark = 42; */
2754                         BPF_MOV64_IMM(BPF_REG_3, 42),
2755                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2756                                     offsetof(struct __sk_buff, mark)),
2757                         /* if (sk) bpf_sk_release(sk) */
2758                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2759                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2760                         BPF_MOV64_IMM(BPF_REG_0, 0),
2761                         BPF_EXIT_INSN(),
2762                 },
2763                 .result = REJECT,
2764                 .errstr = "type=ctx expected=sock",
2765                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2766         },
2767         {
2768                 "unpriv: spill/fill of different pointers stx - leak sock",
2769                 .insns = {
2770                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2771                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2772                         BPF_SK_LOOKUP,
2773                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2774                         /* u64 foo; */
2775                         /* void *target = &foo; */
2776                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2778                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2779                         /* if (skb == NULL) *target = sock; */
2780                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2781                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2782                         /* else *target = skb; */
2783                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2784                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2785                         /* struct __sk_buff *skb = *target; */
2786                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2787                         /* skb->mark = 42; */
2788                         BPF_MOV64_IMM(BPF_REG_3, 42),
2789                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2790                                     offsetof(struct __sk_buff, mark)),
2791                         BPF_EXIT_INSN(),
2792                 },
2793                 .result = REJECT,
2794                 //.errstr = "same insn cannot be used with different pointers",
2795                 .errstr = "Unreleased reference",
2796                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2797         },
2798         {
2799                 "unpriv: spill/fill of different pointers stx - sock and ctx (read)",
2800                 .insns = {
2801                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2802                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2803                         BPF_SK_LOOKUP,
2804                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2805                         /* u64 foo; */
2806                         /* void *target = &foo; */
2807                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2810                         /* if (skb) *target = skb */
2811                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2812                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2813                         /* else *target = sock */
2814                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2815                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2816                         /* struct bpf_sock *sk = *target; */
2817                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2818                         /* if (sk) u32 foo = sk->mark; bpf_sk_release(sk); */
2819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
2820                                 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2821                                             offsetof(struct bpf_sock, mark)),
2822                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2823                         BPF_MOV64_IMM(BPF_REG_0, 0),
2824                         BPF_EXIT_INSN(),
2825                 },
2826                 .result = REJECT,
2827                 .errstr = "same insn cannot be used with different pointers",
2828                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2829         },
2830         {
2831                 "unpriv: spill/fill of different pointers stx - sock and ctx (write)",
2832                 .insns = {
2833                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
2834                         /* struct bpf_sock *sock = bpf_sock_lookup(...); */
2835                         BPF_SK_LOOKUP,
2836                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
2837                         /* u64 foo; */
2838                         /* void *target = &foo; */
2839                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2840                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2841                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
2842                         /* if (skb) *target = skb */
2843                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
2844                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2845                         /* else *target = sock */
2846                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2847                                 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2848                         /* struct bpf_sock *sk = *target; */
2849                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2850                         /* if (sk) sk->mark = 42; bpf_sk_release(sk); */
2851                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2852                                 BPF_MOV64_IMM(BPF_REG_3, 42),
2853                                 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2854                                             offsetof(struct bpf_sock, mark)),
2855                                 BPF_EMIT_CALL(BPF_FUNC_sk_release),
2856                         BPF_MOV64_IMM(BPF_REG_0, 0),
2857                         BPF_EXIT_INSN(),
2858                 },
2859                 .result = REJECT,
2860                 //.errstr = "same insn cannot be used with different pointers",
2861                 .errstr = "cannot write into socket",
2862                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2863         },
2864         {
2865                 "unpriv: spill/fill of different pointers ldx",
2866                 .insns = {
2867                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2868                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2869                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2870                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2871                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2872                                       -(__s32)offsetof(struct bpf_perf_event_data,
2873                                                        sample_period) - 8),
2874                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2875                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2876                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2877                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2878                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2879                                     offsetof(struct bpf_perf_event_data,
2880                                              sample_period)),
2881                         BPF_MOV64_IMM(BPF_REG_0, 0),
2882                         BPF_EXIT_INSN(),
2883                 },
2884                 .result = REJECT,
2885                 .errstr = "same insn cannot be used with different pointers",
2886                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2887         },
2888         {
2889                 "unpriv: write pointer into map elem value",
2890                 .insns = {
2891                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2892                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2893                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2896                                      BPF_FUNC_map_lookup_elem),
2897                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2898                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2899                         BPF_EXIT_INSN(),
2900                 },
2901                 .fixup_map_hash_8b = { 3 },
2902                 .errstr_unpriv = "R0 leaks addr",
2903                 .result_unpriv = REJECT,
2904                 .result = ACCEPT,
2905         },
2906         {
2907                 "unpriv: partial copy of pointer",
2908                 .insns = {
2909                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2910                         BPF_MOV64_IMM(BPF_REG_0, 0),
2911                         BPF_EXIT_INSN(),
2912                 },
2913                 .errstr_unpriv = "R10 partial copy",
2914                 .result_unpriv = REJECT,
2915                 .result = ACCEPT,
2916         },
2917         {
2918                 "unpriv: pass pointer to tail_call",
2919                 .insns = {
2920                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2921                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2922                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2923                                      BPF_FUNC_tail_call),
2924                         BPF_MOV64_IMM(BPF_REG_0, 0),
2925                         BPF_EXIT_INSN(),
2926                 },
2927                 .fixup_prog1 = { 1 },
2928                 .errstr_unpriv = "R3 leaks addr into helper",
2929                 .result_unpriv = REJECT,
2930                 .result = ACCEPT,
2931         },
2932         {
2933                 "unpriv: cmp map pointer with zero",
2934                 .insns = {
2935                         BPF_MOV64_IMM(BPF_REG_1, 0),
2936                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2937                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2938                         BPF_MOV64_IMM(BPF_REG_0, 0),
2939                         BPF_EXIT_INSN(),
2940                 },
2941                 .fixup_map_hash_8b = { 1 },
2942                 .errstr_unpriv = "R1 pointer comparison",
2943                 .result_unpriv = REJECT,
2944                 .result = ACCEPT,
2945         },
2946         {
2947                 "unpriv: write into frame pointer",
2948                 .insns = {
2949                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2950                         BPF_MOV64_IMM(BPF_REG_0, 0),
2951                         BPF_EXIT_INSN(),
2952                 },
2953                 .errstr = "frame pointer is read only",
2954                 .result = REJECT,
2955         },
2956         {
2957                 "unpriv: spill/fill frame pointer",
2958                 .insns = {
2959                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2960                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2961                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2962                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2963                         BPF_MOV64_IMM(BPF_REG_0, 0),
2964                         BPF_EXIT_INSN(),
2965                 },
2966                 .errstr = "frame pointer is read only",
2967                 .result = REJECT,
2968         },
2969         {
2970                 "unpriv: cmp of frame pointer",
2971                 .insns = {
2972                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2973                         BPF_MOV64_IMM(BPF_REG_0, 0),
2974                         BPF_EXIT_INSN(),
2975                 },
2976                 .errstr_unpriv = "R10 pointer comparison",
2977                 .result_unpriv = REJECT,
2978                 .result = ACCEPT,
2979         },
2980         {
2981                 "unpriv: adding of fp",
2982                 .insns = {
2983                         BPF_MOV64_IMM(BPF_REG_0, 0),
2984                         BPF_MOV64_IMM(BPF_REG_1, 0),
2985                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2986                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2987                         BPF_EXIT_INSN(),
2988                 },
2989                 .result = ACCEPT,
2990         },
2991         {
2992                 "unpriv: cmp of stack pointer",
2993                 .insns = {
2994                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2996                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2997                         BPF_MOV64_IMM(BPF_REG_0, 0),
2998                         BPF_EXIT_INSN(),
2999                 },
3000                 .errstr_unpriv = "R2 pointer comparison",
3001                 .result_unpriv = REJECT,
3002                 .result = ACCEPT,
3003         },
3004         {
3005                 "runtime/jit: tail_call within bounds, prog once",
3006                 .insns = {
3007                         BPF_MOV64_IMM(BPF_REG_3, 0),
3008                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3009                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3010                                      BPF_FUNC_tail_call),
3011                         BPF_MOV64_IMM(BPF_REG_0, 1),
3012                         BPF_EXIT_INSN(),
3013                 },
3014                 .fixup_prog1 = { 1 },
3015                 .result = ACCEPT,
3016                 .retval = 42,
3017         },
3018         {
3019                 "runtime/jit: tail_call within bounds, prog loop",
3020                 .insns = {
3021                         BPF_MOV64_IMM(BPF_REG_3, 1),
3022                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3023                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3024                                      BPF_FUNC_tail_call),
3025                         BPF_MOV64_IMM(BPF_REG_0, 1),
3026                         BPF_EXIT_INSN(),
3027                 },
3028                 .fixup_prog1 = { 1 },
3029                 .result = ACCEPT,
3030                 .retval = 41,
3031         },
3032         {
3033                 "runtime/jit: tail_call within bounds, no prog",
3034                 .insns = {
3035                         BPF_MOV64_IMM(BPF_REG_3, 2),
3036                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3037                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3038                                      BPF_FUNC_tail_call),
3039                         BPF_MOV64_IMM(BPF_REG_0, 1),
3040                         BPF_EXIT_INSN(),
3041                 },
3042                 .fixup_prog1 = { 1 },
3043                 .result = ACCEPT,
3044                 .retval = 1,
3045         },
3046         {
3047                 "runtime/jit: tail_call out of bounds",
3048                 .insns = {
3049                         BPF_MOV64_IMM(BPF_REG_3, 256),
3050                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3051                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3052                                      BPF_FUNC_tail_call),
3053                         BPF_MOV64_IMM(BPF_REG_0, 2),
3054                         BPF_EXIT_INSN(),
3055                 },
3056                 .fixup_prog1 = { 1 },
3057                 .result = ACCEPT,
3058                 .retval = 2,
3059         },
3060         {
3061                 "runtime/jit: pass negative index to tail_call",
3062                 .insns = {
3063                         BPF_MOV64_IMM(BPF_REG_3, -1),
3064                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3065                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3066                                      BPF_FUNC_tail_call),
3067                         BPF_MOV64_IMM(BPF_REG_0, 2),
3068                         BPF_EXIT_INSN(),
3069                 },
3070                 .fixup_prog1 = { 1 },
3071                 .result = ACCEPT,
3072                 .retval = 2,
3073         },
3074         {
3075                 "runtime/jit: pass > 32bit index to tail_call",
3076                 .insns = {
3077                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
3078                         BPF_LD_MAP_FD(BPF_REG_2, 0),
3079                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3080                                      BPF_FUNC_tail_call),
3081                         BPF_MOV64_IMM(BPF_REG_0, 2),
3082                         BPF_EXIT_INSN(),
3083                 },
3084                 .fixup_prog1 = { 2 },
3085                 .result = ACCEPT,
3086                 .retval = 42,
3087         },
3088         {
3089                 "stack pointer arithmetic",
3090                 .insns = {
3091                         BPF_MOV64_IMM(BPF_REG_1, 4),
3092                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
3093                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
3094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
3095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
3096                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3097                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
3098                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3099                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3100                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3101                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
3102                         BPF_MOV64_IMM(BPF_REG_0, 0),
3103                         BPF_EXIT_INSN(),
3104                 },
3105                 .result = ACCEPT,
3106         },
3107         {
3108                 "raw_stack: no skb_load_bytes",
3109                 .insns = {
3110                         BPF_MOV64_IMM(BPF_REG_2, 4),
3111                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3112                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3113                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3114                         BPF_MOV64_IMM(BPF_REG_4, 8),
3115                         /* Call to skb_load_bytes() omitted. */
3116                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3117                         BPF_EXIT_INSN(),
3118                 },
3119                 .result = REJECT,
3120                 .errstr = "invalid read from stack off -8+0 size 8",
3121                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3122         },
3123         {
3124                 "raw_stack: skb_load_bytes, negative len",
3125                 .insns = {
3126                         BPF_MOV64_IMM(BPF_REG_2, 4),
3127                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3128                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3129                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3130                         BPF_MOV64_IMM(BPF_REG_4, -8),
3131                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3132                                      BPF_FUNC_skb_load_bytes),
3133                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3134                         BPF_EXIT_INSN(),
3135                 },
3136                 .result = REJECT,
3137                 .errstr = "R4 min value is negative",
3138                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3139         },
3140         {
3141                 "raw_stack: skb_load_bytes, negative len 2",
3142                 .insns = {
3143                         BPF_MOV64_IMM(BPF_REG_2, 4),
3144                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3145                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3146                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3147                         BPF_MOV64_IMM(BPF_REG_4, ~0),
3148                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3149                                      BPF_FUNC_skb_load_bytes),
3150                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3151                         BPF_EXIT_INSN(),
3152                 },
3153                 .result = REJECT,
3154                 .errstr = "R4 min value is negative",
3155                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3156         },
3157         {
3158                 "raw_stack: skb_load_bytes, zero len",
3159                 .insns = {
3160                         BPF_MOV64_IMM(BPF_REG_2, 4),
3161                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3162                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3163                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3164                         BPF_MOV64_IMM(BPF_REG_4, 0),
3165                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3166                                      BPF_FUNC_skb_load_bytes),
3167                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3168                         BPF_EXIT_INSN(),
3169                 },
3170                 .result = REJECT,
3171                 .errstr = "invalid stack type R3",
3172                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3173         },
3174         {
3175                 "raw_stack: skb_load_bytes, no init",
3176                 .insns = {
3177                         BPF_MOV64_IMM(BPF_REG_2, 4),
3178                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3180                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3181                         BPF_MOV64_IMM(BPF_REG_4, 8),
3182                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3183                                      BPF_FUNC_skb_load_bytes),
3184                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3185                         BPF_EXIT_INSN(),
3186                 },
3187                 .result = ACCEPT,
3188                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3189         },
3190         {
3191                 "raw_stack: skb_load_bytes, init",
3192                 .insns = {
3193                         BPF_MOV64_IMM(BPF_REG_2, 4),
3194                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3196                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
3197                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3198                         BPF_MOV64_IMM(BPF_REG_4, 8),
3199                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3200                                      BPF_FUNC_skb_load_bytes),
3201                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3202                         BPF_EXIT_INSN(),
3203                 },
3204                 .result = ACCEPT,
3205                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3206         },
3207         {
3208                 "raw_stack: skb_load_bytes, spilled regs around bounds",
3209                 .insns = {
3210                         BPF_MOV64_IMM(BPF_REG_2, 4),
3211                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3213                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3214                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3215                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3216                         BPF_MOV64_IMM(BPF_REG_4, 8),
3217                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3218                                      BPF_FUNC_skb_load_bytes),
3219                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3220                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3221                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3222                                     offsetof(struct __sk_buff, mark)),
3223                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3224                                     offsetof(struct __sk_buff, priority)),
3225                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3226                         BPF_EXIT_INSN(),
3227                 },
3228                 .result = ACCEPT,
3229                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3230         },
3231         {
3232                 "raw_stack: skb_load_bytes, spilled regs corruption",
3233                 .insns = {
3234                         BPF_MOV64_IMM(BPF_REG_2, 4),
3235                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3236                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3237                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3238                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3239                         BPF_MOV64_IMM(BPF_REG_4, 8),
3240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3241                                      BPF_FUNC_skb_load_bytes),
3242                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3243                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3244                                     offsetof(struct __sk_buff, mark)),
3245                         BPF_EXIT_INSN(),
3246                 },
3247                 .result = REJECT,
3248                 .errstr = "R0 invalid mem access 'inv'",
3249                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3250         },
3251         {
3252                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
3253                 .insns = {
3254                         BPF_MOV64_IMM(BPF_REG_2, 4),
3255                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3256                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3257                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3258                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3259                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3260                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3261                         BPF_MOV64_IMM(BPF_REG_4, 8),
3262                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3263                                      BPF_FUNC_skb_load_bytes),
3264                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3265                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3266                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3267                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3268                                     offsetof(struct __sk_buff, mark)),
3269                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3270                                     offsetof(struct __sk_buff, priority)),
3271                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3272                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
3273                                     offsetof(struct __sk_buff, pkt_type)),
3274                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3275                         BPF_EXIT_INSN(),
3276                 },
3277                 .result = REJECT,
3278                 .errstr = "R3 invalid mem access 'inv'",
3279                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3280         },
3281         {
3282                 "raw_stack: skb_load_bytes, spilled regs + data",
3283                 .insns = {
3284                         BPF_MOV64_IMM(BPF_REG_2, 4),
3285                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3287                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3288                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3289                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3290                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3291                         BPF_MOV64_IMM(BPF_REG_4, 8),
3292                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3293                                      BPF_FUNC_skb_load_bytes),
3294                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3295                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3296                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3297                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3298                                     offsetof(struct __sk_buff, mark)),
3299                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3300                                     offsetof(struct __sk_buff, priority)),
3301                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3302                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3303                         BPF_EXIT_INSN(),
3304                 },
3305                 .result = ACCEPT,
3306                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3307         },
3308         {
3309                 "raw_stack: skb_load_bytes, invalid access 1",
3310                 .insns = {
3311                         BPF_MOV64_IMM(BPF_REG_2, 4),
3312                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3313                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
3314                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3315                         BPF_MOV64_IMM(BPF_REG_4, 8),
3316                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3317                                      BPF_FUNC_skb_load_bytes),
3318                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3319                         BPF_EXIT_INSN(),
3320                 },
3321                 .result = REJECT,
3322                 .errstr = "invalid stack type R3 off=-513 access_size=8",
3323                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3324         },
3325         {
3326                 "raw_stack: skb_load_bytes, invalid access 2",
3327                 .insns = {
3328                         BPF_MOV64_IMM(BPF_REG_2, 4),
3329                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3331                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3332                         BPF_MOV64_IMM(BPF_REG_4, 8),
3333                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3334                                      BPF_FUNC_skb_load_bytes),
3335                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3336                         BPF_EXIT_INSN(),
3337                 },
3338                 .result = REJECT,
3339                 .errstr = "invalid stack type R3 off=-1 access_size=8",
3340                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3341         },
3342         {
3343                 "raw_stack: skb_load_bytes, invalid access 3",
3344                 .insns = {
3345                         BPF_MOV64_IMM(BPF_REG_2, 4),
3346                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
3348                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3349                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3350                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3351                                      BPF_FUNC_skb_load_bytes),
3352                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3353                         BPF_EXIT_INSN(),
3354                 },
3355                 .result = REJECT,
3356                 .errstr = "R4 min value is negative",
3357                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3358         },
3359         {
3360                 "raw_stack: skb_load_bytes, invalid access 4",
3361                 .insns = {
3362                         BPF_MOV64_IMM(BPF_REG_2, 4),
3363                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3365                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3366                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3367                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3368                                      BPF_FUNC_skb_load_bytes),
3369                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3370                         BPF_EXIT_INSN(),
3371                 },
3372                 .result = REJECT,
3373                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3374                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3375         },
3376         {
3377                 "raw_stack: skb_load_bytes, invalid access 5",
3378                 .insns = {
3379                         BPF_MOV64_IMM(BPF_REG_2, 4),
3380                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3382                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3383                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3384                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3385                                      BPF_FUNC_skb_load_bytes),
3386                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3387                         BPF_EXIT_INSN(),
3388                 },
3389                 .result = REJECT,
3390                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3391                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3392         },
3393         {
3394                 "raw_stack: skb_load_bytes, invalid access 6",
3395                 .insns = {
3396                         BPF_MOV64_IMM(BPF_REG_2, 4),
3397                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3398                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3399                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3400                         BPF_MOV64_IMM(BPF_REG_4, 0),
3401                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3402                                      BPF_FUNC_skb_load_bytes),
3403                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3404                         BPF_EXIT_INSN(),
3405                 },
3406                 .result = REJECT,
3407                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3408                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3409         },
3410         {
3411                 "raw_stack: skb_load_bytes, large access",
3412                 .insns = {
3413                         BPF_MOV64_IMM(BPF_REG_2, 4),
3414                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3416                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3417                         BPF_MOV64_IMM(BPF_REG_4, 512),
3418                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3419                                      BPF_FUNC_skb_load_bytes),
3420                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3421                         BPF_EXIT_INSN(),
3422                 },
3423                 .result = ACCEPT,
3424                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3425         },
3426         {
3427                 "context stores via ST",
3428                 .insns = {
3429                         BPF_MOV64_IMM(BPF_REG_0, 0),
3430                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3431                         BPF_EXIT_INSN(),
3432                 },
3433                 .errstr = "BPF_ST stores into R1 ctx is not allowed",
3434                 .result = REJECT,
3435                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3436         },
3437         {
3438                 "context stores via XADD",
3439                 .insns = {
3440                         BPF_MOV64_IMM(BPF_REG_0, 0),
3441                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3442                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3443                         BPF_EXIT_INSN(),
3444                 },
3445                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
3446                 .result = REJECT,
3447                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3448         },
3449         {
3450                 "direct packet access: test1",
3451                 .insns = {
3452                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3453                                     offsetof(struct __sk_buff, data)),
3454                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3455                                     offsetof(struct __sk_buff, data_end)),
3456                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3458                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3459                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3460                         BPF_MOV64_IMM(BPF_REG_0, 0),
3461                         BPF_EXIT_INSN(),
3462                 },
3463                 .result = ACCEPT,
3464                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3465         },
3466         {
3467                 "direct packet access: test2",
3468                 .insns = {
3469                         BPF_MOV64_IMM(BPF_REG_0, 1),
3470                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3471                                     offsetof(struct __sk_buff, data_end)),
3472                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3473                                     offsetof(struct __sk_buff, data)),
3474                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3475                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3476                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3477                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3478                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3479                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3480                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3481                                     offsetof(struct __sk_buff, data)),
3482                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3483                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3484                                     offsetof(struct __sk_buff, len)),
3485                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3486                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3487                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3488                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3489                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3490                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3491                                     offsetof(struct __sk_buff, data_end)),
3492                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3493                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3494                         BPF_MOV64_IMM(BPF_REG_0, 0),
3495                         BPF_EXIT_INSN(),
3496                 },
3497                 .result = ACCEPT,
3498                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3499         },
3500         {
3501                 "direct packet access: test3",
3502                 .insns = {
3503                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3504                                     offsetof(struct __sk_buff, data)),
3505                         BPF_MOV64_IMM(BPF_REG_0, 0),
3506                         BPF_EXIT_INSN(),
3507                 },
3508                 .errstr = "invalid bpf_context access off=76",
3509                 .result = REJECT,
3510                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3511         },
3512         {
3513                 "direct packet access: test4 (write)",
3514                 .insns = {
3515                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3516                                     offsetof(struct __sk_buff, data)),
3517                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3518                                     offsetof(struct __sk_buff, data_end)),
3519                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3521                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3522                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3523                         BPF_MOV64_IMM(BPF_REG_0, 0),
3524                         BPF_EXIT_INSN(),
3525                 },
3526                 .result = ACCEPT,
3527                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3528         },
3529         {
3530                 "direct packet access: test5 (pkt_end >= reg, good access)",
3531                 .insns = {
3532                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3533                                     offsetof(struct __sk_buff, data)),
3534                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3535                                     offsetof(struct __sk_buff, data_end)),
3536                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3537                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3538                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3539                         BPF_MOV64_IMM(BPF_REG_0, 1),
3540                         BPF_EXIT_INSN(),
3541                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3542                         BPF_MOV64_IMM(BPF_REG_0, 0),
3543                         BPF_EXIT_INSN(),
3544                 },
3545                 .result = ACCEPT,
3546                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3547         },
3548         {
3549                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3550                 .insns = {
3551                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3552                                     offsetof(struct __sk_buff, data)),
3553                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3554                                     offsetof(struct __sk_buff, data_end)),
3555                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3557                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3558                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3559                         BPF_MOV64_IMM(BPF_REG_0, 1),
3560                         BPF_EXIT_INSN(),
3561                         BPF_MOV64_IMM(BPF_REG_0, 0),
3562                         BPF_EXIT_INSN(),
3563                 },
3564                 .errstr = "invalid access to packet",
3565                 .result = REJECT,
3566                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3567         },
3568         {
3569                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3570                 .insns = {
3571                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3572                                     offsetof(struct __sk_buff, data)),
3573                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3574                                     offsetof(struct __sk_buff, data_end)),
3575                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3577                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3578                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3579                         BPF_MOV64_IMM(BPF_REG_0, 1),
3580                         BPF_EXIT_INSN(),
3581                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3582                         BPF_MOV64_IMM(BPF_REG_0, 0),
3583                         BPF_EXIT_INSN(),
3584                 },
3585                 .errstr = "invalid access to packet",
3586                 .result = REJECT,
3587                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3588         },
3589         {
3590                 "direct packet access: test8 (double test, variant 1)",
3591                 .insns = {
3592                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3593                                     offsetof(struct __sk_buff, data)),
3594                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3595                                     offsetof(struct __sk_buff, data_end)),
3596                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3598                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3599                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3600                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3601                         BPF_MOV64_IMM(BPF_REG_0, 1),
3602                         BPF_EXIT_INSN(),
3603                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3604                         BPF_MOV64_IMM(BPF_REG_0, 0),
3605                         BPF_EXIT_INSN(),
3606                 },
3607                 .result = ACCEPT,
3608                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3609         },
3610         {
3611                 "direct packet access: test9 (double test, variant 2)",
3612                 .insns = {
3613                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3614                                     offsetof(struct __sk_buff, data)),
3615                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3616                                     offsetof(struct __sk_buff, data_end)),
3617                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3618                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3619                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3620                         BPF_MOV64_IMM(BPF_REG_0, 1),
3621                         BPF_EXIT_INSN(),
3622                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3623                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3624                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3625                         BPF_MOV64_IMM(BPF_REG_0, 0),
3626                         BPF_EXIT_INSN(),
3627                 },
3628                 .result = ACCEPT,
3629                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3630         },
3631         {
3632                 "direct packet access: test10 (write invalid)",
3633                 .insns = {
3634                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3635                                     offsetof(struct __sk_buff, data)),
3636                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3637                                     offsetof(struct __sk_buff, data_end)),
3638                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3639                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3640                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3641                         BPF_MOV64_IMM(BPF_REG_0, 0),
3642                         BPF_EXIT_INSN(),
3643                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3644                         BPF_MOV64_IMM(BPF_REG_0, 0),
3645                         BPF_EXIT_INSN(),
3646                 },
3647                 .errstr = "invalid access to packet",
3648                 .result = REJECT,
3649                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3650         },
3651         {
3652                 "direct packet access: test11 (shift, good access)",
3653                 .insns = {
3654                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3655                                     offsetof(struct __sk_buff, data)),
3656                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3657                                     offsetof(struct __sk_buff, data_end)),
3658                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3660                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3661                         BPF_MOV64_IMM(BPF_REG_3, 144),
3662                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3664                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3665                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3666                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3667                         BPF_MOV64_IMM(BPF_REG_0, 1),
3668                         BPF_EXIT_INSN(),
3669                         BPF_MOV64_IMM(BPF_REG_0, 0),
3670                         BPF_EXIT_INSN(),
3671                 },
3672                 .result = ACCEPT,
3673                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3674                 .retval = 1,
3675         },
3676         {
3677                 "direct packet access: test12 (and, good access)",
3678                 .insns = {
3679                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3680                                     offsetof(struct __sk_buff, data)),
3681                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3682                                     offsetof(struct __sk_buff, data_end)),
3683                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3684                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3685                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3686                         BPF_MOV64_IMM(BPF_REG_3, 144),
3687                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3689                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3690                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3691                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3692                         BPF_MOV64_IMM(BPF_REG_0, 1),
3693                         BPF_EXIT_INSN(),
3694                         BPF_MOV64_IMM(BPF_REG_0, 0),
3695                         BPF_EXIT_INSN(),
3696                 },
3697                 .result = ACCEPT,
3698                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3699                 .retval = 1,
3700         },
3701         {
3702                 "direct packet access: test13 (branches, good access)",
3703                 .insns = {
3704                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3705                                     offsetof(struct __sk_buff, data)),
3706                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3707                                     offsetof(struct __sk_buff, data_end)),
3708                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3709                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3710                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3711                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3712                                     offsetof(struct __sk_buff, mark)),
3713                         BPF_MOV64_IMM(BPF_REG_4, 1),
3714                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3715                         BPF_MOV64_IMM(BPF_REG_3, 14),
3716                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3717                         BPF_MOV64_IMM(BPF_REG_3, 24),
3718                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3720                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3721                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3722                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3723                         BPF_MOV64_IMM(BPF_REG_0, 1),
3724                         BPF_EXIT_INSN(),
3725                         BPF_MOV64_IMM(BPF_REG_0, 0),
3726                         BPF_EXIT_INSN(),
3727                 },
3728                 .result = ACCEPT,
3729                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3730                 .retval = 1,
3731         },
3732         {
3733                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3734                 .insns = {
3735                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3736                                     offsetof(struct __sk_buff, data)),
3737                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3738                                     offsetof(struct __sk_buff, data_end)),
3739                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3740                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3741                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3742                         BPF_MOV64_IMM(BPF_REG_5, 12),
3743                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3744                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3745                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3746                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3747                         BPF_MOV64_IMM(BPF_REG_0, 1),
3748                         BPF_EXIT_INSN(),
3749                         BPF_MOV64_IMM(BPF_REG_0, 0),
3750                         BPF_EXIT_INSN(),
3751                 },
3752                 .result = ACCEPT,
3753                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3754                 .retval = 1,
3755         },
3756         {
3757                 "direct packet access: test15 (spill with xadd)",
3758                 .insns = {
3759                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3760                                     offsetof(struct __sk_buff, data)),
3761                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3762                                     offsetof(struct __sk_buff, data_end)),
3763                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3765                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3766                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3767                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3768                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3769                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3770                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3771                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3772                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3773                         BPF_MOV64_IMM(BPF_REG_0, 0),
3774                         BPF_EXIT_INSN(),
3775                 },
3776                 .errstr = "R2 invalid mem access 'inv'",
3777                 .result = REJECT,
3778                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3779         },
3780         {
3781                 "direct packet access: test16 (arith on data_end)",
3782                 .insns = {
3783                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3784                                     offsetof(struct __sk_buff, data)),
3785                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3786                                     offsetof(struct __sk_buff, data_end)),
3787                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3788                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3789                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3790                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3791                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3792                         BPF_MOV64_IMM(BPF_REG_0, 0),
3793                         BPF_EXIT_INSN(),
3794                 },
3795                 .errstr = "R3 pointer arithmetic on pkt_end",
3796                 .result = REJECT,
3797                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3798         },
3799         {
3800                 "direct packet access: test17 (pruning, alignment)",
3801                 .insns = {
3802                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3803                                     offsetof(struct __sk_buff, data)),
3804                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3805                                     offsetof(struct __sk_buff, data_end)),
3806                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3807                                     offsetof(struct __sk_buff, mark)),
3808                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3810                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3811                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3812                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3813                         BPF_MOV64_IMM(BPF_REG_0, 0),
3814                         BPF_EXIT_INSN(),
3815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3816                         BPF_JMP_A(-6),
3817                 },
3818                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3819                 .result = REJECT,
3820                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3821                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3822         },
3823         {
3824                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3825                 .insns = {
3826                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3827                                     offsetof(struct __sk_buff, data)),
3828                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3829                                     offsetof(struct __sk_buff, data_end)),
3830                         BPF_MOV64_IMM(BPF_REG_0, 8),
3831                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3832                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3833                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3834                         BPF_MOV64_IMM(BPF_REG_0, 0),
3835                         BPF_EXIT_INSN(),
3836                 },
3837                 .result = ACCEPT,
3838                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3839         },
3840         {
3841                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3842                 .insns = {
3843                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3844                                     offsetof(struct __sk_buff, data)),
3845                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3846                                     offsetof(struct __sk_buff, data_end)),
3847                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3849                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3850                         BPF_MOV64_IMM(BPF_REG_4, 4),
3851                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3852                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3853                         BPF_MOV64_IMM(BPF_REG_0, 0),
3854                         BPF_EXIT_INSN(),
3855                 },
3856                 .result = ACCEPT,
3857                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3858         },
3859         {
3860                 "direct packet access: test20 (x += pkt_ptr, 1)",
3861                 .insns = {
3862                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3863                                     offsetof(struct __sk_buff, data)),
3864                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3865                                     offsetof(struct __sk_buff, data_end)),
3866                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3867                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3868                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3869                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3870                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3871                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3872                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3873                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3874                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3875                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3876                         BPF_MOV64_IMM(BPF_REG_0, 0),
3877                         BPF_EXIT_INSN(),
3878                 },
3879                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3880                 .result = ACCEPT,
3881         },
3882         {
3883                 "direct packet access: test21 (x += pkt_ptr, 2)",
3884                 .insns = {
3885                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3886                                     offsetof(struct __sk_buff, data)),
3887                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3888                                     offsetof(struct __sk_buff, data_end)),
3889                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3891                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3892                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3893                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3894                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3895                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3896                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3897                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3898                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3899                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3900                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3901                         BPF_MOV64_IMM(BPF_REG_0, 0),
3902                         BPF_EXIT_INSN(),
3903                 },
3904                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3905                 .result = ACCEPT,
3906         },
3907         {
3908                 "direct packet access: test22 (x += pkt_ptr, 3)",
3909                 .insns = {
3910                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3911                                     offsetof(struct __sk_buff, data)),
3912                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3913                                     offsetof(struct __sk_buff, data_end)),
3914                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3915                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3916                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3917                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3918                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3919                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3920                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3921                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3922                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3923                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3924                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3925                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3926                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3927                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3928                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3929                         BPF_MOV64_IMM(BPF_REG_2, 1),
3930                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3931                         BPF_MOV64_IMM(BPF_REG_0, 0),
3932                         BPF_EXIT_INSN(),
3933                 },
3934                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3935                 .result = ACCEPT,
3936         },
3937         {
3938                 "direct packet access: test23 (x += pkt_ptr, 4)",
3939                 .insns = {
3940                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3941                                     offsetof(struct __sk_buff, data)),
3942                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3943                                     offsetof(struct __sk_buff, data_end)),
3944                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3945                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3946                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3947                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3948                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3949                         BPF_MOV64_IMM(BPF_REG_0, 31),
3950                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3951                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3952                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3954                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3955                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3956                         BPF_MOV64_IMM(BPF_REG_0, 0),
3957                         BPF_EXIT_INSN(),
3958                 },
3959                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3960                 .result = REJECT,
3961                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3962         },
3963         {
3964                 "direct packet access: test24 (x += pkt_ptr, 5)",
3965                 .insns = {
3966                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3967                                     offsetof(struct __sk_buff, data)),
3968                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3969                                     offsetof(struct __sk_buff, data_end)),
3970                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3971                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3972                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3973                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3974                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3975                         BPF_MOV64_IMM(BPF_REG_0, 64),
3976                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3977                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3978                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3979                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3980                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3981                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3982                         BPF_MOV64_IMM(BPF_REG_0, 0),
3983                         BPF_EXIT_INSN(),
3984                 },
3985                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3986                 .result = ACCEPT,
3987         },
3988         {
3989                 "direct packet access: test25 (marking on <, good access)",
3990                 .insns = {
3991                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3992                                     offsetof(struct __sk_buff, data)),
3993                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3994                                     offsetof(struct __sk_buff, data_end)),
3995                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3997                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3998                         BPF_MOV64_IMM(BPF_REG_0, 0),
3999                         BPF_EXIT_INSN(),
4000                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4001                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
4002                 },
4003                 .result = ACCEPT,
4004                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4005         },
4006         {
4007                 "direct packet access: test26 (marking on <, bad access)",
4008                 .insns = {
4009                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4010                                     offsetof(struct __sk_buff, data)),
4011                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4012                                     offsetof(struct __sk_buff, data_end)),
4013                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4015                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
4016                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4017                         BPF_MOV64_IMM(BPF_REG_0, 0),
4018                         BPF_EXIT_INSN(),
4019                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
4020                 },
4021                 .result = REJECT,
4022                 .errstr = "invalid access to packet",
4023                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4024         },
4025         {
4026                 "direct packet access: test27 (marking on <=, good access)",
4027                 .insns = {
4028                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4029                                     offsetof(struct __sk_buff, data)),
4030                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4031                                     offsetof(struct __sk_buff, data_end)),
4032                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4033                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4034                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
4035                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4036                         BPF_MOV64_IMM(BPF_REG_0, 1),
4037                         BPF_EXIT_INSN(),
4038                 },
4039                 .result = ACCEPT,
4040                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4041                 .retval = 1,
4042         },
4043         {
4044                 "direct packet access: test28 (marking on <=, bad access)",
4045                 .insns = {
4046                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4047                                     offsetof(struct __sk_buff, data)),
4048                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4049                                     offsetof(struct __sk_buff, data_end)),
4050                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4051                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4052                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
4053                         BPF_MOV64_IMM(BPF_REG_0, 1),
4054                         BPF_EXIT_INSN(),
4055                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4056                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
4057                 },
4058                 .result = REJECT,
4059                 .errstr = "invalid access to packet",
4060                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4061         },
4062         {
4063                 "helper access to packet: test1, valid packet_ptr range",
4064                 .insns = {
4065                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4066                                     offsetof(struct xdp_md, data)),
4067                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4068                                     offsetof(struct xdp_md, data_end)),
4069                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4071                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4072                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4073                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4074                         BPF_MOV64_IMM(BPF_REG_4, 0),
4075                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4076                                      BPF_FUNC_map_update_elem),
4077                         BPF_MOV64_IMM(BPF_REG_0, 0),
4078                         BPF_EXIT_INSN(),
4079                 },
4080                 .fixup_map_hash_8b = { 5 },
4081                 .result_unpriv = ACCEPT,
4082                 .result = ACCEPT,
4083                 .prog_type = BPF_PROG_TYPE_XDP,
4084         },
4085         {
4086                 "helper access to packet: test2, unchecked packet_ptr",
4087                 .insns = {
4088                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4089                                     offsetof(struct xdp_md, data)),
4090                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4091                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4092                                      BPF_FUNC_map_lookup_elem),
4093                         BPF_MOV64_IMM(BPF_REG_0, 0),
4094                         BPF_EXIT_INSN(),
4095                 },
4096                 .fixup_map_hash_8b = { 1 },
4097                 .result = REJECT,
4098                 .errstr = "invalid access to packet",
4099                 .prog_type = BPF_PROG_TYPE_XDP,
4100         },
4101         {
4102                 "helper access to packet: test3, variable add",
4103                 .insns = {
4104                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4105                                         offsetof(struct xdp_md, data)),
4106                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4107                                         offsetof(struct xdp_md, data_end)),
4108                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4109                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4110                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4111                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4112                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4113                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4114                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4115                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4116                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4117                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4118                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4119                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4120                                      BPF_FUNC_map_lookup_elem),
4121                         BPF_MOV64_IMM(BPF_REG_0, 0),
4122                         BPF_EXIT_INSN(),
4123                 },
4124                 .fixup_map_hash_8b = { 11 },
4125                 .result = ACCEPT,
4126                 .prog_type = BPF_PROG_TYPE_XDP,
4127         },
4128         {
4129                 "helper access to packet: test4, packet_ptr with bad range",
4130                 .insns = {
4131                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4132                                     offsetof(struct xdp_md, data)),
4133                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4134                                     offsetof(struct xdp_md, data_end)),
4135                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4136                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4137                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4138                         BPF_MOV64_IMM(BPF_REG_0, 0),
4139                         BPF_EXIT_INSN(),
4140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4142                                      BPF_FUNC_map_lookup_elem),
4143                         BPF_MOV64_IMM(BPF_REG_0, 0),
4144                         BPF_EXIT_INSN(),
4145                 },
4146                 .fixup_map_hash_8b = { 7 },
4147                 .result = REJECT,
4148                 .errstr = "invalid access to packet",
4149                 .prog_type = BPF_PROG_TYPE_XDP,
4150         },
4151         {
4152                 "helper access to packet: test5, packet_ptr with too short range",
4153                 .insns = {
4154                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4155                                     offsetof(struct xdp_md, data)),
4156                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4157                                     offsetof(struct xdp_md, data_end)),
4158                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4159                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4160                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4161                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4162                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4163                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4164                                      BPF_FUNC_map_lookup_elem),
4165                         BPF_MOV64_IMM(BPF_REG_0, 0),
4166                         BPF_EXIT_INSN(),
4167                 },
4168                 .fixup_map_hash_8b = { 6 },
4169                 .result = REJECT,
4170                 .errstr = "invalid access to packet",
4171                 .prog_type = BPF_PROG_TYPE_XDP,
4172         },
4173         {
4174                 "helper access to packet: test6, cls valid packet_ptr range",
4175                 .insns = {
4176                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4177                                     offsetof(struct __sk_buff, data)),
4178                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4179                                     offsetof(struct __sk_buff, data_end)),
4180                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4181                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4182                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4183                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4184                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4185                         BPF_MOV64_IMM(BPF_REG_4, 0),
4186                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4187                                      BPF_FUNC_map_update_elem),
4188                         BPF_MOV64_IMM(BPF_REG_0, 0),
4189                         BPF_EXIT_INSN(),
4190                 },
4191                 .fixup_map_hash_8b = { 5 },
4192                 .result = ACCEPT,
4193                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4194         },
4195         {
4196                 "helper access to packet: test7, cls unchecked packet_ptr",
4197                 .insns = {
4198                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4199                                     offsetof(struct __sk_buff, data)),
4200                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4201                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4202                                      BPF_FUNC_map_lookup_elem),
4203                         BPF_MOV64_IMM(BPF_REG_0, 0),
4204                         BPF_EXIT_INSN(),
4205                 },
4206                 .fixup_map_hash_8b = { 1 },
4207                 .result = REJECT,
4208                 .errstr = "invalid access to packet",
4209                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4210         },
4211         {
4212                 "helper access to packet: test8, cls variable add",
4213                 .insns = {
4214                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4215                                         offsetof(struct __sk_buff, data)),
4216                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4217                                         offsetof(struct __sk_buff, data_end)),
4218                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4219                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4220                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4221                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4222                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4223                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4224                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4225                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4226                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4227                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4228                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4229                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4230                                      BPF_FUNC_map_lookup_elem),
4231                         BPF_MOV64_IMM(BPF_REG_0, 0),
4232                         BPF_EXIT_INSN(),
4233                 },
4234                 .fixup_map_hash_8b = { 11 },
4235                 .result = ACCEPT,
