tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of version 2 of the GNU General Public
   8  * License as published by the Free Software Foundation.
   9  */
  10
  11 #include <asm/types.h>
  12 #include <linux/types.h>
  13 #include <stdint.h>
  14 #include <stdio.h>
  15 #include <stdlib.h>
  16 #include <unistd.h>
  17 #include <errno.h>
  18 #include <string.h>
  19 #include <stddef.h>
  20 #include <stdbool.h>
  21 #include <sched.h>
  22
  23 #include <sys/capability.h>
  24 #include <sys/resource.h>
  25
  26 #include <linux/unistd.h>
  27 #include <linux/filter.h>
  28 #include <linux/bpf_perf_event.h>
  29 #include <linux/bpf.h>
  30
  31 #include <bpf/bpf.h>
  32
  33 #ifdef HAVE_GENHDR
  34 # include "autoconf.h"
  35 #else
  36 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  37 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  38 # endif
  39 #endif
  40
  41 #include "../../../include/linux/filter.h"
  42
  43 #ifndef ARRAY_SIZE
  44 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
  45 #endif
  46
  47 #define MAX_INSNS       512
  48 #define MAX_FIXUPS      8
  49 #define MAX_NR_MAPS     4
  50
  51 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  52
  53 struct bpf_test {
  54         const char *descr;
  55         struct bpf_insn insns[MAX_INSNS];
  56         int fixup_map1[MAX_FIXUPS];
  57         int fixup_map2[MAX_FIXUPS];
  58         int fixup_prog[MAX_FIXUPS];
  59         int fixup_map_in_map[MAX_FIXUPS];
  60         const char *errstr;
  61         const char *errstr_unpriv;
  62         enum {
  63                 UNDEF,
  64                 ACCEPT,
  65                 REJECT
  66         } result, result_unpriv;
  67         enum bpf_prog_type prog_type;
  68         uint8_t flags;
  69 };
  70
  71 /* Note we want this to be 64 bit aligned so that the end of our array is
  72  * actually the end of the structure.
  73  */
  74 #define MAX_ENTRIES 11
  75
  76 struct test_val {
  77         unsigned int index;
  78         int foo[MAX_ENTRIES];
  79 };
  80
  81 static struct bpf_test tests[] = {
  82         {
  83                 "add+sub+mul",
  84                 .insns = {
  85                         BPF_MOV64_IMM(BPF_REG_1, 1),
  86                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
  87                         BPF_MOV64_IMM(BPF_REG_2, 3),
  88                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
  89                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
  90                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
  91                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
  92                         BPF_EXIT_INSN(),
  93                 },
  94                 .result = ACCEPT,
  95         },
  96         {
  97                 "unreachable",
  98                 .insns = {
  99                         BPF_EXIT_INSN(),
 100                         BPF_EXIT_INSN(),
 101                 },
 102                 .errstr = "unreachable",
 103                 .result = REJECT,
 104         },
 105         {
 106                 "unreachable2",
 107                 .insns = {
 108                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 109                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 110                         BPF_EXIT_INSN(),
 111                 },
 112                 .errstr = "unreachable",
 113                 .result = REJECT,
 114         },
 115         {
 116                 "out of range jump",
 117                 .insns = {
 118                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 119                         BPF_EXIT_INSN(),
 120                 },
 121                 .errstr = "jump out of range",
 122                 .result = REJECT,
 123         },
 124         {
 125                 "out of range jump2",
 126                 .insns = {
 127                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 128                         BPF_EXIT_INSN(),
 129                 },
 130                 .errstr = "jump out of range",
 131                 .result = REJECT,
 132         },
 133         {
 134                 "test1 ld_imm64",
 135                 .insns = {
 136                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 137                         BPF_LD_IMM64(BPF_REG_0, 0),
 138                         BPF_LD_IMM64(BPF_REG_0, 0),
 139                         BPF_LD_IMM64(BPF_REG_0, 1),
 140                         BPF_LD_IMM64(BPF_REG_0, 1),
 141                         BPF_MOV64_IMM(BPF_REG_0, 2),
 142                         BPF_EXIT_INSN(),
 143                 },
 144                 .errstr = "invalid BPF_LD_IMM insn",
 145                 .errstr_unpriv = "R1 pointer comparison",
 146                 .result = REJECT,
 147         },
 148         {
 149                 "test2 ld_imm64",
 150                 .insns = {
 151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 152                         BPF_LD_IMM64(BPF_REG_0, 0),
 153                         BPF_LD_IMM64(BPF_REG_0, 0),
 154                         BPF_LD_IMM64(BPF_REG_0, 1),
 155                         BPF_LD_IMM64(BPF_REG_0, 1),
 156                         BPF_EXIT_INSN(),
 157                 },
 158                 .errstr = "invalid BPF_LD_IMM insn",
 159                 .errstr_unpriv = "R1 pointer comparison",
 160                 .result = REJECT,
 161         },
 162         {
 163                 "test3 ld_imm64",
 164                 .insns = {
 165                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 166                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 167                         BPF_LD_IMM64(BPF_REG_0, 0),
 168                         BPF_LD_IMM64(BPF_REG_0, 0),
 169                         BPF_LD_IMM64(BPF_REG_0, 1),
 170                         BPF_LD_IMM64(BPF_REG_0, 1),
 171                         BPF_EXIT_INSN(),
 172                 },
 173                 .errstr = "invalid bpf_ld_imm64 insn",
 174                 .result = REJECT,
 175         },
 176         {
 177                 "test4 ld_imm64",
 178                 .insns = {
 179                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 180                         BPF_EXIT_INSN(),
 181                 },
 182                 .errstr = "invalid bpf_ld_imm64 insn",
 183                 .result = REJECT,
 184         },
 185         {
 186                 "test5 ld_imm64",
 187                 .insns = {
 188                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 189                 },
 190                 .errstr = "invalid bpf_ld_imm64 insn",
 191                 .result = REJECT,
 192         },
 193         {
 194                 "test6 ld_imm64",
 195                 .insns = {
 196                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 197                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 198                         BPF_EXIT_INSN(),
 199                 },
 200                 .result = ACCEPT,
 201         },
 202         {
 203                 "test7 ld_imm64",
 204                 .insns = {
 205                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 206                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 207                         BPF_EXIT_INSN(),
 208                 },
 209                 .result = ACCEPT,
 210         },
 211         {
 212                 "test8 ld_imm64",
 213                 .insns = {
 214                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 215                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 216                         BPF_EXIT_INSN(),