4236                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4237         },
4238         {
4239                 "helper access to packet: test9, cls packet_ptr with bad range",
4240                 .insns = {
4241                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4242                                     offsetof(struct __sk_buff, data)),
4243                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4244                                     offsetof(struct __sk_buff, data_end)),
4245                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4247                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4248                         BPF_MOV64_IMM(BPF_REG_0, 0),
4249                         BPF_EXIT_INSN(),
4250                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4251                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4252                                      BPF_FUNC_map_lookup_elem),
4253                         BPF_MOV64_IMM(BPF_REG_0, 0),
4254                         BPF_EXIT_INSN(),
4255                 },
4256                 .fixup_map_hash_8b = { 7 },
4257                 .result = REJECT,
4258                 .errstr = "invalid access to packet",
4259                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4260         },
4261         {
4262                 "helper access to packet: test10, cls packet_ptr with too short range",
4263                 .insns = {
4264                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4265                                     offsetof(struct __sk_buff, data)),
4266                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4267                                     offsetof(struct __sk_buff, data_end)),
4268                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4269                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4271                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4272                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4273                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4274                                      BPF_FUNC_map_lookup_elem),
4275                         BPF_MOV64_IMM(BPF_REG_0, 0),
4276                         BPF_EXIT_INSN(),
4277                 },
4278                 .fixup_map_hash_8b = { 6 },
4279                 .result = REJECT,
4280                 .errstr = "invalid access to packet",
4281                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4282         },
4283         {
4284                 "helper access to packet: test11, cls unsuitable helper 1",
4285                 .insns = {
4286                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4287                                     offsetof(struct __sk_buff, data)),
4288                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4289                                     offsetof(struct __sk_buff, data_end)),
4290                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4291                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4292                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
4293                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
4294                         BPF_MOV64_IMM(BPF_REG_2, 0),
4295                         BPF_MOV64_IMM(BPF_REG_4, 42),
4296                         BPF_MOV64_IMM(BPF_REG_5, 0),
4297                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4298                                      BPF_FUNC_skb_store_bytes),
4299                         BPF_MOV64_IMM(BPF_REG_0, 0),
4300                         BPF_EXIT_INSN(),
4301                 },
4302                 .result = REJECT,
4303                 .errstr = "helper access to the packet",
4304                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4305         },
4306         {
4307                 "helper access to packet: test12, cls unsuitable helper 2",
4308                 .insns = {
4309                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4310                                     offsetof(struct __sk_buff, data)),
4311                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4312                                     offsetof(struct __sk_buff, data_end)),
4313                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4314                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
4315                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
4316                         BPF_MOV64_IMM(BPF_REG_2, 0),
4317                         BPF_MOV64_IMM(BPF_REG_4, 4),
4318                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4319                                      BPF_FUNC_skb_load_bytes),
4320                         BPF_MOV64_IMM(BPF_REG_0, 0),
4321                         BPF_EXIT_INSN(),
4322                 },
4323                 .result = REJECT,
4324                 .errstr = "helper access to the packet",
4325                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4326         },
4327         {
4328                 "helper access to packet: test13, cls helper ok",
4329                 .insns = {
4330                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4331                                     offsetof(struct __sk_buff, data)),
4332                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4333                                     offsetof(struct __sk_buff, data_end)),
4334                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4335                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4337                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4338                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4339                         BPF_MOV64_IMM(BPF_REG_2, 4),
4340                         BPF_MOV64_IMM(BPF_REG_3, 0),
4341                         BPF_MOV64_IMM(BPF_REG_4, 0),
4342                         BPF_MOV64_IMM(BPF_REG_5, 0),
4343                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4344                                      BPF_FUNC_csum_diff),
4345                         BPF_MOV64_IMM(BPF_REG_0, 0),
4346                         BPF_EXIT_INSN(),
4347                 },
4348                 .result = ACCEPT,
4349                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4350         },
4351         {
4352                 "helper access to packet: test14, cls helper ok sub",
4353                 .insns = {
4354                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4355                                     offsetof(struct __sk_buff, data)),
4356                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4357                                     offsetof(struct __sk_buff, data_end)),
4358                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4359                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4361                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4362                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4363                         BPF_MOV64_IMM(BPF_REG_2, 4),
4364                         BPF_MOV64_IMM(BPF_REG_3, 0),
4365                         BPF_MOV64_IMM(BPF_REG_4, 0),
4366                         BPF_MOV64_IMM(BPF_REG_5, 0),
4367                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4368                                      BPF_FUNC_csum_diff),
4369                         BPF_MOV64_IMM(BPF_REG_0, 0),
4370                         BPF_EXIT_INSN(),
4371                 },
4372                 .result = ACCEPT,
4373                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4374         },
4375         {
4376                 "helper access to packet: test15, cls helper fail sub",
4377                 .insns = {
4378                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4379                                     offsetof(struct __sk_buff, data)),
4380                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4381                                     offsetof(struct __sk_buff, data_end)),
4382                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4383                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4384                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4385                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4386                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4387                         BPF_MOV64_IMM(BPF_REG_2, 4),
4388                         BPF_MOV64_IMM(BPF_REG_3, 0),
4389                         BPF_MOV64_IMM(BPF_REG_4, 0),
4390                         BPF_MOV64_IMM(BPF_REG_5, 0),
4391                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4392                                      BPF_FUNC_csum_diff),
4393                         BPF_MOV64_IMM(BPF_REG_0, 0),
4394                         BPF_EXIT_INSN(),
4395                 },
4396                 .result = REJECT,
4397                 .errstr = "invalid access to packet",
4398                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4399         },
4400         {
4401                 "helper access to packet: test16, cls helper fail range 1",
4402                 .insns = {
4403                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4404                                     offsetof(struct __sk_buff, data)),
4405                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4406                                     offsetof(struct __sk_buff, data_end)),
4407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4408                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4409                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4410                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4411                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4412                         BPF_MOV64_IMM(BPF_REG_2, 8),
4413                         BPF_MOV64_IMM(BPF_REG_3, 0),
4414                         BPF_MOV64_IMM(BPF_REG_4, 0),
4415                         BPF_MOV64_IMM(BPF_REG_5, 0),
4416                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4417                                      BPF_FUNC_csum_diff),
4418                         BPF_MOV64_IMM(BPF_REG_0, 0),
4419                         BPF_EXIT_INSN(),
4420                 },
4421                 .result = REJECT,
4422                 .errstr = "invalid access to packet",
4423                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4424         },
4425         {
4426                 "helper access to packet: test17, cls helper fail range 2",
4427                 .insns = {
4428                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4429                                     offsetof(struct __sk_buff, data)),
4430                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4431                                     offsetof(struct __sk_buff, data_end)),
4432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4435                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4436                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4437                         BPF_MOV64_IMM(BPF_REG_2, -9),
4438                         BPF_MOV64_IMM(BPF_REG_3, 0),
4439                         BPF_MOV64_IMM(BPF_REG_4, 0),
4440                         BPF_MOV64_IMM(BPF_REG_5, 0),
4441                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4442                                      BPF_FUNC_csum_diff),
4443                         BPF_MOV64_IMM(BPF_REG_0, 0),
4444                         BPF_EXIT_INSN(),
4445                 },
4446                 .result = REJECT,
4447                 .errstr = "R2 min value is negative",
4448                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4449         },
4450         {
4451                 "helper access to packet: test18, cls helper fail range 3",
4452                 .insns = {
4453                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4454                                     offsetof(struct __sk_buff, data)),
4455                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4456                                     offsetof(struct __sk_buff, data_end)),
4457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4460                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4461                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4462                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4463                         BPF_MOV64_IMM(BPF_REG_3, 0),
4464                         BPF_MOV64_IMM(BPF_REG_4, 0),
4465                         BPF_MOV64_IMM(BPF_REG_5, 0),
4466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4467                                      BPF_FUNC_csum_diff),
4468                         BPF_MOV64_IMM(BPF_REG_0, 0),
4469                         BPF_EXIT_INSN(),
4470                 },
4471                 .result = REJECT,
4472                 .errstr = "R2 min value is negative",
4473                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4474         },
4475         {
4476                 "helper access to packet: test19, cls helper range zero",
4477                 .insns = {
4478                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4479                                     offsetof(struct __sk_buff, data)),
4480                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4481                                     offsetof(struct __sk_buff, data_end)),
4482                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4483                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4485                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4486                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4487                         BPF_MOV64_IMM(BPF_REG_2, 0),
4488                         BPF_MOV64_IMM(BPF_REG_3, 0),
4489                         BPF_MOV64_IMM(BPF_REG_4, 0),
4490                         BPF_MOV64_IMM(BPF_REG_5, 0),
4491                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4492                                      BPF_FUNC_csum_diff),
4493                         BPF_MOV64_IMM(BPF_REG_0, 0),
4494                         BPF_EXIT_INSN(),
4495                 },
4496                 .result = ACCEPT,
4497                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4498         },
4499         {
4500                 "helper access to packet: test20, pkt end as input",
4501                 .insns = {
4502                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4503                                     offsetof(struct __sk_buff, data)),
4504                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4505                                     offsetof(struct __sk_buff, data_end)),
4506                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4507                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4508                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4509                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4510                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4511                         BPF_MOV64_IMM(BPF_REG_2, 4),
4512                         BPF_MOV64_IMM(BPF_REG_3, 0),
4513                         BPF_MOV64_IMM(BPF_REG_4, 0),
4514                         BPF_MOV64_IMM(BPF_REG_5, 0),
4515                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4516                                      BPF_FUNC_csum_diff),
4517                         BPF_MOV64_IMM(BPF_REG_0, 0),
4518                         BPF_EXIT_INSN(),
4519                 },
4520                 .result = REJECT,
4521                 .errstr = "R1 type=pkt_end expected=fp",
4522                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4523         },
4524         {
4525                 "helper access to packet: test21, wrong reg",
4526                 .insns = {
4527                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4528                                     offsetof(struct __sk_buff, data)),
4529                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4530                                     offsetof(struct __sk_buff, data_end)),
4531                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4533                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4534                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4535                         BPF_MOV64_IMM(BPF_REG_2, 4),
4536                         BPF_MOV64_IMM(BPF_REG_3, 0),
4537                         BPF_MOV64_IMM(BPF_REG_4, 0),
4538                         BPF_MOV64_IMM(BPF_REG_5, 0),
4539                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4540                                      BPF_FUNC_csum_diff),
4541                         BPF_MOV64_IMM(BPF_REG_0, 0),
4542                         BPF_EXIT_INSN(),
4543                 },
4544                 .result = REJECT,
4545                 .errstr = "invalid access to packet",
4546                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4547         },
4548         {
4549                 "prevent map lookup in sockmap",
4550                 .insns = {
4551                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4552                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4554                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4555                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4556                                      BPF_FUNC_map_lookup_elem),
4557                         BPF_EXIT_INSN(),
4558                 },
4559                 .fixup_map_sockmap = { 3 },
4560                 .result = REJECT,
4561                 .errstr = "cannot pass map_type 15 into func bpf_map_lookup_elem",
4562                 .prog_type = BPF_PROG_TYPE_SOCK_OPS,
4563         },
4564         {
4565                 "prevent map lookup in sockhash",
4566                 .insns = {
4567                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4568                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4569                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4570                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4571                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4572                                      BPF_FUNC_map_lookup_elem),
4573                         BPF_EXIT_INSN(),
4574                 },
4575                 .fixup_map_sockhash = { 3 },
4576                 .result = REJECT,
4577                 .errstr = "cannot pass map_type 18 into func bpf_map_lookup_elem",
4578                 .prog_type = BPF_PROG_TYPE_SOCK_OPS,
4579         },
4580         {
4581                 "prevent map lookup in xskmap",
4582                 .insns = {
4583                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4584                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4586                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4587                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4588                                      BPF_FUNC_map_lookup_elem),
4589                         BPF_EXIT_INSN(),
4590                 },
4591                 .fixup_map_xskmap = { 3 },
4592                 .result = REJECT,
4593                 .errstr = "cannot pass map_type 17 into func bpf_map_lookup_elem",
4594                 .prog_type = BPF_PROG_TYPE_XDP,
4595         },
4596         {
4597                 "prevent map lookup in stack trace",
4598                 .insns = {
4599                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4600                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4601                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4602                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4603                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4604                                      BPF_FUNC_map_lookup_elem),
4605                         BPF_EXIT_INSN(),
4606                 },
4607                 .fixup_map_stacktrace = { 3 },
4608                 .result = REJECT,
4609                 .errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem",
4610                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
4611         },
4612         {
4613                 "prevent map lookup in prog array",
4614                 .insns = {
4615                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4616                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4617                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4618                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4619                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4620                                      BPF_FUNC_map_lookup_elem),
4621                         BPF_EXIT_INSN(),
4622                 },
4623                 .fixup_prog2 = { 3 },
4624                 .result = REJECT,
4625                 .errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem",
4626         },
4627         {
4628                 "valid map access into an array with a constant",
4629                 .insns = {
4630                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4631                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4632                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4633                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4634                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4635                                      BPF_FUNC_map_lookup_elem),
4636                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4637                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4638                                    offsetof(struct test_val, foo)),
4639                         BPF_EXIT_INSN(),
4640                 },
4641                 .fixup_map_hash_48b = { 3 },
4642                 .errstr_unpriv = "R0 leaks addr",
4643                 .result_unpriv = REJECT,
4644                 .result = ACCEPT,
4645         },
4646         {
4647                 "valid map access into an array with a register",
4648                 .insns = {
4649                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4650                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4652                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4653                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4654                                      BPF_FUNC_map_lookup_elem),
4655                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4656                         BPF_MOV64_IMM(BPF_REG_1, 4),
4657                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4658                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4659                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4660                                    offsetof(struct test_val, foo)),
4661                         BPF_EXIT_INSN(),
4662                 },
4663                 .fixup_map_hash_48b = { 3 },
4664                 .errstr_unpriv = "R0 leaks addr",
4665                 .result_unpriv = REJECT,
4666                 .result = ACCEPT,
4667                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4668         },
4669         {
4670                 "valid map access into an array with a variable",
4671                 .insns = {
4672                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4673                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4674                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4675                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4676                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4677                                      BPF_FUNC_map_lookup_elem),
4678                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4679                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4680                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4681                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4682                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4683                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4684                                    offsetof(struct test_val, foo)),
4685                         BPF_EXIT_INSN(),
4686                 },
4687                 .fixup_map_hash_48b = { 3 },
4688                 .errstr_unpriv = "R0 leaks addr",
4689                 .result_unpriv = REJECT,
4690                 .result = ACCEPT,
4691                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4692         },
4693         {
4694                 "valid map access into an array with a signed variable",
4695                 .insns = {
4696                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4697                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4698                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4699                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4700                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4701                                      BPF_FUNC_map_lookup_elem),
4702                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4703                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4704                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4705                         BPF_MOV32_IMM(BPF_REG_1, 0),
4706                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4707                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4708                         BPF_MOV32_IMM(BPF_REG_1, 0),
4709                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4710                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4711                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4712                                    offsetof(struct test_val, foo)),
4713                         BPF_EXIT_INSN(),
4714                 },
4715                 .fixup_map_hash_48b = { 3 },
4716                 .errstr_unpriv = "R0 leaks addr",
4717                 .result_unpriv = REJECT,
4718                 .result = ACCEPT,
4719                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4720         },
4721         {
4722                 "invalid map access into an array with a constant",
4723                 .insns = {
4724                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4725                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4726                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4727                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4728                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4729                                      BPF_FUNC_map_lookup_elem),
4730                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4731                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4732                                    offsetof(struct test_val, foo)),
4733                         BPF_EXIT_INSN(),
4734                 },
4735                 .fixup_map_hash_48b = { 3 },
4736                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4737                 .result = REJECT,
4738         },
4739         {
4740                 "invalid map access into an array with a register",
4741                 .insns = {
4742                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4743                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4744                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4745                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4746                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4747                                      BPF_FUNC_map_lookup_elem),
4748                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4749                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4750                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4751                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4752                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4753                                    offsetof(struct test_val, foo)),
4754                         BPF_EXIT_INSN(),
4755                 },
4756                 .fixup_map_hash_48b = { 3 },
4757                 .errstr = "R0 min value is outside of the array range",
4758                 .result = REJECT,
4759                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4760         },
4761         {
4762                 "invalid map access into an array with a variable",
4763                 .insns = {
4764                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4765                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4766                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4767                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4768                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4769                                      BPF_FUNC_map_lookup_elem),
4770                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4771                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4772                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4773                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4774                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4775                                    offsetof(struct test_val, foo)),
4776                         BPF_EXIT_INSN(),
4777                 },
4778                 .fixup_map_hash_48b = { 3 },
4779                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4780                 .result = REJECT,
4781                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4782         },
4783         {
4784                 "invalid map access into an array with no floor check",
4785                 .insns = {
4786                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4787                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4788                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4789                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4790                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4791                                      BPF_FUNC_map_lookup_elem),
4792                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4793                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4794                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4795                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4796                         BPF_MOV32_IMM(BPF_REG_1, 0),
4797                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4798                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4799                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4800                                    offsetof(struct test_val, foo)),
4801                         BPF_EXIT_INSN(),
4802                 },
4803                 .fixup_map_hash_48b = { 3 },
4804                 .errstr_unpriv = "R0 leaks addr",
4805                 .errstr = "R0 unbounded memory access",
4806                 .result_unpriv = REJECT,
4807                 .result = REJECT,
4808                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4809         },
4810         {
4811                 "invalid map access into an array with a invalid max check",
4812                 .insns = {
4813                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4814                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4816                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4817                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4818                                      BPF_FUNC_map_lookup_elem),
4819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4820                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4821                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4822                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4823                         BPF_MOV32_IMM(BPF_REG_1, 0),
4824                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4825                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4826                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4827                                    offsetof(struct test_val, foo)),
4828                         BPF_EXIT_INSN(),
4829                 },
4830                 .fixup_map_hash_48b = { 3 },
4831                 .errstr_unpriv = "R0 leaks addr",
4832                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4833                 .result_unpriv = REJECT,
4834                 .result = REJECT,
4835                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4836         },
4837         {
4838                 "invalid map access into an array with a invalid max check",
4839                 .insns = {
4840                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4841                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4843                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4844                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4845                                      BPF_FUNC_map_lookup_elem),
4846                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4847                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4848                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4849                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4850                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4851                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4852                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4853                                      BPF_FUNC_map_lookup_elem),
4854                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4855                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4856                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4857                                     offsetof(struct test_val, foo)),
4858                         BPF_EXIT_INSN(),
4859                 },
4860                 .fixup_map_hash_48b = { 3, 11 },
4861                 .errstr = "R0 pointer += pointer",
4862                 .result = REJECT,
4863                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4864         },
4865         {
4866                 "direct packet read test#1 for CGROUP_SKB",
4867                 .insns = {
4868                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4869                                     offsetof(struct __sk_buff, data)),
4870                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4871                                     offsetof(struct __sk_buff, data_end)),
4872                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4873                                     offsetof(struct __sk_buff, len)),
4874                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4875                                     offsetof(struct __sk_buff, pkt_type)),
4876                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4877                                     offsetof(struct __sk_buff, mark)),
4878                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4879                                     offsetof(struct __sk_buff, mark)),
4880                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4881                                     offsetof(struct __sk_buff, queue_mapping)),
4882                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4883                                     offsetof(struct __sk_buff, protocol)),
4884                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4885                                     offsetof(struct __sk_buff, vlan_present)),
4886                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4887                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4888                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4889                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4890                         BPF_MOV64_IMM(BPF_REG_0, 0),
4891                         BPF_EXIT_INSN(),
4892                 },
4893                 .result = ACCEPT,
4894                 .result_unpriv = REJECT,
4895                 .errstr_unpriv = "invalid bpf_context access off=76 size=4",
4896                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4897         },
4898         {
4899                 "direct packet read test#2 for CGROUP_SKB",
4900                 .insns = {
4901                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4902                                     offsetof(struct __sk_buff, vlan_tci)),
4903                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4904                                     offsetof(struct __sk_buff, vlan_proto)),
4905                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4906                                     offsetof(struct __sk_buff, priority)),
4907                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4908                                     offsetof(struct __sk_buff, priority)),
4909                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4910                                     offsetof(struct __sk_buff,
4911                                              ingress_ifindex)),
4912                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4913                                     offsetof(struct __sk_buff, tc_index)),
4914                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4915                                     offsetof(struct __sk_buff, hash)),
4916                         BPF_MOV64_IMM(BPF_REG_0, 0),
4917                         BPF_EXIT_INSN(),
4918                 },
4919                 .result = ACCEPT,
4920                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4921         },
4922         {
4923                 "direct packet read test#3 for CGROUP_SKB",
4924                 .insns = {
4925                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4926                                     offsetof(struct __sk_buff, cb[0])),
4927                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4928                                     offsetof(struct __sk_buff, cb[1])),
4929                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4930                                     offsetof(struct __sk_buff, cb[2])),
4931                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4932                                     offsetof(struct __sk_buff, cb[3])),
4933                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4934                                     offsetof(struct __sk_buff, cb[4])),
4935                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
4936                                     offsetof(struct __sk_buff, napi_id)),
4937                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_4,
4938                                     offsetof(struct __sk_buff, cb[0])),
4939                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_5,
4940                                     offsetof(struct __sk_buff, cb[1])),
4941                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
4942                                     offsetof(struct __sk_buff, cb[2])),
4943                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_7,
4944                                     offsetof(struct __sk_buff, cb[3])),
4945                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_8,
4946                                     offsetof(struct __sk_buff, cb[4])),
4947                         BPF_MOV64_IMM(BPF_REG_0, 0),
4948                         BPF_EXIT_INSN(),
4949                 },
4950                 .result = ACCEPT,
4951                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4952         },
4953         {
4954                 "direct packet read test#4 for CGROUP_SKB",
4955                 .insns = {
4956                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4957                                     offsetof(struct __sk_buff, family)),
4958                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4959                                     offsetof(struct __sk_buff, remote_ip4)),
4960                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
4961                                     offsetof(struct __sk_buff, local_ip4)),
4962                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4963                                     offsetof(struct __sk_buff, remote_ip6[0])),
4964                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4965                                     offsetof(struct __sk_buff, remote_ip6[1])),
4966                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4967                                     offsetof(struct __sk_buff, remote_ip6[2])),
4968                         BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
4969                                     offsetof(struct __sk_buff, remote_ip6[3])),
4970                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4971                                     offsetof(struct __sk_buff, local_ip6[0])),
4972                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4973                                     offsetof(struct __sk_buff, local_ip6[1])),
4974                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4975                                     offsetof(struct __sk_buff, local_ip6[2])),
4976                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4977                                     offsetof(struct __sk_buff, local_ip6[3])),
4978                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4979                                     offsetof(struct __sk_buff, remote_port)),
4980                         BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
4981                                     offsetof(struct __sk_buff, local_port)),
4982                         BPF_MOV64_IMM(BPF_REG_0, 0),
4983                         BPF_EXIT_INSN(),
4984                 },
4985                 .result = ACCEPT,
4986                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4987         },
4988         {
4989                 "invalid access of tc_classid for CGROUP_SKB",
4990                 .insns = {
4991                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4992                                     offsetof(struct __sk_buff, tc_classid)),
4993                         BPF_MOV64_IMM(BPF_REG_0, 0),
4994                         BPF_EXIT_INSN(),
4995                 },
4996                 .result = REJECT,
4997                 .errstr = "invalid bpf_context access",
4998                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4999         },
5000         {
5001                 "invalid access of data_meta for CGROUP_SKB",
5002                 .insns = {
5003                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5004                                     offsetof(struct __sk_buff, data_meta)),
5005                         BPF_MOV64_IMM(BPF_REG_0, 0),
5006                         BPF_EXIT_INSN(),
5007                 },
5008                 .result = REJECT,
5009                 .errstr = "invalid bpf_context access",
5010                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5011         },
5012         {
5013                 "invalid access of flow_keys for CGROUP_SKB",
5014                 .insns = {
5015                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5016                                     offsetof(struct __sk_buff, flow_keys)),
5017                         BPF_MOV64_IMM(BPF_REG_0, 0),
5018                         BPF_EXIT_INSN(),
5019                 },
5020                 .result = REJECT,
5021                 .errstr = "invalid bpf_context access",
5022                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5023         },
5024         {
5025                 "invalid write access to napi_id for CGROUP_SKB",
5026                 .insns = {
5027                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
5028                                     offsetof(struct __sk_buff, napi_id)),
5029                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_9,
5030                                     offsetof(struct __sk_buff, napi_id)),
5031                         BPF_MOV64_IMM(BPF_REG_0, 0),
5032                         BPF_EXIT_INSN(),
5033                 },
5034                 .result = REJECT,
5035                 .errstr = "invalid bpf_context access",
5036                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5037         },
5038         {
5039                 "valid cgroup storage access",
5040                 .insns = {
5041                         BPF_MOV64_IMM(BPF_REG_2, 0),
5042                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5043                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5044                                      BPF_FUNC_get_local_storage),
5045                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5046                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5047                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5048                         BPF_EXIT_INSN(),
5049                 },
5050                 .fixup_cgroup_storage = { 1 },
5051                 .result = ACCEPT,
5052                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5053         },
5054         {
5055                 "invalid cgroup storage access 1",
5056                 .insns = {
5057                         BPF_MOV64_IMM(BPF_REG_2, 0),
5058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5060                                      BPF_FUNC_get_local_storage),
5061                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5062                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5063                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5064                         BPF_EXIT_INSN(),
5065                 },
5066                 .fixup_map_hash_8b = { 1 },
5067                 .result = REJECT,
5068                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
5069                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5070         },
5071         {
5072                 "invalid cgroup storage access 2",
5073                 .insns = {
5074                         BPF_MOV64_IMM(BPF_REG_2, 0),
5075                         BPF_LD_MAP_FD(BPF_REG_1, 1),
5076                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5077                                      BPF_FUNC_get_local_storage),
5078                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5079                         BPF_EXIT_INSN(),
5080                 },
5081                 .result = REJECT,
5082                 .errstr = "fd 1 is not pointing to valid bpf_map",
5083                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5084         },
5085         {
5086                 "invalid cgroup storage access 3",
5087                 .insns = {
5088                         BPF_MOV64_IMM(BPF_REG_2, 0),
5089                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5090                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5091                                      BPF_FUNC_get_local_storage),
5092                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
5093                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5094                         BPF_MOV64_IMM(BPF_REG_0, 0),
5095                         BPF_EXIT_INSN(),
5096                 },
5097                 .fixup_cgroup_storage = { 1 },
5098                 .result = REJECT,
5099                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
5100                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5101         },
5102         {
5103                 "invalid cgroup storage access 4",
5104                 .insns = {
5105                         BPF_MOV64_IMM(BPF_REG_2, 0),
5106                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5107                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5108                                      BPF_FUNC_get_local_storage),
5109                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
5110                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5112                         BPF_EXIT_INSN(),
5113                 },
5114                 .fixup_cgroup_storage = { 1 },
5115                 .result = REJECT,
5116                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
5117                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5118         },
5119         {
5120                 "invalid cgroup storage access 5",
5121                 .insns = {
5122                         BPF_MOV64_IMM(BPF_REG_2, 7),
5123                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5124                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5125                                      BPF_FUNC_get_local_storage),
5126                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5127                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5128                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5129                         BPF_EXIT_INSN(),
5130                 },
5131                 .fixup_cgroup_storage = { 1 },
5132                 .result = REJECT,
5133                 .errstr = "get_local_storage() doesn't support non-zero flags",
5134                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5135         },
5136         {
5137                 "invalid cgroup storage access 6",
5138                 .insns = {
5139                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
5140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5142                                      BPF_FUNC_get_local_storage),
5143                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5144                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5145                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5146                         BPF_EXIT_INSN(),
5147                 },
5148                 .fixup_cgroup_storage = { 1 },
5149                 .result = REJECT,
5150                 .errstr = "get_local_storage() doesn't support non-zero flags",
5151                 .errstr_unpriv = "R2 leaks addr into helper function",
5152                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5153         },
5154         {
5155                 "valid per-cpu cgroup storage access",
5156                 .insns = {
5157                         BPF_MOV64_IMM(BPF_REG_2, 0),
5158                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5159                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5160                                      BPF_FUNC_get_local_storage),
5161                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5162                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5163                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5164                         BPF_EXIT_INSN(),
5165                 },
5166                 .fixup_percpu_cgroup_storage = { 1 },
5167                 .result = ACCEPT,
5168                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5169         },
5170         {
5171                 "invalid per-cpu cgroup storage access 1",
5172                 .insns = {
5173                         BPF_MOV64_IMM(BPF_REG_2, 0),
5174                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5175                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5176                                      BPF_FUNC_get_local_storage),
5177                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5178                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5179                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5180                         BPF_EXIT_INSN(),
5181                 },
5182                 .fixup_map_hash_8b = { 1 },
5183                 .result = REJECT,
5184                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
5185                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5186         },
5187         {
5188                 "invalid per-cpu cgroup storage access 2",
5189                 .insns = {
5190                         BPF_MOV64_IMM(BPF_REG_2, 0),
5191                         BPF_LD_MAP_FD(BPF_REG_1, 1),
5192                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5193                                      BPF_FUNC_get_local_storage),
5194                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5195                         BPF_EXIT_INSN(),
5196                 },
5197                 .result = REJECT,
5198                 .errstr = "fd 1 is not pointing to valid bpf_map",
5199                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5200         },
5201         {
5202                 "invalid per-cpu cgroup storage access 3",
5203                 .insns = {
5204                         BPF_MOV64_IMM(BPF_REG_2, 0),
5205                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5206                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5207                                      BPF_FUNC_get_local_storage),
5208                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
5209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5210                         BPF_MOV64_IMM(BPF_REG_0, 0),
5211                         BPF_EXIT_INSN(),
5212                 },
5213                 .fixup_percpu_cgroup_storage = { 1 },
5214                 .result = REJECT,
5215                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
5216                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5217         },
5218         {
5219                 "invalid per-cpu cgroup storage access 4",
5220                 .insns = {
5221                         BPF_MOV64_IMM(BPF_REG_2, 0),
5222                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5223                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5224                                      BPF_FUNC_get_local_storage),
5225                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
5226                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5227                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5228                         BPF_EXIT_INSN(),
5229                 },
5230                 .fixup_cgroup_storage = { 1 },
5231                 .result = REJECT,
5232                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
5233                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5234         },
5235         {
5236                 "invalid per-cpu cgroup storage access 5",
5237                 .insns = {
5238                         BPF_MOV64_IMM(BPF_REG_2, 7),
5239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5241                                      BPF_FUNC_get_local_storage),
5242                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5243                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5244                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5245                         BPF_EXIT_INSN(),
5246                 },
5247                 .fixup_percpu_cgroup_storage = { 1 },
5248                 .result = REJECT,
5249                 .errstr = "get_local_storage() doesn't support non-zero flags",
5250                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5251         },
5252         {
5253                 "invalid per-cpu cgroup storage access 6",
5254                 .insns = {
5255                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
5256                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5257                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5258                                      BPF_FUNC_get_local_storage),
5259                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5260                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
5261                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
5262                         BPF_EXIT_INSN(),
5263                 },
5264                 .fixup_percpu_cgroup_storage = { 1 },
5265                 .result = REJECT,
5266                 .errstr = "get_local_storage() doesn't support non-zero flags",
5267                 .errstr_unpriv = "R2 leaks addr into helper function",
5268                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
5269         },
5270         {
5271                 "multiple registers share map_lookup_elem result",
5272                 .insns = {
5273                         BPF_MOV64_IMM(BPF_REG_1, 10),
5274                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5275                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5277                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5279                                      BPF_FUNC_map_lookup_elem),
5280                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5281                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5282                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5283                         BPF_EXIT_INSN(),
5284                 },
5285                 .fixup_map_hash_8b = { 4 },
5286                 .result = ACCEPT,
5287                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5288         },
5289         {
5290                 "alu ops on ptr_to_map_value_or_null, 1",
5291                 .insns = {
5292                         BPF_MOV64_IMM(BPF_REG_1, 10),
5293                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5294                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5295                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5296                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5297                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5298                                      BPF_FUNC_map_lookup_elem),
5299                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
5301                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
5302                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5303                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5304                         BPF_EXIT_INSN(),
5305                 },
5306                 .fixup_map_hash_8b = { 4 },
5307                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5308                 .result = REJECT,
5309                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5310         },
5311         {
5312                 "alu ops on ptr_to_map_value_or_null, 2",
5313                 .insns = {
5314                         BPF_MOV64_IMM(BPF_REG_1, 10),
5315                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5316                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5318                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5319                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5320                                      BPF_FUNC_map_lookup_elem),
5321                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5322                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
5323                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5324                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5325                         BPF_EXIT_INSN(),
5326                 },
5327                 .fixup_map_hash_8b = { 4 },
5328                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5329                 .result = REJECT,
5330                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5331         },
5332         {
5333                 "alu ops on ptr_to_map_value_or_null, 3",
5334                 .insns = {
5335                         BPF_MOV64_IMM(BPF_REG_1, 10),
5336                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5337                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5338                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5339                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5340                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5341                                      BPF_FUNC_map_lookup_elem),
5342                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5343                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
5344                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5345                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5346                         BPF_EXIT_INSN(),
5347                 },
5348                 .fixup_map_hash_8b = { 4 },
5349                 .errstr = "R4 pointer arithmetic on map_value_or_null",
5350                 .result = REJECT,
5351                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5352         },
5353         {
5354                 "invalid memory access with multiple map_lookup_elem calls",
5355                 .insns = {
5356                         BPF_MOV64_IMM(BPF_REG_1, 10),
5357                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5358                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5359                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5360                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5361                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
5362                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
5363                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5364                                      BPF_FUNC_map_lookup_elem),
5365                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5366                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
5367                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
5368                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5369                                      BPF_FUNC_map_lookup_elem),
5370                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5371                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5372                         BPF_EXIT_INSN(),
5373                 },
5374                 .fixup_map_hash_8b = { 4 },
5375                 .result = REJECT,
5376                 .errstr = "R4 !read_ok",
5377                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5378         },
5379         {
5380                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
5381                 .insns = {
5382                         BPF_MOV64_IMM(BPF_REG_1, 10),
5383                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
5384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5386                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5387                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
5388                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
5389                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5390                                      BPF_FUNC_map_lookup_elem),
5391                         BPF_MOV64_IMM(BPF_REG_2, 10),
5392                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
5393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
5394                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
5395                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5396                                      BPF_FUNC_map_lookup_elem),
5397                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
5398                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5399                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
5400                         BPF_EXIT_INSN(),
5401                 },
5402                 .fixup_map_hash_8b = { 4 },
5403                 .result = ACCEPT,
5404                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
5405         },
5406         {
5407                 "invalid map access from else condition",
5408                 .insns = {
5409                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5410                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5412                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5413                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
5414                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5415                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5416                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
5417                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
5418                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
5419                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
5420                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
5421                         BPF_EXIT_INSN(),
5422                 },
5423                 .fixup_map_hash_48b = { 3 },
5424                 .errstr = "R0 unbounded memory access",
5425                 .result = REJECT,
5426                 .errstr_unpriv = "R0 leaks addr",
5427                 .result_unpriv = REJECT,
5428                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5429         },
5430         {
5431                 "constant register |= constant should keep constant type",
5432                 .insns = {
5433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5435                         BPF_MOV64_IMM(BPF_REG_2, 34),
5436                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
5437                         BPF_MOV64_IMM(BPF_REG_3, 0),
5438                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5439                         BPF_EXIT_INSN(),
5440                 },
5441                 .result = ACCEPT,
5442                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5443         },
5444         {
5445                 "constant register |= constant should not bypass stack boundary checks",
5446                 .insns = {
5447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5449                         BPF_MOV64_IMM(BPF_REG_2, 34),
5450                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
5451                         BPF_MOV64_IMM(BPF_REG_3, 0),
5452                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5453                         BPF_EXIT_INSN(),
5454                 },
5455                 .errstr = "invalid stack type R1 off=-48 access_size=58",
5456                 .result = REJECT,
5457                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5458         },
5459         {
5460                 "constant register |= constant register should keep constant type",
5461                 .insns = {
5462                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5463                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5464                         BPF_MOV64_IMM(BPF_REG_2, 34),
5465                         BPF_MOV64_IMM(BPF_REG_4, 13),
5466                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5467                         BPF_MOV64_IMM(BPF_REG_3, 0),
5468                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5469                         BPF_EXIT_INSN(),
5470                 },
5471                 .result = ACCEPT,
5472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5473         },
5474         {
5475                 "constant register |= constant register should not bypass stack boundary checks",
5476                 .insns = {
5477                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
5479                         BPF_MOV64_IMM(BPF_REG_2, 34),
5480                         BPF_MOV64_IMM(BPF_REG_4, 24),
5481                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
5482                         BPF_MOV64_IMM(BPF_REG_3, 0),
5483                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5484                         BPF_EXIT_INSN(),
5485                 },
5486                 .errstr = "invalid stack type R1 off=-48 access_size=58",
5487                 .result = REJECT,
5488                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5489         },
5490         {
5491                 "invalid direct packet write for LWT_IN",
5492                 .insns = {
5493                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5494                                     offsetof(struct __sk_buff, data)),
5495                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5496                                     offsetof(struct __sk_buff, data_end)),
5497                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5498                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5499                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5500                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5501                         BPF_MOV64_IMM(BPF_REG_0, 0),
5502                         BPF_EXIT_INSN(),
5503                 },
5504                 .errstr = "cannot write into packet",
5505                 .result = REJECT,
5506                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5507         },
5508         {
5509                 "invalid direct packet write for LWT_OUT",
5510                 .insns = {
5511                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5512                                     offsetof(struct __sk_buff, data)),
5513                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5514                                     offsetof(struct __sk_buff, data_end)),
5515                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5516                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5517                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5518                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5519                         BPF_MOV64_IMM(BPF_REG_0, 0),
5520                         BPF_EXIT_INSN(),
5521                 },
5522                 .errstr = "cannot write into packet",
5523                 .result = REJECT,
5524                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5525         },
5526         {
5527                 "direct packet write for LWT_XMIT",
5528                 .insns = {
5529                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5530                                     offsetof(struct __sk_buff, data)),
5531                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5532                                     offsetof(struct __sk_buff, data_end)),
5533                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5535                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5536                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5537                         BPF_MOV64_IMM(BPF_REG_0, 0),
5538                         BPF_EXIT_INSN(),
5539                 },
5540                 .result = ACCEPT,
5541                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5542         },
5543         {
5544                 "direct packet read for LWT_IN",
5545                 .insns = {
5546                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5547                                     offsetof(struct __sk_buff, data)),
5548                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5549                                     offsetof(struct __sk_buff, data_end)),
5550                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5551                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5552                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5553                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5554                         BPF_MOV64_IMM(BPF_REG_0, 0),
5555                         BPF_EXIT_INSN(),
5556                 },
5557                 .result = ACCEPT,
5558                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5559         },
5560         {
5561                 "direct packet read for LWT_OUT",
5562                 .insns = {
5563                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5564                                     offsetof(struct __sk_buff, data)),
5565                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5566                                     offsetof(struct __sk_buff, data_end)),
5567                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5569                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5570                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5571                         BPF_MOV64_IMM(BPF_REG_0, 0),
5572                         BPF_EXIT_INSN(),
5573                 },
5574                 .result = ACCEPT,
5575                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5576         },
5577         {
5578                 "direct packet read for LWT_XMIT",
5579                 .insns = {
5580                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5581                                     offsetof(struct __sk_buff, data)),
5582                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5583                                     offsetof(struct __sk_buff, data_end)),
5584                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5586                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5587                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5588                         BPF_MOV64_IMM(BPF_REG_0, 0),
5589                         BPF_EXIT_INSN(),
5590                 },
5591                 .result = ACCEPT,
5592                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5593         },
5594         {
5595                 "overlapping checks for direct packet access",
5596                 .insns = {
5597                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5598                                     offsetof(struct __sk_buff, data)),
5599                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5600                                     offsetof(struct __sk_buff, data_end)),
5601                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5603                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
5604                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
5605                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
5606                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
5607                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
5608                         BPF_MOV64_IMM(BPF_REG_0, 0),
5609                         BPF_EXIT_INSN(),
5610                 },
5611                 .result = ACCEPT,
5612                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5613         },
5614         {
5615                 "make headroom for LWT_XMIT",
5616                 .insns = {
5617                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5618                         BPF_MOV64_IMM(BPF_REG_2, 34),
5619                         BPF_MOV64_IMM(BPF_REG_3, 0),
5620                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5621                         /* split for s390 to succeed */
5622                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5623                         BPF_MOV64_IMM(BPF_REG_2, 42),
5624                         BPF_MOV64_IMM(BPF_REG_3, 0),
5625                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5626                         BPF_MOV64_IMM(BPF_REG_0, 0),
5627                         BPF_EXIT_INSN(),
5628                 },
5629                 .result = ACCEPT,
5630                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5631         },
5632         {
5633                 "invalid access of tc_classid for LWT_IN",
5634                 .insns = {
5635                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5636                                     offsetof(struct __sk_buff, tc_classid)),
5637                         BPF_EXIT_INSN(),
5638                 },
5639                 .result = REJECT,
5640                 .errstr = "invalid bpf_context access",
5641         },
5642         {
5643                 "invalid access of tc_classid for LWT_OUT",
5644                 .insns = {
5645                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5646                                     offsetof(struct __sk_buff, tc_classid)),
5647                         BPF_EXIT_INSN(),
5648                 },
5649                 .result = REJECT,
5650                 .errstr = "invalid bpf_context access",
5651         },
5652         {
5653                 "invalid access of tc_classid for LWT_XMIT",
5654                 .insns = {
5655                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5656                                     offsetof(struct __sk_buff, tc_classid)),
5657                         BPF_EXIT_INSN(),
5658                 },
5659                 .result = REJECT,
5660                 .errstr = "invalid bpf_context access",
5661         },
5662         {
5663                 "leak pointer into ctx 1",
5664                 .insns = {
5665                         BPF_MOV64_IMM(BPF_REG_0, 0),
5666                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5667                                     offsetof(struct __sk_buff, cb[0])),
5668                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5669                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
5670                                       offsetof(struct __sk_buff, cb[0])),
5671                         BPF_EXIT_INSN(),
5672                 },
5673                 .fixup_map_hash_8b = { 2 },
5674                 .errstr_unpriv = "R2 leaks addr into mem",
5675                 .result_unpriv = REJECT,
5676                 .result = REJECT,
5677                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
5678         },
5679         {
5680                 "leak pointer into ctx 2",
5681                 .insns = {
5682                         BPF_MOV64_IMM(BPF_REG_0, 0),
5683                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5684                                     offsetof(struct __sk_buff, cb[0])),
5685                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
5686                                       offsetof(struct __sk_buff, cb[0])),
5687                         BPF_EXIT_INSN(),
5688                 },
5689                 .errstr_unpriv = "R10 leaks addr into mem",
5690                 .result_unpriv = REJECT,
5691                 .result = REJECT,
5692                 .errstr = "BPF_XADD stores into R1 ctx is not allowed",
5693         },
5694         {
5695                 "leak pointer into ctx 3",
5696                 .insns = {
5697                         BPF_MOV64_IMM(BPF_REG_0, 0),
5698                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5699                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
5700                                       offsetof(struct __sk_buff, cb[0])),
5701                         BPF_EXIT_INSN(),
5702                 },
5703                 .fixup_map_hash_8b = { 1 },
5704                 .errstr_unpriv = "R2 leaks addr into ctx",
5705                 .result_unpriv = REJECT,
5706                 .result = ACCEPT,
5707         },
5708         {