 217                 },
 218                 .errstr = "uses reserved fields",
 219                 .result = REJECT,
 220         },
 221         {
 222                 "test9 ld_imm64",
 223                 .insns = {
 224                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 225                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 226                         BPF_EXIT_INSN(),
 227                 },
 228                 .errstr = "invalid bpf_ld_imm64 insn",
 229                 .result = REJECT,
 230         },
 231         {
 232                 "test10 ld_imm64",
 233                 .insns = {
 234                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 235                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 236                         BPF_EXIT_INSN(),
 237                 },
 238                 .errstr = "invalid bpf_ld_imm64 insn",
 239                 .result = REJECT,
 240         },
 241         {
 242                 "test11 ld_imm64",
 243                 .insns = {
 244                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 245                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 246                         BPF_EXIT_INSN(),
 247                 },
 248                 .errstr = "invalid bpf_ld_imm64 insn",
 249                 .result = REJECT,
 250         },
 251         {
 252                 "test12 ld_imm64",
 253                 .insns = {
 254                         BPF_MOV64_IMM(BPF_REG_1, 0),
 255                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 256                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 257                         BPF_EXIT_INSN(),
 258                 },
 259                 .errstr = "not pointing to valid bpf_map",
 260                 .result = REJECT,
 261         },
 262         {
 263                 "test13 ld_imm64",
 264                 .insns = {
 265                         BPF_MOV64_IMM(BPF_REG_1, 0),
 266                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 267                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 268                         BPF_EXIT_INSN(),
 269                 },
 270                 .errstr = "invalid bpf_ld_imm64 insn",
 271                 .result = REJECT,
 272         },
 273         {
 274                 "no bpf_exit",
 275                 .insns = {
 276                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 277                 },
 278                 .errstr = "jump out of range",
 279                 .result = REJECT,
 280         },
 281         {
 282                 "loop (back-edge)",
 283                 .insns = {
 284                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 285                         BPF_EXIT_INSN(),
 286                 },
 287                 .errstr = "back-edge",
 288                 .result = REJECT,
 289         },
 290         {
 291                 "loop2 (back-edge)",
 292                 .insns = {
 293                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 294                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 295                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 296                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 297                         BPF_EXIT_INSN(),
 298                 },
 299                 .errstr = "back-edge",
 300                 .result = REJECT,
 301         },
 302         {
 303                 "conditional loop",
 304                 .insns = {
 305                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 306                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 307                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 308                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 309                         BPF_EXIT_INSN(),
 310                 },
 311                 .errstr = "back-edge",
 312                 .result = REJECT,
 313         },
 314         {
 315                 "read uninitialized register",
 316                 .insns = {
 317                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 318                         BPF_EXIT_INSN(),
 319                 },
 320                 .errstr = "R2 !read_ok",
 321                 .result = REJECT,
 322         },
 323         {
 324                 "read invalid register",
 325                 .insns = {
 326                         BPF_MOV64_REG(BPF_REG_0, -1),
 327                         BPF_EXIT_INSN(),
 328                 },
 329                 .errstr = "R15 is invalid",
 330                 .result = REJECT,
 331         },
 332         {
 333                 "program doesn't init R0 before exit",
 334                 .insns = {
 335                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 336                         BPF_EXIT_INSN(),
 337                 },
 338                 .errstr = "R0 !read_ok",
 339                 .result = REJECT,
 340         },
 341         {
 342                 "program doesn't init R0 before exit in all branches",
 343                 .insns = {
 344                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 345                         BPF_MOV64_IMM(BPF_REG_0, 1),
 346                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 347                         BPF_EXIT_INSN(),
 348                 },
 349                 .errstr = "R0 !read_ok",
 350                 .errstr_unpriv = "R1 pointer comparison",
 351                 .result = REJECT,
 352         },
 353         {
 354                 "stack out of bounds",
 355                 .insns = {
 356                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 357                         BPF_EXIT_INSN(),
 358                 },
 359                 .errstr = "invalid stack",
 360                 .result = REJECT,
 361         },
 362         {
 363                 "invalid call insn1",
 364                 .insns = {
 365                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 366                         BPF_EXIT_INSN(),
 367                 },
 368                 .errstr = "BPF_CALL uses reserved",
 369                 .result = REJECT,
 370         },
 371         {
 372                 "invalid call insn2",
 373                 .insns = {
 374                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 375                         BPF_EXIT_INSN(),
 376                 },
 377                 .errstr = "BPF_CALL uses reserved",
 378                 .result = REJECT,
 379         },
 380         {
 381                 "invalid function call",
 382                 .insns = {
 383                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 384                         BPF_EXIT_INSN(),
 385                 },
 386                 .errstr = "invalid func unknown#1234567",
 387                 .result = REJECT,
 388         },
 389         {
 390                 "uninitialized stack1",
 391                 .insns = {
 392                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 393                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 394                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 395                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 396                                      BPF_FUNC_map_lookup_elem),
 397                         BPF_EXIT_INSN(),
 398                 },
 399                 .fixup_map1 = { 2 },
 400                 .errstr = "invalid indirect read from stack",
 401                 .result = REJECT,
 402         },
 403         {
 404                 "uninitialized stack2",
 405                 .insns = {
 406                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 407                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 408                         BPF_EXIT_INSN(),
 409                 },
 410                 .errstr = "invalid read from stack",
 411                 .result = REJECT,
 412         },
 413         {
 414                 "invalid fp arithmetic",
 415                 /* If this gets ever changed, make sure JITs can deal with it. */
 416                 .insns = {
 417                         BPF_MOV64_IMM(BPF_REG_0, 0),
 418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 419                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 420                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 421                         BPF_EXIT_INSN(),
 422                 },
 423                 .errstr_unpriv = "R1 pointer arithmetic",
 424                 .result_unpriv = REJECT,
 425                 .errstr = "R1 invalid mem access",
 426                 .result = REJECT,
 427         },
 428         {
 429                 "non-invalid fp arithmetic",
 430                 .insns = {
 431                         BPF_MOV64_IMM(BPF_REG_0, 0),
 432                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 433                         BPF_EXIT_INSN(),
 434                 },
 435                 .result = ACCEPT,
 436         },
 437         {
 438                 "invalid argument register",
 439                 .insns = {
 440                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 441                                      BPF_FUNC_get_cgroup_classid),
 442                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 443                                      BPF_FUNC_get_cgroup_classid),
 444                         BPF_EXIT_INSN(),
 445                 },
 446                 .errstr = "R1 !read_ok",
 447                 .result = REJECT,
 448                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 449         },
 450         {
 451                 "non-invalid argument register",
 452                 .insns = {
 453                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 454                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 455                                      BPF_FUNC_get_cgroup_classid),
 456                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 457                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 458                                      BPF_FUNC_get_cgroup_classid),
 459                         BPF_EXIT_INSN(),
 460                 },
 461                 .result = ACCEPT,
 462                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 463         },
 464         {
 465                 "check valid spill/fill",
 466                 .insns = {
 467                         /* spill R1(ctx) into stack */
 468                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 469                         /* fill it back into R2 */
 470                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 471                         /* should be able to access R0 = *(R2 + 8) */
 472                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 473                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 474                         BPF_EXIT_INSN(),
 475                 },
 476                 .errstr_unpriv = "R0 leaks addr",
 477                 .result = ACCEPT,
 478                 .result_unpriv = REJECT,
 479         },
 480         {
 481                 "check valid spill/fill, skb mark",
 482                 .insns = {
 483                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 484                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 485                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 486                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 487                                     offsetof(struct __sk_buff, mark)),
 488                         BPF_EXIT_INSN(),
 489                 },
 490                 .result = ACCEPT,
 491                 .result_unpriv = ACCEPT,
 492         },
 493         {
 494                 "check corrupted spill/fill",
 495                 .insns = {
 496                         /* spill R1(ctx) into stack */
 497                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 498                         /* mess up with R1 pointer on stack */
 499                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 500                         /* fill back into R0 should fail */
 501                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 502                         BPF_EXIT_INSN(),
 503                 },
 504                 .errstr_unpriv = "attempt to corrupt spilled",
 505                 .errstr = "corrupted spill",
 506                 .result = REJECT,
 507         },
 508         {
 509                 "invalid src register in STX",
 510                 .insns = {
 511                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 512                         BPF_EXIT_INSN(),
 513                 },
 514                 .errstr = "R15 is invalid",
 515                 .result = REJECT,
 516         },
 517         {
 518                 "invalid dst register in STX",
 519                 .insns = {
 520                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 521                         BPF_EXIT_INSN(),
 522                 },
 523                 .errstr = "R14 is invalid",
 524                 .result = REJECT,
 525         },
 526         {
 527                 "invalid dst register in ST",
 528                 .insns = {
 529                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 530                         BPF_EXIT_INSN(),
 531                 },
 532                 .errstr = "R14 is invalid",
 533                 .result = REJECT,
 534         },
 535         {
 536                 "invalid src register in LDX",
 537                 .insns = {
 538                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
 539                         BPF_EXIT_INSN(),
 540                 },
 541                 .errstr = "R12 is invalid",
 542                 .result = REJECT,
 543         },
 544         {
 545                 "invalid dst register in LDX",
 546                 .insns = {
 547                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
 548                         BPF_EXIT_INSN(),
 549                 },
 550                 .errstr = "R11 is invalid",
 551                 .result = REJECT,
 552         },
 553         {
 554                 "junk insn",
 555                 .insns = {
 556                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 557                         BPF_EXIT_INSN(),
 558                 },
 559                 .errstr = "invalid BPF_LD_IMM",
 560                 .result = REJECT,
 561         },
 562         {
 563                 "junk insn2",
 564                 .insns = {
 565                         BPF_RAW_INSN(1, 0, 0, 0, 0),
 566                         BPF_EXIT_INSN(),
 567                 },
 568                 .errstr = "BPF_LDX uses reserved fields",
 569                 .result = REJECT,
 570         },
 571         {
 572                 "junk insn3",
 573                 .insns = {
 574                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
 575                         BPF_EXIT_INSN(),
 576                 },
 577                 .errstr = "invalid BPF_ALU opcode f0",