5709                 "leak pointer into map val",
5710                 .insns = {
5711                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5712                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5713                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5714                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5715                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5716                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5717                                      BPF_FUNC_map_lookup_elem),
5718                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5719                         BPF_MOV64_IMM(BPF_REG_3, 0),
5720                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
5721                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
5722                         BPF_MOV64_IMM(BPF_REG_0, 0),
5723                         BPF_EXIT_INSN(),
5724                 },
5725                 .fixup_map_hash_8b = { 4 },
5726                 .errstr_unpriv = "R6 leaks addr into mem",
5727                 .result_unpriv = REJECT,
5728                 .result = ACCEPT,
5729         },
5730         {
5731                 "helper access to map: full range",
5732                 .insns = {
5733                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5734                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5735                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5736                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5737                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5738                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5739                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5740                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5741                         BPF_MOV64_IMM(BPF_REG_3, 0),
5742                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5743                         BPF_EXIT_INSN(),
5744                 },
5745                 .fixup_map_hash_48b = { 3 },
5746                 .result = ACCEPT,
5747                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5748         },
5749         {
5750                 "helper access to map: partial range",
5751                 .insns = {
5752                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5753                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5754                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5755                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5756                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5757                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5758                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5759                         BPF_MOV64_IMM(BPF_REG_2, 8),
5760                         BPF_MOV64_IMM(BPF_REG_3, 0),
5761                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5762                         BPF_EXIT_INSN(),
5763                 },
5764                 .fixup_map_hash_48b = { 3 },
5765                 .result = ACCEPT,
5766                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5767         },
5768         {
5769                 "helper access to map: empty range",
5770                 .insns = {
5771                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5772                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5773                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5774                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5775                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5776                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5777                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5778                         BPF_MOV64_IMM(BPF_REG_2, 0),
5779                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5780                         BPF_EXIT_INSN(),
5781                 },
5782                 .fixup_map_hash_48b = { 3 },
5783                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
5784                 .result = REJECT,
5785                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5786         },
5787         {
5788                 "helper access to map: out-of-bound range",
5789                 .insns = {
5790                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5792                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5793                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5794                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5796                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5797                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
5798                         BPF_MOV64_IMM(BPF_REG_3, 0),
5799                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5800                         BPF_EXIT_INSN(),
5801                 },
5802                 .fixup_map_hash_48b = { 3 },
5803                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
5804                 .result = REJECT,
5805                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5806         },
5807         {
5808                 "helper access to map: negative range",
5809                 .insns = {
5810                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5812                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5813                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5814                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5815                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5816                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5817                         BPF_MOV64_IMM(BPF_REG_2, -8),
5818                         BPF_MOV64_IMM(BPF_REG_3, 0),
5819                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5820                         BPF_EXIT_INSN(),
5821                 },
5822                 .fixup_map_hash_48b = { 3 },
5823                 .errstr = "R2 min value is negative",
5824                 .result = REJECT,
5825                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5826         },
5827         {
5828                 "helper access to adjusted map (via const imm): full range",
5829                 .insns = {
5830                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5832                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5833                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5834                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5835                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5836                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5838                                 offsetof(struct test_val, foo)),
5839                         BPF_MOV64_IMM(BPF_REG_2,
5840                                 sizeof(struct test_val) -
5841                                 offsetof(struct test_val, foo)),
5842                         BPF_MOV64_IMM(BPF_REG_3, 0),
5843                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5844                         BPF_EXIT_INSN(),
5845                 },
5846                 .fixup_map_hash_48b = { 3 },
5847                 .result = ACCEPT,
5848                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5849         },
5850         {
5851                 "helper access to adjusted map (via const imm): partial range",
5852                 .insns = {
5853                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5855                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5856                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5857                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5858                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5859                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5860                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5861                                 offsetof(struct test_val, foo)),
5862                         BPF_MOV64_IMM(BPF_REG_2, 8),
5863                         BPF_MOV64_IMM(BPF_REG_3, 0),
5864                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5865                         BPF_EXIT_INSN(),
5866                 },
5867                 .fixup_map_hash_48b = { 3 },
5868                 .result = ACCEPT,
5869                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5870         },
5871         {
5872                 "helper access to adjusted map (via const imm): empty range",
5873                 .insns = {
5874                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5876                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5877                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5878                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5879                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5880                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5881                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5882                                 offsetof(struct test_val, foo)),
5883                         BPF_MOV64_IMM(BPF_REG_2, 0),
5884                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5885                         BPF_EXIT_INSN(),
5886                 },
5887                 .fixup_map_hash_48b = { 3 },
5888                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5889                 .result = REJECT,
5890                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5891         },
5892         {
5893                 "helper access to adjusted map (via const imm): out-of-bound range",
5894                 .insns = {
5895                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5896                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5897                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5898                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5899                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5900                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5903                                 offsetof(struct test_val, foo)),
5904                         BPF_MOV64_IMM(BPF_REG_2,
5905                                 sizeof(struct test_val) -
5906                                 offsetof(struct test_val, foo) + 8),
5907                         BPF_MOV64_IMM(BPF_REG_3, 0),
5908                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5909                         BPF_EXIT_INSN(),
5910                 },
5911                 .fixup_map_hash_48b = { 3 },
5912                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5913                 .result = REJECT,
5914                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5915         },
5916         {
5917                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5918                 .insns = {
5919                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5920                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5921                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5922                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5923                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5924                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5925                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5926                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5927                                 offsetof(struct test_val, foo)),
5928                         BPF_MOV64_IMM(BPF_REG_2, -8),
5929                         BPF_MOV64_IMM(BPF_REG_3, 0),
5930                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5931                         BPF_EXIT_INSN(),
5932                 },
5933                 .fixup_map_hash_48b = { 3 },
5934                 .errstr = "R2 min value is negative",
5935                 .result = REJECT,
5936                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5937         },
5938         {
5939                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5940                 .insns = {
5941                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5942                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5943                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5944                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5945                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5946                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5947                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5948                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5949                                 offsetof(struct test_val, foo)),
5950                         BPF_MOV64_IMM(BPF_REG_2, -1),
5951                         BPF_MOV64_IMM(BPF_REG_3, 0),
5952                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5953                         BPF_EXIT_INSN(),
5954                 },
5955                 .fixup_map_hash_48b = { 3 },
5956                 .errstr = "R2 min value is negative",
5957                 .result = REJECT,
5958                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5959         },
5960         {
5961                 "helper access to adjusted map (via const reg): full range",
5962                 .insns = {
5963                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5964                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5965                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5966                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5967                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5968                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5969                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5970                         BPF_MOV64_IMM(BPF_REG_3,
5971                                 offsetof(struct test_val, foo)),
5972                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5973                         BPF_MOV64_IMM(BPF_REG_2,
5974                                 sizeof(struct test_val) -
5975                                 offsetof(struct test_val, foo)),
5976                         BPF_MOV64_IMM(BPF_REG_3, 0),
5977                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5978                         BPF_EXIT_INSN(),
5979                 },
5980                 .fixup_map_hash_48b = { 3 },
5981                 .result = ACCEPT,
5982                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5983         },
5984         {
5985                 "helper access to adjusted map (via const reg): partial range",
5986                 .insns = {
5987                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5989                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5990                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5991                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5992                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5993                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5994                         BPF_MOV64_IMM(BPF_REG_3,
5995                                 offsetof(struct test_val, foo)),
5996                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5997                         BPF_MOV64_IMM(BPF_REG_2, 8),
5998                         BPF_MOV64_IMM(BPF_REG_3, 0),
5999                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6000                         BPF_EXIT_INSN(),
6001                 },
6002                 .fixup_map_hash_48b = { 3 },
6003                 .result = ACCEPT,
6004                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6005         },
6006         {
6007                 "helper access to adjusted map (via const reg): empty range",
6008                 .insns = {
6009                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6010                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6011                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6012                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6013                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6014                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6015                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6016                         BPF_MOV64_IMM(BPF_REG_3, 0),
6017                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6018                         BPF_MOV64_IMM(BPF_REG_2, 0),
6019                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
6020                         BPF_EXIT_INSN(),
6021                 },
6022                 .fixup_map_hash_48b = { 3 },
6023                 .errstr = "R1 min value is outside of the array range",
6024                 .result = REJECT,
6025                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6026         },
6027         {
6028                 "helper access to adjusted map (via const reg): out-of-bound range",
6029                 .insns = {
6030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6032                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6033                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6034                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6036                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6037                         BPF_MOV64_IMM(BPF_REG_3,
6038                                 offsetof(struct test_val, foo)),
6039                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6040                         BPF_MOV64_IMM(BPF_REG_2,
6041                                 sizeof(struct test_val) -
6042                                 offsetof(struct test_val, foo) + 8),
6043                         BPF_MOV64_IMM(BPF_REG_3, 0),
6044                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6045                         BPF_EXIT_INSN(),
6046                 },
6047                 .fixup_map_hash_48b = { 3 },
6048                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
6049                 .result = REJECT,
6050                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6051         },
6052         {
6053                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
6054                 .insns = {
6055                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6057                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6059                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6060                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6061                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6062                         BPF_MOV64_IMM(BPF_REG_3,
6063                                 offsetof(struct test_val, foo)),
6064                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6065                         BPF_MOV64_IMM(BPF_REG_2, -8),
6066                         BPF_MOV64_IMM(BPF_REG_3, 0),
6067                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6068                         BPF_EXIT_INSN(),
6069                 },
6070                 .fixup_map_hash_48b = { 3 },
6071                 .errstr = "R2 min value is negative",
6072                 .result = REJECT,
6073                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6074         },
6075         {
6076                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
6077                 .insns = {
6078                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6080                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6081                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6082                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6083                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6084                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6085                         BPF_MOV64_IMM(BPF_REG_3,
6086                                 offsetof(struct test_val, foo)),
6087                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6088                         BPF_MOV64_IMM(BPF_REG_2, -1),
6089                         BPF_MOV64_IMM(BPF_REG_3, 0),
6090                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6091                         BPF_EXIT_INSN(),
6092                 },
6093                 .fixup_map_hash_48b = { 3 },
6094                 .errstr = "R2 min value is negative",
6095                 .result = REJECT,
6096                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6097         },
6098         {
6099                 "helper access to adjusted map (via variable): full range",
6100                 .insns = {
6101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6103                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6104                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6105                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6106                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6107                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6109                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6110                                 offsetof(struct test_val, foo), 4),
6111                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6112                         BPF_MOV64_IMM(BPF_REG_2,
6113                                 sizeof(struct test_val) -
6114                                 offsetof(struct test_val, foo)),
6115                         BPF_MOV64_IMM(BPF_REG_3, 0),
6116                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6117                         BPF_EXIT_INSN(),
6118                 },
6119                 .fixup_map_hash_48b = { 3 },
6120                 .result = ACCEPT,
6121                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6122         },
6123         {
6124                 "helper access to adjusted map (via variable): partial range",
6125                 .insns = {
6126                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6127                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6128                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6129                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6130                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6131                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6132                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6133                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6134                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6135                                 offsetof(struct test_val, foo), 4),
6136                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6137                         BPF_MOV64_IMM(BPF_REG_2, 8),
6138                         BPF_MOV64_IMM(BPF_REG_3, 0),
6139                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6140                         BPF_EXIT_INSN(),
6141                 },
6142                 .fixup_map_hash_48b = { 3 },
6143                 .result = ACCEPT,
6144                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6145         },
6146         {
6147                 "helper access to adjusted map (via variable): empty range",
6148                 .insns = {
6149                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6150                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6151                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6152                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6153                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6154                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6155                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6156                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6157                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6158                                 offsetof(struct test_val, foo), 3),
6159                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6160                         BPF_MOV64_IMM(BPF_REG_2, 0),
6161                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
6162                         BPF_EXIT_INSN(),
6163                 },
6164                 .fixup_map_hash_48b = { 3 },
6165                 .errstr = "R1 min value is outside of the array range",
6166                 .result = REJECT,
6167                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6168         },
6169         {
6170                 "helper access to adjusted map (via variable): no max check",
6171                 .insns = {
6172                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6173                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6175                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6176                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6177                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6178                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6179                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6180                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6181                         BPF_MOV64_IMM(BPF_REG_2, 1),
6182                         BPF_MOV64_IMM(BPF_REG_3, 0),
6183                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6184                         BPF_EXIT_INSN(),
6185                 },
6186                 .fixup_map_hash_48b = { 3 },
6187                 .errstr = "R1 unbounded memory access",
6188                 .result = REJECT,
6189                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6190         },
6191         {
6192                 "helper access to adjusted map (via variable): wrong max check",
6193                 .insns = {
6194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6196                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6197                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6198                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6200                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6201                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6202                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6203                                 offsetof(struct test_val, foo), 4),
6204                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6205                         BPF_MOV64_IMM(BPF_REG_2,
6206                                 sizeof(struct test_val) -
6207                                 offsetof(struct test_val, foo) + 1),
6208                         BPF_MOV64_IMM(BPF_REG_3, 0),
6209                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6210                         BPF_EXIT_INSN(),
6211                 },
6212                 .fixup_map_hash_48b = { 3 },
6213                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
6214                 .result = REJECT,
6215                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6216         },
6217         {
6218                 "helper access to map: bounds check using <, good access",
6219                 .insns = {
6220                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6221                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6222                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6223                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6224                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6225                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6226                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6227                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6228                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
6229                         BPF_MOV64_IMM(BPF_REG_0, 0),
6230                         BPF_EXIT_INSN(),
6231                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6232                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6233                         BPF_MOV64_IMM(BPF_REG_0, 0),
6234                         BPF_EXIT_INSN(),
6235                 },
6236                 .fixup_map_hash_48b = { 3 },
6237                 .result = ACCEPT,
6238                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6239         },
6240         {
6241                 "helper access to map: bounds check using <, bad access",
6242                 .insns = {
6243                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6245                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6246                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6247                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6249                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6250                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6251                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
6252                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6253                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6254                         BPF_MOV64_IMM(BPF_REG_0, 0),
6255                         BPF_EXIT_INSN(),
6256                         BPF_MOV64_IMM(BPF_REG_0, 0),
6257                         BPF_EXIT_INSN(),
6258                 },
6259                 .fixup_map_hash_48b = { 3 },
6260                 .result = REJECT,
6261                 .errstr = "R1 unbounded memory access",
6262                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6263         },
6264         {
6265                 "helper access to map: bounds check using <=, good access",
6266                 .insns = {
6267                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6268                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6269                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6270                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6271                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6272                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6273                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6274                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6275                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
6276                         BPF_MOV64_IMM(BPF_REG_0, 0),
6277                         BPF_EXIT_INSN(),
6278                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6279                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6280                         BPF_MOV64_IMM(BPF_REG_0, 0),
6281                         BPF_EXIT_INSN(),
6282                 },
6283                 .fixup_map_hash_48b = { 3 },
6284                 .result = ACCEPT,
6285                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6286         },
6287         {
6288                 "helper access to map: bounds check using <=, bad access",
6289                 .insns = {
6290                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6291                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6292                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6293                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6294                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6295                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6296                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6297                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6298                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
6299                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6300                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6301                         BPF_MOV64_IMM(BPF_REG_0, 0),
6302                         BPF_EXIT_INSN(),
6303                         BPF_MOV64_IMM(BPF_REG_0, 0),
6304                         BPF_EXIT_INSN(),
6305                 },
6306                 .fixup_map_hash_48b = { 3 },
6307                 .result = REJECT,
6308                 .errstr = "R1 unbounded memory access",
6309                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6310         },
6311         {
6312                 "helper access to map: bounds check using s<, good access",
6313                 .insns = {
6314                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6315                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6316                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6317                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6318                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6319                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6320                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6321                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6322                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6323                         BPF_MOV64_IMM(BPF_REG_0, 0),
6324                         BPF_EXIT_INSN(),
6325                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
6326                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6327                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6328                         BPF_MOV64_IMM(BPF_REG_0, 0),
6329                         BPF_EXIT_INSN(),
6330                 },
6331                 .fixup_map_hash_48b = { 3 },
6332                 .result = ACCEPT,
6333                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6334         },
6335         {
6336                 "helper access to map: bounds check using s<, good access 2",
6337                 .insns = {
6338                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6339                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6340                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6341                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6342                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6343                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6344                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6345                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6346                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6347                         BPF_MOV64_IMM(BPF_REG_0, 0),
6348                         BPF_EXIT_INSN(),
6349                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
6350                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6351                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6352                         BPF_MOV64_IMM(BPF_REG_0, 0),
6353                         BPF_EXIT_INSN(),
6354                 },
6355                 .fixup_map_hash_48b = { 3 },
6356                 .result = ACCEPT,
6357                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6358         },
6359         {
6360                 "helper access to map: bounds check using s<, bad access",
6361                 .insns = {
6362                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6364                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6366                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6367                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6368                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6369                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
6370                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
6371                         BPF_MOV64_IMM(BPF_REG_0, 0),
6372                         BPF_EXIT_INSN(),
6373                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
6374                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6375                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6376                         BPF_MOV64_IMM(BPF_REG_0, 0),
6377                         BPF_EXIT_INSN(),
6378                 },
6379                 .fixup_map_hash_48b = { 3 },
6380                 .result = REJECT,
6381                 .errstr = "R1 min value is negative",
6382                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6383         },
6384         {
6385                 "helper access to map: bounds check using s<=, good access",
6386                 .insns = {
6387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6389                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6390                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6391                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6392                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6393                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6394                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6395                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6396                         BPF_MOV64_IMM(BPF_REG_0, 0),
6397                         BPF_EXIT_INSN(),
6398                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
6399                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6400                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6401                         BPF_MOV64_IMM(BPF_REG_0, 0),
6402                         BPF_EXIT_INSN(),
6403                 },
6404                 .fixup_map_hash_48b = { 3 },
6405                 .result = ACCEPT,
6406                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6407         },
6408         {
6409                 "helper access to map: bounds check using s<=, good access 2",
6410                 .insns = {
6411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6413                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6414                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6415                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6416                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6417                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6418                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6419                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6420                         BPF_MOV64_IMM(BPF_REG_0, 0),
6421                         BPF_EXIT_INSN(),
6422                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
6423                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6424                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6425                         BPF_MOV64_IMM(BPF_REG_0, 0),
6426                         BPF_EXIT_INSN(),
6427                 },
6428                 .fixup_map_hash_48b = { 3 },
6429                 .result = ACCEPT,
6430                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6431         },
6432         {
6433                 "helper access to map: bounds check using s<=, bad access",
6434                 .insns = {
6435                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6436                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6437                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6438                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6439                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6440                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6441                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6442                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
6443                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
6444                         BPF_MOV64_IMM(BPF_REG_0, 0),
6445                         BPF_EXIT_INSN(),
6446                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
6447                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
6448                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
6449                         BPF_MOV64_IMM(BPF_REG_0, 0),
6450                         BPF_EXIT_INSN(),
6451                 },
6452                 .fixup_map_hash_48b = { 3 },
6453                 .result = REJECT,
6454                 .errstr = "R1 min value is negative",
6455                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6456         },
6457         {
6458                 "map lookup helper access to map",
6459                 .insns = {
6460                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6462                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6463                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6464                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6465                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6466                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6467                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6468                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6469                         BPF_EXIT_INSN(),
6470                 },
6471                 .fixup_map_hash_16b = { 3, 8 },
6472                 .result = ACCEPT,
6473                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6474         },
6475         {
6476                 "map update helper access to map",
6477                 .insns = {
6478                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6480                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6481                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6482                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6483                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6484                         BPF_MOV64_IMM(BPF_REG_4, 0),
6485                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6486                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6487                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6488                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6489                         BPF_EXIT_INSN(),
6490                 },
6491                 .fixup_map_hash_16b = { 3, 10 },
6492                 .result = ACCEPT,
6493                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6494         },
6495         {
6496                 "map update helper access to map: wrong size",
6497                 .insns = {
6498                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6500                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6501                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6502                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6503                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6504                         BPF_MOV64_IMM(BPF_REG_4, 0),
6505                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
6506                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6507                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6508                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
6509                         BPF_EXIT_INSN(),
6510                 },
6511                 .fixup_map_hash_8b = { 3 },
6512                 .fixup_map_hash_16b = { 10 },
6513                 .result = REJECT,
6514                 .errstr = "invalid access to map value, value_size=8 off=0 size=16",
6515                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6516         },
6517         {
6518                 "map helper access to adjusted map (via const imm)",
6519                 .insns = {
6520                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6521                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6522                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6523                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6524                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6525                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6526                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6527                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6528                                       offsetof(struct other_val, bar)),
6529                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6530                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6531                         BPF_EXIT_INSN(),
6532                 },
6533                 .fixup_map_hash_16b = { 3, 9 },
6534                 .result = ACCEPT,
6535                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6536         },
6537         {
6538                 "map helper access to adjusted map (via const imm): out-of-bound 1",
6539                 .insns = {
6540                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6541                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6542                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6543                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6544                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6545                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6546                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6547                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6548                                       sizeof(struct other_val) - 4),
6549                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6550                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6551                         BPF_EXIT_INSN(),
6552                 },
6553                 .fixup_map_hash_16b = { 3, 9 },
6554                 .result = REJECT,
6555                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6556                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6557         },
6558         {
6559                 "map helper access to adjusted map (via const imm): out-of-bound 2",
6560                 .insns = {
6561                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6562                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6563                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6564                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6565                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6566                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6567                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6569                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6570                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6571                         BPF_EXIT_INSN(),
6572                 },
6573                 .fixup_map_hash_16b = { 3, 9 },
6574                 .result = REJECT,
6575                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6576                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6577         },
6578         {
6579                 "map helper access to adjusted map (via const reg)",
6580                 .insns = {
6581                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6582                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6583                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6584                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6585                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6586                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6587                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6588                         BPF_MOV64_IMM(BPF_REG_3,
6589                                       offsetof(struct other_val, bar)),
6590                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6591                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6592                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6593                         BPF_EXIT_INSN(),
6594                 },
6595                 .fixup_map_hash_16b = { 3, 10 },
6596                 .result = ACCEPT,
6597                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6598         },
6599         {
6600                 "map helper access to adjusted map (via const reg): out-of-bound 1",
6601                 .insns = {
6602                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6604                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6605                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6606                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6607                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6608                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6609                         BPF_MOV64_IMM(BPF_REG_3,
6610                                       sizeof(struct other_val) - 4),
6611                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6612                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6613                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6614                         BPF_EXIT_INSN(),
6615                 },
6616                 .fixup_map_hash_16b = { 3, 10 },
6617                 .result = REJECT,
6618                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6619                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6620         },
6621         {
6622                 "map helper access to adjusted map (via const reg): out-of-bound 2",
6623                 .insns = {
6624                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6626                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6627                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6628                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6629                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6630                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6631                         BPF_MOV64_IMM(BPF_REG_3, -4),
6632                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6633                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6634                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6635                         BPF_EXIT_INSN(),
6636                 },
6637                 .fixup_map_hash_16b = { 3, 10 },
6638                 .result = REJECT,
6639                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6640                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6641         },
6642         {
6643                 "map helper access to adjusted map (via variable)",
6644                 .insns = {
6645                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6646                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6647                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6648                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6649                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6650                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6651                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6652                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6653                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6654                                     offsetof(struct other_val, bar), 4),
6655                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6656                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6657                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6658                         BPF_EXIT_INSN(),
6659                 },
6660                 .fixup_map_hash_16b = { 3, 11 },
6661                 .result = ACCEPT,
6662                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6663         },
6664         {
6665                 "map helper access to adjusted map (via variable): no max check",
6666                 .insns = {
6667                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6668                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6669                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6670                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6671                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6672                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6673                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6674                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6675                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6676                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6677                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6678                         BPF_EXIT_INSN(),
6679                 },
6680                 .fixup_map_hash_16b = { 3, 10 },
6681                 .result = REJECT,
6682                 .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
6683                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6684         },
6685         {
6686                 "map helper access to adjusted map (via variable): wrong max check",
6687                 .insns = {
6688                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6689                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6690                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6691                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6692                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6693                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6694                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6695                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6696                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6697                                     offsetof(struct other_val, bar) + 1, 4),
6698                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6699                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6700                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6701                         BPF_EXIT_INSN(),
6702                 },
6703                 .fixup_map_hash_16b = { 3, 11 },
6704                 .result = REJECT,
6705                 .errstr = "invalid access to map value, value_size=16 off=9 size=8",
6706                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6707         },
6708         {
6709                 "map element value is preserved across register spilling",
6710                 .insns = {
6711                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6712                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6713                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6714                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6715                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6716                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6717                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6718                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6720                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6721                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6722                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6723                         BPF_EXIT_INSN(),
6724                 },
6725                 .fixup_map_hash_48b = { 3 },
6726                 .errstr_unpriv = "R0 leaks addr",
6727                 .result = ACCEPT,
6728                 .result_unpriv = REJECT,
6729         },
6730         {
6731                 "map element value or null is marked on register spilling",
6732                 .insns = {
6733                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6734                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6735                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6736                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6737                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6738                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
6740                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6741                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6742                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6743                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6744                         BPF_EXIT_INSN(),
6745                 },
6746                 .fixup_map_hash_48b = { 3 },
6747                 .errstr_unpriv = "R0 leaks addr",
6748                 .result = ACCEPT,
6749                 .result_unpriv = REJECT,
6750         },
6751         {
6752                 "map element value store of cleared call register",
6753                 .insns = {
6754                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6756                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6757                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6758                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6759                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
6760                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
6761                         BPF_EXIT_INSN(),
6762                 },
6763                 .fixup_map_hash_48b = { 3 },
6764                 .errstr_unpriv = "R1 !read_ok",
6765                 .errstr = "R1 !read_ok",
6766                 .result = REJECT,
6767                 .result_unpriv = REJECT,
6768         },
6769         {
6770                 "map element value with unaligned store",
6771                 .insns = {
6772                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6773                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6774                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6775                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6776                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6777                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
6778                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6779                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6780                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
6781                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
6782                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6783                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
6784                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
6785                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
6786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
6787                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
6788                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
6789                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
6790                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
6791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
6792                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
6793                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
6794                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
6795                         BPF_EXIT_INSN(),
6796                 },
6797                 .fixup_map_hash_48b = { 3 },
6798                 .errstr_unpriv = "R0 leaks addr",
6799                 .result = ACCEPT,
6800                 .result_unpriv = REJECT,
6801                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6802         },
6803         {
6804                 "map element value with unaligned load",
6805                 .insns = {
6806                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6807                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6808                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6809                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6810                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6811                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6812                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6813                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
6814                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6815                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6816                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
6817                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6818                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
6819                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
6820                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
6821                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6822                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
6823                         BPF_EXIT_INSN(),
6824                 },
6825                 .fixup_map_hash_48b = { 3 },
6826                 .errstr_unpriv = "R0 leaks addr",
6827                 .result = ACCEPT,
6828                 .result_unpriv = REJECT,
6829                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6830         },
6831         {
6832                 "map element value illegal alu op, 1",
6833                 .insns = {
6834                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6836                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6837                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6838                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6839                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6840                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
6841                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6842                         BPF_EXIT_INSN(),
6843                 },
6844                 .fixup_map_hash_48b = { 3 },
6845                 .errstr = "R0 bitwise operator &= on pointer",
6846                 .result = REJECT,
6847         },
6848         {
6849                 "map element value illegal alu op, 2",
6850                 .insns = {
6851                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6853                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6855                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6856                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6857                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
6858                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6859                         BPF_EXIT_INSN(),
6860                 },
6861                 .fixup_map_hash_48b = { 3 },
6862                 .errstr = "R0 32-bit pointer arithmetic prohibited",
6863                 .result = REJECT,
6864         },
6865         {
6866                 "map element value illegal alu op, 3",
6867                 .insns = {
6868                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6869                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6870                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6871                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6872                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6873                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6874                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
6875                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6876                         BPF_EXIT_INSN(),
6877                 },
6878                 .fixup_map_hash_48b = { 3 },
6879                 .errstr = "R0 pointer arithmetic with /= operator",
6880                 .result = REJECT,
6881         },
6882         {
6883                 "map element value illegal alu op, 4",
6884                 .insns = {
6885                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6886                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6887                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6888                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6889                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6890                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6891                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
6892                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6893                         BPF_EXIT_INSN(),
6894                 },
6895                 .fixup_map_hash_48b = { 3 },
6896                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
6897                 .errstr = "invalid mem access 'inv'",
6898                 .result = REJECT,
6899                 .result_unpriv = REJECT,
6900         },
6901         {
6902                 "map element value illegal alu op, 5",
6903                 .insns = {
6904                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6905                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6906                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6907                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6908                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6909                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6910                         BPF_MOV64_IMM(BPF_REG_3, 4096),
6911                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6912                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6913                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6914                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
6915                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
6916                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6917                         BPF_EXIT_INSN(),
6918                 },
6919                 .fixup_map_hash_48b = { 3 },
6920                 .errstr = "R0 invalid mem access 'inv'",
6921                 .result = REJECT,
6922         },
6923         {
6924                 "map element value is preserved across register spilling",
6925                 .insns = {
6926                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6927                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6928                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6929                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6930                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6931                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6932                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
6933                                 offsetof(struct test_val, foo)),
6934                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6935                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6936                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6937                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6938                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6939                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6940                         BPF_EXIT_INSN(),
6941                 },
6942                 .fixup_map_hash_48b = { 3 },
6943                 .errstr_unpriv = "R0 leaks addr",
6944                 .result = ACCEPT,
6945                 .result_unpriv = REJECT,
6946                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6947         },
6948         {
6949                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
6950                 .insns = {
6951                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6953                         BPF_MOV64_IMM(BPF_REG_0, 0),
6954                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6955                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6956                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6957                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6958                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6959                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6960                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6961                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6962                         BPF_MOV64_IMM(BPF_REG_2, 16),
6963                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6964                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6965                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6966                         BPF_MOV64_IMM(BPF_REG_4, 0),
6967                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6968                         BPF_MOV64_IMM(BPF_REG_3, 0),
6969                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6970                         BPF_MOV64_IMM(BPF_REG_0, 0),
6971                         BPF_EXIT_INSN(),
6972                 },
6973                 .result = ACCEPT,
6974                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6975         },
6976         {
6977                 "helper access to variable memory: stack, bitwise AND, zero included",
6978                 .insns = {
6979                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6980                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6981                         BPF_MOV64_IMM(BPF_REG_2, 16),
6982                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6983                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6984                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6985                         BPF_MOV64_IMM(BPF_REG_3, 0),
6986                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6987                         BPF_EXIT_INSN(),
6988                 },
6989                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6990                 .result = REJECT,
6991                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6992         },
6993         {
6994                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
6995                 .insns = {
6996                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6997                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6998                         BPF_MOV64_IMM(BPF_REG_2, 16),
6999                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7000                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7001                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
7002                         BPF_MOV64_IMM(BPF_REG_4, 0),
7003                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7004                         BPF_MOV64_IMM(BPF_REG_3, 0),
7005                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7006                         BPF_MOV64_IMM(BPF_REG_0, 0),
7007                         BPF_EXIT_INSN(),
7008                 },
7009                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7010                 .result = REJECT,
7011                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7012         },
7013         {
7014                 "helper access to variable memory: stack, JMP, correct bounds",
7015                 .insns = {
7016                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7017                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7018                         BPF_MOV64_IMM(BPF_REG_0, 0),
7019                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7020                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7021                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7022                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7023                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7024                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7025                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7026                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7027                         BPF_MOV64_IMM(BPF_REG_2, 16),
7028                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7029                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7030                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
7031                         BPF_MOV64_IMM(BPF_REG_4, 0),
7032                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7033                         BPF_MOV64_IMM(BPF_REG_3, 0),
7034                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7035                         BPF_MOV64_IMM(BPF_REG_0, 0),
7036                         BPF_EXIT_INSN(),
7037                 },
7038                 .result = ACCEPT,
7039                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7040         },
7041         {
7042                 "helper access to variable memory: stack, JMP (signed), correct bounds",
7043                 .insns = {
7044                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7045                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7046                         BPF_MOV64_IMM(BPF_REG_0, 0),
7047                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7048                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7049                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7050                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7051                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7052                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7053                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7054                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7055                         BPF_MOV64_IMM(BPF_REG_2, 16),
7056                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7057                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7058                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
7059                         BPF_MOV64_IMM(BPF_REG_4, 0),
7060                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7061                         BPF_MOV64_IMM(BPF_REG_3, 0),
7062                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7063                         BPF_MOV64_IMM(BPF_REG_0, 0),
7064                         BPF_EXIT_INSN(),
7065                 },
7066                 .result = ACCEPT,
7067                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7068         },
7069         {
7070                 "helper access to variable memory: stack, JMP, bounds + offset",
7071                 .insns = {
7072                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7073                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7074                         BPF_MOV64_IMM(BPF_REG_2, 16),
7075                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7076                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7077                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
7078                         BPF_MOV64_IMM(BPF_REG_4, 0),
7079                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
7080                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7081                         BPF_MOV64_IMM(BPF_REG_3, 0),
7082                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7083                         BPF_MOV64_IMM(BPF_REG_0, 0),
7084                         BPF_EXIT_INSN(),
7085                 },
7086                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7087                 .result = REJECT,
7088                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7089         },
7090         {
7091                 "helper access to variable memory: stack, JMP, wrong max",
7092                 .insns = {
7093                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7095                         BPF_MOV64_IMM(BPF_REG_2, 16),
7096                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7097                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7098                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
7099                         BPF_MOV64_IMM(BPF_REG_4, 0),
7100                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7101                         BPF_MOV64_IMM(BPF_REG_3, 0),
7102                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7103                         BPF_MOV64_IMM(BPF_REG_0, 0),
7104                         BPF_EXIT_INSN(),
7105                 },
7106                 .errstr = "invalid stack type R1 off=-64 access_size=65",
7107                 .result = REJECT,
7108                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7109         },
7110         {
7111                 "helper access to variable memory: stack, JMP, no max check",
7112                 .insns = {
7113                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7115                         BPF_MOV64_IMM(BPF_REG_2, 16),
7116                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7117                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7118                         BPF_MOV64_IMM(BPF_REG_4, 0),
7119                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
7120                         BPF_MOV64_IMM(BPF_REG_3, 0),
7121                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7122                         BPF_MOV64_IMM(BPF_REG_0, 0),
7123                         BPF_EXIT_INSN(),
7124                 },
7125                 /* because max wasn't checked, signed min is negative */
7126                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
7127                 .result = REJECT,
7128                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7129         },
7130         {
7131                 "helper access to variable memory: stack, JMP, no min check",
7132                 .insns = {
7133                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7135                         BPF_MOV64_IMM(BPF_REG_2, 16),
7136                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7137                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7138                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
7139                         BPF_MOV64_IMM(BPF_REG_3, 0),
7140                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7141                         BPF_MOV64_IMM(BPF_REG_0, 0),
7142                         BPF_EXIT_INSN(),
7143                 },
7144                 .errstr = "invalid indirect read from stack off -64+0 size 64",
7145                 .result = REJECT,
7146                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7147         },
7148         {
7149                 "helper access to variable memory: stack, JMP (signed), no min check",
7150                 .insns = {
7151                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7152                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7153                         BPF_MOV64_IMM(BPF_REG_2, 16),
7154                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