 578                 .result = REJECT,
 579         },
 580         {
 581                 "junk insn4",
 582                 .insns = {
 583                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
 584                         BPF_EXIT_INSN(),
 585                 },
 586                 .errstr = "invalid BPF_ALU opcode f0",
 587                 .result = REJECT,
 588         },
 589         {
 590                 "junk insn5",
 591                 .insns = {
 592                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
 593                         BPF_EXIT_INSN(),
 594                 },
 595                 .errstr = "BPF_ALU uses reserved fields",
 596                 .result = REJECT,
 597         },
 598         {
 599                 "misaligned read from stack",
 600                 .insns = {
 601                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 602                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
 603                         BPF_EXIT_INSN(),
 604                 },
 605                 .errstr = "misaligned access",
 606                 .result = REJECT,
 607         },
 608         {
 609                 "invalid map_fd for function call",
 610                 .insns = {
 611                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 612                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
 613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 614                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 615                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 616                                      BPF_FUNC_map_delete_elem),
 617                         BPF_EXIT_INSN(),
 618                 },
 619                 .errstr = "fd 0 is not pointing to valid bpf_map",
 620                 .result = REJECT,
 621         },
 622         {
 623                 "don't check return value before access",
 624                 .insns = {
 625                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 626                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 627                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 628                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 629                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 630                                      BPF_FUNC_map_lookup_elem),
 631                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
 632                         BPF_EXIT_INSN(),
 633                 },
 634                 .fixup_map1 = { 3 },
 635                 .errstr = "R0 invalid mem access 'map_value_or_null'",
 636                 .result = REJECT,
 637         },
 638         {
 639                 "access memory with incorrect alignment",
 640                 .insns = {
 641                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 642                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 643                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 644                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 645                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 646                                      BPF_FUNC_map_lookup_elem),
 647                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
 648                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
 649                         BPF_EXIT_INSN(),
 650                 },
 651                 .fixup_map1 = { 3 },
 652                 .errstr = "misaligned access",
 653                 .result = REJECT,
 654         },
 655         {
 656                 "sometimes access memory with incorrect alignment",
 657                 .insns = {
 658                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 659                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 661                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 662                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 663                                      BPF_FUNC_map_lookup_elem),
 664                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
 665                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
 666                         BPF_EXIT_INSN(),
 667                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
 668                         BPF_EXIT_INSN(),
 669                 },
 670                 .fixup_map1 = { 3 },
 671                 .errstr = "R0 invalid mem access",
 672                 .errstr_unpriv = "R0 leaks addr",
 673                 .result = REJECT,
 674         },
 675         {
 676                 "jump test 1",
 677                 .insns = {
 678                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 679                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
 680                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 681                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 682                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
 683                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
 684                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
 685                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
 686                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
 687                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
 688                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
 689                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
 690                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
 691                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
 692                         BPF_MOV64_IMM(BPF_REG_0, 0),
 693                         BPF_EXIT_INSN(),
 694                 },
 695                 .errstr_unpriv = "R1 pointer comparison",
 696                 .result_unpriv = REJECT,
 697                 .result = ACCEPT,
 698         },
 699         {
 700                 "jump test 2",
 701                 .insns = {
 702                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 703                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
 704                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 705                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
 706                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
 707                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
 708                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
 709                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
 710                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
 711                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
 712                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
 713                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
 714                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
 715                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
 716                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
 717                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 718                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
 719                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
 720                         BPF_MOV64_IMM(BPF_REG_0, 0),
 721                         BPF_EXIT_INSN(),
 722                 },
 723                 .errstr_unpriv = "R1 pointer comparison",
 724                 .result_unpriv = REJECT,
 725                 .result = ACCEPT,
 726         },
 727         {
 728                 "jump test 3",
 729                 .insns = {
 730                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 731                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
 732                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
 733                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 734                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
 735                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
 736                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
 737                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
 738                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
 739                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
 740                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
 741                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
 742                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
 743                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
 744                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
 745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
 746                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
 747                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
 748                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
 749                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
 750                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
 751                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
 752                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
 753                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
 754                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 755                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 756                                      BPF_FUNC_map_delete_elem),
 757                         BPF_EXIT_INSN(),
 758                 },
 759                 .fixup_map1 = { 24 },
 760                 .errstr_unpriv = "R1 pointer comparison",
 761                 .result_unpriv = REJECT,
 762                 .result = ACCEPT,
 763         },
 764         {
 765                 "jump test 4",
 766                 .insns = {
 767                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 768                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 769                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 770                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 771                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 772                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 773                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 774                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 775                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 776                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 777                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 778                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 779                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 780                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 781                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 782                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 783                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 784                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 785                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 786                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 787                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 788                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 789                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 790                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 791                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 792                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 793                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 794                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 796                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 797                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 798                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 799                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
 800                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
 801                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
 802                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
 803                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 804                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 805                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 806                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
 807                         BPF_MOV64_IMM(BPF_REG_0, 0),
 808                         BPF_EXIT_INSN(),
 809                 },
 810                 .errstr_unpriv = "R1 pointer comparison",
 811                 .result_unpriv = REJECT,
 812                 .result = ACCEPT,
 813         },
 814         {
 815                 "jump test 5",
 816                 .insns = {
 817                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 818                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 819                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 820                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 821                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 822                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 823                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 824                         BPF_MOV64_IMM(BPF_REG_0, 0),
 825                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 826                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 827                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 828                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 829                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 830                         BPF_MOV64_IMM(BPF_REG_0, 0),
 831                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 832                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 833                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 834                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 835                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 836                         BPF_MOV64_IMM(BPF_REG_0, 0),
 837                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 838                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 839                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 840                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 841                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 842                         BPF_MOV64_IMM(BPF_REG_0, 0),
 843                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 844                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