7155                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
7156                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
7157                         BPF_MOV64_IMM(BPF_REG_3, 0),
7158                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7159                         BPF_MOV64_IMM(BPF_REG_0, 0),
7160                         BPF_EXIT_INSN(),
7161                 },
7162                 .errstr = "R2 min value is negative",
7163                 .result = REJECT,
7164                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7165         },
7166         {
7167                 "helper access to variable memory: map, JMP, correct bounds",
7168                 .insns = {
7169                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7172                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7173                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7174                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7175                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7176                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7177                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7178                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7179                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7180                                 sizeof(struct test_val), 4),
7181                         BPF_MOV64_IMM(BPF_REG_4, 0),
7182                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7183                         BPF_MOV64_IMM(BPF_REG_3, 0),
7184                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7185                         BPF_MOV64_IMM(BPF_REG_0, 0),
7186                         BPF_EXIT_INSN(),
7187                 },
7188                 .fixup_map_hash_48b = { 3 },
7189                 .result = ACCEPT,
7190                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7191         },
7192         {
7193                 "helper access to variable memory: map, JMP, wrong max",
7194                 .insns = {
7195                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7196                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7197                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7198                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7199                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7201                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7202                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7203                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7204                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7205                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7206                                 sizeof(struct test_val) + 1, 4),
7207                         BPF_MOV64_IMM(BPF_REG_4, 0),
7208                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7209                         BPF_MOV64_IMM(BPF_REG_3, 0),
7210                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7211                         BPF_MOV64_IMM(BPF_REG_0, 0),
7212                         BPF_EXIT_INSN(),
7213                 },
7214                 .fixup_map_hash_48b = { 3 },
7215                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
7216                 .result = REJECT,
7217                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7218         },
7219         {
7220                 "helper access to variable memory: map adjusted, JMP, correct bounds",
7221                 .insns = {
7222                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7224                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7225                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7226                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7227                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
7228                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7229                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
7230                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7231                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7232                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7233                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7234                                 sizeof(struct test_val) - 20, 4),
7235                         BPF_MOV64_IMM(BPF_REG_4, 0),
7236                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7237                         BPF_MOV64_IMM(BPF_REG_3, 0),
7238                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7239                         BPF_MOV64_IMM(BPF_REG_0, 0),
7240                         BPF_EXIT_INSN(),
7241                 },
7242                 .fixup_map_hash_48b = { 3 },
7243                 .result = ACCEPT,
7244                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7245         },
7246         {
7247                 "helper access to variable memory: map adjusted, JMP, wrong max",
7248                 .insns = {
7249                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7251                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
7252                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7253                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
7255                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7256                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
7257                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
7258                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7259                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7260                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
7261                                 sizeof(struct test_val) - 19, 4),
7262                         BPF_MOV64_IMM(BPF_REG_4, 0),
7263                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
7264                         BPF_MOV64_IMM(BPF_REG_3, 0),
7265                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7266                         BPF_MOV64_IMM(BPF_REG_0, 0),
7267                         BPF_EXIT_INSN(),
7268                 },
7269                 .fixup_map_hash_48b = { 3 },
7270                 .errstr = "R1 min value is outside of the array range",
7271                 .result = REJECT,
7272                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7273         },
7274         {
7275                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
7276                 .insns = {
7277                         BPF_MOV64_IMM(BPF_REG_1, 0),
7278                         BPF_MOV64_IMM(BPF_REG_2, 0),
7279                         BPF_MOV64_IMM(BPF_REG_3, 0),
7280                         BPF_MOV64_IMM(BPF_REG_4, 0),
7281                         BPF_MOV64_IMM(BPF_REG_5, 0),
7282                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7283                         BPF_EXIT_INSN(),
7284                 },
7285                 .result = ACCEPT,
7286                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7287         },
7288         {
7289                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
7290                 .insns = {
7291                         BPF_MOV64_IMM(BPF_REG_1, 0),
7292                         BPF_MOV64_IMM(BPF_REG_2, 1),
7293                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7294                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7295                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
7296                         BPF_MOV64_IMM(BPF_REG_3, 0),
7297                         BPF_MOV64_IMM(BPF_REG_4, 0),
7298                         BPF_MOV64_IMM(BPF_REG_5, 0),
7299                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7300                         BPF_EXIT_INSN(),
7301                 },
7302                 .errstr = "R1 type=inv expected=fp",
7303                 .result = REJECT,
7304                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7305         },
7306         {
7307                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
7308                 .insns = {
7309                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7310                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7311                         BPF_MOV64_IMM(BPF_REG_2, 0),
7312                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
7313                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
7314                         BPF_MOV64_IMM(BPF_REG_3, 0),
7315                         BPF_MOV64_IMM(BPF_REG_4, 0),
7316                         BPF_MOV64_IMM(BPF_REG_5, 0),
7317                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7318                         BPF_EXIT_INSN(),
7319                 },
7320                 .result = ACCEPT,
7321                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7322         },
7323         {
7324                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
7325                 .insns = {
7326                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7327                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7328                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7329                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7330                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7331                                      BPF_FUNC_map_lookup_elem),
7332                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7333                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7334                         BPF_MOV64_IMM(BPF_REG_2, 0),
7335                         BPF_MOV64_IMM(BPF_REG_3, 0),
7336                         BPF_MOV64_IMM(BPF_REG_4, 0),
7337                         BPF_MOV64_IMM(BPF_REG_5, 0),
7338                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7339                         BPF_EXIT_INSN(),
7340                 },
7341                 .fixup_map_hash_8b = { 3 },
7342                 .result = ACCEPT,
7343                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7344         },
7345         {
7346                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
7347                 .insns = {
7348                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7349                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7351                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7352                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7353                                      BPF_FUNC_map_lookup_elem),
7354                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7355                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7356                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
7357                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7358                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7359                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
7360                         BPF_MOV64_IMM(BPF_REG_3, 0),
7361                         BPF_MOV64_IMM(BPF_REG_4, 0),
7362                         BPF_MOV64_IMM(BPF_REG_5, 0),
7363                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7364                         BPF_EXIT_INSN(),
7365                 },
7366                 .fixup_map_hash_8b = { 3 },
7367                 .result = ACCEPT,
7368                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7369         },
7370         {
7371                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
7372                 .insns = {
7373                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7374                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7375                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7376                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7377                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7378                                      BPF_FUNC_map_lookup_elem),
7379                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7380                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7381                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7382                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7383                         BPF_MOV64_IMM(BPF_REG_3, 0),
7384                         BPF_MOV64_IMM(BPF_REG_4, 0),
7385                         BPF_MOV64_IMM(BPF_REG_5, 0),
7386                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7387                         BPF_EXIT_INSN(),
7388                 },
7389                 .fixup_map_hash_8b = { 3 },
7390                 .result = ACCEPT,
7391                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7392         },
7393         {
7394                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
7395                 .insns = {
7396                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7397                                     offsetof(struct __sk_buff, data)),
7398                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7399                                     offsetof(struct __sk_buff, data_end)),
7400                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
7401                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7402                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
7403                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
7404                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
7405                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7406                         BPF_MOV64_IMM(BPF_REG_3, 0),
7407                         BPF_MOV64_IMM(BPF_REG_4, 0),
7408                         BPF_MOV64_IMM(BPF_REG_5, 0),
7409                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
7410                         BPF_EXIT_INSN(),
7411                 },
7412                 .result = ACCEPT,
7413                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7414                 .retval = 0 /* csum_diff of 64-byte packet */,
7415         },
7416         {
7417                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
7418                 .insns = {
7419                         BPF_MOV64_IMM(BPF_REG_1, 0),
7420                         BPF_MOV64_IMM(BPF_REG_2, 0),
7421                         BPF_MOV64_IMM(BPF_REG_3, 0),
7422                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7423                         BPF_EXIT_INSN(),
7424                 },
7425                 .errstr = "R1 type=inv expected=fp",
7426                 .result = REJECT,
7427                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7428         },
7429         {
7430                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
7431                 .insns = {
7432                         BPF_MOV64_IMM(BPF_REG_1, 0),
7433                         BPF_MOV64_IMM(BPF_REG_2, 1),
7434                         BPF_MOV64_IMM(BPF_REG_3, 0),
7435                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7436                         BPF_EXIT_INSN(),
7437                 },
7438                 .errstr = "R1 type=inv expected=fp",
7439                 .result = REJECT,
7440                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7441         },
7442         {
7443                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7444                 .insns = {
7445                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7446                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7447                         BPF_MOV64_IMM(BPF_REG_2, 0),
7448                         BPF_MOV64_IMM(BPF_REG_3, 0),
7449                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7450                         BPF_EXIT_INSN(),
7451                 },
7452                 .result = ACCEPT,
7453                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7454         },
7455         {
7456                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7457                 .insns = {
7458                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7459                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7461                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7462                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7463                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7464                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7465                         BPF_MOV64_IMM(BPF_REG_2, 0),
7466                         BPF_MOV64_IMM(BPF_REG_3, 0),
7467                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7468                         BPF_EXIT_INSN(),
7469                 },
7470                 .fixup_map_hash_8b = { 3 },
7471                 .result = ACCEPT,
7472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7473         },
7474         {
7475                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7476                 .insns = {
7477                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7478                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7480                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7481                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7482                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7483                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7484                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
7485                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7486                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
7487                         BPF_MOV64_IMM(BPF_REG_3, 0),
7488                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7489                         BPF_EXIT_INSN(),
7490                 },
7491                 .fixup_map_hash_8b = { 3 },
7492                 .result = ACCEPT,
7493                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7494         },
7495         {
7496                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
7497                 .insns = {
7498                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7499                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7501                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7502                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
7503                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7504                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7505                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
7506                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
7507                         BPF_MOV64_IMM(BPF_REG_3, 0),
7508                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7509                         BPF_EXIT_INSN(),
7510                 },
7511                 .fixup_map_hash_8b = { 3 },
7512                 .result = ACCEPT,
7513                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7514         },
7515         {
7516                 "helper access to variable memory: 8 bytes leak",
7517                 .insns = {
7518                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7519                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7520                         BPF_MOV64_IMM(BPF_REG_0, 0),
7521                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7522                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7523                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7524                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7525                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7526                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7527                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7528                         BPF_MOV64_IMM(BPF_REG_2, 1),
7529                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7530                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7531                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
7532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7533                         BPF_MOV64_IMM(BPF_REG_3, 0),
7534                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7535                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7536                         BPF_EXIT_INSN(),
7537                 },
7538                 .errstr = "invalid indirect read from stack off -64+32 size 64",
7539                 .result = REJECT,
7540                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7541         },
7542         {
7543                 "helper access to variable memory: 8 bytes no leak (init memory)",
7544                 .insns = {
7545                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7546                         BPF_MOV64_IMM(BPF_REG_0, 0),
7547                         BPF_MOV64_IMM(BPF_REG_0, 0),
7548                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7549                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7550                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7551                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7552                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7553                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7554                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7555                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7557                         BPF_MOV64_IMM(BPF_REG_2, 0),
7558                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
7559                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
7560                         BPF_MOV64_IMM(BPF_REG_3, 0),
7561                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7562                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7563                         BPF_EXIT_INSN(),
7564                 },
7565                 .result = ACCEPT,
7566                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7567         },
7568         {
7569                 "invalid and of negative number",
7570                 .insns = {
7571                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7572                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7573                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7574                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7575                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7576                                      BPF_FUNC_map_lookup_elem),
7577                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7578                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7579                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
7580                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
7581                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7582                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7583                                    offsetof(struct test_val, foo)),
7584                         BPF_EXIT_INSN(),
7585                 },
7586                 .fixup_map_hash_48b = { 3 },
7587                 .errstr = "R0 max value is outside of the array range",
7588                 .result = REJECT,
7589                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7590         },
7591         {
7592                 "invalid range check",
7593                 .insns = {
7594                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7595                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7596                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7597                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7598                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7599                                      BPF_FUNC_map_lookup_elem),
7600                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
7601                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7602                         BPF_MOV64_IMM(BPF_REG_9, 1),
7603                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
7604                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
7605                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
7606                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
7607                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
7608                         BPF_MOV32_IMM(BPF_REG_3, 1),
7609                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
7610                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
7611                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
7612                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
7613                         BPF_MOV64_REG(BPF_REG_0, 0),
7614                         BPF_EXIT_INSN(),
7615                 },
7616                 .fixup_map_hash_48b = { 3 },
7617                 .errstr = "R0 max value is outside of the array range",
7618                 .result = REJECT,
7619                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7620         },
7621         {
7622                 "map in map access",
7623                 .insns = {
7624                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7625                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7627                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7628                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7629                                      BPF_FUNC_map_lookup_elem),
7630                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7631                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7632                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7634                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7635                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7636                                      BPF_FUNC_map_lookup_elem),
7637                         BPF_MOV64_IMM(BPF_REG_0, 0),
7638                         BPF_EXIT_INSN(),
7639                 },
7640                 .fixup_map_in_map = { 3 },
7641                 .result = ACCEPT,
7642         },
7643         {
7644                 "invalid inner map pointer",
7645                 .insns = {
7646                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7647                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7648                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7649                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7650                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7651                                      BPF_FUNC_map_lookup_elem),
7652                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7653                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7654                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7655                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7656                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7657                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7658                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7659                                      BPF_FUNC_map_lookup_elem),
7660                         BPF_MOV64_IMM(BPF_REG_0, 0),
7661                         BPF_EXIT_INSN(),
7662                 },
7663                 .fixup_map_in_map = { 3 },
7664                 .errstr = "R1 pointer arithmetic on map_ptr prohibited",
7665                 .result = REJECT,
7666         },
7667         {
7668                 "forgot null checking on the inner map pointer",
7669                 .insns = {
7670                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7671                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7672                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7673                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7674                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7675                                      BPF_FUNC_map_lookup_elem),
7676                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7677                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7678                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7679                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7680                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7681                                      BPF_FUNC_map_lookup_elem),
7682                         BPF_MOV64_IMM(BPF_REG_0, 0),
7683                         BPF_EXIT_INSN(),
7684                 },
7685                 .fixup_map_in_map = { 3 },
7686                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
7687                 .result = REJECT,
7688         },
7689         {
7690                 "ld_abs: check calling conv, r1",
7691                 .insns = {
7692                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7693                         BPF_MOV64_IMM(BPF_REG_1, 0),
7694                         BPF_LD_ABS(BPF_W, -0x200000),
7695                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7696                         BPF_EXIT_INSN(),
7697                 },
7698                 .errstr = "R1 !read_ok",
7699                 .result = REJECT,
7700         },
7701         {
7702                 "ld_abs: check calling conv, r2",
7703                 .insns = {
7704                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7705                         BPF_MOV64_IMM(BPF_REG_2, 0),
7706                         BPF_LD_ABS(BPF_W, -0x200000),
7707                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7708                         BPF_EXIT_INSN(),
7709                 },
7710                 .errstr = "R2 !read_ok",
7711                 .result = REJECT,
7712         },
7713         {
7714                 "ld_abs: check calling conv, r3",
7715                 .insns = {
7716                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7717                         BPF_MOV64_IMM(BPF_REG_3, 0),
7718                         BPF_LD_ABS(BPF_W, -0x200000),
7719                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7720                         BPF_EXIT_INSN(),
7721                 },
7722                 .errstr = "R3 !read_ok",
7723                 .result = REJECT,
7724         },
7725         {
7726                 "ld_abs: check calling conv, r4",
7727                 .insns = {
7728                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7729                         BPF_MOV64_IMM(BPF_REG_4, 0),
7730                         BPF_LD_ABS(BPF_W, -0x200000),
7731                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7732                         BPF_EXIT_INSN(),
7733                 },
7734                 .errstr = "R4 !read_ok",
7735                 .result = REJECT,
7736         },
7737         {
7738                 "ld_abs: check calling conv, r5",
7739                 .insns = {
7740                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7741                         BPF_MOV64_IMM(BPF_REG_5, 0),
7742                         BPF_LD_ABS(BPF_W, -0x200000),
7743                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7744                         BPF_EXIT_INSN(),
7745                 },
7746                 .errstr = "R5 !read_ok",
7747                 .result = REJECT,
7748         },
7749         {
7750                 "ld_abs: check calling conv, r7",
7751                 .insns = {
7752                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7753                         BPF_MOV64_IMM(BPF_REG_7, 0),
7754                         BPF_LD_ABS(BPF_W, -0x200000),
7755                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7756                         BPF_EXIT_INSN(),
7757                 },
7758                 .result = ACCEPT,
7759         },
7760         {
7761                 "ld_abs: tests on r6 and skb data reload helper",
7762                 .insns = {
7763                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7764                         BPF_LD_ABS(BPF_B, 0),
7765                         BPF_LD_ABS(BPF_H, 0),
7766                         BPF_LD_ABS(BPF_W, 0),
7767                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
7768                         BPF_MOV64_IMM(BPF_REG_6, 0),
7769                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
7770                         BPF_MOV64_IMM(BPF_REG_2, 1),
7771                         BPF_MOV64_IMM(BPF_REG_3, 2),
7772                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7773                                      BPF_FUNC_skb_vlan_push),
7774                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
7775                         BPF_LD_ABS(BPF_B, 0),
7776                         BPF_LD_ABS(BPF_H, 0),
7777                         BPF_LD_ABS(BPF_W, 0),
7778                         BPF_MOV64_IMM(BPF_REG_0, 42),
7779                         BPF_EXIT_INSN(),
7780                 },
7781                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7782                 .result = ACCEPT,
7783                 .retval = 42 /* ultimate return value */,
7784         },
7785         {
7786                 "ld_ind: check calling conv, r1",
7787                 .insns = {
7788                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7789                         BPF_MOV64_IMM(BPF_REG_1, 1),
7790                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
7791                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7792                         BPF_EXIT_INSN(),
7793                 },
7794                 .errstr = "R1 !read_ok",
7795                 .result = REJECT,
7796         },
7797         {
7798                 "ld_ind: check calling conv, r2",
7799                 .insns = {
7800                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7801                         BPF_MOV64_IMM(BPF_REG_2, 1),
7802                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
7803                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7804                         BPF_EXIT_INSN(),
7805                 },
7806                 .errstr = "R2 !read_ok",
7807                 .result = REJECT,
7808         },
7809         {
7810                 "ld_ind: check calling conv, r3",
7811                 .insns = {
7812                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7813                         BPF_MOV64_IMM(BPF_REG_3, 1),
7814                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
7815                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7816                         BPF_EXIT_INSN(),
7817                 },
7818                 .errstr = "R3 !read_ok",
7819                 .result = REJECT,
7820         },
7821         {
7822                 "ld_ind: check calling conv, r4",
7823                 .insns = {
7824                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7825                         BPF_MOV64_IMM(BPF_REG_4, 1),
7826                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
7827                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7828                         BPF_EXIT_INSN(),
7829                 },
7830                 .errstr = "R4 !read_ok",
7831                 .result = REJECT,
7832         },
7833         {
7834                 "ld_ind: check calling conv, r5",
7835                 .insns = {
7836                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7837                         BPF_MOV64_IMM(BPF_REG_5, 1),
7838                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
7839                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7840                         BPF_EXIT_INSN(),
7841                 },
7842                 .errstr = "R5 !read_ok",
7843                 .result = REJECT,
7844         },
7845         {
7846                 "ld_ind: check calling conv, r7",
7847                 .insns = {
7848                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7849                         BPF_MOV64_IMM(BPF_REG_7, 1),
7850                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
7851                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7852                         BPF_EXIT_INSN(),
7853                 },
7854                 .result = ACCEPT,
7855                 .retval = 1,
7856         },
7857         {
7858                 "check bpf_perf_event_data->sample_period byte load permitted",
7859                 .insns = {
7860                         BPF_MOV64_IMM(BPF_REG_0, 0),
7861 #if __BYTE_ORDER == __LITTLE_ENDIAN
7862                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7863                                     offsetof(struct bpf_perf_event_data, sample_period)),
7864 #else
7865                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7866                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
7867 #endif
7868                         BPF_EXIT_INSN(),
7869                 },
7870                 .result = ACCEPT,
7871                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7872         },
7873         {
7874                 "check bpf_perf_event_data->sample_period half load permitted",
7875                 .insns = {
7876                         BPF_MOV64_IMM(BPF_REG_0, 0),
7877 #if __BYTE_ORDER == __LITTLE_ENDIAN
7878                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7879                                     offsetof(struct bpf_perf_event_data, sample_period)),
7880 #else
7881                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7882                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
7883 #endif
7884                         BPF_EXIT_INSN(),
7885                 },
7886                 .result = ACCEPT,
7887                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7888         },
7889         {
7890                 "check bpf_perf_event_data->sample_period word load permitted",
7891                 .insns = {
7892                         BPF_MOV64_IMM(BPF_REG_0, 0),
7893 #if __BYTE_ORDER == __LITTLE_ENDIAN
7894                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7895                                     offsetof(struct bpf_perf_event_data, sample_period)),
7896 #else
7897                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7898                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
7899 #endif
7900                         BPF_EXIT_INSN(),
7901                 },
7902                 .result = ACCEPT,
7903                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7904         },
7905         {
7906                 "check bpf_perf_event_data->sample_period dword load permitted",
7907                 .insns = {
7908                         BPF_MOV64_IMM(BPF_REG_0, 0),
7909                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
7910                                     offsetof(struct bpf_perf_event_data, sample_period)),
7911                         BPF_EXIT_INSN(),
7912                 },
7913                 .result = ACCEPT,
7914                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7915         },
7916         {
7917                 "check skb->data half load not permitted",
7918                 .insns = {
7919                         BPF_MOV64_IMM(BPF_REG_0, 0),
7920 #if __BYTE_ORDER == __LITTLE_ENDIAN
7921                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7922                                     offsetof(struct __sk_buff, data)),
7923 #else
7924                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7925                                     offsetof(struct __sk_buff, data) + 2),
7926 #endif
7927                         BPF_EXIT_INSN(),
7928                 },
7929                 .result = REJECT,
7930                 .errstr = "invalid bpf_context access",
7931         },
7932         {
7933                 "check skb->tc_classid half load not permitted for lwt prog",
7934                 .insns = {
7935                         BPF_MOV64_IMM(BPF_REG_0, 0),
7936 #if __BYTE_ORDER == __LITTLE_ENDIAN
7937                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7938                                     offsetof(struct __sk_buff, tc_classid)),
7939 #else
7940                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7941                                     offsetof(struct __sk_buff, tc_classid) + 2),
7942 #endif
7943                         BPF_EXIT_INSN(),
7944                 },
7945                 .result = REJECT,
7946                 .errstr = "invalid bpf_context access",
7947                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7948         },
7949         {
7950                 "bounds checks mixing signed and unsigned, positive bounds",
7951                 .insns = {
7952                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7953                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7954                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7955                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7956                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7957                                      BPF_FUNC_map_lookup_elem),
7958                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7959                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7960                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7961                         BPF_MOV64_IMM(BPF_REG_2, 2),
7962                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
7963                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
7964                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7965                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7966                         BPF_MOV64_IMM(BPF_REG_0, 0),
7967                         BPF_EXIT_INSN(),
7968                 },
7969                 .fixup_map_hash_8b = { 3 },
7970                 .errstr = "unbounded min value",
7971                 .result = REJECT,
7972         },
7973         {
7974                 "bounds checks mixing signed and unsigned",
7975                 .insns = {
7976                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7978                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7979                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7980                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7981                                      BPF_FUNC_map_lookup_elem),
7982                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7983                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7984                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7985                         BPF_MOV64_IMM(BPF_REG_2, -1),
7986                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7987                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7988                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7989                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7990                         BPF_MOV64_IMM(BPF_REG_0, 0),
7991                         BPF_EXIT_INSN(),
7992                 },
7993                 .fixup_map_hash_8b = { 3 },
7994                 .errstr = "unbounded min value",
7995                 .result = REJECT,
7996         },
7997         {
7998                 "bounds checks mixing signed and unsigned, variant 2",
7999                 .insns = {
8000                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8001                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8002                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8003                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8004                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8005                                      BPF_FUNC_map_lookup_elem),
8006                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8007                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8008                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8009                         BPF_MOV64_IMM(BPF_REG_2, -1),
8010                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
8011                         BPF_MOV64_IMM(BPF_REG_8, 0),
8012                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
8013                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
8014                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
8015                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
8016                         BPF_MOV64_IMM(BPF_REG_0, 0),
8017                         BPF_EXIT_INSN(),
8018                 },
8019                 .fixup_map_hash_8b = { 3 },
8020                 .errstr = "unbounded min value",
8021                 .result = REJECT,
8022         },
8023         {
8024                 "bounds checks mixing signed and unsigned, variant 3",
8025                 .insns = {
8026                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8027                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8028                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8029                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8030                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8031                                      BPF_FUNC_map_lookup_elem),
8032                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8033                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8034                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8035                         BPF_MOV64_IMM(BPF_REG_2, -1),
8036                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
8037                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
8038                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
8039                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
8040                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
8041                         BPF_MOV64_IMM(BPF_REG_0, 0),
8042                         BPF_EXIT_INSN(),
8043                 },
8044                 .fixup_map_hash_8b = { 3 },
8045                 .errstr = "unbounded min value",
8046                 .result = REJECT,
8047         },
8048         {
8049                 "bounds checks mixing signed and unsigned, variant 4",
8050                 .insns = {
8051                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8052                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8053                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8054                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8055                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8056                                      BPF_FUNC_map_lookup_elem),
8057                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8058                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8059                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8060                         BPF_MOV64_IMM(BPF_REG_2, 1),
8061                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
8062                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8063                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8064                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8065                         BPF_MOV64_IMM(BPF_REG_0, 0),
8066                         BPF_EXIT_INSN(),
8067                 },
8068                 .fixup_map_hash_8b = { 3 },
8069                 .result = ACCEPT,
8070         },
8071         {
8072                 "bounds checks mixing signed and unsigned, variant 5",
8073                 .insns = {
8074                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8075                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8076                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8077                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8078                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8079                                      BPF_FUNC_map_lookup_elem),
8080                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8081                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8082                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8083                         BPF_MOV64_IMM(BPF_REG_2, -1),
8084                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
8085                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
8086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
8087                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
8088                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8089                         BPF_MOV64_IMM(BPF_REG_0, 0),
8090                         BPF_EXIT_INSN(),
8091                 },
8092                 .fixup_map_hash_8b = { 3 },
8093                 .errstr = "unbounded min value",
8094                 .result = REJECT,
8095         },
8096         {
8097                 "bounds checks mixing signed and unsigned, variant 6",
8098                 .insns = {
8099                         BPF_MOV64_IMM(BPF_REG_2, 0),
8100                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
8101                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
8102                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8103                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
8104                         BPF_MOV64_IMM(BPF_REG_6, -1),
8105                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
8106                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
8107                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8108                         BPF_MOV64_IMM(BPF_REG_5, 0),
8109                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
8110                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8111                                      BPF_FUNC_skb_load_bytes),
8112                         BPF_MOV64_IMM(BPF_REG_0, 0),
8113                         BPF_EXIT_INSN(),
8114                 },
8115                 .errstr = "R4 min value is negative, either use unsigned",
8116                 .result = REJECT,
8117         },
8118         {
8119                 "bounds checks mixing signed and unsigned, variant 7",
8120                 .insns = {
8121                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8122                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8123                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8124                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8125                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8126                                      BPF_FUNC_map_lookup_elem),
8127                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
8128                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8129                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8130                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
8131                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
8132                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8133                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8134                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8135                         BPF_MOV64_IMM(BPF_REG_0, 0),
8136                         BPF_EXIT_INSN(),
8137                 },
8138                 .fixup_map_hash_8b = { 3 },
8139                 .result = ACCEPT,
8140         },
8141         {
8142                 "bounds checks mixing signed and unsigned, variant 8",
8143                 .insns = {
8144                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8145                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8146                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8147                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8148                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8149                                      BPF_FUNC_map_lookup_elem),
8150                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8151                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8152                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8153                         BPF_MOV64_IMM(BPF_REG_2, -1),
8154                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8155                         BPF_MOV64_IMM(BPF_REG_0, 0),
8156                         BPF_EXIT_INSN(),
8157                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8158                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8159                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8160                         BPF_MOV64_IMM(BPF_REG_0, 0),
8161                         BPF_EXIT_INSN(),
8162                 },
8163                 .fixup_map_hash_8b = { 3 },
8164                 .errstr = "unbounded min value",
8165                 .result = REJECT,
8166         },
8167         {
8168                 "bounds checks mixing signed and unsigned, variant 9",
8169                 .insns = {
8170                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8171                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8172                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8173                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8174                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8175                                      BPF_FUNC_map_lookup_elem),
8176                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
8177                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8178                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8179                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
8180                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8181                         BPF_MOV64_IMM(BPF_REG_0, 0),
8182                         BPF_EXIT_INSN(),
8183                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8184                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8185                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8186                         BPF_MOV64_IMM(BPF_REG_0, 0),
8187                         BPF_EXIT_INSN(),
8188                 },
8189                 .fixup_map_hash_8b = { 3 },
8190                 .result = ACCEPT,
8191         },
8192         {
8193                 "bounds checks mixing signed and unsigned, variant 10",
8194                 .insns = {
8195                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8196                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8198                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8199                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8200                                      BPF_FUNC_map_lookup_elem),
8201                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8202                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8203                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8204                         BPF_MOV64_IMM(BPF_REG_2, 0),
8205                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
8206                         BPF_MOV64_IMM(BPF_REG_0, 0),
8207                         BPF_EXIT_INSN(),
8208                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8209                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8210                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8211                         BPF_MOV64_IMM(BPF_REG_0, 0),
8212                         BPF_EXIT_INSN(),
8213                 },
8214                 .fixup_map_hash_8b = { 3 },
8215                 .errstr = "unbounded min value",
8216                 .result = REJECT,
8217         },
8218         {
8219                 "bounds checks mixing signed and unsigned, variant 11",
8220                 .insns = {
8221                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8222                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8224                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8225                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8226                                      BPF_FUNC_map_lookup_elem),
8227                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8228                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8229                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8230                         BPF_MOV64_IMM(BPF_REG_2, -1),
8231                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8232                         /* Dead branch. */
8233                         BPF_MOV64_IMM(BPF_REG_0, 0),
8234                         BPF_EXIT_INSN(),
8235                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8236                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8237                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8238                         BPF_MOV64_IMM(BPF_REG_0, 0),
8239                         BPF_EXIT_INSN(),
8240                 },
8241                 .fixup_map_hash_8b = { 3 },
8242                 .errstr = "unbounded min value",
8243                 .result = REJECT,
8244         },
8245         {
8246                 "bounds checks mixing signed and unsigned, variant 12",
8247                 .insns = {
8248                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8249                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8251                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8252                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8253                                      BPF_FUNC_map_lookup_elem),
8254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8255                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8256                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8257                         BPF_MOV64_IMM(BPF_REG_2, -6),
8258                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8259                         BPF_MOV64_IMM(BPF_REG_0, 0),
8260                         BPF_EXIT_INSN(),
8261                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8262                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8263                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8264                         BPF_MOV64_IMM(BPF_REG_0, 0),
8265                         BPF_EXIT_INSN(),
8266                 },
8267                 .fixup_map_hash_8b = { 3 },
8268                 .errstr = "unbounded min value",
8269                 .result = REJECT,
8270         },
8271         {
8272                 "bounds checks mixing signed and unsigned, variant 13",
8273                 .insns = {
8274                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8275                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8277                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8279                                      BPF_FUNC_map_lookup_elem),
8280                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8281                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8282                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8283                         BPF_MOV64_IMM(BPF_REG_2, 2),
8284                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8285                         BPF_MOV64_IMM(BPF_REG_7, 1),
8286                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
8287                         BPF_MOV64_IMM(BPF_REG_0, 0),
8288                         BPF_EXIT_INSN(),
8289                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
8290                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
8291                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
8292                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8293                         BPF_MOV64_IMM(BPF_REG_0, 0),
8294                         BPF_EXIT_INSN(),
8295                 },
8296                 .fixup_map_hash_8b = { 3 },
8297                 .errstr = "unbounded min value",
8298                 .result = REJECT,
8299         },
8300         {
8301                 "bounds checks mixing signed and unsigned, variant 14",
8302                 .insns = {
8303                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
8304                                     offsetof(struct __sk_buff, mark)),
8305                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8306                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8307                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8308                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8309                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8310                                      BPF_FUNC_map_lookup_elem),
8311                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8312                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8313                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8314                         BPF_MOV64_IMM(BPF_REG_2, -1),
8315                         BPF_MOV64_IMM(BPF_REG_8, 2),
8316                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
8317                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
8318                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
8319                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8320                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8321                         BPF_MOV64_IMM(BPF_REG_0, 0),
8322                         BPF_EXIT_INSN(),
8323                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
8324                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
8325                 },
8326                 .fixup_map_hash_8b = { 4 },
8327                 .errstr = "R0 invalid mem access 'inv'",
8328                 .result = REJECT,
8329         },
8330         {
8331                 "bounds checks mixing signed and unsigned, variant 15",
8332                 .insns = {
8333                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8334                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8335                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8336                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8337                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8338                                      BPF_FUNC_map_lookup_elem),
8339                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8340                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
8341                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
8342                         BPF_MOV64_IMM(BPF_REG_2, -6),
8343                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
8344                         BPF_MOV64_IMM(BPF_REG_0, 0),
8345                         BPF_EXIT_INSN(),
8346                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8347                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
8348                         BPF_MOV64_IMM(BPF_REG_0, 0),
8349                         BPF_EXIT_INSN(),
8350                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
8351                         BPF_MOV64_IMM(BPF_REG_0, 0),
8352                         BPF_EXIT_INSN(),
8353                 },
8354                 .fixup_map_hash_8b = { 3 },
8355                 .errstr = "unbounded min value",
8356                 .result = REJECT,
8357                 .result_unpriv = REJECT,
8358         },
8359         {
8360                 "subtraction bounds (map value) variant 1",
8361                 .insns = {
8362                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8363                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8366                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8367                                      BPF_FUNC_map_lookup_elem),
8368                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8369                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8370                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
8371                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
8372                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
8373                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
8374                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
8375                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8376                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8377                         BPF_EXIT_INSN(),
8378                         BPF_MOV64_IMM(BPF_REG_0, 0),
8379                         BPF_EXIT_INSN(),
8380                 },
8381                 .fixup_map_hash_8b = { 3 },
8382                 .errstr = "R0 max value is outside of the array range",
8383                 .result = REJECT,
8384         },
8385         {
8386                 "subtraction bounds (map value) variant 2",
8387                 .insns = {
8388                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8389                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8390                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8391                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8392                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8393                                      BPF_FUNC_map_lookup_elem),
8394                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8395                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8396                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
8397                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
8398                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
8399                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
8400                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8401                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8402                         BPF_EXIT_INSN(),
8403                         BPF_MOV64_IMM(BPF_REG_0, 0),
8404                         BPF_EXIT_INSN(),
8405                 },
8406                 .fixup_map_hash_8b = { 3 },
8407                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
8408                 .result = REJECT,
8409         },
8410         {
8411                 "bounds check based on zero-extended MOV",
8412                 .insns = {
8413                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8414                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8416                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8417                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8418                                      BPF_FUNC_map_lookup_elem),
8419                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8420                         /* r2 = 0x0000'0000'ffff'ffff */
8421                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
8422                         /* r2 = 0 */
8423                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
8424                         /* no-op */
8425                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8426                         /* access at offset 0 */
8427                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8428                         /* exit */
8429                         BPF_MOV64_IMM(BPF_REG_0, 0),
8430                         BPF_EXIT_INSN(),
8431                 },
8432                 .fixup_map_hash_8b = { 3 },
8433                 .result = ACCEPT
8434         },
8435         {
8436                 "bounds check based on sign-extended MOV. test1",
8437                 .insns = {
8438                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8439                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8440                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8441                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8442                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8443                                      BPF_FUNC_map_lookup_elem),
8444                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8445                         /* r2 = 0xffff'ffff'ffff'ffff */
8446                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
8447                         /* r2 = 0xffff'ffff */
8448                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
8449                         /* r0 = <oob pointer> */
8450                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8451                         /* access to OOB pointer */
8452                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8453                         /* exit */
8454                         BPF_MOV64_IMM(BPF_REG_0, 0),
8455                         BPF_EXIT_INSN(),
8456                 },
8457                 .fixup_map_hash_8b = { 3 },
8458                 .errstr = "map_value pointer and 4294967295",
8459                 .result = REJECT
8460         },
8461         {
8462                 "bounds check based on sign-extended MOV. test2",
8463                 .insns = {
8464                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8465                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8466                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8467                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8468                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8469                                      BPF_FUNC_map_lookup_elem),
8470                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8471                         /* r2 = 0xffff'ffff'ffff'ffff */
8472                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
8473                         /* r2 = 0xfff'ffff */
8474                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
8475                         /* r0 = <oob pointer> */
8476                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
8477                         /* access to OOB pointer */
8478                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8479                         /* exit */
8480                         BPF_MOV64_IMM(BPF_REG_0, 0),
8481                         BPF_EXIT_INSN(),
8482                 },
8483                 .fixup_map_hash_8b = { 3 },
8484                 .errstr = "R0 min value is outside of the array range",
8485                 .result = REJECT
8486         },
8487         {
8488                 "bounds check based on reg_off + var_off + insn_off. test1",
8489                 .insns = {
8490                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8491                                     offsetof(struct __sk_buff, mark)),
8492                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8493                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8494                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8495                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8496                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8497                                      BPF_FUNC_map_lookup_elem),
8498                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8499                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8500                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
8501                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8503                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8504                         BPF_MOV64_IMM(BPF_REG_0, 0),
8505                         BPF_EXIT_INSN(),
8506                 },
8507                 .fixup_map_hash_8b = { 4 },
8508                 .errstr = "value_size=8 off=1073741825",
8509                 .result = REJECT,
8510                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8511         },
8512         {
8513                 "bounds check based on reg_off + var_off + insn_off. test2",
8514                 .insns = {
8515                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8516                                     offsetof(struct __sk_buff, mark)),
8517                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8518                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8519                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8520                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8521                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8522                                      BPF_FUNC_map_lookup_elem),
8523                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8524                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8525                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
8526                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8527                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8528                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8529                         BPF_MOV64_IMM(BPF_REG_0, 0),
8530                         BPF_EXIT_INSN(),
8531                 },
8532                 .fixup_map_hash_8b = { 4 },
8533                 .errstr = "value 1073741823",
8534                 .result = REJECT,
8535                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8536         },
8537         {
8538                 "bounds check after truncation of non-boundary-crossing range",
8539                 .insns = {
8540                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8541                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8542                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8543                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8544                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8545                                      BPF_FUNC_map_lookup_elem),
8546                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8547                         /* r1 = [0x00, 0xff] */
8548                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8549                         BPF_MOV64_IMM(BPF_REG_2, 1),
8550                         /* r2 = 0x10'0000'0000 */
8551                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
8552                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
8553                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8554                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
8555                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8556                         /* r1 = [0x00, 0xff] */
8557                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
8558                         /* r1 = 0 */
8559                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8560                         /* no-op */
8561                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8562                         /* access at offset 0 */
8563                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8564                         /* exit */
8565                         BPF_MOV64_IMM(BPF_REG_0, 0),
8566                         BPF_EXIT_INSN(),
8567                 },
8568                 .fixup_map_hash_8b = { 3 },
8569                 .result = ACCEPT
8570         },
8571         {
8572                 "bounds check after truncation of boundary-crossing range (1)",
8573                 .insns = {
8574                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8575                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8577                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8578                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8579                                      BPF_FUNC_map_lookup_elem),
8580                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8581                         /* r1 = [0x00, 0xff] */
8582                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8583                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8584                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8585                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8586                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8587                          *      [0x0000'0000, 0x0000'007f]
8588                          */
8589                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
8590                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8591                         /* r1 = [0x00, 0xff] or
8592                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8593                          */
8594                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8595                         /* r1 = 0 or
8596                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8597                          */
8598                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8599                         /* no-op or OOB pointer computation */
8600                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8601                         /* potentially OOB access */
8602                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8603                         /* exit */
8604                         BPF_MOV64_IMM(BPF_REG_0, 0),
8605                         BPF_EXIT_INSN(),
8606                 },
8607                 .fixup_map_hash_8b = { 3 },
8608                 /* not actually fully unbounded, but the bound is very high */
8609                 .errstr = "R0 unbounded memory access",
8610                 .result = REJECT
8611         },
8612         {
8613                 "bounds check after truncation of boundary-crossing range (2)",
8614                 .insns = {
8615                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8616                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8617                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8618                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8619                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8620                                      BPF_FUNC_map_lookup_elem),
8621                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8622                         /* r1 = [0x00, 0xff] */
8623                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8624                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8625                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8627                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8628                          *      [0x0000'0000, 0x0000'007f]
8629                          * difference to previous test: truncation via MOV32
8630                          * instead of ALU32.