 845                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 846                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
 847                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 848                         BPF_MOV64_IMM(BPF_REG_0, 0),
 849                         BPF_EXIT_INSN(),
 850                 },
 851                 .errstr_unpriv = "R1 pointer comparison",
 852                 .result_unpriv = REJECT,
 853                 .result = ACCEPT,
 854         },
 855         {
 856                 "access skb fields ok",
 857                 .insns = {
 858                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 859                                     offsetof(struct __sk_buff, len)),
 860                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 861                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 862                                     offsetof(struct __sk_buff, mark)),
 863                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 864                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 865                                     offsetof(struct __sk_buff, pkt_type)),
 866                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
 867                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 868                                     offsetof(struct __sk_buff, queue_mapping)),
 869                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 870                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 871                                     offsetof(struct __sk_buff, protocol)),
 872                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 873                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 874                                     offsetof(struct __sk_buff, vlan_present)),
 875                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 876                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 877                                     offsetof(struct __sk_buff, vlan_tci)),
 878                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 879                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 880                                     offsetof(struct __sk_buff, napi_id)),
 881                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
 882                         BPF_EXIT_INSN(),
 883                 },
 884                 .result = ACCEPT,
 885         },
 886         {
 887                 "access skb fields bad1",
 888                 .insns = {
 889                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
 890                         BPF_EXIT_INSN(),
 891                 },
 892                 .errstr = "invalid bpf_context access",
 893                 .result = REJECT,
 894         },
 895         {
 896                 "access skb fields bad2",
 897                 .insns = {
 898                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
 899                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 900                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 901                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 902                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 903                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 904                                      BPF_FUNC_map_lookup_elem),
 905                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 906                         BPF_EXIT_INSN(),
 907                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 908                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 909                                     offsetof(struct __sk_buff, pkt_type)),
 910                         BPF_EXIT_INSN(),
 911                 },
 912                 .fixup_map1 = { 4 },
 913                 .errstr = "different pointers",
 914                 .errstr_unpriv = "R1 pointer comparison",
 915                 .result = REJECT,
 916         },
 917         {
 918                 "access skb fields bad3",
 919                 .insns = {
 920                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 921                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 922                                     offsetof(struct __sk_buff, pkt_type)),
 923                         BPF_EXIT_INSN(),
 924                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 925                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 926                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 927                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 928                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 929                                      BPF_FUNC_map_lookup_elem),
 930                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 931                         BPF_EXIT_INSN(),
 932                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 933                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
 934                 },
 935                 .fixup_map1 = { 6 },
 936                 .errstr = "different pointers",
 937                 .errstr_unpriv = "R1 pointer comparison",
 938                 .result = REJECT,
 939         },
 940         {
 941                 "access skb fields bad4",
 942                 .insns = {
 943                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
 944                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
 945                                     offsetof(struct __sk_buff, len)),
 946                         BPF_MOV64_IMM(BPF_REG_0, 0),
 947                         BPF_EXIT_INSN(),
 948                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 949                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 950                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 951                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 952                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 953                                      BPF_FUNC_map_lookup_elem),
 954                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 955                         BPF_EXIT_INSN(),
 956                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 957                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
 958                 },
 959                 .fixup_map1 = { 7 },
 960                 .errstr = "different pointers",
 961                 .errstr_unpriv = "R1 pointer comparison",
 962                 .result = REJECT,
 963         },
 964         {
 965                 "check skb->mark is not writeable by sockets",
 966                 .insns = {
 967                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
 968                                     offsetof(struct __sk_buff, mark)),
 969                         BPF_EXIT_INSN(),
 970                 },
 971                 .errstr = "invalid bpf_context access",
 972                 .errstr_unpriv = "R1 leaks addr",
 973                 .result = REJECT,
 974         },
 975         {
 976                 "check skb->tc_index is not writeable by sockets",
 977                 .insns = {
 978                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
 979                                     offsetof(struct __sk_buff, tc_index)),
 980                         BPF_EXIT_INSN(),
 981                 },
 982                 .errstr = "invalid bpf_context access",
 983                 .errstr_unpriv = "R1 leaks addr",