8631                          */
8632                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
8633                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8634                         /* r1 = [0x00, 0xff] or
8635                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8636                          */
8637                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8638                         /* r1 = 0 or
8639                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8640                          */
8641                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8642                         /* no-op or OOB pointer computation */
8643                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8644                         /* potentially OOB access */
8645                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8646                         /* exit */
8647                         BPF_MOV64_IMM(BPF_REG_0, 0),
8648                         BPF_EXIT_INSN(),
8649                 },
8650                 .fixup_map_hash_8b = { 3 },
8651                 /* not actually fully unbounded, but the bound is very high */
8652                 .errstr = "R0 unbounded memory access",
8653                 .result = REJECT
8654         },
8655         {
8656                 "bounds check after wrapping 32-bit addition",
8657                 .insns = {
8658                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8659                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8661                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8662                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8663                                      BPF_FUNC_map_lookup_elem),
8664                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
8665                         /* r1 = 0x7fff'ffff */
8666                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
8667                         /* r1 = 0xffff'fffe */
8668                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8669                         /* r1 = 0 */
8670                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
8671                         /* no-op */
8672                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8673                         /* access at offset 0 */
8674                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8675                         /* exit */
8676                         BPF_MOV64_IMM(BPF_REG_0, 0),
8677                         BPF_EXIT_INSN(),
8678                 },
8679                 .fixup_map_hash_8b = { 3 },
8680                 .result = ACCEPT
8681         },
8682         {
8683                 "bounds check after shift with oversized count operand",
8684                 .insns = {
8685                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8686                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8688                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8689                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8690                                      BPF_FUNC_map_lookup_elem),
8691                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8692                         BPF_MOV64_IMM(BPF_REG_2, 32),
8693                         BPF_MOV64_IMM(BPF_REG_1, 1),
8694                         /* r1 = (u32)1 << (u32)32 = ? */
8695                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
8696                         /* r1 = [0x0000, 0xffff] */
8697                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
8698                         /* computes unknown pointer, potentially OOB */
8699                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8700                         /* potentially OOB access */
8701                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8702                         /* exit */
8703                         BPF_MOV64_IMM(BPF_REG_0, 0),
8704                         BPF_EXIT_INSN(),
8705                 },
8706                 .fixup_map_hash_8b = { 3 },
8707                 .errstr = "R0 max value is outside of the array range",
8708                 .result = REJECT
8709         },
8710         {
8711                 "bounds check after right shift of maybe-negative number",
8712                 .insns = {
8713                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8714                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8715                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8716                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8717                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8718                                      BPF_FUNC_map_lookup_elem),
8719                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8720                         /* r1 = [0x00, 0xff] */
8721                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8722                         /* r1 = [-0x01, 0xfe] */
8723                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
8724                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
8725                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8726                         /* r1 = 0 or 0xffff'ffff'ffff */
8727                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8728                         /* computes unknown pointer, potentially OOB */
8729                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8730                         /* potentially OOB access */
8731                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8732                         /* exit */
8733                         BPF_MOV64_IMM(BPF_REG_0, 0),
8734                         BPF_EXIT_INSN(),
8735                 },
8736                 .fixup_map_hash_8b = { 3 },
8737                 .errstr = "R0 unbounded memory access",
8738                 .result = REJECT
8739         },
8740         {
8741                 "bounds check map access with off+size signed 32bit overflow. test1",
8742                 .insns = {
8743                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8744                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8746                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8747                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8748                                      BPF_FUNC_map_lookup_elem),
8749                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8750                         BPF_EXIT_INSN(),
8751                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
8752                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8753                         BPF_JMP_A(0),
8754                         BPF_EXIT_INSN(),
8755                 },
8756                 .fixup_map_hash_8b = { 3 },
8757                 .errstr = "map_value pointer and 2147483646",
8758                 .result = REJECT
8759         },
8760         {
8761                 "bounds check map access with off+size signed 32bit overflow. test2",
8762                 .insns = {
8763                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8764                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8765                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8766                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8767                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8768                                      BPF_FUNC_map_lookup_elem),
8769                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8770                         BPF_EXIT_INSN(),
8771                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8772                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8773                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8774                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8775                         BPF_JMP_A(0),
8776                         BPF_EXIT_INSN(),
8777                 },
8778                 .fixup_map_hash_8b = { 3 },
8779                 .errstr = "pointer offset 1073741822",
8780                 .result = REJECT
8781         },
8782         {
8783                 "bounds check map access with off+size signed 32bit overflow. test3",
8784                 .insns = {
8785                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8786                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8788                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8789                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8790                                      BPF_FUNC_map_lookup_elem),
8791                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8792                         BPF_EXIT_INSN(),
8793                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8794                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8795                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8796                         BPF_JMP_A(0),
8797                         BPF_EXIT_INSN(),
8798                 },
8799                 .fixup_map_hash_8b = { 3 },
8800                 .errstr = "pointer offset -1073741822",
8801                 .result = REJECT
8802         },
8803         {
8804                 "bounds check map access with off+size signed 32bit overflow. test4",
8805                 .insns = {
8806                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8807                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8809                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8810                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8811                                      BPF_FUNC_map_lookup_elem),
8812                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8813                         BPF_EXIT_INSN(),
8814                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
8815                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
8816                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8817                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8818                         BPF_JMP_A(0),
8819                         BPF_EXIT_INSN(),
8820                 },
8821                 .fixup_map_hash_8b = { 3 },
8822                 .errstr = "map_value pointer and 1000000000000",
8823                 .result = REJECT
8824         },
8825         {
8826                 "pointer/scalar confusion in state equality check (way 1)",
8827                 .insns = {
8828                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8829                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8830                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8831                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8832                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8833                                      BPF_FUNC_map_lookup_elem),
8834                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
8835                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8836                         BPF_JMP_A(1),
8837                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8838                         BPF_JMP_A(0),
8839                         BPF_EXIT_INSN(),
8840                 },
8841                 .fixup_map_hash_8b = { 3 },
8842                 .result = ACCEPT,
8843                 .retval = POINTER_VALUE,
8844                 .result_unpriv = REJECT,
8845                 .errstr_unpriv = "R0 leaks addr as return value"
8846         },
8847         {
8848                 "pointer/scalar confusion in state equality check (way 2)",
8849                 .insns = {
8850                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8851                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8853                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8854                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8855                                      BPF_FUNC_map_lookup_elem),
8856                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
8857                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8858                         BPF_JMP_A(1),
8859                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8860                         BPF_EXIT_INSN(),
8861                 },
8862                 .fixup_map_hash_8b = { 3 },
8863                 .result = ACCEPT,
8864                 .retval = POINTER_VALUE,
8865                 .result_unpriv = REJECT,
8866                 .errstr_unpriv = "R0 leaks addr as return value"
8867         },
8868         {
8869                 "variable-offset ctx access",
8870                 .insns = {
8871                         /* Get an unknown value */
8872                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8873                         /* Make it small and 4-byte aligned */
8874                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8875                         /* add it to skb.  We now have either &skb->len or
8876                          * &skb->pkt_type, but we don't know which
8877                          */
8878                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8879                         /* dereference it */
8880                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
8881                         BPF_EXIT_INSN(),
8882                 },
8883                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
8884                 .result = REJECT,
8885                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8886         },
8887         {
8888                 "variable-offset stack access",
8889                 .insns = {
8890                         /* Fill the top 8 bytes of the stack */
8891                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8892                         /* Get an unknown value */
8893                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8894                         /* Make it small and 4-byte aligned */
8895                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8896                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8897                         /* add it to fp.  We now have either fp-4 or fp-8, but
8898                          * we don't know which
8899                          */
8900                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8901                         /* dereference it */
8902                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
8903                         BPF_EXIT_INSN(),
8904                 },
8905                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
8906                 .result = REJECT,
8907                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8908         },
8909         {
8910                 "indirect variable-offset stack access",
8911                 .insns = {
8912                         /* Fill the top 8 bytes of the stack */
8913                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8914                         /* Get an unknown value */
8915                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8916                         /* Make it small and 4-byte aligned */
8917                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8918                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8919                         /* add it to fp.  We now have either fp-4 or fp-8, but
8920                          * we don't know which
8921                          */
8922                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8923                         /* dereference it indirectly */
8924                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8925                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8926                                      BPF_FUNC_map_lookup_elem),
8927                         BPF_MOV64_IMM(BPF_REG_0, 0),
8928                         BPF_EXIT_INSN(),
8929                 },
8930                 .fixup_map_hash_8b = { 5 },
8931                 .errstr = "variable stack read R2",
8932                 .result = REJECT,
8933                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8934         },
8935         {
8936                 "direct stack access with 32-bit wraparound. test1",
8937                 .insns = {
8938                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8939                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8941                         BPF_MOV32_IMM(BPF_REG_0, 0),
8942                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8943                         BPF_EXIT_INSN()
8944                 },
8945                 .errstr = "fp pointer and 2147483647",
8946                 .result = REJECT
8947         },
8948         {
8949                 "direct stack access with 32-bit wraparound. test2",
8950                 .insns = {
8951                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8954                         BPF_MOV32_IMM(BPF_REG_0, 0),
8955                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8956                         BPF_EXIT_INSN()
8957                 },
8958                 .errstr = "fp pointer and 1073741823",
8959                 .result = REJECT
8960         },
8961         {
8962                 "direct stack access with 32-bit wraparound. test3",
8963                 .insns = {
8964                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8965                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8966                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8967                         BPF_MOV32_IMM(BPF_REG_0, 0),
8968                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8969                         BPF_EXIT_INSN()
8970                 },
8971                 .errstr = "fp pointer offset 1073741822",
8972                 .result = REJECT
8973         },
8974         {
8975                 "liveness pruning and write screening",
8976                 .insns = {
8977                         /* Get an unknown value */
8978                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8979                         /* branch conditions teach us nothing about R2 */
8980                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8981                         BPF_MOV64_IMM(BPF_REG_0, 0),
8982                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8983                         BPF_MOV64_IMM(BPF_REG_0, 0),
8984                         BPF_EXIT_INSN(),
8985                 },
8986                 .errstr = "R0 !read_ok",
8987                 .result = REJECT,
8988                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8989         },
8990         {
8991                 "varlen_map_value_access pruning",
8992                 .insns = {
8993                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8994                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8996                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8997                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8998                                      BPF_FUNC_map_lookup_elem),
8999                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
9000                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
9001                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
9002                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
9003                         BPF_MOV32_IMM(BPF_REG_1, 0),
9004                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
9005                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
9006                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
9007                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
9008                                    offsetof(struct test_val, foo)),
9009                         BPF_EXIT_INSN(),
9010                 },
9011                 .fixup_map_hash_48b = { 3 },
9012                 .errstr_unpriv = "R0 leaks addr",
9013                 .errstr = "R0 unbounded memory access",
9014                 .result_unpriv = REJECT,
9015                 .result = REJECT,
9016                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9017         },
9018         {
9019                 "invalid 64-bit BPF_END",
9020                 .insns = {
9021                         BPF_MOV32_IMM(BPF_REG_0, 0),
9022                         {
9023                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
9024                                 .dst_reg = BPF_REG_0,
9025                                 .src_reg = 0,
9026                                 .off   = 0,
9027                                 .imm   = 32,
9028                         },
9029                         BPF_EXIT_INSN(),
9030                 },
9031                 .errstr = "unknown opcode d7",
9032                 .result = REJECT,
9033         },
9034         {
9035                 "XDP, using ifindex from netdev",
9036                 .insns = {
9037                         BPF_MOV64_IMM(BPF_REG_0, 0),
9038                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9039                                     offsetof(struct xdp_md, ingress_ifindex)),
9040                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
9041                         BPF_MOV64_IMM(BPF_REG_0, 1),
9042                         BPF_EXIT_INSN(),
9043                 },
9044                 .result = ACCEPT,
9045                 .prog_type = BPF_PROG_TYPE_XDP,
9046                 .retval = 1,
9047         },
9048         {
9049                 "meta access, test1",
9050                 .insns = {
9051                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9052                                     offsetof(struct xdp_md, data_meta)),
9053                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9054                                     offsetof(struct xdp_md, data)),
9055                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9057                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9058                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9059                         BPF_MOV64_IMM(BPF_REG_0, 0),
9060                         BPF_EXIT_INSN(),
9061                 },
9062                 .result = ACCEPT,
9063                 .prog_type = BPF_PROG_TYPE_XDP,
9064         },
9065         {
9066                 "meta access, test2",
9067                 .insns = {
9068                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9069                                     offsetof(struct xdp_md, data_meta)),
9070                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9071                                     offsetof(struct xdp_md, data)),
9072                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9073                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
9074                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9076                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9077                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9078                         BPF_MOV64_IMM(BPF_REG_0, 0),
9079                         BPF_EXIT_INSN(),
9080                 },
9081                 .result = REJECT,
9082                 .errstr = "invalid access to packet, off=-8",
9083                 .prog_type = BPF_PROG_TYPE_XDP,
9084         },
9085         {
9086                 "meta access, test3",
9087                 .insns = {
9088                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9089                                     offsetof(struct xdp_md, data_meta)),
9090                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9091                                     offsetof(struct xdp_md, data_end)),
9092                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9093                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9094                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9095                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9096                         BPF_MOV64_IMM(BPF_REG_0, 0),
9097                         BPF_EXIT_INSN(),
9098                 },
9099                 .result = REJECT,
9100                 .errstr = "invalid access to packet",
9101                 .prog_type = BPF_PROG_TYPE_XDP,
9102         },
9103         {
9104                 "meta access, test4",
9105                 .insns = {
9106                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9107                                     offsetof(struct xdp_md, data_meta)),
9108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9109                                     offsetof(struct xdp_md, data_end)),
9110                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9111                                     offsetof(struct xdp_md, data)),
9112                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
9113                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9114                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
9115                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9116                         BPF_MOV64_IMM(BPF_REG_0, 0),
9117                         BPF_EXIT_INSN(),
9118                 },
9119                 .result = REJECT,
9120                 .errstr = "invalid access to packet",
9121                 .prog_type = BPF_PROG_TYPE_XDP,
9122         },
9123         {
9124                 "meta access, test5",
9125                 .insns = {
9126                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9127                                     offsetof(struct xdp_md, data_meta)),
9128                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9129                                     offsetof(struct xdp_md, data)),
9130                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9131                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9132                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
9133                         BPF_MOV64_IMM(BPF_REG_2, -8),
9134                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9135                                      BPF_FUNC_xdp_adjust_meta),
9136                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
9137                         BPF_MOV64_IMM(BPF_REG_0, 0),
9138                         BPF_EXIT_INSN(),
9139                 },
9140                 .result = REJECT,
9141                 .errstr = "R3 !read_ok",
9142                 .prog_type = BPF_PROG_TYPE_XDP,
9143         },
9144         {
9145                 "meta access, test6",
9146                 .insns = {
9147                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9148                                     offsetof(struct xdp_md, data_meta)),
9149                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9150                                     offsetof(struct xdp_md, data)),
9151                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9152                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9153                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9154                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9155                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
9156                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9157                         BPF_MOV64_IMM(BPF_REG_0, 0),
9158                         BPF_EXIT_INSN(),
9159                 },
9160                 .result = REJECT,
9161                 .errstr = "invalid access to packet",
9162                 .prog_type = BPF_PROG_TYPE_XDP,
9163         },
9164         {
9165                 "meta access, test7",
9166                 .insns = {
9167                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9168                                     offsetof(struct xdp_md, data_meta)),
9169                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9170                                     offsetof(struct xdp_md, data)),
9171                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
9172                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
9173                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9174                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
9175                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9176                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9177                         BPF_MOV64_IMM(BPF_REG_0, 0),
9178                         BPF_EXIT_INSN(),
9179                 },
9180                 .result = ACCEPT,
9181                 .prog_type = BPF_PROG_TYPE_XDP,
9182         },
9183         {
9184                 "meta access, test8",
9185                 .insns = {
9186                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9187                                     offsetof(struct xdp_md, data_meta)),
9188                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9189                                     offsetof(struct xdp_md, data)),
9190                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9191                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
9192                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9193                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9194                         BPF_MOV64_IMM(BPF_REG_0, 0),
9195                         BPF_EXIT_INSN(),
9196                 },
9197                 .result = ACCEPT,
9198                 .prog_type = BPF_PROG_TYPE_XDP,
9199         },
9200         {
9201                 "meta access, test9",
9202                 .insns = {
9203                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9204                                     offsetof(struct xdp_md, data_meta)),
9205                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9206                                     offsetof(struct xdp_md, data)),
9207                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
9208                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
9209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
9210                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
9211                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9212                         BPF_MOV64_IMM(BPF_REG_0, 0),
9213                         BPF_EXIT_INSN(),
9214                 },
9215                 .result = REJECT,
9216                 .errstr = "invalid access to packet",
9217                 .prog_type = BPF_PROG_TYPE_XDP,
9218         },
9219         {
9220                 "meta access, test10",
9221                 .insns = {
9222                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9223                                     offsetof(struct xdp_md, data_meta)),
9224                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9225                                     offsetof(struct xdp_md, data)),
9226                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9227                                     offsetof(struct xdp_md, data_end)),
9228                         BPF_MOV64_IMM(BPF_REG_5, 42),
9229                         BPF_MOV64_IMM(BPF_REG_6, 24),
9230                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
9231                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
9232                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
9233                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
9234                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
9235                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
9236                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
9237                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
9238                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
9239                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
9240                         BPF_MOV64_IMM(BPF_REG_0, 0),
9241                         BPF_EXIT_INSN(),
9242                 },
9243                 .result = REJECT,
9244                 .errstr = "invalid access to packet",
9245                 .prog_type = BPF_PROG_TYPE_XDP,
9246         },
9247         {
9248                 "meta access, test11",
9249                 .insns = {
9250                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9251                                     offsetof(struct xdp_md, data_meta)),
9252                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9253                                     offsetof(struct xdp_md, data)),
9254                         BPF_MOV64_IMM(BPF_REG_5, 42),
9255                         BPF_MOV64_IMM(BPF_REG_6, 24),
9256                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
9257                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
9258                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
9259                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
9260                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
9261                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
9262                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
9263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
9264                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
9265                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
9266                         BPF_MOV64_IMM(BPF_REG_0, 0),
9267                         BPF_EXIT_INSN(),
9268                 },
9269                 .result = ACCEPT,
9270                 .prog_type = BPF_PROG_TYPE_XDP,
9271         },
9272         {
9273                 "meta access, test12",
9274                 .insns = {
9275                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9276                                     offsetof(struct xdp_md, data_meta)),
9277                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9278                                     offsetof(struct xdp_md, data)),
9279                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
9280                                     offsetof(struct xdp_md, data_end)),
9281                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
9282                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
9283                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
9284                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
9285                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
9286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
9287                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
9288                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
9289                         BPF_MOV64_IMM(BPF_REG_0, 0),
9290                         BPF_EXIT_INSN(),
9291                 },
9292                 .result = ACCEPT,
9293                 .prog_type = BPF_PROG_TYPE_XDP,
9294         },
9295         {
9296                 "arithmetic ops make PTR_TO_CTX unusable",
9297                 .insns = {
9298                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
9299                                       offsetof(struct __sk_buff, data) -
9300                                       offsetof(struct __sk_buff, mark)),
9301                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9302                                     offsetof(struct __sk_buff, mark)),
9303                         BPF_EXIT_INSN(),
9304                 },
9305                 .errstr = "dereference of modified ctx ptr",
9306                 .result = REJECT,
9307                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9308         },
9309         {
9310                 "pkt_end - pkt_start is allowed",
9311                 .insns = {
9312                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9313                                     offsetof(struct __sk_buff, data_end)),
9314                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9315                                     offsetof(struct __sk_buff, data)),
9316                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
9317                         BPF_EXIT_INSN(),
9318                 },
9319                 .result = ACCEPT,
9320                 .retval = TEST_DATA_LEN,
9321                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9322         },
9323         {
9324                 "XDP pkt read, pkt_end mangling, bad access 1",
9325                 .insns = {
9326                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9327                                     offsetof(struct xdp_md, data)),
9328                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9329                                     offsetof(struct xdp_md, data_end)),
9330                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9332                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
9333                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9334                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9335                         BPF_MOV64_IMM(BPF_REG_0, 0),
9336                         BPF_EXIT_INSN(),
9337                 },
9338                 .errstr = "R3 pointer arithmetic on pkt_end",
9339                 .result = REJECT,
9340                 .prog_type = BPF_PROG_TYPE_XDP,
9341         },
9342         {
9343                 "XDP pkt read, pkt_end mangling, bad access 2",
9344                 .insns = {
9345                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9346                                     offsetof(struct xdp_md, data)),
9347                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9348                                     offsetof(struct xdp_md, data_end)),
9349                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9351                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
9352                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9353                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9354                         BPF_MOV64_IMM(BPF_REG_0, 0),
9355                         BPF_EXIT_INSN(),
9356                 },
9357                 .errstr = "R3 pointer arithmetic on pkt_end",
9358                 .result = REJECT,
9359                 .prog_type = BPF_PROG_TYPE_XDP,
9360         },
9361         {
9362                 "XDP pkt read, pkt_data' > pkt_end, good access",
9363                 .insns = {
9364                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9365                                     offsetof(struct xdp_md, data)),
9366                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9367                                     offsetof(struct xdp_md, data_end)),
9368                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9369                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9370                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9371                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9372                         BPF_MOV64_IMM(BPF_REG_0, 0),
9373                         BPF_EXIT_INSN(),
9374                 },
9375                 .result = ACCEPT,
9376                 .prog_type = BPF_PROG_TYPE_XDP,
9377         },
9378         {
9379                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
9380                 .insns = {
9381                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9382                                     offsetof(struct xdp_md, data)),
9383                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9384                                     offsetof(struct xdp_md, data_end)),
9385                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9386                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9387                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9388                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9389                         BPF_MOV64_IMM(BPF_REG_0, 0),
9390                         BPF_EXIT_INSN(),
9391                 },
9392                 .errstr = "R1 offset is outside of the packet",
9393                 .result = REJECT,
9394                 .prog_type = BPF_PROG_TYPE_XDP,
9395                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9396         },
9397         {
9398                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
9399                 .insns = {
9400                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9401                                     offsetof(struct xdp_md, data)),
9402                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9403                                     offsetof(struct xdp_md, data_end)),
9404                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9406                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9407                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9408                         BPF_MOV64_IMM(BPF_REG_0, 0),
9409                         BPF_EXIT_INSN(),
9410                 },
9411                 .errstr = "R1 offset is outside of the packet",
9412                 .result = REJECT,
9413                 .prog_type = BPF_PROG_TYPE_XDP,
9414         },
9415         {
9416                 "XDP pkt read, pkt_end > pkt_data', good access",
9417                 .insns = {
9418                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9419                                     offsetof(struct xdp_md, data)),
9420                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9421                                     offsetof(struct xdp_md, data_end)),
9422                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9424                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9425                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9426                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9427                         BPF_MOV64_IMM(BPF_REG_0, 0),
9428                         BPF_EXIT_INSN(),
9429                 },
9430                 .result = ACCEPT,
9431                 .prog_type = BPF_PROG_TYPE_XDP,
9432                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9433         },
9434         {
9435                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
9436                 .insns = {
9437                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9438                                     offsetof(struct xdp_md, data)),
9439                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9440                                     offsetof(struct xdp_md, data_end)),
9441                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9442                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9443                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9444                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9445                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9446                         BPF_MOV64_IMM(BPF_REG_0, 0),
9447                         BPF_EXIT_INSN(),
9448                 },
9449                 .errstr = "R1 offset is outside of the packet",
9450                 .result = REJECT,
9451                 .prog_type = BPF_PROG_TYPE_XDP,
9452         },
9453         {
9454                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
9455                 .insns = {
9456                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9457                                     offsetof(struct xdp_md, data)),
9458                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9459                                     offsetof(struct xdp_md, data_end)),
9460                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9462                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9463                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9464                         BPF_MOV64_IMM(BPF_REG_0, 0),
9465                         BPF_EXIT_INSN(),
9466                 },
9467                 .errstr = "R1 offset is outside of the packet",
9468                 .result = REJECT,
9469                 .prog_type = BPF_PROG_TYPE_XDP,
9470         },
9471         {
9472                 "XDP pkt read, pkt_data' < pkt_end, good access",
9473                 .insns = {
9474                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9475                                     offsetof(struct xdp_md, data)),
9476                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9477                                     offsetof(struct xdp_md, data_end)),
9478                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9480                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9481                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9482                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9483                         BPF_MOV64_IMM(BPF_REG_0, 0),
9484                         BPF_EXIT_INSN(),
9485                 },
9486                 .result = ACCEPT,
9487                 .prog_type = BPF_PROG_TYPE_XDP,
9488                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9489         },
9490         {
9491                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
9492                 .insns = {
9493                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9494                                     offsetof(struct xdp_md, data)),
9495                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9496                                     offsetof(struct xdp_md, data_end)),
9497                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9498                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9499                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9500                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9501                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9502                         BPF_MOV64_IMM(BPF_REG_0, 0),
9503                         BPF_EXIT_INSN(),
9504                 },
9505                 .errstr = "R1 offset is outside of the packet",
9506                 .result = REJECT,
9507                 .prog_type = BPF_PROG_TYPE_XDP,
9508         },
9509         {
9510                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
9511                 .insns = {
9512                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9513                                     offsetof(struct xdp_md, data)),
9514                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9515                                     offsetof(struct xdp_md, data_end)),
9516                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9518                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9519                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9520                         BPF_MOV64_IMM(BPF_REG_0, 0),
9521                         BPF_EXIT_INSN(),
9522                 },
9523                 .errstr = "R1 offset is outside of the packet",
9524                 .result = REJECT,
9525                 .prog_type = BPF_PROG_TYPE_XDP,
9526         },
9527         {
9528                 "XDP pkt read, pkt_end < pkt_data', good access",
9529                 .insns = {
9530                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9531                                     offsetof(struct xdp_md, data)),
9532                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9533                                     offsetof(struct xdp_md, data_end)),
9534                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9536                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9537                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9538                         BPF_MOV64_IMM(BPF_REG_0, 0),
9539                         BPF_EXIT_INSN(),
9540                 },
9541                 .result = ACCEPT,
9542                 .prog_type = BPF_PROG_TYPE_XDP,
9543         },
9544         {
9545                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
9546                 .insns = {
9547                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9548                                     offsetof(struct xdp_md, data)),
9549                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9550                                     offsetof(struct xdp_md, data_end)),
9551                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9553                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9554                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9555                         BPF_MOV64_IMM(BPF_REG_0, 0),
9556                         BPF_EXIT_INSN(),
9557                 },
9558                 .errstr = "R1 offset is outside of the packet",
9559                 .result = REJECT,
9560                 .prog_type = BPF_PROG_TYPE_XDP,
9561                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9562         },
9563         {
9564                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
9565                 .insns = {
9566                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9567                                     offsetof(struct xdp_md, data)),
9568                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9569                                     offsetof(struct xdp_md, data_end)),
9570                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9571                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9572                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9573                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9574                         BPF_MOV64_IMM(BPF_REG_0, 0),
9575                         BPF_EXIT_INSN(),
9576                 },
9577                 .errstr = "R1 offset is outside of the packet",
9578                 .result = REJECT,
9579                 .prog_type = BPF_PROG_TYPE_XDP,
9580         },
9581         {
9582                 "XDP pkt read, pkt_data' >= pkt_end, good access",
9583                 .insns = {
9584                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9585                                     offsetof(struct xdp_md, data)),
9586                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9587                                     offsetof(struct xdp_md, data_end)),
9588                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9590                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9591                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9592                         BPF_MOV64_IMM(BPF_REG_0, 0),
9593                         BPF_EXIT_INSN(),
9594                 },
9595                 .result = ACCEPT,
9596                 .prog_type = BPF_PROG_TYPE_XDP,
9597                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9598         },
9599         {
9600                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
9601                 .insns = {
9602                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9603                                     offsetof(struct xdp_md, data)),
9604                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9605                                     offsetof(struct xdp_md, data_end)),
9606                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9607                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9608                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9609                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9610                         BPF_MOV64_IMM(BPF_REG_0, 0),
9611                         BPF_EXIT_INSN(),
9612                 },
9613                 .errstr = "R1 offset is outside of the packet",
9614                 .result = REJECT,
9615                 .prog_type = BPF_PROG_TYPE_XDP,
9616         },
9617         {
9618                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
9619                 .insns = {
9620                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9621                                     offsetof(struct xdp_md, data)),
9622                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9623                                     offsetof(struct xdp_md, data_end)),
9624                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9626                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9627                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9628                         BPF_MOV64_IMM(BPF_REG_0, 0),
9629                         BPF_EXIT_INSN(),
9630                 },
9631                 .errstr = "R1 offset is outside of the packet",
9632                 .result = REJECT,
9633                 .prog_type = BPF_PROG_TYPE_XDP,
9634                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9635         },
9636         {
9637                 "XDP pkt read, pkt_end >= pkt_data', good access",
9638                 .insns = {
9639                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9640                                     offsetof(struct xdp_md, data)),
9641                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9642                                     offsetof(struct xdp_md, data_end)),
9643                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9644                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9645                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9646                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9647                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9648                         BPF_MOV64_IMM(BPF_REG_0, 0),
9649                         BPF_EXIT_INSN(),
9650                 },
9651                 .result = ACCEPT,
9652                 .prog_type = BPF_PROG_TYPE_XDP,
9653         },
9654         {
9655                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
9656                 .insns = {
9657                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9658                                     offsetof(struct xdp_md, data)),
9659                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9660                                     offsetof(struct xdp_md, data_end)),
9661                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9662                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9663                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9664                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9665                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9666                         BPF_MOV64_IMM(BPF_REG_0, 0),
9667                         BPF_EXIT_INSN(),
9668                 },
9669                 .errstr = "R1 offset is outside of the packet",
9670                 .result = REJECT,
9671                 .prog_type = BPF_PROG_TYPE_XDP,
9672                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9673         },
9674         {
9675                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
9676                 .insns = {
9677                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9678                                     offsetof(struct xdp_md, data)),
9679                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9680                                     offsetof(struct xdp_md, data_end)),
9681                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9682                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9683                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9684                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9685                         BPF_MOV64_IMM(BPF_REG_0, 0),
9686                         BPF_EXIT_INSN(),
9687                 },
9688                 .errstr = "R1 offset is outside of the packet",
9689                 .result = REJECT,
9690                 .prog_type = BPF_PROG_TYPE_XDP,
9691         },
9692         {
9693                 "XDP pkt read, pkt_data' <= pkt_end, good access",
9694                 .insns = {
9695                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9696                                     offsetof(struct xdp_md, data)),
9697                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9698                                     offsetof(struct xdp_md, data_end)),
9699                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9701                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9702                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9703                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9704                         BPF_MOV64_IMM(BPF_REG_0, 0),
9705                         BPF_EXIT_INSN(),
9706                 },
9707                 .result = ACCEPT,
9708                 .prog_type = BPF_PROG_TYPE_XDP,
9709         },
9710         {
9711                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
9712                 .insns = {
9713                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9714                                     offsetof(struct xdp_md, data)),
9715                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9716                                     offsetof(struct xdp_md, data_end)),
9717                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9718                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9719                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9720                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9721                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9722                         BPF_MOV64_IMM(BPF_REG_0, 0),
9723                         BPF_EXIT_INSN(),
9724                 },
9725                 .errstr = "R1 offset is outside of the packet",
9726                 .result = REJECT,
9727                 .prog_type = BPF_PROG_TYPE_XDP,
9728                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9729         },
9730         {
9731                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
9732                 .insns = {
9733                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9734                                     offsetof(struct xdp_md, data)),
9735                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9736                                     offsetof(struct xdp_md, data_end)),
9737                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9739                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9740                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9741                         BPF_MOV64_IMM(BPF_REG_0, 0),
9742                         BPF_EXIT_INSN(),
9743                 },
9744                 .errstr = "R1 offset is outside of the packet",
9745                 .result = REJECT,
9746                 .prog_type = BPF_PROG_TYPE_XDP,
9747         },
9748         {
9749                 "XDP pkt read, pkt_end <= pkt_data', good access",
9750                 .insns = {
9751                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9752                                     offsetof(struct xdp_md, data)),
9753                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9754                                     offsetof(struct xdp_md, data_end)),
9755                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9756                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9757                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9758                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9759                         BPF_MOV64_IMM(BPF_REG_0, 0),
9760                         BPF_EXIT_INSN(),
9761                 },
9762                 .result = ACCEPT,
9763                 .prog_type = BPF_PROG_TYPE_XDP,
9764                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9765         },
9766         {
9767                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
9768                 .insns = {
9769                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9770                                     offsetof(struct xdp_md, data)),
9771                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9772                                     offsetof(struct xdp_md, data_end)),
9773                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9775                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9776                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9777                         BPF_MOV64_IMM(BPF_REG_0, 0),
9778                         BPF_EXIT_INSN(),
9779                 },
9780                 .errstr = "R1 offset is outside of the packet",
9781                 .result = REJECT,
9782                 .prog_type = BPF_PROG_TYPE_XDP,
9783         },
9784         {
9785                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
9786                 .insns = {
9787                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9788                                     offsetof(struct xdp_md, data)),
9789                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9790                                     offsetof(struct xdp_md, data_end)),
9791                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9792                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9793                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9794                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9795                         BPF_MOV64_IMM(BPF_REG_0, 0),
9796                         BPF_EXIT_INSN(),
9797                 },
9798                 .errstr = "R1 offset is outside of the packet",
9799                 .result = REJECT,
9800                 .prog_type = BPF_PROG_TYPE_XDP,
9801                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9802         },
9803         {
9804                 "XDP pkt read, pkt_meta' > pkt_data, good access",
9805                 .insns = {
9806                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9807                                     offsetof(struct xdp_md, data_meta)),
9808                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9809                                     offsetof(struct xdp_md, data)),
9810                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9812                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9813                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9814                         BPF_MOV64_IMM(BPF_REG_0, 0),
9815                         BPF_EXIT_INSN(),
9816                 },
9817                 .result = ACCEPT,
9818                 .prog_type = BPF_PROG_TYPE_XDP,
9819         },
9820         {
9821                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
9822                 .insns = {
9823                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9824                                     offsetof(struct xdp_md, data_meta)),
9825                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9826                                     offsetof(struct xdp_md, data)),
9827                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9829                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9830                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9831                         BPF_MOV64_IMM(BPF_REG_0, 0),
9832                         BPF_EXIT_INSN(),
9833                 },
9834                 .errstr = "R1 offset is outside of the packet",
9835                 .result = REJECT,
9836                 .prog_type = BPF_PROG_TYPE_XDP,
9837                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9838         },
9839         {
9840                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
9841                 .insns = {
9842                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9843                                     offsetof(struct xdp_md, data_meta)),
9844                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9845                                     offsetof(struct xdp_md, data)),
9846                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9847                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9848                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9849                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9850                         BPF_MOV64_IMM(BPF_REG_0, 0),
9851                         BPF_EXIT_INSN(),
9852                 },
9853                 .errstr = "R1 offset is outside of the packet",
9854                 .result = REJECT,
9855                 .prog_type = BPF_PROG_TYPE_XDP,
9856         },
9857         {
9858                 "XDP pkt read, pkt_data > pkt_meta', good access",
9859                 .insns = {
9860                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9861                                     offsetof(struct xdp_md, data_meta)),
9862                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9863                                     offsetof(struct xdp_md, data)),
9864                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9865                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9866                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9867                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9868                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9869                         BPF_MOV64_IMM(BPF_REG_0, 0),
9870                         BPF_EXIT_INSN(),
9871                 },
9872                 .result = ACCEPT,
9873                 .prog_type = BPF_PROG_TYPE_XDP,
9874                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9875         },
9876         {
9877                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
9878                 .insns = {
9879                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9880                                     offsetof(struct xdp_md, data_meta)),
9881                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9882                                     offsetof(struct xdp_md, data)),
9883                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9884                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9885                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9886                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9887                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9888                         BPF_MOV64_IMM(BPF_REG_0, 0),
9889                         BPF_EXIT_INSN(),
9890                 },
9891                 .errstr = "R1 offset is outside of the packet",
9892                 .result = REJECT,
9893                 .prog_type = BPF_PROG_TYPE_XDP,
9894         },
9895         {
9896                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
9897                 .insns = {
9898                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9899                                     offsetof(struct xdp_md, data_meta)),
9900                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9901                                     offsetof(struct xdp_md, data)),
9902                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9903                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9904                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9905                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9906                         BPF_MOV64_IMM(BPF_REG_0, 0),
9907                         BPF_EXIT_INSN(),
9908                 },
9909                 .errstr = "R1 offset is outside of the packet",
9910                 .result = REJECT,
9911                 .prog_type = BPF_PROG_TYPE_XDP,
9912         },
9913         {
9914                 "XDP pkt read, pkt_meta' < pkt_data, good access",
9915                 .insns = {
9916                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9917                                     offsetof(struct xdp_md, data_meta)),
9918                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9919                                     offsetof(struct xdp_md, data)),
9920                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9921                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9922                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9923                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9924                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9925                         BPF_MOV64_IMM(BPF_REG_0, 0),
9926                         BPF_EXIT_INSN(),
9927                 },
9928                 .result = ACCEPT,
9929                 .prog_type = BPF_PROG_TYPE_XDP,
9930                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9931         },
9932         {
9933                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
9934                 .insns = {
9935                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9936                                     offsetof(struct xdp_md, data_meta)),
9937                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9938                                     offsetof(struct xdp_md, data)),
9939                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9941                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9942                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9943                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9944                         BPF_MOV64_IMM(BPF_REG_0, 0),
9945                         BPF_EXIT_INSN(),
9946                 },
9947                 .errstr = "R1 offset is outside of the packet",
9948                 .result = REJECT,
9949                 .prog_type = BPF_PROG_TYPE_XDP,
9950         },
9951         {
9952                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
9953                 .insns = {
9954                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9955                                     offsetof(struct xdp_md, data_meta)),
9956                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9957                                     offsetof(struct xdp_md, data)),
9958                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9959                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9960                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9961                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9962                         BPF_MOV64_IMM(BPF_REG_0, 0),
9963                         BPF_EXIT_INSN(),
9964                 },
9965                 .errstr = "R1 offset is outside of the packet",
9966                 .result = REJECT,
9967                 .prog_type = BPF_PROG_TYPE_XDP,
9968         },
9969         {
9970                 "XDP pkt read, pkt_data < pkt_meta', good access",
9971                 .insns = {
9972                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9973                                     offsetof(struct xdp_md, data_meta)),
9974                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9975                                     offsetof(struct xdp_md, data)),
9976                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9978                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9979                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9980                         BPF_MOV64_IMM(BPF_REG_0, 0),
9981                         BPF_EXIT_INSN(),
9982                 },
9983                 .result = ACCEPT,
9984                 .prog_type = BPF_PROG_TYPE_XDP,
9985         },
9986         {
9987                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
9988                 .insns = {
9989                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9990                                     offsetof(struct xdp_md, data_meta)),
9991                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9992                                     offsetof(struct xdp_md, data)),
9993                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9994                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9995                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9996                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9997                         BPF_MOV64_IMM(BPF_REG_0, 0),
9998                         BPF_EXIT_INSN(),
9999                 },
10000                 .errstr = "R1 offset is outside of the packet",
10001                 .result = REJECT,
10002                 .prog_type = BPF_PROG_TYPE_XDP,
10003                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10004         },
10005         {
10006                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
10007                 .insns = {
10008                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10009                                     offsetof(struct xdp_md, data_meta)),
10010                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10011                                     offsetof(struct xdp_md, data)),
10012                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10014                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
10015                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10016                         BPF_MOV64_IMM(BPF_REG_0, 0),
10017                         BPF_EXIT_INSN(),
10018                 },
10019                 .errstr = "R1 offset is outside of the packet",
10020                 .result = REJECT,
10021                 .prog_type = BPF_PROG_TYPE_XDP,
10022         },
10023         {
10024                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
10025                 .insns = {
10026                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10027                                     offsetof(struct xdp_md, data_meta)),
10028                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10029                                     offsetof(struct xdp_md, data)),
10030                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10032                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
10033                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10034                         BPF_MOV64_IMM(BPF_REG_0, 0),
10035                         BPF_EXIT_INSN(),
10036                 },
10037                 .result = ACCEPT,
10038                 .prog_type = BPF_PROG_TYPE_XDP,
10039                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10040         },
10041         {
10042                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
10043                 .insns = {
10044                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10045                                     offsetof(struct xdp_md, data_meta)),
10046                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10047                                     offsetof(struct xdp_md, data)),
10048                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10049                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10050                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
10051                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10052                         BPF_MOV64_IMM(BPF_REG_0, 0),
10053                         BPF_EXIT_INSN(),
10054                 },
10055                 .errstr = "R1 offset is outside of the packet",
10056                 .result = REJECT,
10057                 .prog_type = BPF_PROG_TYPE_XDP,
10058         },
10059         {
10060                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
10061                 .insns = {
10062                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10063                                     offsetof(struct xdp_md, data_meta)),
10064                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10065                                     offsetof(struct xdp_md, data)),
10066                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10067                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10068                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
10069                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10070                         BPF_MOV64_IMM(BPF_REG_0, 0),
10071                         BPF_EXIT_INSN(),
10072                 },
10073                 .errstr = "R1 offset is outside of the packet",
10074                 .result = REJECT,
10075                 .prog_type = BPF_PROG_TYPE_XDP,
10076                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10077         },
10078         {
10079                 "XDP pkt read, pkt_data >= pkt_meta', good access",
10080                 .insns = {
10081                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10082                                     offsetof(struct xdp_md, data_meta)),
10083                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10084                                     offsetof(struct xdp_md, data)),
10085                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10087                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10088                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10089                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10090                         BPF_MOV64_IMM(BPF_REG_0, 0),
10091                         BPF_EXIT_INSN(),
10092                 },
10093                 .result = ACCEPT,
10094                 .prog_type = BPF_PROG_TYPE_XDP,
10095         },
10096         {
10097                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
10098                 .insns = {
10099                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10100                                     offsetof(struct xdp_md, data_meta)),
10101                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10102                                     offsetof(struct xdp_md, data)),
10103                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10105                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10106                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10107                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10108                         BPF_MOV64_IMM(BPF_REG_0, 0),
10109                         BPF_EXIT_INSN(),
10110                 },
10111                 .errstr = "R1 offset is outside of the packet",
10112                 .result = REJECT,
10113                 .prog_type = BPF_PROG_TYPE_XDP,
10114                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10115         },
10116         {
10117                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
10118                 .insns = {
10119                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10120                                     offsetof(struct xdp_md, data_meta)),
10121                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10122                                     offsetof(struct xdp_md, data)),
10123                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10124                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10125                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
10126                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10127                         BPF_MOV64_IMM(BPF_REG_0, 0),
10128                         BPF_EXIT_INSN(),
10129                 },
10130                 .errstr = "R1 offset is outside of the packet",
10131                 .result = REJECT,
10132                 .prog_type = BPF_PROG_TYPE_XDP,
10133         },
10134         {
10135                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
10136                 .insns = {
10137                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10138                                     offsetof(struct xdp_md, data_meta)),
10139                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10140                                     offsetof(struct xdp_md, data)),
10141                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10142                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10143                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10144                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10145                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10146                         BPF_MOV64_IMM(BPF_REG_0, 0),
10147                         BPF_EXIT_INSN(),
10148                 },
10149                 .result = ACCEPT,
10150                 .prog_type = BPF_PROG_TYPE_XDP,
10151         },
10152         {
10153                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
10154                 .insns = {
10155                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10156                                     offsetof(struct xdp_md, data_meta)),
10157                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10158                                     offsetof(struct xdp_md, data)),
10159                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10160                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10161                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10162                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10163                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
10164                         BPF_MOV64_IMM(BPF_REG_0, 0),
10165                         BPF_EXIT_INSN(),
10166                 },
10167                 .errstr = "R1 offset is outside of the packet",
10168                 .result = REJECT,
10169                 .prog_type = BPF_PROG_TYPE_XDP,
10170                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10171         },
10172         {
10173                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
10174                 .insns = {
10175                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10176                                     offsetof(struct xdp_md, data_meta)),
10177                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10178                                     offsetof(struct xdp_md, data)),
10179                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10180                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10181                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
10182                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10183                         BPF_MOV64_IMM(BPF_REG_0, 0),
10184                         BPF_EXIT_INSN(),
10185                 },
10186                 .errstr = "R1 offset is outside of the packet",
10187                 .result = REJECT,
10188                 .prog_type = BPF_PROG_TYPE_XDP,
10189         },
10190         {
10191                 "XDP pkt read, pkt_data <= pkt_meta', good access",
10192                 .insns = {
10193                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10194                                     offsetof(struct xdp_md, data_meta)),
10195                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10196                                     offsetof(struct xdp_md, data)),
10197                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10198                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10199                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10200                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10201                         BPF_MOV64_IMM(BPF_REG_0, 0),
10202                         BPF_EXIT_INSN(),
10203                 },
10204                 .result = ACCEPT,
10205                 .prog_type = BPF_PROG_TYPE_XDP,
10206                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10207         },
10208         {
10209                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
10210                 .insns = {
10211                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10212                                     offsetof(struct xdp_md, data_meta)),
10213                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10214                                     offsetof(struct xdp_md, data)),
10215                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10216                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10217                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
10218                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
10219                         BPF_MOV64_IMM(BPF_REG_0, 0),
10220                         BPF_EXIT_INSN(),
10221                 },
10222                 .errstr = "R1 offset is outside of the packet",
10223                 .result = REJECT,
10224                 .prog_type = BPF_PROG_TYPE_XDP,
10225         },
10226         {
10227                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
10228                 .insns = {
10229                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10230                                     offsetof(struct xdp_md, data_meta)),
10231                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10232                                     offsetof(struct xdp_md, data)),
10233                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
10234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
10235                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
10236                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
10237                         BPF_MOV64_IMM(BPF_REG_0, 0),
10238                         BPF_EXIT_INSN(),
10239                 },
10240                 .errstr = "R1 offset is outside of the packet",
10241                 .result = REJECT,
10242                 .prog_type = BPF_PROG_TYPE_XDP,
10243                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
10244         },
10245         {
10246                 "check deducing bounds from const, 1",
10247                 .insns = {
10248                         BPF_MOV64_IMM(BPF_REG_0, 1),
10249                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
10250                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10251                         BPF_EXIT_INSN(),
10252                 },
10253                 .result = REJECT,
10254                 .errstr = "R0 tried to subtract pointer from scalar",
10255         },
10256         {
10257                 "check deducing bounds from const, 2",
10258                 .insns = {
10259                         BPF_MOV64_IMM(BPF_REG_0, 1),
10260                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
10261                         BPF_EXIT_INSN(),
10262                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
10263                         BPF_EXIT_INSN(),
10264                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10265                         BPF_EXIT_INSN(),
10266                 },
10267                 .result = ACCEPT,
10268                 .retval = 1,
10269         },
10270         {
10271                 "check deducing bounds from const, 3",
10272                 .insns = {
10273                         BPF_MOV64_IMM(BPF_REG_0, 0),
10274                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
10275                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10276                         BPF_EXIT_INSN(),
10277                 },
10278                 .result = REJECT,
10279                 .errstr = "R0 tried to subtract pointer from scalar",
10280         },
10281         {
10282                 "check deducing bounds from const, 4",
10283                 .insns = {
10284                         BPF_MOV64_IMM(BPF_REG_0, 0),
10285                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
10286                         BPF_EXIT_INSN(),
10287                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10288                         BPF_EXIT_INSN(),
10289                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10290                         BPF_EXIT_INSN(),
10291                 },
10292                 .result = ACCEPT,
10293         },
10294         {
10295                 "check deducing bounds from const, 5",
10296                 .insns = {
10297                         BPF_MOV64_IMM(BPF_REG_0, 0),
10298                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10299                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10300                         BPF_EXIT_INSN(),
10301                 },
10302                 .result = REJECT,
10303                 .errstr = "R0 tried to subtract pointer from scalar",
10304         },
10305         {
10306                 "check deducing bounds from const, 6",
10307                 .insns = {
10308                         BPF_MOV64_IMM(BPF_REG_0, 0),
10309                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10310                         BPF_EXIT_INSN(),
10311                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10312                         BPF_EXIT_INSN(),
10313                 },
10314                 .result = REJECT,
10315                 .errstr = "R0 tried to subtract pointer from scalar",
10316         },
10317         {
10318                 "check deducing bounds from const, 7",
10319                 .insns = {
10320                         BPF_MOV64_IMM(BPF_REG_0, ~0),
10321                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
10322                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
10323                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10324                                     offsetof(struct __sk_buff, mark)),
10325                         BPF_EXIT_INSN(),
10326                 },
10327                 .result = REJECT,
10328                 .errstr = "dereference of modified ctx ptr",
10329         },
10330         {
10331                 "check deducing bounds from const, 8",
10332                 .insns = {
10333                         BPF_MOV64_IMM(BPF_REG_0, ~0),
10334                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
10335                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
10336                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10337                                     offsetof(struct __sk_buff, mark)),
10338                         BPF_EXIT_INSN(),
10339                 },
10340                 .result = REJECT,
10341                 .errstr = "dereference of modified ctx ptr",
10342         },
10343         {
10344                 "check deducing bounds from const, 9",
10345                 .insns = {
10346                         BPF_MOV64_IMM(BPF_REG_0, 0),
10347                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
10348                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10349                         BPF_EXIT_INSN(),
10350                 },
10351                 .result = REJECT,
10352                 .errstr = "R0 tried to subtract pointer from scalar",
10353         },
10354         {
10355                 "check deducing bounds from const, 10",
10356                 .insns = {
10357                         BPF_MOV64_IMM(BPF_REG_0, 0),
10358                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
10359                         /* Marks reg as unknown. */
10360                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
10361                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
10362                         BPF_EXIT_INSN(),
10363                 },
10364                 .result = REJECT,
10365                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
10366         },
10367         {
10368                 "bpf_exit with invalid return code. test1",
10369                 .insns = {
10370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10371                         BPF_EXIT_INSN(),
10372                 },
10373                 .errstr = "R0 has value (0x0; 0xffffffff)",
10374                 .result = REJECT,
10375                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10376         },
10377         {
10378                 "bpf_exit with invalid return code. test2",
10379                 .insns = {
10380                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10381                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
10382                         BPF_EXIT_INSN(),
10383                 },
10384                 .result = ACCEPT,
10385                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10386         },
10387         {
10388                 "bpf_exit with invalid return code. test3",
10389                 .insns = {
10390                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10391                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
10392                         BPF_EXIT_INSN(),
10393                 },
10394                 .errstr = "R0 has value (0x0; 0x3)",
10395                 .result = REJECT,
10396                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10397         },
10398         {
10399                 "bpf_exit with invalid return code. test4",
10400                 .insns = {
10401                         BPF_MOV64_IMM(BPF_REG_0, 1),
10402                         BPF_EXIT_INSN(),
10403                 },
10404                 .result = ACCEPT,
10405                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10406         },
10407         {
10408                 "bpf_exit with invalid return code. test5",
10409                 .insns = {
10410                         BPF_MOV64_IMM(BPF_REG_0, 2),
10411                         BPF_EXIT_INSN(),
10412                 },
10413                 .errstr = "R0 has value (0x2; 0x0)",
10414                 .result = REJECT,
10415                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10416         },
10417         {
10418                 "bpf_exit with invalid return code. test6",
10419                 .insns = {
10420                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10421                         BPF_EXIT_INSN(),
10422                 },
10423                 .errstr = "R0 is not a known value (ctx)",
10424                 .result = REJECT,
10425                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10426         },
10427         {
10428                 "bpf_exit with invalid return code. test7",
10429                 .insns = {
10430                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10431                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
10432                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
10433                         BPF_EXIT_INSN(),
10434                 },
10435                 .errstr = "R0 has unknown scalar value",
10436                 .result = REJECT,
10437                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
10438         },
10439         {
10440                 "calls: basic sanity",
10441                 .insns = {
10442                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10443                         BPF_MOV64_IMM(BPF_REG_0, 1),
10444                         BPF_EXIT_INSN(),
10445                         BPF_MOV64_IMM(BPF_REG_0, 2),
10446                         BPF_EXIT_INSN(),
10447                 },
10448                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10449                 .result = ACCEPT,
10450         },
10451         {
10452                 "calls: not on unpriviledged",
10453                 .insns = {
10454                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10455                         BPF_MOV64_IMM(BPF_REG_0, 1),
10456                         BPF_EXIT_INSN(),
10457                         BPF_MOV64_IMM(BPF_REG_0, 2),
10458                         BPF_EXIT_INSN(),
10459                 },
10460                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
10461                 .result_unpriv = REJECT,
10462                 .result = ACCEPT,
10463                 .retval = 1,
10464         },
10465         {
10466                 "calls: div by 0 in subprog",
10467                 .insns = {
10468                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10469                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10470                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10471                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10472                                     offsetof(struct __sk_buff, data_end)),
10473                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10474                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10475                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10476                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10477                         BPF_MOV64_IMM(BPF_REG_0, 1),
10478                         BPF_EXIT_INSN(),
10479                         BPF_MOV32_IMM(BPF_REG_2, 0),
10480                         BPF_MOV32_IMM(BPF_REG_3, 1),
10481                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
10482                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10483                                     offsetof(struct __sk_buff, data)),
10484                         BPF_EXIT_INSN(),
10485                 },
10486                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10487                 .result = ACCEPT,
10488                 .retval = 1,
10489         },
10490         {
10491                 "calls: multiple ret types in subprog 1",
10492                 .insns = {
10493                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10494                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10495                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10496                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10497                                     offsetof(struct __sk_buff, data_end)),
10498                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10500                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10501                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10502                         BPF_MOV64_IMM(BPF_REG_0, 1),
10503                         BPF_EXIT_INSN(),
10504                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10505                                     offsetof(struct __sk_buff, data)),
10506                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10507                         BPF_MOV32_IMM(BPF_REG_0, 42),
10508                         BPF_EXIT_INSN(),
10509                 },
10510                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10511                 .result = REJECT,
10512                 .errstr = "R0 invalid mem access 'inv'",
10513         },
10514         {
10515                 "calls: multiple ret types in subprog 2",
10516                 .insns = {
10517                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10518                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10519                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10520                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10521                                     offsetof(struct __sk_buff, data_end)),
10522                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10524                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10525                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10526                         BPF_MOV64_IMM(BPF_REG_0, 1),
10527                         BPF_EXIT_INSN(),
10528                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10529                                     offsetof(struct __sk_buff, data)),
10530                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10531                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
10532                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10533                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10535                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10536                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10537                                      BPF_FUNC_map_lookup_elem),
10538                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10539                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
10540                                     offsetof(struct __sk_buff, data)),
10541                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
10542                         BPF_EXIT_INSN(),
10543                 },
10544                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10545                 .fixup_map_hash_8b = { 16 },
10546                 .result = REJECT,
10547                 .errstr = "R0 min value is outside of the array range",
10548         },
10549         {
10550                 "calls: overlapping caller/callee",
10551                 .insns = {
10552                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
10553                         BPF_MOV64_IMM(BPF_REG_0, 1),
10554                         BPF_EXIT_INSN(),
10555                 },
10556                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10557                 .errstr = "last insn is not an exit or jmp",
10558                 .result = REJECT,
10559         },
10560         {
10561                 "calls: wrong recursive calls",
10562                 .insns = {
10563                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10564                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10565                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10566                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10567                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10568                         BPF_MOV64_IMM(BPF_REG_0, 1),
10569                         BPF_EXIT_INSN(),
10570                 },
10571                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10572                 .errstr = "jump out of range",
10573                 .result = REJECT,
10574         },
10575         {
10576                 "calls: wrong src reg",
10577                 .insns = {
10578                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
10579                         BPF_MOV64_IMM(BPF_REG_0, 1),
10580                         BPF_EXIT_INSN(),
10581                 },
10582                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10583                 .errstr = "BPF_CALL uses reserved fields",
10584                 .result = REJECT,
10585         },
10586         {
10587                 "calls: wrong off value",
10588                 .insns = {
10589                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
10590                         BPF_MOV64_IMM(BPF_REG_0, 1),
10591                         BPF_EXIT_INSN(),
10592                         BPF_MOV64_IMM(BPF_REG_0, 2),
10593                         BPF_EXIT_INSN(),
10594                 },
10595                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10596                 .errstr = "BPF_CALL uses reserved fields",
10597                 .result = REJECT,
10598         },
10599         {
10600                 "calls: jump back loop",
10601                 .insns = {
10602                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10603                         BPF_MOV64_IMM(BPF_REG_0, 1),
10604                         BPF_EXIT_INSN(),
10605                 },
10606                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10607                 .errstr = "back-edge from insn 0 to 0",
10608                 .result = REJECT,
10609         },
10610         {
10611                 "calls: conditional call",
10612                 .insns = {
10613                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10614                                     offsetof(struct __sk_buff, mark)),
10615                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10616                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10617                         BPF_MOV64_IMM(BPF_REG_0, 1),
10618                         BPF_EXIT_INSN(),
10619                         BPF_MOV64_IMM(BPF_REG_0, 2),
10620                         BPF_EXIT_INSN(),
10621                 },
10622                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10623                 .errstr = "jump out of range",
10624                 .result = REJECT,
10625         },
10626         {
10627                 "calls: conditional call 2",
10628                 .insns = {
10629                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10630                                     offsetof(struct __sk_buff, mark)),
10631                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10632                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10633                         BPF_MOV64_IMM(BPF_REG_0, 1),
10634                         BPF_EXIT_INSN(),
10635                         BPF_MOV64_IMM(BPF_REG_0, 2),
10636                         BPF_EXIT_INSN(),
10637                         BPF_MOV64_IMM(BPF_REG_0, 3),
10638                         BPF_EXIT_INSN(),
10639                 },
10640                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10641                 .result = ACCEPT,
10642         },
10643         {
10644                 "calls: conditional call 3",
10645                 .insns = {
10646                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10647                                     offsetof(struct __sk_buff, mark)),
10648                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10649                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10650                         BPF_MOV64_IMM(BPF_REG_0, 1),
10651                         BPF_EXIT_INSN(),
10652                         BPF_MOV64_IMM(BPF_REG_0, 1),
10653                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10654                         BPF_MOV64_IMM(BPF_REG_0, 3),
10655                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10656                 },
10657                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10658                 .errstr = "back-edge from insn",
10659                 .result = REJECT,
10660         },
10661         {
10662                 "calls: conditional call 4",
10663                 .insns = {
10664                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10665                                     offsetof(struct __sk_buff, mark)),
10666                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10667                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10668                         BPF_MOV64_IMM(BPF_REG_0, 1),
10669                         BPF_EXIT_INSN(),
10670                         BPF_MOV64_IMM(BPF_REG_0, 1),
10671                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
10672                         BPF_MOV64_IMM(BPF_REG_0, 3),
10673                         BPF_EXIT_INSN(),
10674                 },
10675                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10676                 .result = ACCEPT,
10677         },
10678         {
10679                 "calls: conditional call 5",
10680                 .insns = {
10681                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10682                                     offsetof(struct __sk_buff, mark)),
10683                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10684                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10685                         BPF_MOV64_IMM(BPF_REG_0, 1),
10686                         BPF_EXIT_INSN(),
10687                         BPF_MOV64_IMM(BPF_REG_0, 1),
10688                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10689                         BPF_MOV64_IMM(BPF_REG_0, 3),
10690                         BPF_EXIT_INSN(),
10691                 },
10692                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10693                 .errstr = "back-edge from insn",
10694                 .result = REJECT,
10695         },
10696         {
10697                 "calls: conditional call 6",
10698                 .insns = {
10699                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10700                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
10701                         BPF_EXIT_INSN(),
10702                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10703                                     offsetof(struct __sk_buff, mark)),
10704                         BPF_EXIT_INSN(),
10705                 },
10706                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10707                 .errstr = "back-edge from insn",
10708                 .result = REJECT,
10709         },
10710         {
10711                 "calls: using r0 returned by callee",
10712                 .insns = {
10713                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10714                         BPF_EXIT_INSN(),
10715                         BPF_MOV64_IMM(BPF_REG_0, 2),
10716                         BPF_EXIT_INSN(),
10717                 },
10718                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10719                 .result = ACCEPT,
10720         },
10721         {
10722                 "calls: using uninit r0 from callee",
10723                 .insns = {
10724                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10725                         BPF_EXIT_INSN(),
10726                         BPF_EXIT_INSN(),
10727                 },
10728                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10729                 .errstr = "!read_ok",
10730                 .result = REJECT,
10731         },
10732         {
10733                 "calls: callee is using r1",
10734                 .insns = {
10735                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10736                         BPF_EXIT_INSN(),
10737                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10738                                     offsetof(struct __sk_buff, len)),
10739                         BPF_EXIT_INSN(),
10740                 },
10741                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
10742                 .result = ACCEPT,
10743                 .retval = TEST_DATA_LEN,
10744         },
10745         {
10746                 "calls: callee using args1",
10747                 .insns = {
10748                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10749                         BPF_EXIT_INSN(),
10750                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10751                         BPF_EXIT_INSN(),
10752                 },
10753                 .errstr_unpriv = "allowed for root only",
10754                 .result_unpriv = REJECT,
10755                 .result = ACCEPT,
10756                 .retval = POINTER_VALUE,
10757         },
10758         {
10759                 "calls: callee using wrong args2",
10760                 .insns = {
10761                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10762                         BPF_EXIT_INSN(),
10763                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10764                         BPF_EXIT_INSN(),
10765                 },
10766                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10767                 .errstr = "R2 !read_ok",
10768                 .result = REJECT,
10769         },
10770         {
10771                 "calls: callee using two args",
10772                 .insns = {
10773                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10774                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
10775                                     offsetof(struct __sk_buff, len)),
10776                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
10777                                     offsetof(struct __sk_buff, len)),
10778                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10779                         BPF_EXIT_INSN(),
10780                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10781                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
10782                         BPF_EXIT_INSN(),
10783                 },
10784                 .errstr_unpriv = "allowed for root only",
10785                 .result_unpriv = REJECT,
10786                 .result = ACCEPT,
10787                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
10788         },
10789         {
10790                 "calls: callee changing pkt pointers",
10791                 .insns = {
10792                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
10793                                     offsetof(struct xdp_md, data)),
10794                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
10795                                     offsetof(struct xdp_md, data_end)),
10796                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
10797                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
10798                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
10799                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10800                         /* clear_all_pkt_pointers() has to walk all frames
10801                          * to make sure that pkt pointers in the caller
10802                          * are cleared when callee is calling a helper that
10803                          * adjusts packet size
10804                          */
10805                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10806                         BPF_MOV32_IMM(BPF_REG_0, 0),
10807                         BPF_EXIT_INSN(),
10808                         BPF_MOV64_IMM(BPF_REG_2, 0),
10809                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10810                                      BPF_FUNC_xdp_adjust_head),
10811                         BPF_EXIT_INSN(),
10812                 },
10813                 .result = REJECT,
10814                 .errstr = "R6 invalid mem access 'inv'",
10815                 .prog_type = BPF_PROG_TYPE_XDP,
10816         },
10817         {
10818                 "calls: two calls with args",
10819                 .insns = {
10820                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10821                         BPF_EXIT_INSN(),
10822                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10823                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10824                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10825                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10826                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10827                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10828                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10829                         BPF_EXIT_INSN(),
10830                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10831                                     offsetof(struct __sk_buff, len)),
10832                         BPF_EXIT_INSN(),
10833                 },
10834                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10835                 .result = ACCEPT,
10836                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
10837         },
10838         {
10839                 "calls: calls with stack arith",
10840                 .insns = {
10841                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10843                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10844                         BPF_EXIT_INSN(),
10845                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10846                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10847                         BPF_EXIT_INSN(),
10848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10849                         BPF_MOV64_IMM(BPF_REG_0, 42),
10850                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10851                         BPF_EXIT_INSN(),
10852                 },
10853                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10854                 .result = ACCEPT,
10855                 .retval = 42,
10856         },
10857         {
10858                 "calls: calls with misaligned stack access",
10859                 .insns = {
10860                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10861                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10862                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10863                         BPF_EXIT_INSN(),
10864                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
10865                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10866                         BPF_EXIT_INSN(),
10867                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10868                         BPF_MOV64_IMM(BPF_REG_0, 42),
10869                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10870                         BPF_EXIT_INSN(),
10871                 },
10872                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10873                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
10874                 .errstr = "misaligned stack access",
10875                 .result = REJECT,
10876         },
10877         {
10878                 "calls: calls control flow, jump test",
10879                 .insns = {
10880                         BPF_MOV64_IMM(BPF_REG_0, 42),
10881                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10882                         BPF_MOV64_IMM(BPF_REG_0, 43),
10883                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10884                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10885                         BPF_EXIT_INSN(),
10886                 },
10887                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10888                 .result = ACCEPT,
10889                 .retval = 43,
10890         },
10891         {
10892                 "calls: calls control flow, jump test 2",
10893                 .insns = {
10894                         BPF_MOV64_IMM(BPF_REG_0, 42),
10895                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10896                         BPF_MOV64_IMM(BPF_REG_0, 43),
10897                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10898                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10899                         BPF_EXIT_INSN(),
10900                 },
10901                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10902                 .errstr = "jump out of range from insn 1 to 4",
10903                 .result = REJECT,
10904         },
10905         {
10906                 "calls: two calls with bad jump",
10907                 .insns = {
10908                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10909                         BPF_EXIT_INSN(),
10910                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10911                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10912                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10913                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10914                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10915                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10916                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10917                         BPF_EXIT_INSN(),
10918                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10919                                     offsetof(struct __sk_buff, len)),
10920                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
10921                         BPF_EXIT_INSN(),
10922                 },
10923                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10924                 .errstr = "jump out of range from insn 11 to 9",
10925                 .result = REJECT,
10926         },
10927         {
10928                 "calls: recursive call. test1",
10929                 .insns = {
10930                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10931                         BPF_EXIT_INSN(),
10932                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10933                         BPF_EXIT_INSN(),
10934                 },
10935                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10936                 .errstr = "back-edge",
10937                 .result = REJECT,
10938         },
10939         {
10940                 "calls: recursive call. test2",
10941                 .insns = {
10942                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10943                         BPF_EXIT_INSN(),
10944                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10945                         BPF_EXIT_INSN(),
10946                 },
10947                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10948                 .errstr = "back-edge",
10949                 .result = REJECT,
10950         },
10951         {
10952                 "calls: unreachable code",
10953                 .insns = {
10954                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10955                         BPF_EXIT_INSN(),
10956                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10957                         BPF_EXIT_INSN(),
10958                         BPF_MOV64_IMM(BPF_REG_0, 0),
10959                         BPF_EXIT_INSN(),
10960                         BPF_MOV64_IMM(BPF_REG_0, 0),
10961                         BPF_EXIT_INSN(),
10962                 },
10963                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10964                 .errstr = "unreachable insn 6",
10965                 .result = REJECT,
10966         },
10967         {
10968                 "calls: invalid call",
10969                 .insns = {
10970                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10971                         BPF_EXIT_INSN(),
10972                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
10973                         BPF_EXIT_INSN(),
10974                 },
10975                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10976                 .errstr = "invalid destination",
10977                 .result = REJECT,
10978         },
10979         {
10980                 "calls: invalid call 2",
10981                 .insns = {
10982                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10983                         BPF_EXIT_INSN(),
10984                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
10985                         BPF_EXIT_INSN(),
10986                 },
10987                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10988                 .errstr = "invalid destination",
10989                 .result = REJECT,
10990         },
10991         {
10992                 "calls: jumping across function bodies. test1",
10993                 .insns = {
10994                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10995                         BPF_MOV64_IMM(BPF_REG_0, 0),
10996                         BPF_EXIT_INSN(),
10997                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
10998                         BPF_EXIT_INSN(),
10999                 },
11000                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11001                 .errstr = "jump out of range",
11002                 .result = REJECT,
11003         },
11004         {
11005                 "calls: jumping across function bodies. test2",
11006                 .insns = {
11007                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
11008                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11009                         BPF_MOV64_IMM(BPF_REG_0, 0),
11010                         BPF_EXIT_INSN(),
11011                         BPF_EXIT_INSN(),
11012                 },
11013                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11014                 .errstr = "jump out of range",
11015                 .result = REJECT,
11016         },
11017         {
11018                 "calls: call without exit",
11019                 .insns = {
11020                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11021                         BPF_EXIT_INSN(),
11022                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11023                         BPF_EXIT_INSN(),
11024                         BPF_MOV64_IMM(BPF_REG_0, 0),
11025                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
11026                 },
11027                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11028                 .errstr = "not an exit",
11029                 .result = REJECT,
11030         },
11031         {
11032                 "calls: call into middle of ld_imm64",
11033                 .insns = {
11034                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11035                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11036                         BPF_MOV64_IMM(BPF_REG_0, 0),
11037                         BPF_EXIT_INSN(),
11038                         BPF_LD_IMM64(BPF_REG_0, 0),
11039                         BPF_EXIT_INSN(),
11040                 },
11041                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11042                 .errstr = "last insn",
11043                 .result = REJECT,
11044         },
11045         {
11046                 "calls: call into middle of other call",
11047                 .insns = {
11048                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11049                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11050                         BPF_MOV64_IMM(BPF_REG_0, 0),
11051                         BPF_EXIT_INSN(),
11052                         BPF_MOV64_IMM(BPF_REG_0, 0),
11053                         BPF_MOV64_IMM(BPF_REG_0, 0),
11054                         BPF_EXIT_INSN(),
11055                 },
11056                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11057                 .errstr = "last insn",
11058                 .result = REJECT,
11059         },
11060         {
11061                 "calls: ld_abs with changing ctx data in callee",
11062                 .insns = {
11063                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11064                         BPF_LD_ABS(BPF_B, 0),
11065                         BPF_LD_ABS(BPF_H, 0),
11066                         BPF_LD_ABS(BPF_W, 0),
11067                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
11068                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
11069                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
11070                         BPF_LD_ABS(BPF_B, 0),
11071                         BPF_LD_ABS(BPF_H, 0),
11072                         BPF_LD_ABS(BPF_W, 0),
11073                         BPF_EXIT_INSN(),
11074                         BPF_MOV64_IMM(BPF_REG_2, 1),
11075                         BPF_MOV64_IMM(BPF_REG_3, 2),
11076                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11077                                      BPF_FUNC_skb_vlan_push),
11078                         BPF_EXIT_INSN(),
11079                 },
11080                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11081                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
11082                 .result = REJECT,
11083         },
11084         {
11085                 "calls: two calls with bad fallthrough",
11086                 .insns = {
11087                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11088                         BPF_EXIT_INSN(),
11089                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11090                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11091                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11092                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11093                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11094                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11095                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11096                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
11097                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
11098                                     offsetof(struct __sk_buff, len)),
11099                         BPF_EXIT_INSN(),
11100                 },
11101                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11102                 .errstr = "not an exit",
11103                 .result = REJECT,
11104         },
11105         {
11106                 "calls: two calls with stack read",
11107                 .insns = {
11108                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11109                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11110                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11111                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11112                         BPF_EXIT_INSN(),
11113                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11114                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
11115                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
11116                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11117                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11118                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
11119                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
11120                         BPF_EXIT_INSN(),
11121                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
11122                         BPF_EXIT_INSN(),
11123                 },
11124                 .prog_type = BPF_PROG_TYPE_XDP,
11125                 .result = ACCEPT,
11126         },
11127         {
11128                 "calls: two calls with stack write",
11129                 .insns = {
11130                         /* main prog */
11131                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11132                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11133                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11134                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11135                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11136                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11137                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11138                         BPF_EXIT_INSN(),
11139
11140                         /* subprog 1 */
11141                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11142                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11143                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
11144                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
11145                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11146                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11147                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
11148                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
11149                         /* write into stack frame of main prog */
11150                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11151                         BPF_EXIT_INSN(),
11152
11153                         /* subprog 2 */
11154                         /* read from stack frame of main prog */
11155                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
11156                         BPF_EXIT_INSN(),
11157                 },
11158                 .prog_type = BPF_PROG_TYPE_XDP,
11159                 .result = ACCEPT,
11160         },
11161         {
11162                 "calls: stack overflow using two frames (pre-call access)",
11163                 .insns = {
11164                         /* prog 1 */
11165                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11166                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
11167                         BPF_EXIT_INSN(),
11168
11169                         /* prog 2 */
11170                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11171                         BPF_MOV64_IMM(BPF_REG_0, 0),
11172                         BPF_EXIT_INSN(),
11173                 },
11174                 .prog_type = BPF_PROG_TYPE_XDP,
11175                 .errstr = "combined stack size",
11176                 .result = REJECT,
11177         },
11178         {
11179                 "calls: stack overflow using two frames (post-call access)",
11180                 .insns = {
11181                         /* prog 1 */
11182                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
11183                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11184                         BPF_EXIT_INSN(),
11185
11186                         /* prog 2 */
11187                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11188                         BPF_MOV64_IMM(BPF_REG_0, 0),
11189                         BPF_EXIT_INSN(),
11190                 },
11191                 .prog_type = BPF_PROG_TYPE_XDP,
11192                 .errstr = "combined stack size",
11193                 .result = REJECT,
11194         },
11195         {
11196                 "calls: stack depth check using three frames. test1",
11197                 .insns = {
11198                         /* main */
11199                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11200                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
11201                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
11202                         BPF_MOV64_IMM(BPF_REG_0, 0),
11203                         BPF_EXIT_INSN(),
11204                         /* A */
11205                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11206                         BPF_EXIT_INSN(),
11207                         /* B */
11208                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
11209                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11210                         BPF_EXIT_INSN(),
11211                 },
11212                 .prog_type = BPF_PROG_TYPE_XDP,
11213                 /* stack_main=32, stack_A=256, stack_B=64
11214                  * and max(main+A, main+A+B) < 512
11215                  */
11216                 .result = ACCEPT,
11217         },
11218         {
11219                 "calls: stack depth check using three frames. test2",
11220                 .insns = {
11221                         /* main */
11222                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11223                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
11224                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
11225                         BPF_MOV64_IMM(BPF_REG_0, 0),
11226                         BPF_EXIT_INSN(),
11227                         /* A */
11228                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11229                         BPF_EXIT_INSN(),
11230                         /* B */
11231                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
11232                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11233                         BPF_EXIT_INSN(),
11234                 },
11235                 .prog_type = BPF_PROG_TYPE_XDP,
11236                 /* stack_main=32, stack_A=64, stack_B=256
11237                  * and max(main+A, main+A+B) < 512
11238                  */
11239                 .result = ACCEPT,
11240         },
11241         {
11242                 "calls: stack depth check using three frames. test3",
11243                 .insns = {
11244                         /* main */
11245                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11246                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
11247                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11248                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
11249                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
11250                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
11251                         BPF_MOV64_IMM(BPF_REG_0, 0),
11252                         BPF_EXIT_INSN(),
11253                         /* A */
11254                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
11255                         BPF_EXIT_INSN(),
11256                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
11257                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
11258                         /* B */
11259                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
11260                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
11261                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
11262                         BPF_EXIT_INSN(),
11263                 },
11264                 .prog_type = BPF_PROG_TYPE_XDP,
11265                 /* stack_main=64, stack_A=224, stack_B=256
11266                  * and max(main+A, main+A+B) > 512
11267                  */
11268                 .errstr = "combined stack",
11269                 .result = REJECT,
11270         },
11271         {
11272                 "calls: stack depth check using three frames. test4",
11273                 /* void main(void) {
11274                  *   func1(0);
11275                  *   func1(1);
11276                  *   func2(1);
11277                  * }
11278                  * void func1(int alloc_or_recurse) {
11279                  *   if (alloc_or_recurse) {
11280                  *     frame_pointer[-300] = 1;
11281                  *   } else {
11282                  *     func2(alloc_or_recurse);
11283                  *   }
11284                  * }
11285                  * void func2(int alloc_or_recurse) {
11286                  *   if (alloc_or_recurse) {
11287                  *     frame_pointer[-300] = 1;
11288                  *   }
11289                  * }
11290                  */
11291                 .insns = {
11292                         /* main */
11293                         BPF_MOV64_IMM(BPF_REG_1, 0),
11294                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
11295                         BPF_MOV64_IMM(BPF_REG_1, 1),
11296                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
11297                         BPF_MOV64_IMM(BPF_REG_1, 1),
11298                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
11299                         BPF_MOV64_IMM(BPF_REG_0, 0),
11300                         BPF_EXIT_INSN(),
11301                         /* A */
11302                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
11303                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11304                         BPF_EXIT_INSN(),
11305                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
11306                         BPF_EXIT_INSN(),
11307                         /* B */
11308                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
11309                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
11310                         BPF_EXIT_INSN(),
11311                 },
11312                 .prog_type = BPF_PROG_TYPE_XDP,
11313                 .result = REJECT,
11314                 .errstr = "combined stack",
11315         },
11316         {
11317                 "calls: stack depth check using three frames. test5",
11318                 .insns = {
11319                         /* main */
11320                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
11321                         BPF_EXIT_INSN(),
11322                         /* A */
11323                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
11324                         BPF_EXIT_INSN(),
11325                         /* B */
11326                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
11327                         BPF_EXIT_INSN(),
11328                         /* C */
11329                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
11330                         BPF_EXIT_INSN(),
11331                         /* D */
11332                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
11333                         BPF_EXIT_INSN(),
11334                         /* E */
11335                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
11336                         BPF_EXIT_INSN(),
11337                         /* F */
11338                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
11339                         BPF_EXIT_INSN(),
11340                         /* G */
11341                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
11342                         BPF_EXIT_INSN(),
11343                         /* H */
11344                         BPF_MOV64_IMM(BPF_REG_0, 0),
11345                         BPF_EXIT_INSN(),
11346                 },
11347                 .prog_type = BPF_PROG_TYPE_XDP,
11348                 .errstr = "call stack",
11349                 .result = REJECT,
11350         },
11351         {
11352                 "calls: spill into caller stack frame",
11353                 .insns = {
11354                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11355                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11356                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11357                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11358                         BPF_EXIT_INSN(),
11359                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
11360                         BPF_MOV64_IMM(BPF_REG_0, 0),
11361                         BPF_EXIT_INSN(),
11362                 },
11363                 .prog_type = BPF_PROG_TYPE_XDP,
11364                 .errstr = "cannot spill",
11365                 .result = REJECT,
11366         },
11367         {
11368                 "calls: write into caller stack frame",
11369                 .insns = {
11370                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11371                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11372                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11373                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11374                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11375                         BPF_EXIT_INSN(),
11376                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
11377                         BPF_MOV64_IMM(BPF_REG_0, 0),
11378                         BPF_EXIT_INSN(),
11379                 },
11380                 .prog_type = BPF_PROG_TYPE_XDP,
11381                 .result = ACCEPT,
11382                 .retval = 42,
11383         },
11384         {
11385                 "calls: write into callee stack frame",
11386                 .insns = {
11387                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11388                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
11389                         BPF_EXIT_INSN(),
11390                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
11391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