 984                 .result = REJECT,
 985         },
 986         {
 987                 "check cb access: byte",
 988                 .insns = {
 989                         BPF_MOV64_IMM(BPF_REG_0, 0),
 990                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
 991                                     offsetof(struct __sk_buff, cb[0])),
 992                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
 993                                     offsetof(struct __sk_buff, cb[0]) + 1),
 994                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
 995                                     offsetof(struct __sk_buff, cb[0]) + 2),
 996                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
 997                                     offsetof(struct __sk_buff, cb[0]) + 3),
 998                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
 999                                     offsetof(struct __sk_buff, cb[1])),
1000                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1001                                     offsetof(struct __sk_buff, cb[1]) + 1),
1002                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1003                                     offsetof(struct __sk_buff, cb[1]) + 2),
1004                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1005                                     offsetof(struct __sk_buff, cb[1]) + 3),
1006                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1007                                     offsetof(struct __sk_buff, cb[2])),
1008                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1009                                     offsetof(struct __sk_buff, cb[2]) + 1),
1010                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1011                                     offsetof(struct __sk_buff, cb[2]) + 2),
1012                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1013                                     offsetof(struct __sk_buff, cb[2]) + 3),
1014                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1015                                     offsetof(struct __sk_buff, cb[3])),
1016                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1017                                     offsetof(struct __sk_buff, cb[3]) + 1),
1018                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1019                                     offsetof(struct __sk_buff, cb[3]) + 2),
1020                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1021                                     offsetof(struct __sk_buff, cb[3]) + 3),
1022                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1023                                     offsetof(struct __sk_buff, cb[4])),
1024                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1025                                     offsetof(struct __sk_buff, cb[4]) + 1),
1026                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1027                                     offsetof(struct __sk_buff, cb[4]) + 2),
1028                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1029                                     offsetof(struct __sk_buff, cb[4]) + 3),
1030                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1031                                     offsetof(struct __sk_buff, cb[0])),
1032                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1033                                     offsetof(struct __sk_buff, cb[0]) + 1),
1034                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1035                                     offsetof(struct __sk_buff, cb[0]) + 2),
1036                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1037                                     offsetof(struct __sk_buff, cb[0]) + 3),
1038                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1039                                     offsetof(struct __sk_buff, cb[1])),
1040                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1041                                     offsetof(struct __sk_buff, cb[1]) + 1),
1042                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1043                                     offsetof(struct __sk_buff, cb[1]) + 2),
1044                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1045                                     offsetof(struct __sk_buff, cb[1]) + 3),
1046                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1047                                     offsetof(struct __sk_buff, cb[2])),
1048                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1049                                     offsetof(struct __sk_buff, cb[2]) + 1),
1050                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1051                                     offsetof(struct __sk_buff, cb[2]) + 2),
1052                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1053                                     offsetof(struct __sk_buff, cb[2]) + 3),
1054                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1055                                     offsetof(struct __sk_buff, cb[3])),
1056                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1057                                     offsetof(struct __sk_buff, cb[3]) + 1),
1058                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1059                                     offsetof(struct __sk_buff, cb[3]) + 2),
1060                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1061                                     offsetof(struct __sk_buff, cb[3]) + 3),
1062                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1063                                     offsetof(struct __sk_buff, cb[4])),
1064                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1065                                     offsetof(struct __sk_buff, cb[4]) + 1),
1066                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1067                                     offsetof(struct __sk_buff, cb[4]) + 2),
1068                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1069                                     offsetof(struct __sk_buff, cb[4]) + 3),
1070                         BPF_EXIT_INSN(),
1071                 },
1072                 .result = ACCEPT,
1073         },
1074         {
1075                 "check cb access: byte, oob 1",
1076                 .insns = {
1077                         BPF_MOV64_IMM(BPF_REG_0, 0),
1078                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1079                                     offsetof(struct __sk_buff, cb[4]) + 4),
1080                         BPF_EXIT_INSN(),
1081                 },
1082                 .errstr = "invalid bpf_context access",
1083                 .result = REJECT,
1084         },
1085         {
1086                 "check cb access: byte, oob 2",
1087                 .insns = {
1088                         BPF_MOV64_IMM(BPF_REG_0, 0),
1089                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1090                                     offsetof(struct __sk_buff, cb[0]) - 1),
1091                         BPF_EXIT_INSN(),
1092                 },
1093                 .errstr = "invalid bpf_context access",
1094                 .result = REJECT,
1095         },
1096         {
1097                 "check cb access: byte, oob 3",
1098                 .insns = {
1099                         BPF_MOV64_IMM(BPF_REG_0, 0),
1100                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1101                                     offsetof(struct __sk_buff, cb[4]) + 4),