11392                         BPF_EXIT_INSN(),
11393                 },
11394                 .prog_type = BPF_PROG_TYPE_XDP,
11395                 .errstr = "cannot return stack pointer",
11396                 .result = REJECT,
11397         },
11398         {
11399                 "calls: two calls with stack write and void return",
11400                 .insns = {
11401                         /* main prog */
11402                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11403                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11405                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11406                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11407                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11408                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11409                         BPF_EXIT_INSN(),
11410
11411                         /* subprog 1 */
11412                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11413                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11415                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11416                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11417                         BPF_EXIT_INSN(),
11418
11419                         /* subprog 2 */
11420                         /* write into stack frame of main prog */
11421                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
11422                         BPF_EXIT_INSN(), /* void return */
11423                 },
11424                 .prog_type = BPF_PROG_TYPE_XDP,
11425                 .result = ACCEPT,
11426         },
11427         {
11428                 "calls: ambiguous return value",
11429                 .insns = {
11430                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11431                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
11432                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11434                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11435                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11436                         BPF_EXIT_INSN(),
11437                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
11438                         BPF_MOV64_IMM(BPF_REG_0, 0),
11439                         BPF_EXIT_INSN(),
11440                 },
11441                 .errstr_unpriv = "allowed for root only",
11442                 .result_unpriv = REJECT,
11443                 .errstr = "R0 !read_ok",
11444                 .result = REJECT,
11445         },
11446         {
11447                 "calls: two calls that return map_value",
11448                 .insns = {
11449                         /* main prog */
11450                         /* pass fp-16, fp-8 into a function */
11451                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11452                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11453                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11454                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11455                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
11456
11457                         /* fetch map_value_ptr from the stack of this function */
11458                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11459                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11460                         /* write into map value */
11461                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11462                         /* fetch secound map_value_ptr from the stack */
11463                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
11464                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11465                         /* write into map value */
11466                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11467                         BPF_MOV64_IMM(BPF_REG_0, 0),
11468                         BPF_EXIT_INSN(),
11469
11470                         /* subprog 1 */
11471                         /* call 3rd function twice */
11472                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11473                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11474                         /* first time with fp-8 */
11475                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11476                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11477                         /* second time with fp-16 */
11478                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11479                         BPF_EXIT_INSN(),
11480
11481                         /* subprog 2 */
11482                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11483                         /* lookup from map */
11484                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11485                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11486                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11487                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11488                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11489                                      BPF_FUNC_map_lookup_elem),
11490                         /* write map_value_ptr into stack frame of main prog */
11491                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11492                         BPF_MOV64_IMM(BPF_REG_0, 0),
11493                         BPF_EXIT_INSN(), /* return 0 */
11494                 },
11495                 .prog_type = BPF_PROG_TYPE_XDP,
11496                 .fixup_map_hash_8b = { 23 },
11497                 .result = ACCEPT,
11498         },
11499         {
11500                 "calls: two calls that return map_value with bool condition",
11501                 .insns = {
11502                         /* main prog */
11503                         /* pass fp-16, fp-8 into a function */
11504                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11505                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11506                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11507                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11508                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11509                         BPF_MOV64_IMM(BPF_REG_0, 0),
11510                         BPF_EXIT_INSN(),
11511
11512                         /* subprog 1 */
11513                         /* call 3rd function twice */
11514                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11515                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11516                         /* first time with fp-8 */
11517                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11518                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11519                         /* fetch map_value_ptr from the stack of this function */
11520                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11521                         /* write into map value */
11522                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11523                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11524                         /* second time with fp-16 */
11525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11526                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11527                         /* fetch secound map_value_ptr from the stack */
11528                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11529                         /* write into map value */
11530                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11531                         BPF_EXIT_INSN(),
11532
11533                         /* subprog 2 */
11534                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11535                         /* lookup from map */
11536                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11537                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11538                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11539                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11540                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11541                                      BPF_FUNC_map_lookup_elem),
11542                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11543                         BPF_MOV64_IMM(BPF_REG_0, 0),
11544                         BPF_EXIT_INSN(), /* return 0 */
11545                         /* write map_value_ptr into stack frame of main prog */
11546                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11547                         BPF_MOV64_IMM(BPF_REG_0, 1),
11548                         BPF_EXIT_INSN(), /* return 1 */
11549                 },
11550                 .prog_type = BPF_PROG_TYPE_XDP,
11551                 .fixup_map_hash_8b = { 23 },
11552                 .result = ACCEPT,
11553         },
11554         {
11555                 "calls: two calls that return map_value with incorrect bool check",
11556                 .insns = {
11557                         /* main prog */
11558                         /* pass fp-16, fp-8 into a function */
11559                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11560                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11561                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11562                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11563                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11564                         BPF_MOV64_IMM(BPF_REG_0, 0),
11565                         BPF_EXIT_INSN(),
11566
11567                         /* subprog 1 */
11568                         /* call 3rd function twice */
11569                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11570                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11571                         /* first time with fp-8 */
11572                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11573                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11574                         /* fetch map_value_ptr from the stack of this function */
11575                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11576                         /* write into map value */
11577                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11578                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11579                         /* second time with fp-16 */
11580                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11581                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11582                         /* fetch secound map_value_ptr from the stack */
11583                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11584                         /* write into map value */
11585                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11586                         BPF_EXIT_INSN(),
11587
11588                         /* subprog 2 */
11589                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11590                         /* lookup from map */
11591                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11592                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11593                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11594                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11595                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11596                                      BPF_FUNC_map_lookup_elem),
11597                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11598                         BPF_MOV64_IMM(BPF_REG_0, 0),
11599                         BPF_EXIT_INSN(), /* return 0 */
11600                         /* write map_value_ptr into stack frame of main prog */
11601                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11602                         BPF_MOV64_IMM(BPF_REG_0, 1),
11603                         BPF_EXIT_INSN(), /* return 1 */
11604                 },
11605                 .prog_type = BPF_PROG_TYPE_XDP,
11606                 .fixup_map_hash_8b = { 23 },
11607                 .result = REJECT,
11608                 .errstr = "invalid read from stack off -16+0 size 8",
11609         },
11610         {
11611                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
11612                 .insns = {
11613                         /* main prog */
11614                         /* pass fp-16, fp-8 into a function */
11615                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11616                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11617                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11618                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11619                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11620                         BPF_MOV64_IMM(BPF_REG_0, 0),
11621                         BPF_EXIT_INSN(),
11622
11623                         /* subprog 1 */
11624                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11625                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11626                         /* 1st lookup from map */
11627                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11628                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11629                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11630                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11631                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11632                                      BPF_FUNC_map_lookup_elem),
11633                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11634                         BPF_MOV64_IMM(BPF_REG_8, 0),
11635                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11636                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11637                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11638                         BPF_MOV64_IMM(BPF_REG_8, 1),
11639
11640                         /* 2nd lookup from map */
11641                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11642                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11643                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11644                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11645                                      BPF_FUNC_map_lookup_elem),
11646                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11647                         BPF_MOV64_IMM(BPF_REG_9, 0),
11648                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11649                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11650                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11651                         BPF_MOV64_IMM(BPF_REG_9, 1),
11652
11653                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11654                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11655                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11656                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11657                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11658                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11659                         BPF_EXIT_INSN(),
11660
11661                         /* subprog 2 */
11662                         /* if arg2 == 1 do *arg1 = 0 */
11663                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11664                         /* fetch map_value_ptr from the stack of this function */
11665                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11666                         /* write into map value */
11667                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11668
11669                         /* if arg4 == 1 do *arg3 = 0 */
11670                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11671                         /* fetch map_value_ptr from the stack of this function */
11672                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11673                         /* write into map value */
11674                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11675                         BPF_EXIT_INSN(),
11676                 },
11677                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11678                 .fixup_map_hash_8b = { 12, 22 },
11679                 .result = REJECT,
11680                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11681         },
11682         {
11683                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
11684                 .insns = {
11685                         /* main prog */
11686                         /* pass fp-16, fp-8 into a function */
11687                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11689                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11690                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11691                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11692                         BPF_MOV64_IMM(BPF_REG_0, 0),
11693                         BPF_EXIT_INSN(),
11694
11695                         /* subprog 1 */
11696                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11697                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11698                         /* 1st lookup from map */
11699                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11700                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11701                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11702                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11703                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11704                                      BPF_FUNC_map_lookup_elem),
11705                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11706                         BPF_MOV64_IMM(BPF_REG_8, 0),
11707                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11708                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11709                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11710                         BPF_MOV64_IMM(BPF_REG_8, 1),
11711
11712                         /* 2nd lookup from map */
11713                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11714                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11715                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11716                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11717                                      BPF_FUNC_map_lookup_elem),
11718                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11719                         BPF_MOV64_IMM(BPF_REG_9, 0),
11720                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11721                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11722                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11723                         BPF_MOV64_IMM(BPF_REG_9, 1),
11724
11725                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11726                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11727                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11728                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11729                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11730                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11731                         BPF_EXIT_INSN(),
11732
11733                         /* subprog 2 */
11734                         /* if arg2 == 1 do *arg1 = 0 */
11735                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11736                         /* fetch map_value_ptr from the stack of this function */
11737                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11738                         /* write into map value */
11739                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11740
11741                         /* if arg4 == 1 do *arg3 = 0 */
11742                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11743                         /* fetch map_value_ptr from the stack of this function */
11744                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11745                         /* write into map value */
11746                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11747                         BPF_EXIT_INSN(),
11748                 },
11749                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11750                 .fixup_map_hash_8b = { 12, 22 },
11751                 .result = ACCEPT,
11752         },
11753         {
11754                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
11755                 .insns = {
11756                         /* main prog */
11757                         /* pass fp-16, fp-8 into a function */
11758                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11759                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11760                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11761                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11762                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11763                         BPF_MOV64_IMM(BPF_REG_0, 0),
11764                         BPF_EXIT_INSN(),
11765
11766                         /* subprog 1 */
11767                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11768                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11769                         /* 1st lookup from map */
11770                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
11771                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11772                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11773                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11774                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11775                                      BPF_FUNC_map_lookup_elem),
11776                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11777                         BPF_MOV64_IMM(BPF_REG_8, 0),
11778                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11779                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11780                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11781                         BPF_MOV64_IMM(BPF_REG_8, 1),
11782
11783                         /* 2nd lookup from map */
11784                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11785                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11786                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11787                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11788                                      BPF_FUNC_map_lookup_elem),
11789                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11790                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
11791                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11792                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11793                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11794                         BPF_MOV64_IMM(BPF_REG_9, 1),
11795
11796                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11797                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
11798                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11799                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11800                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11801                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
11802                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
11803
11804                         /* subprog 2 */
11805                         /* if arg2 == 1 do *arg1 = 0 */
11806                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11807                         /* fetch map_value_ptr from the stack of this function */
11808                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11809                         /* write into map value */
11810                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11811
11812                         /* if arg4 == 1 do *arg3 = 0 */
11813                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11814                         /* fetch map_value_ptr from the stack of this function */
11815                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11816                         /* write into map value */
11817                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11818                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
11819                 },
11820                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11821                 .fixup_map_hash_8b = { 12, 22 },
11822                 .result = REJECT,
11823                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11824         },
11825         {
11826                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
11827                 .insns = {
11828                         /* main prog */
11829                         /* pass fp-16, fp-8 into a function */
11830                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11832                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11833                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11834                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11835                         BPF_MOV64_IMM(BPF_REG_0, 0),
11836                         BPF_EXIT_INSN(),
11837
11838                         /* subprog 1 */
11839                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11840                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11841                         /* 1st lookup from map */
11842                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11843                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11844                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11845                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11846                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11847                                      BPF_FUNC_map_lookup_elem),
11848                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11849                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11850                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11851                         BPF_MOV64_IMM(BPF_REG_8, 0),
11852                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11853                         BPF_MOV64_IMM(BPF_REG_8, 1),
11854
11855                         /* 2nd lookup from map */
11856                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11857                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11858                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11859                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11860                                      BPF_FUNC_map_lookup_elem),
11861                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11862                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11863                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11864                         BPF_MOV64_IMM(BPF_REG_9, 0),
11865                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11866                         BPF_MOV64_IMM(BPF_REG_9, 1),
11867
11868                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11869                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11870                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11871                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11872                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11873                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11874                         BPF_EXIT_INSN(),
11875
11876                         /* subprog 2 */
11877                         /* if arg2 == 1 do *arg1 = 0 */
11878                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11879                         /* fetch map_value_ptr from the stack of this function */
11880                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11881                         /* write into map value */
11882                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11883
11884                         /* if arg4 == 1 do *arg3 = 0 */
11885                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11886                         /* fetch map_value_ptr from the stack of this function */
11887                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11888                         /* write into map value */
11889                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11890                         BPF_EXIT_INSN(),
11891                 },
11892                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11893                 .fixup_map_hash_8b = { 12, 22 },
11894                 .result = ACCEPT,
11895         },
11896         {
11897                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
11898                 .insns = {
11899                         /* main prog */
11900                         /* pass fp-16, fp-8 into a function */
11901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11903                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11904                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11905                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11906                         BPF_MOV64_IMM(BPF_REG_0, 0),
11907                         BPF_EXIT_INSN(),
11908
11909                         /* subprog 1 */
11910                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11911                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11912                         /* 1st lookup from map */
11913                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11914                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11915                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11916                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11917                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11918                                      BPF_FUNC_map_lookup_elem),
11919                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11920                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11921                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11922                         BPF_MOV64_IMM(BPF_REG_8, 0),
11923                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11924                         BPF_MOV64_IMM(BPF_REG_8, 1),
11925
11926                         /* 2nd lookup from map */
11927                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11928                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11929                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11930                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11931                                      BPF_FUNC_map_lookup_elem),
11932                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11933                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11934                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11935                         BPF_MOV64_IMM(BPF_REG_9, 0),
11936                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11937                         BPF_MOV64_IMM(BPF_REG_9, 1),
11938
11939                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11940                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11941                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11942                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11943                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11944                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11945                         BPF_EXIT_INSN(),
11946
11947                         /* subprog 2 */
11948                         /* if arg2 == 1 do *arg1 = 0 */
11949                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11950                         /* fetch map_value_ptr from the stack of this function */
11951                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11952                         /* write into map value */
11953                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11954
11955                         /* if arg4 == 0 do *arg3 = 0 */
11956                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
11957                         /* fetch map_value_ptr from the stack of this function */
11958                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11959                         /* write into map value */
11960                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11961                         BPF_EXIT_INSN(),
11962                 },
11963                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11964                 .fixup_map_hash_8b = { 12, 22 },
11965                 .result = REJECT,
11966                 .errstr = "R0 invalid mem access 'inv'",
11967         },
11968         {
11969                 "calls: pkt_ptr spill into caller stack",
11970                 .insns = {
11971                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11972                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11973                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11974                         BPF_EXIT_INSN(),
11975
11976                         /* subprog 1 */
11977                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11978                                     offsetof(struct __sk_buff, data)),
11979                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11980                                     offsetof(struct __sk_buff, data_end)),
11981                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11982                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11983                         /* spill unchecked pkt_ptr into stack of caller */
11984                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11985                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11986                         /* now the pkt range is verified, read pkt_ptr from stack */
11987                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11988                         /* write 4 bytes into packet */
11989                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11990                         BPF_EXIT_INSN(),
11991                 },
11992                 .result = ACCEPT,
11993                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11994                 .retval = POINTER_VALUE,
11995         },
11996         {
11997                 "calls: pkt_ptr spill into caller stack 2",
11998                 .insns = {
11999                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12000                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12001                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12002                         /* Marking is still kept, but not in all cases safe. */
12003                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12004                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12005                         BPF_EXIT_INSN(),
12006
12007                         /* subprog 1 */
12008                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12009                                     offsetof(struct __sk_buff, data)),
12010                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12011                                     offsetof(struct __sk_buff, data_end)),
12012                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12014                         /* spill unchecked pkt_ptr into stack of caller */
12015                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12016                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12017                         /* now the pkt range is verified, read pkt_ptr from stack */
12018                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
12019                         /* write 4 bytes into packet */
12020                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12021                         BPF_EXIT_INSN(),
12022                 },
12023                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12024                 .errstr = "invalid access to packet",
12025                 .result = REJECT,
12026         },
12027         {
12028                 "calls: pkt_ptr spill into caller stack 3",
12029                 .insns = {
12030                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12032                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12033                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12034                         /* Marking is still kept and safe here. */
12035                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12036                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12037                         BPF_EXIT_INSN(),
12038
12039                         /* subprog 1 */
12040                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12041                                     offsetof(struct __sk_buff, data)),
12042                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12043                                     offsetof(struct __sk_buff, data_end)),
12044                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12045                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12046                         /* spill unchecked pkt_ptr into stack of caller */
12047                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12048                         BPF_MOV64_IMM(BPF_REG_5, 0),
12049                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12050                         BPF_MOV64_IMM(BPF_REG_5, 1),
12051                         /* now the pkt range is verified, read pkt_ptr from stack */
12052                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
12053                         /* write 4 bytes into packet */
12054                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12055                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12056                         BPF_EXIT_INSN(),
12057                 },
12058                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12059                 .result = ACCEPT,
12060                 .retval = 1,
12061         },
12062         {
12063                 "calls: pkt_ptr spill into caller stack 4",
12064                 .insns = {
12065                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12066                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12067                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12068                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12069                         /* Check marking propagated. */
12070                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12071                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
12072                         BPF_EXIT_INSN(),
12073
12074                         /* subprog 1 */
12075                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12076                                     offsetof(struct __sk_buff, data)),
12077                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12078                                     offsetof(struct __sk_buff, data_end)),
12079                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12080                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12081                         /* spill unchecked pkt_ptr into stack of caller */
12082                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12083                         BPF_MOV64_IMM(BPF_REG_5, 0),
12084                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12085                         BPF_MOV64_IMM(BPF_REG_5, 1),
12086                         /* don't read back pkt_ptr from stack here */
12087                         /* write 4 bytes into packet */
12088                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12089                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12090                         BPF_EXIT_INSN(),
12091                 },
12092                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12093                 .result = ACCEPT,
12094                 .retval = 1,
12095         },
12096         {
12097                 "calls: pkt_ptr spill into caller stack 5",
12098                 .insns = {
12099                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12100                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12101                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
12102                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12103                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12104                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12105                         BPF_EXIT_INSN(),
12106
12107                         /* subprog 1 */
12108                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12109                                     offsetof(struct __sk_buff, data)),
12110                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12111                                     offsetof(struct __sk_buff, data_end)),
12112                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12113                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12114                         BPF_MOV64_IMM(BPF_REG_5, 0),
12115                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12116                         /* spill checked pkt_ptr into stack of caller */
12117                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12118                         BPF_MOV64_IMM(BPF_REG_5, 1),
12119                         /* don't read back pkt_ptr from stack here */
12120                         /* write 4 bytes into packet */
12121                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12122                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12123                         BPF_EXIT_INSN(),
12124                 },
12125                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12126                 .errstr = "same insn cannot be used with different",
12127                 .result = REJECT,
12128         },
12129         {
12130                 "calls: pkt_ptr spill into caller stack 6",
12131                 .insns = {
12132                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12133                                     offsetof(struct __sk_buff, data_end)),
12134                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12135                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12136                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12137                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12138                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12139                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12140                         BPF_EXIT_INSN(),
12141
12142                         /* subprog 1 */
12143                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12144                                     offsetof(struct __sk_buff, data)),
12145                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12146                                     offsetof(struct __sk_buff, data_end)),
12147                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12148                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12149                         BPF_MOV64_IMM(BPF_REG_5, 0),
12150                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12151                         /* spill checked pkt_ptr into stack of caller */
12152                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12153                         BPF_MOV64_IMM(BPF_REG_5, 1),
12154                         /* don't read back pkt_ptr from stack here */
12155                         /* write 4 bytes into packet */
12156                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12157                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12158                         BPF_EXIT_INSN(),
12159                 },
12160                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12161                 .errstr = "R4 invalid mem access",
12162                 .result = REJECT,
12163         },
12164         {
12165                 "calls: pkt_ptr spill into caller stack 7",
12166                 .insns = {
12167                         BPF_MOV64_IMM(BPF_REG_2, 0),
12168                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12169                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12170                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12171                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12172                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12173                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12174                         BPF_EXIT_INSN(),
12175
12176                         /* subprog 1 */
12177                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12178                                     offsetof(struct __sk_buff, data)),
12179                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12180                                     offsetof(struct __sk_buff, data_end)),
12181                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12182                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12183                         BPF_MOV64_IMM(BPF_REG_5, 0),
12184                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12185                         /* spill checked pkt_ptr into stack of caller */
12186                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12187                         BPF_MOV64_IMM(BPF_REG_5, 1),
12188                         /* don't read back pkt_ptr from stack here */
12189                         /* write 4 bytes into packet */
12190                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12191                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12192                         BPF_EXIT_INSN(),
12193                 },
12194                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12195                 .errstr = "R4 invalid mem access",
12196                 .result = REJECT,
12197         },
12198         {
12199                 "calls: pkt_ptr spill into caller stack 8",
12200                 .insns = {
12201                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12202                                     offsetof(struct __sk_buff, data)),
12203                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12204                                     offsetof(struct __sk_buff, data_end)),
12205                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12206                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12207                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
12208                         BPF_EXIT_INSN(),
12209                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12210                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12211                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12212                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12213                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12214                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12215                         BPF_EXIT_INSN(),
12216
12217                         /* subprog 1 */
12218                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12219                                     offsetof(struct __sk_buff, data)),
12220                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12221                                     offsetof(struct __sk_buff, data_end)),
12222                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12224                         BPF_MOV64_IMM(BPF_REG_5, 0),
12225                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
12226                         /* spill checked pkt_ptr into stack of caller */
12227                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12228                         BPF_MOV64_IMM(BPF_REG_5, 1),
12229                         /* don't read back pkt_ptr from stack here */
12230                         /* write 4 bytes into packet */
12231                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12232                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12233                         BPF_EXIT_INSN(),
12234                 },
12235                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12236                 .result = ACCEPT,
12237         },
12238         {
12239                 "calls: pkt_ptr spill into caller stack 9",
12240                 .insns = {
12241                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12242                                     offsetof(struct __sk_buff, data)),
12243                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12244                                     offsetof(struct __sk_buff, data_end)),
12245                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12247                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
12248                         BPF_EXIT_INSN(),
12249                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12251                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12252                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
12253                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
12254                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
12255                         BPF_EXIT_INSN(),
12256
12257                         /* subprog 1 */
12258                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12259                                     offsetof(struct __sk_buff, data)),
12260                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12261                                     offsetof(struct __sk_buff, data_end)),
12262                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
12263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
12264                         BPF_MOV64_IMM(BPF_REG_5, 0),
12265                         /* spill unchecked pkt_ptr into stack of caller */
12266                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
12267                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
12268                         BPF_MOV64_IMM(BPF_REG_5, 1),
12269                         /* don't read back pkt_ptr from stack here */
12270                         /* write 4 bytes into packet */
12271                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12272                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
12273                         BPF_EXIT_INSN(),
12274                 },
12275                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12276                 .errstr = "invalid access to packet",
12277                 .result = REJECT,
12278         },
12279         {
12280                 "calls: caller stack init to zero or map_value_or_null",
12281                 .insns = {
12282                         BPF_MOV64_IMM(BPF_REG_0, 0),
12283                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12284                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12285                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12286                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
12287                         /* fetch map_value_or_null or const_zero from stack */
12288                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12289                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
12290                         /* store into map_value */
12291                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
12292                         BPF_EXIT_INSN(),
12293
12294                         /* subprog 1 */
12295                         /* if (ctx == 0) return; */
12296                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
12297                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
12298                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
12299                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12301                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12302                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12303                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12304                                      BPF_FUNC_map_lookup_elem),
12305                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
12306                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
12307                         BPF_EXIT_INSN(),
12308                 },
12309                 .fixup_map_hash_8b = { 13 },
12310                 .result = ACCEPT,
12311                 .prog_type = BPF_PROG_TYPE_XDP,
12312         },
12313         {
12314                 "calls: stack init to zero and pruning",
12315                 .insns = {
12316                         /* first make allocated_stack 16 byte */
12317                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
12318                         /* now fork the execution such that the false branch
12319                          * of JGT insn will be verified second and it skisp zero
12320                          * init of fp-8 stack slot. If stack liveness marking
12321                          * is missing live_read marks from call map_lookup
12322                          * processing then pruning will incorrectly assume
12323                          * that fp-8 stack slot was unused in the fall-through
12324                          * branch and will accept the program incorrectly
12325                          */
12326                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
12327                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12328                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
12329                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12331                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12332                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12333                                      BPF_FUNC_map_lookup_elem),
12334                         BPF_EXIT_INSN(),
12335                 },
12336                 .fixup_map_hash_48b = { 6 },
12337                 .errstr = "invalid indirect read from stack off -8+0 size 8",
12338                 .result = REJECT,
12339                 .prog_type = BPF_PROG_TYPE_XDP,
12340         },
12341         {
12342                 "calls: two calls returning different map pointers for lookup (hash, array)",
12343                 .insns = {
12344                         /* main prog */
12345                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
12346                         BPF_CALL_REL(11),
12347                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12348                         BPF_CALL_REL(12),
12349                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12350                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12351                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12352                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12353                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12354                                      BPF_FUNC_map_lookup_elem),
12355                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12356                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
12357                                    offsetof(struct test_val, foo)),
12358                         BPF_MOV64_IMM(BPF_REG_0, 1),
12359                         BPF_EXIT_INSN(),
12360                         /* subprog 1 */
12361                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12362                         BPF_EXIT_INSN(),
12363                         /* subprog 2 */
12364                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12365                         BPF_EXIT_INSN(),
12366                 },
12367                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12368                 .fixup_map_hash_48b = { 13 },
12369                 .fixup_map_array_48b = { 16 },
12370                 .result = ACCEPT,
12371                 .retval = 1,
12372         },
12373         {
12374                 "calls: two calls returning different map pointers for lookup (hash, map in map)",
12375                 .insns = {
12376                         /* main prog */
12377                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
12378                         BPF_CALL_REL(11),
12379                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
12380                         BPF_CALL_REL(12),
12381                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12382                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12383                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12384                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12385                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12386                                      BPF_FUNC_map_lookup_elem),
12387                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
12388                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
12389                                    offsetof(struct test_val, foo)),
12390                         BPF_MOV64_IMM(BPF_REG_0, 1),
12391                         BPF_EXIT_INSN(),
12392                         /* subprog 1 */
12393                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12394                         BPF_EXIT_INSN(),
12395                         /* subprog 2 */
12396                         BPF_LD_MAP_FD(BPF_REG_0, 0),
12397                         BPF_EXIT_INSN(),
12398                 },
12399                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12400                 .fixup_map_in_map = { 16 },
12401                 .fixup_map_array_48b = { 13 },
12402                 .result = REJECT,
12403                 .errstr = "R0 invalid mem access 'map_ptr'",
12404         },
12405         {
12406                 "cond: two branches returning different map pointers for lookup (tail, tail)",
12407                 .insns = {
12408                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
12409                                     offsetof(struct __sk_buff, mark)),
12410                         BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
12411                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12412                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12413                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12414                         BPF_MOV64_IMM(BPF_REG_3, 7),
12415                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12416                                      BPF_FUNC_tail_call),
12417                         BPF_MOV64_IMM(BPF_REG_0, 1),
12418                         BPF_EXIT_INSN(),
12419                 },
12420                 .fixup_prog1 = { 5 },
12421                 .fixup_prog2 = { 2 },
12422                 .result_unpriv = REJECT,
12423                 .errstr_unpriv = "tail_call abusing map_ptr",
12424                 .result = ACCEPT,
12425                 .retval = 42,
12426         },
12427         {
12428                 "cond: two branches returning same map pointers for lookup (tail, tail)",
12429                 .insns = {
12430                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
12431                                     offsetof(struct __sk_buff, mark)),
12432                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
12433                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12434                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
12435                         BPF_LD_MAP_FD(BPF_REG_2, 0),
12436                         BPF_MOV64_IMM(BPF_REG_3, 7),
12437                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12438                                      BPF_FUNC_tail_call),
12439                         BPF_MOV64_IMM(BPF_REG_0, 1),
12440                         BPF_EXIT_INSN(),
12441                 },
12442                 .fixup_prog2 = { 2, 5 },
12443                 .result_unpriv = ACCEPT,
12444                 .result = ACCEPT,
12445                 .retval = 42,
12446         },
12447         {
12448                 "search pruning: all branches should be verified (nop operation)",
12449                 .insns = {
12450                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12451                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12452                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12453                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12454                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12455                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
12456                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12457                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12458                         BPF_MOV64_IMM(BPF_REG_4, 0),
12459                         BPF_JMP_A(1),
12460                         BPF_MOV64_IMM(BPF_REG_4, 1),
12461                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12462                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12463                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12464                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
12465                         BPF_MOV64_IMM(BPF_REG_6, 0),
12466                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
12467                         BPF_EXIT_INSN(),
12468                 },
12469                 .fixup_map_hash_8b = { 3 },
12470                 .errstr = "R6 invalid mem access 'inv'",
12471                 .result = REJECT,
12472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12473         },
12474         {
12475                 "search pruning: all branches should be verified (invalid stack access)",
12476                 .insns = {
12477                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12479                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
12480                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12481                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
12482                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
12483                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
12484                         BPF_MOV64_IMM(BPF_REG_4, 0),
12485                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
12486                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
12487                         BPF_JMP_A(1),
12488                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
12489                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
12490                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
12491                         BPF_EXIT_INSN(),
12492                 },
12493                 .fixup_map_hash_8b = { 3 },
12494                 .errstr = "invalid read from stack off -16+0 size 8",
12495                 .result = REJECT,
12496                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12497         },
12498         {
12499                 "jit: lsh, rsh, arsh by 1",
12500                 .insns = {
12501                         BPF_MOV64_IMM(BPF_REG_0, 1),
12502                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
12503                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
12504                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
12505                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
12506                         BPF_EXIT_INSN(),
12507                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
12508                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
12509                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
12510                         BPF_EXIT_INSN(),
12511                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
12512                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
12513                         BPF_EXIT_INSN(),
12514                         BPF_MOV64_IMM(BPF_REG_0, 2),
12515                         BPF_EXIT_INSN(),
12516                 },
12517                 .result = ACCEPT,
12518                 .retval = 2,
12519         },
12520         {
12521                 "jit: mov32 for ldimm64, 1",
12522                 .insns = {
12523                         BPF_MOV64_IMM(BPF_REG_0, 2),
12524                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
12525                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
12526                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
12527                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12528                         BPF_MOV64_IMM(BPF_REG_0, 1),
12529                         BPF_EXIT_INSN(),
12530                 },
12531                 .result = ACCEPT,
12532                 .retval = 2,
12533         },
12534         {
12535                 "jit: mov32 for ldimm64, 2",
12536                 .insns = {
12537                         BPF_MOV64_IMM(BPF_REG_0, 1),
12538                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
12539                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
12540                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12541                         BPF_MOV64_IMM(BPF_REG_0, 2),
12542                         BPF_EXIT_INSN(),
12543                 },
12544                 .result = ACCEPT,
12545                 .retval = 2,
12546         },
12547         {
12548                 "jit: various mul tests",
12549                 .insns = {
12550                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12551                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12552                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
12553                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12554                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12555                         BPF_MOV64_IMM(BPF_REG_0, 1),
12556                         BPF_EXIT_INSN(),
12557                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12558                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12559                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12560                         BPF_MOV64_IMM(BPF_REG_0, 1),
12561                         BPF_EXIT_INSN(),
12562                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
12563                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12564                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12565                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12566                         BPF_MOV64_IMM(BPF_REG_0, 1),
12567                         BPF_EXIT_INSN(),
12568                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12569                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12570                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12571                         BPF_MOV64_IMM(BPF_REG_0, 1),
12572                         BPF_EXIT_INSN(),
12573                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
12574                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
12575                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12576                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
12577                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
12578                         BPF_MOV64_IMM(BPF_REG_0, 1),
12579                         BPF_EXIT_INSN(),
12580                         BPF_MOV64_IMM(BPF_REG_0, 2),
12581                         BPF_EXIT_INSN(),
12582                 },
12583                 .result = ACCEPT,
12584                 .retval = 2,
12585         },
12586         {
12587                 "xadd/w check unaligned stack",
12588                 .insns = {
12589                         BPF_MOV64_IMM(BPF_REG_0, 1),
12590                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12591                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
12592                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12593                         BPF_EXIT_INSN(),
12594                 },
12595                 .result = REJECT,
12596                 .errstr = "misaligned stack access off",
12597                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12598         },
12599         {
12600                 "xadd/w check unaligned map",
12601                 .insns = {
12602                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12603                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12604                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12605                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12606                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12607                                      BPF_FUNC_map_lookup_elem),
12608                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
12609                         BPF_EXIT_INSN(),
12610                         BPF_MOV64_IMM(BPF_REG_1, 1),
12611                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
12612                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
12613                         BPF_EXIT_INSN(),
12614                 },
12615                 .fixup_map_hash_8b = { 3 },
12616                 .result = REJECT,
12617                 .errstr = "misaligned value access off",
12618                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12619         },
12620         {
12621                 "xadd/w check unaligned pkt",
12622                 .insns = {
12623                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12624                                     offsetof(struct xdp_md, data)),
12625                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12626                                     offsetof(struct xdp_md, data_end)),
12627                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
12628                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
12629                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
12630                         BPF_MOV64_IMM(BPF_REG_0, 99),
12631                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
12632                         BPF_MOV64_IMM(BPF_REG_0, 1),
12633                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12634                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
12635                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
12636                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
12637                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
12638                         BPF_EXIT_INSN(),
12639                 },
12640                 .result = REJECT,
12641                 .errstr = "BPF_XADD stores into R2 pkt is not allowed",
12642                 .prog_type = BPF_PROG_TYPE_XDP,
12643         },
12644         {
12645                 "xadd/w check whether src/dst got mangled, 1",
12646                 .insns = {
12647                         BPF_MOV64_IMM(BPF_REG_0, 1),
12648                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12649                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12650                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12651                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12652                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12653                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12654                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12655                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12656                         BPF_EXIT_INSN(),
12657                         BPF_MOV64_IMM(BPF_REG_0, 42),
12658                         BPF_EXIT_INSN(),
12659                 },
12660                 .result = ACCEPT,
12661                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12662                 .retval = 3,
12663         },
12664         {
12665                 "xadd/w check whether src/dst got mangled, 2",
12666                 .insns = {
12667                         BPF_MOV64_IMM(BPF_REG_0, 1),
12668                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12669                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12670                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12671                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12672                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12673                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12674                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12675                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
12676                         BPF_EXIT_INSN(),
12677                         BPF_MOV64_IMM(BPF_REG_0, 42),
12678                         BPF_EXIT_INSN(),
12679                 },
12680                 .result = ACCEPT,
12681                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12682                 .retval = 3,
12683         },
12684         {
12685                 "bpf_get_stack return R0 within range",
12686                 .insns = {
12687                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12688                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12689                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12690                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12691                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12692                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12693                                      BPF_FUNC_map_lookup_elem),
12694                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
12695                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
12696                         BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
12697                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12698                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12699                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
12700                         BPF_MOV64_IMM(BPF_REG_4, 256),
12701                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12702                         BPF_MOV64_IMM(BPF_REG_1, 0),
12703                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
12704                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
12705                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
12706                         BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
12707                         BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
12708                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12709                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
12710                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
12711                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
12712                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
12713                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12714                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
12715                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12716                         BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
12717                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
12718                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
12719                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12720                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
12721                         BPF_MOV64_IMM(BPF_REG_4, 0),
12722                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12723                         BPF_EXIT_INSN(),
12724                 },
12725                 .fixup_map_hash_48b = { 4 },
12726                 .result = ACCEPT,
12727                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12728         },
12729         {
12730                 "ld_abs: invalid op 1",
12731                 .insns = {
12732                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12733                         BPF_LD_ABS(BPF_DW, 0),
12734                         BPF_EXIT_INSN(),
12735                 },
12736                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12737                 .result = REJECT,
12738                 .errstr = "unknown opcode",
12739         },
12740         {
12741                 "ld_abs: invalid op 2",
12742                 .insns = {
12743                         BPF_MOV32_IMM(BPF_REG_0, 256),
12744                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12745                         BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
12746                         BPF_EXIT_INSN(),
12747                 },
12748                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12749                 .result = REJECT,
12750                 .errstr = "unknown opcode",
12751         },
12752         {
12753                 "ld_abs: nmap reduced",
12754                 .insns = {
12755                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12756                         BPF_LD_ABS(BPF_H, 12),
12757                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
12758                         BPF_LD_ABS(BPF_H, 12),
12759                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
12760                         BPF_MOV32_IMM(BPF_REG_0, 18),
12761                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
12762                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
12763                         BPF_LD_IND(BPF_W, BPF_REG_7, 14),
12764                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
12765                         BPF_MOV32_IMM(BPF_REG_0, 280971478),
12766                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12767                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12768                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
12769                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12770                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
12771                         BPF_LD_ABS(BPF_H, 12),
12772                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
12773                         BPF_MOV32_IMM(BPF_REG_0, 22),
12774                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12775                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12776                         BPF_LD_IND(BPF_H, BPF_REG_7, 14),
12777                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
12778                         BPF_MOV32_IMM(BPF_REG_0, 17366),
12779                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
12780                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
12781                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
12782                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12783                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12784                         BPF_MOV32_IMM(BPF_REG_0, 256),
12785                         BPF_EXIT_INSN(),
12786                         BPF_MOV32_IMM(BPF_REG_0, 0),
12787                         BPF_EXIT_INSN(),
12788                 },
12789                 .data = {
12790                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
12791                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
12792                         0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
12793                 },
12794                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12795                 .result = ACCEPT,
12796                 .retval = 256,
12797         },
12798         {
12799                 "ld_abs: div + abs, test 1",
12800                 .insns = {
12801                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12802                         BPF_LD_ABS(BPF_B, 3),
12803                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12804                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12805                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12806                         BPF_LD_ABS(BPF_B, 4),
12807                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12808                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12809                         BPF_EXIT_INSN(),
12810                 },
12811                 .data = {
12812                         10, 20, 30, 40, 50,
12813                 },
12814                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12815                 .result = ACCEPT,
12816                 .retval = 10,
12817         },
12818         {
12819                 "ld_abs: div + abs, test 2",
12820                 .insns = {
12821                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12822                         BPF_LD_ABS(BPF_B, 3),
12823                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12824                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12825                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12826                         BPF_LD_ABS(BPF_B, 128),
12827                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12828                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12829                         BPF_EXIT_INSN(),
12830                 },
12831                 .data = {
12832                         10, 20, 30, 40, 50,
12833                 },
12834                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12835                 .result = ACCEPT,
12836                 .retval = 0,
12837         },
12838         {
12839                 "ld_abs: div + abs, test 3",
12840                 .insns = {
12841                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12842                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12843                         BPF_LD_ABS(BPF_B, 3),
12844                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12845                         BPF_EXIT_INSN(),
12846                 },
12847                 .data = {
12848                         10, 20, 30, 40, 50,
12849                 },
12850                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12851                 .result = ACCEPT,
12852                 .retval = 0,
12853         },
12854         {
12855                 "ld_abs: div + abs, test 4",
12856                 .insns = {
12857                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12858                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12859                         BPF_LD_ABS(BPF_B, 256),
12860                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12861                         BPF_EXIT_INSN(),
12862                 },
12863                 .data = {
12864                         10, 20, 30, 40, 50,
12865                 },
12866                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12867                 .result = ACCEPT,
12868                 .retval = 0,
12869         },
12870         {
12871                 "ld_abs: vlan + abs, test 1",
12872                 .insns = { },
12873                 .data = {
12874                         0x34,
12875                 },
12876                 .fill_helper = bpf_fill_ld_abs_vlan_push_pop,
12877                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12878                 .result = ACCEPT,
12879                 .retval = 0xbef,
12880         },
12881         {
12882                 "ld_abs: vlan + abs, test 2",
12883                 .insns = {
12884                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12885                         BPF_LD_ABS(BPF_B, 0),
12886                         BPF_LD_ABS(BPF_H, 0),
12887                         BPF_LD_ABS(BPF_W, 0),
12888                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
12889                         BPF_MOV64_IMM(BPF_REG_6, 0),
12890                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12891                         BPF_MOV64_IMM(BPF_REG_2, 1),
12892                         BPF_MOV64_IMM(BPF_REG_3, 2),
12893                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12894                                      BPF_FUNC_skb_vlan_push),
12895                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
12896                         BPF_LD_ABS(BPF_B, 0),
12897                         BPF_LD_ABS(BPF_H, 0),
12898                         BPF_LD_ABS(BPF_W, 0),
12899                         BPF_MOV64_IMM(BPF_REG_0, 42),
12900                         BPF_EXIT_INSN(),
12901                 },
12902                 .data = {
12903                         0x34,
12904                 },
12905                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12906                 .result = ACCEPT,
12907                 .retval = 42,
12908         },
12909         {
12910                 "ld_abs: jump around ld_abs",
12911                 .insns = { },
12912                 .data = {
12913                         10, 11,
12914                 },
12915                 .fill_helper = bpf_fill_jump_around_ld_abs,
12916                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12917                 .result = ACCEPT,
12918                 .retval = 10,
12919         },
12920         {
12921                 "ld_dw: xor semi-random 64 bit imms, test 1",
12922                 .insns = { },
12923                 .data = { },
12924                 .fill_helper = bpf_fill_rand_ld_dw,
12925                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12926                 .result = ACCEPT,
12927                 .retval = 4090,
12928         },
12929         {
12930                 "ld_dw: xor semi-random 64 bit imms, test 2",
12931                 .insns = { },
12932                 .data = { },
12933                 .fill_helper = bpf_fill_rand_ld_dw,
12934                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12935                 .result = ACCEPT,
12936                 .retval = 2047,
12937         },
12938         {
12939                 "ld_dw: xor semi-random 64 bit imms, test 3",
12940                 .insns = { },
12941                 .data = { },
12942                 .fill_helper = bpf_fill_rand_ld_dw,
12943                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12944                 .result = ACCEPT,
12945                 .retval = 511,
12946         },
12947         {
12948                 "ld_dw: xor semi-random 64 bit imms, test 4",
12949                 .insns = { },
12950                 .data = { },
12951                 .fill_helper = bpf_fill_rand_ld_dw,
12952                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12953                 .result = ACCEPT,
12954                 .retval = 5,
12955         },
12956         {
12957                 "pass unmodified ctx pointer to helper",
12958                 .insns = {
12959                         BPF_MOV64_IMM(BPF_REG_2, 0),
12960                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12961                                      BPF_FUNC_csum_update),
12962                         BPF_MOV64_IMM(BPF_REG_0, 0),
12963                         BPF_EXIT_INSN(),
12964                 },
12965                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12966                 .result = ACCEPT,
12967         },
12968         {
12969                 "reference tracking: leak potential reference",
12970                 .insns = {
12971                         BPF_SK_LOOKUP,
12972                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), /* leak reference */
12973                         BPF_EXIT_INSN(),
12974                 },
12975                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12976                 .errstr = "Unreleased reference",
12977                 .result = REJECT,
12978         },
12979         {
12980                 "reference tracking: leak potential reference on stack",
12981                 .insns = {
12982                         BPF_SK_LOOKUP,
12983                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12985                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
12986                         BPF_MOV64_IMM(BPF_REG_0, 0),
12987                         BPF_EXIT_INSN(),
12988                 },
12989                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12990                 .errstr = "Unreleased reference",
12991                 .result = REJECT,
12992         },
12993         {
12994                 "reference tracking: leak potential reference on stack 2",
12995                 .insns = {
12996                         BPF_SK_LOOKUP,
12997                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
12998                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
12999                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13000                         BPF_MOV64_IMM(BPF_REG_0, 0),
13001                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
13002                         BPF_EXIT_INSN(),
13003                 },
13004                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13005                 .errstr = "Unreleased reference",
13006                 .result = REJECT,
13007         },
13008         {
13009                 "reference tracking: zero potential reference",
13010                 .insns = {
13011                         BPF_SK_LOOKUP,
13012                         BPF_MOV64_IMM(BPF_REG_0, 0), /* leak reference */
13013                         BPF_EXIT_INSN(),
13014                 },
13015                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13016                 .errstr = "Unreleased reference",
13017                 .result = REJECT,
13018         },
13019         {
13020                 "reference tracking: copy and zero potential references",
13021                 .insns = {
13022                         BPF_SK_LOOKUP,
13023                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
13024                         BPF_MOV64_IMM(BPF_REG_0, 0),
13025                         BPF_MOV64_IMM(BPF_REG_7, 0), /* leak reference */
13026                         BPF_EXIT_INSN(),
13027                 },
13028                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13029                 .errstr = "Unreleased reference",
13030                 .result = REJECT,
13031         },
13032         {
13033                 "reference tracking: release reference without check",
13034                 .insns = {
13035                         BPF_SK_LOOKUP,
13036                         /* reference in r0 may be NULL */
13037                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13038                         BPF_MOV64_IMM(BPF_REG_2, 0),
13039                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13040                         BPF_EXIT_INSN(),
13041                 },
13042                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13043                 .errstr = "type=sock_or_null expected=sock",
13044                 .result = REJECT,
13045         },
13046         {
13047                 "reference tracking: release reference",
13048                 .insns = {
13049                         BPF_SK_LOOKUP,
13050                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13051                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13052                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13053                         BPF_EXIT_INSN(),
13054                 },
13055                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13056                 .result = ACCEPT,
13057         },
13058         {
13059                 "reference tracking: release reference 2",
13060                 .insns = {
13061                         BPF_SK_LOOKUP,
13062                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13063                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
13064                         BPF_EXIT_INSN(),
13065                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13066                         BPF_EXIT_INSN(),
13067                 },
13068                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13069                 .result = ACCEPT,
13070         },
13071         {
13072                 "reference tracking: release reference twice",
13073                 .insns = {
13074                         BPF_SK_LOOKUP,
13075                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13076                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13077                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13078                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13079                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13080                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13081                         BPF_EXIT_INSN(),
13082                 },
13083                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13084                 .errstr = "type=inv expected=sock",
13085                 .result = REJECT,
13086         },
13087         {
13088                 "reference tracking: release reference twice inside branch",
13089                 .insns = {
13090                         BPF_SK_LOOKUP,
13091                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13092                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13093                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), /* goto end */
13094                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13095                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13096                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13097                         BPF_EXIT_INSN(),
13098                 },
13099                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13100                 .errstr = "type=inv expected=sock",
13101                 .result = REJECT,
13102         },
13103         {
13104                 "reference tracking: alloc, check, free in one subbranch",
13105                 .insns = {
13106                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13107                                     offsetof(struct __sk_buff, data)),
13108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13109                                     offsetof(struct __sk_buff, data_end)),
13110                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
13112                         /* if (offsetof(skb, mark) > data_len) exit; */
13113                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
13114                         BPF_EXIT_INSN(),
13115                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
13116                                     offsetof(struct __sk_buff, mark)),
13117                         BPF_SK_LOOKUP,
13118                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 1), /* mark == 0? */
13119                         /* Leak reference in R0 */
13120                         BPF_EXIT_INSN(),
13121                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13122                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13123                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13124                         BPF_EXIT_INSN(),
13125                 },
13126                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13127                 .errstr = "Unreleased reference",
13128                 .result = REJECT,
13129         },
13130         {
13131                 "reference tracking: alloc, check, free in both subbranches",
13132                 .insns = {
13133                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13134                                     offsetof(struct __sk_buff, data)),
13135                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13136                                     offsetof(struct __sk_buff, data_end)),
13137                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
13139                         /* if (offsetof(skb, mark) > data_len) exit; */
13140                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
13141                         BPF_EXIT_INSN(),
13142                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
13143                                     offsetof(struct __sk_buff, mark)),
13144                         BPF_SK_LOOKUP,
13145                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 4), /* mark == 0? */
13146                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13147                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13148                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13149                         BPF_EXIT_INSN(),
13150                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
13151                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13152                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13153                         BPF_EXIT_INSN(),
13154                 },
13155                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13156                 .result = ACCEPT,
13157         },
13158         {
13159                 "reference tracking in call: free reference in subprog",
13160                 .insns = {
13161                         BPF_SK_LOOKUP,
13162                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
13163                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13164                         BPF_MOV64_IMM(BPF_REG_0, 0),
13165                         BPF_EXIT_INSN(),
13166
13167                         /* subprog 1 */
13168                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
13169                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
13170                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13171                         BPF_EXIT_INSN(),
13172                 },
13173                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13174                 .result = ACCEPT,
13175         },
13176         {
13177                 "pass modified ctx pointer to helper, 1",
13178                 .insns = {
13179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
13180                         BPF_MOV64_IMM(BPF_REG_2, 0),
13181                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13182                                      BPF_FUNC_csum_update),
13183                         BPF_MOV64_IMM(BPF_REG_0, 0),
13184                         BPF_EXIT_INSN(),
13185                 },
13186                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13187                 .result = REJECT,
13188                 .errstr = "dereference of modified ctx ptr",
13189         },
13190         {
13191                 "pass modified ctx pointer to helper, 2",
13192                 .insns = {
13193                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
13194                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13195                                      BPF_FUNC_get_socket_cookie),
13196                         BPF_MOV64_IMM(BPF_REG_0, 0),
13197                         BPF_EXIT_INSN(),
13198                 },
13199                 .result_unpriv = REJECT,
13200                 .result = REJECT,
13201                 .errstr_unpriv = "dereference of modified ctx ptr",
13202                 .errstr = "dereference of modified ctx ptr",
13203         },
13204         {
13205                 "pass modified ctx pointer to helper, 3",
13206                 .insns = {
13207                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
13208                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
13209                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
13210                         BPF_MOV64_IMM(BPF_REG_2, 0),
13211                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13212                                      BPF_FUNC_csum_update),
13213                         BPF_MOV64_IMM(BPF_REG_0, 0),
13214                         BPF_EXIT_INSN(),
13215                 },
13216                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13217                 .result = REJECT,
13218                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
13219         },
13220         {
13221                 "mov64 src == dst",
13222                 .insns = {
13223                         BPF_MOV64_IMM(BPF_REG_2, 0),
13224                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
13225                         // Check bounds are OK
13226                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
13227                         BPF_MOV64_IMM(BPF_REG_0, 0),
13228                         BPF_EXIT_INSN(),
13229                 },
13230                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13231                 .result = ACCEPT,
13232         },
13233         {
13234                 "mov64 src != dst",
13235                 .insns = {
13236                         BPF_MOV64_IMM(BPF_REG_3, 0),
13237                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
13238                         // Check bounds are OK
13239                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
13240                         BPF_MOV64_IMM(BPF_REG_0, 0),
13241                         BPF_EXIT_INSN(),
13242                 },
13243                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13244                 .result = ACCEPT,
13245         },
13246         {
13247                 "reference tracking in call: free reference in subprog and outside",
13248                 .insns = {
13249                         BPF_SK_LOOKUP,
13250                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
13251                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13252                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
13253                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13254                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13255                         BPF_EXIT_INSN(),
13256
13257                         /* subprog 1 */
13258                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
13259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
13260                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13261                         BPF_EXIT_INSN(),
13262                 },
13263                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13264                 .errstr = "type=inv expected=sock",
13265                 .result = REJECT,
13266         },
13267         {
13268                 "reference tracking in call: alloc & leak reference in subprog",
13269                 .insns = {
13270                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13271                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13272                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
13273                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13274                         BPF_MOV64_IMM(BPF_REG_0, 0),
13275                         BPF_EXIT_INSN(),
13276
13277                         /* subprog 1 */
13278                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_4),
13279                         BPF_SK_LOOKUP,
13280                         /* spill unchecked sk_ptr into stack of caller */
13281                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
13282                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13283                         BPF_EXIT_INSN(),
13284                 },
13285                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13286                 .errstr = "Unreleased reference",
13287                 .result = REJECT,
13288         },
13289         {
13290                 "reference tracking in call: alloc in subprog, release outside",
13291                 .insns = {
13292                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13293                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
13294                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13295                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13296                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13297                         BPF_EXIT_INSN(),
13298
13299                         /* subprog 1 */
13300                         BPF_SK_LOOKUP,
13301                         BPF_EXIT_INSN(), /* return sk */
13302                 },
13303                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13304                 .retval = POINTER_VALUE,
13305                 .result = ACCEPT,
13306         },
13307         {
13308                 "reference tracking in call: sk_ptr leak into caller stack",
13309                 .insns = {
13310                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13311                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13312                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13313                         BPF_MOV64_IMM(BPF_REG_0, 0),
13314                         BPF_EXIT_INSN(),
13315
13316                         /* subprog 1 */
13317                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13318                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13319                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
13320                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
13321                         /* spill unchecked sk_ptr into stack of caller */
13322                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13324                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
13325                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13326                         BPF_EXIT_INSN(),
13327
13328                         /* subprog 2 */
13329                         BPF_SK_LOOKUP,
13330                         BPF_EXIT_INSN(),
13331                 },
13332                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13333                 .errstr = "Unreleased reference",
13334                 .result = REJECT,
13335         },
13336         {
13337                 "reference tracking in call: sk_ptr spill into caller stack",
13338                 .insns = {
13339                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
13340                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
13341                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
13342                         BPF_MOV64_IMM(BPF_REG_0, 0),
13343                         BPF_EXIT_INSN(),
13344
13345                         /* subprog 1 */
13346                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13348                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
13349                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
13350                         /* spill unchecked sk_ptr into stack of caller */
13351                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
13352                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
13353                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
13354                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
13355                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13356                         /* now the sk_ptr is verified, free the reference */
13357                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_4, 0),
13358                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13359                         BPF_EXIT_INSN(),
13360
13361                         /* subprog 2 */
13362                         BPF_SK_LOOKUP,
13363                         BPF_EXIT_INSN(),
13364                 },
13365                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13366                 .result = ACCEPT,
13367         },
13368         {
13369                 "reference tracking: allow LD_ABS",
13370                 .insns = {
13371                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13372                         BPF_SK_LOOKUP,
13373                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13374                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13375                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13376                         BPF_LD_ABS(BPF_B, 0),
13377                         BPF_LD_ABS(BPF_H, 0),
13378                         BPF_LD_ABS(BPF_W, 0),
13379                         BPF_EXIT_INSN(),
13380                 },
13381                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13382                 .result = ACCEPT,
13383         },
13384         {
13385                 "reference tracking: forbid LD_ABS while holding reference",
13386                 .insns = {
13387                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13388                         BPF_SK_LOOKUP,
13389                         BPF_LD_ABS(BPF_B, 0),
13390                         BPF_LD_ABS(BPF_H, 0),
13391                         BPF_LD_ABS(BPF_W, 0),
13392                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13393                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13394                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13395                         BPF_EXIT_INSN(),
13396                 },
13397                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13398                 .errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
13399                 .result = REJECT,
13400         },
13401         {
13402                 "reference tracking: allow LD_IND",
13403                 .insns = {
13404                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13405                         BPF_SK_LOOKUP,
13406                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13407                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13408                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13409                         BPF_MOV64_IMM(BPF_REG_7, 1),
13410                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
13411                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
13412                         BPF_EXIT_INSN(),
13413                 },
13414                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13415                 .result = ACCEPT,
13416                 .retval = 1,
13417         },
13418         {
13419                 "reference tracking: forbid LD_IND while holding reference",
13420                 .insns = {
13421                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
13422                         BPF_SK_LOOKUP,
13423                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
13424                         BPF_MOV64_IMM(BPF_REG_7, 1),
13425                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
13426                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
13427                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_4),
13428                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13429                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13430                         BPF_EXIT_INSN(),
13431                 },
13432                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13433                 .errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
13434                 .result = REJECT,
13435         },
13436         {
13437                 "reference tracking: check reference or tail call",
13438                 .insns = {
13439                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13440                         BPF_SK_LOOKUP,
13441                         /* if (sk) bpf_sk_release() */
13442                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13443                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 7),
13444                         /* bpf_tail_call() */
13445                         BPF_MOV64_IMM(BPF_REG_3, 2),
13446                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13448                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13449                                      BPF_FUNC_tail_call),
13450                         BPF_MOV64_IMM(BPF_REG_0, 0),
13451                         BPF_EXIT_INSN(),
13452                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13453                         BPF_EXIT_INSN(),
13454                 },
13455                 .fixup_prog1 = { 17 },
13456                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13457                 .result = ACCEPT,
13458         },
13459         {
13460                 "reference tracking: release reference then tail call",
13461                 .insns = {
13462                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13463                         BPF_SK_LOOKUP,
13464                         /* if (sk) bpf_sk_release() */
13465                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13466                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13467                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13468                         /* bpf_tail_call() */
13469                         BPF_MOV64_IMM(BPF_REG_3, 2),
13470                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13471                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13472                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13473                                      BPF_FUNC_tail_call),
13474                         BPF_MOV64_IMM(BPF_REG_0, 0),
13475                         BPF_EXIT_INSN(),
13476                 },
13477                 .fixup_prog1 = { 18 },
13478                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13479                 .result = ACCEPT,
13480         },
13481         {
13482                 "reference tracking: leak possible reference over tail call",
13483                 .insns = {
13484                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13485                         /* Look up socket and store in REG_6 */
13486                         BPF_SK_LOOKUP,
13487                         /* bpf_tail_call() */
13488                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13489                         BPF_MOV64_IMM(BPF_REG_3, 2),
13490                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13491                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13492                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13493                                      BPF_FUNC_tail_call),
13494                         BPF_MOV64_IMM(BPF_REG_0, 0),
13495                         /* if (sk) bpf_sk_release() */
13496                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13497                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
13498                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13499                         BPF_EXIT_INSN(),
13500                 },
13501                 .fixup_prog1 = { 16 },
13502                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13503                 .errstr = "tail_call would lead to reference leak",
13504                 .result = REJECT,
13505         },
13506         {
13507                 "reference tracking: leak checked reference over tail call",
13508                 .insns = {
13509                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
13510                         /* Look up socket and store in REG_6 */
13511                         BPF_SK_LOOKUP,
13512                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13513                         /* if (!sk) goto end */
13514                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
13515                         /* bpf_tail_call() */
13516                         BPF_MOV64_IMM(BPF_REG_3, 0),
13517                         BPF_LD_MAP_FD(BPF_REG_2, 0),
13518                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
13519                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13520                                      BPF_FUNC_tail_call),
13521                         BPF_MOV64_IMM(BPF_REG_0, 0),
13522                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13523                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13524                         BPF_EXIT_INSN(),
13525                 },
13526                 .fixup_prog1 = { 17 },
13527                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13528                 .errstr = "tail_call would lead to reference leak",
13529                 .result = REJECT,
13530         },
13531         {
13532                 "reference tracking: mangle and release sock_or_null",
13533                 .insns = {
13534                         BPF_SK_LOOKUP,
13535                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13536                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
13537                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
13538                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13539                         BPF_EXIT_INSN(),
13540                 },
13541                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13542                 .errstr = "R1 pointer arithmetic on sock_or_null prohibited",
13543                 .result = REJECT,
13544         },
13545         {
13546                 "reference tracking: mangle and release sock",
13547                 .insns = {
13548                         BPF_SK_LOOKUP,
13549                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13550                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13551                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
13552                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13553                         BPF_EXIT_INSN(),
13554                 },
13555                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13556                 .errstr = "R1 pointer arithmetic on sock prohibited",
13557                 .result = REJECT,
13558         },
13559         {
13560                 "reference tracking: access member",
13561                 .insns = {
13562                         BPF_SK_LOOKUP,
13563                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13564                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13565                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
13566                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13567                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13568                         BPF_EXIT_INSN(),
13569                 },
13570                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13571                 .result = ACCEPT,
13572         },
13573         {
13574                 "reference tracking: write to member",
13575                 .insns = {
13576                         BPF_SK_LOOKUP,
13577                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13578                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
13579                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13580                         BPF_LD_IMM64(BPF_REG_2, 42),
13581                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
13582                                     offsetof(struct bpf_sock, mark)),
13583                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13584                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13585                         BPF_LD_IMM64(BPF_REG_0, 0),
13586                         BPF_EXIT_INSN(),
13587                 },
13588                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13589                 .errstr = "cannot write into socket",
13590                 .result = REJECT,
13591         },
13592         {
13593                 "reference tracking: invalid 64-bit access of member",
13594                 .insns = {
13595                         BPF_SK_LOOKUP,
13596                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13597                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13598                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
13599                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13600                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13601                         BPF_EXIT_INSN(),
13602                 },
13603                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13604                 .errstr = "invalid bpf_sock access off=0 size=8",
13605                 .result = REJECT,
13606         },
13607         {
13608                 "reference tracking: access after release",
13609                 .insns = {
13610                         BPF_SK_LOOKUP,
13611                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
13612                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
13613                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13614                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
13615                         BPF_EXIT_INSN(),
13616                 },
13617                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13618                 .errstr = "!read_ok",
13619                 .result = REJECT,
13620         },
13621         {
13622                 "reference tracking: direct access for lookup",
13623                 .insns = {
13624                         /* Check that the packet is at least 64B long */
13625                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
13626                                     offsetof(struct __sk_buff, data)),
13627                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
13628                                     offsetof(struct __sk_buff, data_end)),
13629                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
13630                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
13631                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
13632                         /* sk = sk_lookup_tcp(ctx, skb->data, ...) */
13633                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct bpf_sock_tuple)),
13634                         BPF_MOV64_IMM(BPF_REG_4, 0),
13635                         BPF_MOV64_IMM(BPF_REG_5, 0),
13636                         BPF_EMIT_CALL(BPF_FUNC_sk_lookup_tcp),
13637                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
13638                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
13639                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
13640                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
13641                         BPF_EMIT_CALL(BPF_FUNC_sk_release),
13642                         BPF_EXIT_INSN(),
13643                 },
13644                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
13645                 .result = ACCEPT,
13646         },
13647 };
13648
13649 static int probe_filter_length(const struct bpf_insn *fp)
13650 {
13651         int len;
13652
13653         for (len = MAX_INSNS - 1; len > 0; --len)
13654                 if (fp[len].code != 0 || fp[len].imm != 0)
13655                         break;
13656         return len + 1;
13657 }
13658
13659 static int create_map(uint32_t type, uint32_t size_key,
13660                       uint32_t size_value, uint32_t max_elem)
13661 {
13662         int fd;
13663
13664         fd = bpf_create_map(type, size_key, size_value, max_elem,
13665                             type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);
13666         if (fd < 0)
13667                 printf("Failed to create hash map '%s'!\n", strerror(errno));
13668
13669         return fd;
13670 }
13671
13672 static int create_prog_dummy1(enum bpf_map_type prog_type)
13673 {
13674         struct bpf_insn prog[] = {
13675                 BPF_MOV64_IMM(BPF_REG_0, 42),
13676                 BPF_EXIT_INSN(),
13677         };
13678
13679         return bpf_load_program(prog_type, prog,
13680                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
13681 }
13682
13683 static int create_prog_dummy2(enum bpf_map_type prog_type, int mfd, int idx)
13684 {
13685         struct bpf_insn prog[] = {
13686                 BPF_MOV64_IMM(BPF_REG_3, idx),
13687                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
13688                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
13689                              BPF_FUNC_tail_call),
13690                 BPF_MOV64_IMM(BPF_REG_0, 41),
13691                 BPF_EXIT_INSN(),
13692         };
13693
13694         return bpf_load_program(prog_type, prog,
13695                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
13696 }
13697
13698 static int create_prog_array(enum bpf_map_type prog_type, uint32_t max_elem,
13699                              int p1key)
13700 {
13701         int p2key = 1;
13702         int mfd, p1fd, p2fd;
13703
13704         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
13705                              sizeof(int), max_elem, 0);
13706         if (mfd < 0) {
13707                 printf("Failed to create prog array '%s'!\n", strerror(errno));
13708                 return -1;
13709         }
13710
13711         p1fd = create_prog_dummy1(prog_type);
13712         p2fd = create_prog_dummy2(prog_type, mfd, p2key);
13713         if (p1fd < 0 || p2fd < 0)
13714                 goto out;
13715         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
13716                 goto out;
13717         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
13718                 goto out;
13719         close(p2fd);
13720         close(p1fd);
13721
13722         return mfd;
13723 out:
13724         close(p2fd);
13725         close(p1fd);
13726         close(mfd);
13727         return -1;
13728 }
13729
13730 static int create_map_in_map(void)
13731 {
13732         int inner_map_fd, outer_map_fd;
13733
13734         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
13735                                       sizeof(int), 1, 0);
13736         if (inner_map_fd < 0) {
13737                 printf("Failed to create array '%s'!\n", strerror(errno));
13738                 return inner_map_fd;
13739         }
13740
13741         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
13742                                              sizeof(int), inner_map_fd, 1, 0);
13743         if (outer_map_fd < 0)
13744                 printf("Failed to create array of maps '%s'!\n",
13745                        strerror(errno));
13746
13747         close(inner_map_fd);
13748
13749         return outer_map_fd;
13750 }
13751
13752 static int create_cgroup_storage(bool percpu)
13753 {
13754         enum bpf_map_type type = percpu ? BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE :
13755                 BPF_MAP_TYPE_CGROUP_STORAGE;
13756         int fd;
13757
13758         fd = bpf_create_map(type, sizeof(struct bpf_cgroup_storage_key),
13759                             TEST_DATA_LEN, 0, 0);
13760         if (fd < 0)
13761                 printf("Failed to create cgroup storage '%s'!\n",
13762                        strerror(errno));
13763
13764         return fd;
13765 }
13766
13767 static char bpf_vlog[UINT_MAX >> 8];
13768
13769 static void do_test_fixup(struct bpf_test *test, enum bpf_map_type prog_type,
13770                           struct bpf_insn *prog, int *map_fds)
13771 {
13772         int *fixup_map_hash_8b = test->fixup_map_hash_8b;
13773         int *fixup_map_hash_48b = test->fixup_map_hash_48b;
13774         int *fixup_map_hash_16b = test->fixup_map_hash_16b;
13775         int *fixup_map_array_48b = test->fixup_map_array_48b;
13776         int *fixup_map_sockmap = test->fixup_map_sockmap;
13777         int *fixup_map_sockhash = test->fixup_map_sockhash;
13778         int *fixup_map_xskmap = test->fixup_map_xskmap;
13779         int *fixup_map_stacktrace = test->fixup_map_stacktrace;
13780         int *fixup_prog1 = test->fixup_prog1;
13781         int *fixup_prog2 = test->fixup_prog2;
13782         int *fixup_map_in_map = test->fixup_map_in_map;
13783         int *fixup_cgroup_storage = test->fixup_cgroup_storage;
13784         int *fixup_percpu_cgroup_storage = test->fixup_percpu_cgroup_storage;
13785
13786         if (test->fill_helper)
13787                 test->fill_helper(test);
13788
13789         /* Allocating HTs with 1 elem is fine here, since we only test
13790          * for verifier and not do a runtime lookup, so the only thing
13791          * that really matters is value size in this case.
13792          */
13793         if (*fixup_map_hash_8b) {
13794                 map_fds[0] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
13795                                         sizeof(long long), 1);
13796                 do {
13797                         prog[*fixup_map_hash_8b].imm = map_fds[0];
13798                         fixup_map_hash_8b++;
13799                 } while (*fixup_map_hash_8b);
13800         }
13801
13802         if (*fixup_map_hash_48b) {
13803                 map_fds[1] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
13804                                         sizeof(struct test_val), 1);
13805                 do {
13806                         prog[*fixup_map_hash_48b].imm = map_fds[1];
13807                         fixup_map_hash_48b++;
13808                 } while (*fixup_map_hash_48b);
13809         }
13810
13811         if (*fixup_map_hash_16b) {
13812                 map_fds[2] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
13813                                         sizeof(struct other_val), 1);
13814                 do {
13815                         prog[*fixup_map_hash_16b].imm = map_fds[2];
13816                         fixup_map_hash_16b++;
13817                 } while (*fixup_map_hash_16b);
13818         }
13819
13820         if (*fixup_map_array_48b) {
13821                 map_fds[3] = create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
13822                                         sizeof(struct test_val), 1);
13823                 do {
13824                         prog[*fixup_map_array_48b].imm = map_fds[3];
13825                         fixup_map_array_48b++;
13826                 } while (*fixup_map_array_48b);
13827         }
13828
13829         if (*fixup_prog1) {
13830                 map_fds[4] = create_prog_array(prog_type, 4, 0);
13831                 do {
13832                         prog[*fixup_prog1].imm = map_fds[4];
13833                         fixup_prog1++;
13834                 } while (*fixup_prog1);
13835         }
13836
13837         if (*fixup_prog2) {
13838                 map_fds[5] = create_prog_array(prog_type, 8, 7);
13839                 do {
13840                         prog[*fixup_prog2].imm = map_fds[5];
13841                         fixup_prog2++;
13842                 } while (*fixup_prog2);
13843         }
13844
13845         if (*fixup_map_in_map) {
13846                 map_fds[6] = create_map_in_map();
13847                 do {
13848                         prog[*fixup_map_in_map].imm = map_fds[6];
13849                         fixup_map_in_map++;
13850                 } while (*fixup_map_in_map);
13851         }
13852
13853         if (*fixup_cgroup_storage) {
13854                 map_fds[7] = create_cgroup_storage(false);
13855                 do {
13856                         prog[*fixup_cgroup_storage].imm = map_fds[7];
13857                         fixup_cgroup_storage++;
13858                 } while (*fixup_cgroup_storage);
13859         }
13860
13861         if (*fixup_percpu_cgroup_storage) {
13862                 map_fds[8] = create_cgroup_storage(true);
13863                 do {
13864                         prog[*fixup_percpu_cgroup_storage].imm = map_fds[8];
13865                         fixup_percpu_cgroup_storage++;
13866                 } while (*fixup_percpu_cgroup_storage);
13867         }
13868         if (*fixup_map_sockmap) {
13869                 map_fds[9] = create_map(BPF_MAP_TYPE_SOCKMAP, sizeof(int),
13870                                         sizeof(int), 1);
13871                 do {
13872                         prog[*fixup_map_sockmap].imm = map_fds[9];
13873                         fixup_map_sockmap++;
13874                 } while (*fixup_map_sockmap);
13875         }
13876         if (*fixup_map_sockhash) {
13877                 map_fds[10] = create_map(BPF_MAP_TYPE_SOCKHASH, sizeof(int),
13878                                         sizeof(int), 1);
13879                 do {
13880                         prog[*fixup_map_sockhash].imm = map_fds[10];
13881                         fixup_map_sockhash++;
13882                 } while (*fixup_map_sockhash);
13883         }
13884         if (*fixup_map_xskmap) {
13885                 map_fds[11] = create_map(BPF_MAP_TYPE_XSKMAP, sizeof(int),
13886                                         sizeof(int), 1);
13887                 do {
13888                         prog[*fixup_map_xskmap].imm = map_fds[11];
13889                         fixup_map_xskmap++;
13890                 } while (*fixup_map_xskmap);
13891         }
13892         if (*fixup_map_stacktrace) {
13893                 map_fds[12] = create_map(BPF_MAP_TYPE_STACK_TRACE, sizeof(u32),
13894                                          sizeof(u64), 1);
13895                 do {
13896                         prog[*fixup_map_stacktrace].imm = map_fds[12];
13897                         fixup_map_stacktrace++;
13898                 } while (fixup_map_stacktrace);
13899         }
13900 }
13901
13902 static void do_test_single(struct bpf_test *test, bool unpriv,
13903                            int *passes, int *errors)
13904 {
13905         int fd_prog, expected_ret, reject_from_alignment;
13906         int prog_len, prog_type = test->prog_type;
13907         struct bpf_insn *prog = test->insns;
13908         int map_fds[MAX_NR_MAPS];
13909         const char *expected_err;
13910         uint32_t retval;
13911         int i, err;
13912
13913         for (i = 0; i < MAX_NR_MAPS; i++)
13914                 map_fds[i] = -1;
13915
13916         if (!prog_type)
13917                 prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
13918         do_test_fixup(test, prog_type, prog, map_fds);
13919         prog_len = probe_filter_length(prog);
13920
13921         fd_prog = bpf_verify_program(prog_type, prog, prog_len,
13922                                      test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
13923                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
13924
13925         expected_ret = unpriv && test->result_unpriv != UNDEF ?
13926                        test->result_unpriv : test->result;
13927         expected_err = unpriv && test->errstr_unpriv ?
13928                        test->errstr_unpriv : test->errstr;
13929
13930         reject_from_alignment = fd_prog < 0 &&
13931                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
13932                                 strstr(bpf_vlog, "Unknown alignment.");
13933 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
13934         if (reject_from_alignment) {
13935                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
13936                        strerror(errno));
13937                 goto fail_log;
13938         }
13939 #endif
13940         if (expected_ret == ACCEPT) {
13941                 if (fd_prog < 0 && !reject_from_alignment) {
13942                         printf("FAIL\nFailed to load prog '%s'!\n",
13943                                strerror(errno));
13944                         goto fail_log;
13945                 }
13946         } else {
13947                 if (fd_prog >= 0) {
13948                         printf("FAIL\nUnexpected success to load!\n");
13949                         goto fail_log;
13950                 }
13951                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
13952                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
13953                               expected_err, bpf_vlog);
13954                         goto fail_log;
13955                 }
13956         }
13957
13958         if (fd_prog >= 0) {
13959                 __u8 tmp[TEST_DATA_LEN << 2];
13960                 __u32 size_tmp = sizeof(tmp);
13961
13962                 err = bpf_prog_test_run(fd_prog, 1, test->data,
13963                                         sizeof(test->data), tmp, &size_tmp,
13964                                         &retval, NULL);
13965                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
13966                         printf("Unexpected bpf_prog_test_run error\n");
13967                         goto fail_log;
13968                 }
13969                 if (!err && retval != test->retval &&
13970                     test->retval != POINTER_VALUE) {
13971                         printf("FAIL retval %d != %d\n", retval, test->retval);
13972                         goto fail_log;
13973                 }
13974         }
13975         (*passes)++;
13976         printf("OK%s\n", reject_from_alignment ?
13977                " (NOTE: reject due to unknown alignment)" : "");
13978 close_fds:
13979         close(fd_prog);
13980         for (i = 0; i < MAX_NR_MAPS; i++)
13981                 close(map_fds[i]);
13982         sched_yield();
13983         return;
13984 fail_log:
13985         (*errors)++;
13986         printf("%s", bpf_vlog);
13987         goto close_fds;
13988 }
13989
13990 static bool is_admin(void)
13991 {
13992         cap_t caps;
13993         cap_flag_value_t sysadmin = CAP_CLEAR;
13994         const cap_value_t cap_val = CAP_SYS_ADMIN;
13995
13996 #ifdef CAP_IS_SUPPORTED
13997         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
13998                 perror("cap_get_flag");
13999                 return false;
14000         }
14001 #endif
14002         caps = cap_get_proc();
14003         if (!caps) {
14004                 perror("cap_get_proc");
14005                 return false;
14006         }
14007         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
14008                 perror("cap_get_flag");
14009         if (cap_free(caps))
14010                 perror("cap_free");
14011         return (sysadmin == CAP_SET);
14012 }
14013
14014 static int set_admin(bool admin)
14015 {
14016         cap_t caps;
14017         const cap_value_t cap_val = CAP_SYS_ADMIN;
14018         int ret = -1;
14019
14020         caps = cap_get_proc();
14021         if (!caps) {
14022                 perror("cap_get_proc");
14023                 return -1;
14024         }
14025         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
14026                                 admin ? CAP_SET : CAP_CLEAR)) {
14027                 perror("cap_set_flag");
14028                 goto out;
14029         }
14030         if (cap_set_proc(caps)) {
14031                 perror("cap_set_proc");
14032                 goto out;
14033         }
14034         ret = 0;
14035 out:
14036         if (cap_free(caps))
14037                 perror("cap_free");
14038         return ret;
14039 }
14040
14041 static void get_unpriv_disabled()
14042 {
14043         char buf[2];
14044         FILE *fd;
14045
14046         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
14047         if (!fd) {
14048                 perror("fopen /proc/sys/"UNPRIV_SYSCTL);
14049                 unpriv_disabled = true;
14050                 return;
14051         }
14052         if (fgets(buf, 2, fd) == buf && atoi(buf))
14053                 unpriv_disabled = true;
14054         fclose(fd);
14055 }
14056
14057 static bool test_as_unpriv(struct bpf_test *test)
14058 {
14059         return !test->prog_type ||
14060                test->prog_type == BPF_PROG_TYPE_SOCKET_FILTER ||
14061                test->prog_type == BPF_PROG_TYPE_CGROUP_SKB;
14062 }
14063
14064 static int do_test(bool unpriv, unsigned int from, unsigned int to)
14065 {
14066         int i, passes = 0, errors = 0, skips = 0;
14067
14068         for (i = from; i < to; i++) {
14069                 struct bpf_test *test = &tests[i];
14070
14071                 /* Program types that are not supported by non-root we
14072                  * skip right away.
14073                  */
14074                 if (test_as_unpriv(test) && unpriv_disabled) {
14075                         printf("#%d/u %s SKIP\n", i, test->descr);
14076                         skips++;
14077                 } else if (test_as_unpriv(test)) {
14078                         if (!unpriv)
14079                                 set_admin(false);
14080                         printf("#%d/u %s ", i, test->descr);
14081                         do_test_single(test, true, &passes, &errors);
14082                         if (!unpriv)
14083                                 set_admin(true);
14084                 }
14085
14086                 if (unpriv) {
14087                         printf("#%d/p %s SKIP\n", i, test->descr);
14088                         skips++;
14089                 } else {
14090                         printf("#%d/p %s ", i, test->descr);
14091                         do_test_single(test, false, &passes, &errors);
14092                 }
14093         }
14094
14095         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
14096                skips, errors);
14097         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
14098 }
14099
14100 int main(int argc, char **argv)
14101 {
14102         unsigned int from = 0, to = ARRAY_SIZE(tests);
14103         bool unpriv = !is_admin();
14104
14105         if (argc == 3) {
14106                 unsigned int l = atoi(argv[argc - 2]);
14107                 unsigned int u = atoi(argv[argc - 1]);
14108
14109                 if (l < to && u < to) {
14110                         from = l;
14111                         to   = u + 1;
14112                 }
14113         } else if (argc == 2) {
14114                 unsigned int t = atoi(argv[argc - 1]);
14115
14116                 if (t < to) {
14117                         from = t;
14118                         to   = t + 1;
14119                 }
14120         }
14121
14122         get_unpriv_disabled();
14123         if (unpriv && unpriv_disabled) {
14124                 printf("Cannot run as unprivileged user with sysctl %s.\n",
14125                        UNPRIV_SYSCTL);
14126                 return EXIT_FAILURE;
14127         }
14128
14129         bpf_semi_rand_init();
14130         return do_test(unpriv, from, to);
14131 }