1102                         BPF_EXIT_INSN(),
1103                 },
1104                 .errstr = "invalid bpf_context access",
1105                 .result = REJECT,
1106         },
1107         {
1108                 "check cb access: byte, oob 4",
1109                 .insns = {
1110                         BPF_MOV64_IMM(BPF_REG_0, 0),
1111                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1112                                     offsetof(struct __sk_buff, cb[0]) - 1),
1113                         BPF_EXIT_INSN(),
1114                 },
1115                 .errstr = "invalid bpf_context access",
1116                 .result = REJECT,
1117         },
1118         {
1119                 "check cb access: byte, wrong type",
1120                 .insns = {
1121                         BPF_MOV64_IMM(BPF_REG_0, 0),
1122                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1123                                     offsetof(struct __sk_buff, cb[0])),
1124                         BPF_EXIT_INSN(),
1125                 },
1126                 .errstr = "invalid bpf_context access",
1127                 .result = REJECT,
1128                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1129         },
1130         {
1131                 "check cb access: half",
1132                 .insns = {
1133                         BPF_MOV64_IMM(BPF_REG_0, 0),
1134                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1135                                     offsetof(struct __sk_buff, cb[0])),
1136                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1137                                     offsetof(struct __sk_buff, cb[0]) + 2),
1138                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1139                                     offsetof(struct __sk_buff, cb[1])),
1140                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1141                                     offsetof(struct __sk_buff, cb[1]) + 2),
1142                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1143                                     offsetof(struct __sk_buff, cb[2])),
1144                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1145                                     offsetof(struct __sk_buff, cb[2]) + 2),
1146                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1147                                     offsetof(struct __sk_buff, cb[3])),
1148                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1149                                     offsetof(struct __sk_buff, cb[3]) + 2),
1150                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1151                                     offsetof(struct __sk_buff, cb[4])),
1152                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1153                                     offsetof(struct __sk_buff, cb[4]) + 2),
1154                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1155                                     offsetof(struct __sk_buff, cb[0])),
1156                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1157                                     offsetof(struct __sk_buff, cb[0]) + 2),
1158                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1159                                     offsetof(struct __sk_buff, cb[1])),
1160                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1161                                     offsetof(struct __sk_buff, cb[1]) + 2),
1162                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1163                                     offsetof(struct __sk_buff, cb[2])),
1164                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1165                                     offsetof(struct __sk_buff, cb[2]) + 2),
1166                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1167                                     offsetof(struct __sk_buff, cb[3])),
1168                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1169                                     offsetof(struct __sk_buff, cb[3]) + 2),
1170                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1171                                     offsetof(struct __sk_buff, cb[4])),
1172                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1173                                     offsetof(struct __sk_buff, cb[4]) + 2),
1174                         BPF_EXIT_INSN(),
1175                 },
1176                 .result = ACCEPT,
1177         },
1178         {
1179                 "check cb access: half, unaligned",
1180                 .insns = {
1181                         BPF_MOV64_IMM(BPF_REG_0, 0),
1182                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1183                                     offsetof(struct __sk_buff, cb[0]) + 1),
1184                         BPF_EXIT_INSN(),
1185                 },
1186                 .errstr = "misaligned access",
1187                 .result = REJECT,
1188         },
1189         {
1190                 "check cb access: half, oob 1",
1191                 .insns = {
1192                         BPF_MOV64_IMM(BPF_REG_0, 0),
1193                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1194                                     offsetof(struct __sk_buff, cb[4]) + 4),
1195                         BPF_EXIT_INSN(),
1196                 },
1197                 .errstr = "invalid bpf_context access",
1198                 .result = REJECT,
1199         },
1200         {
1201                 "check cb access: half, oob 2",
1202                 .insns = {
1203                         BPF_MOV64_IMM(BPF_REG_0, 0),
1204                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1205                                     offsetof(struct __sk_buff, cb[0]) - 2),
1206                         BPF_EXIT_INSN(),
1207                 },
1208                 .errstr = "invalid bpf_context access",
1209                 .result = REJECT,
1210         },
1211         {
1212                 "check cb access: half, oob 3",
1213                 .insns = {
1214                         BPF_MOV64_IMM(BPF_REG_0, 0),
1215                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1216                                     offsetof(struct __sk_buff, cb[4]) + 4),
1217                         BPF_EXIT_INSN(),
1218                 },
1219                 .errstr = "invalid bpf_context access",
1220                 .result = REJECT,
1221         },
1222         {
1223                 "check cb access: half, oob 4",
1224                 .insns = {
1225                         BPF_MOV64_IMM(BPF_REG_0, 0),
1226                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1227                                     offsetof(struct __sk_buff, cb[0]) - 2),
1228                         BPF_EXIT_INSN(),
1229                 },
1230                 .errstr = "invalid bpf_context access",
1231                 .result = REJECT,
1232         },
1233         {
1234                 "check cb access: half, wrong type",
1235                 .insns = {
1236                         BPF_MOV64_IMM(BPF_REG_0, 0),
1237                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1238                                     offsetof(struct __sk_buff, cb[0])),
1239                         BPF_EXIT_INSN(),
1240                 },
1241                 .errstr = "invalid bpf_context access",
1242                 .result = REJECT,
1243                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1244         },
1245         {
1246                 "check cb access: word",
1247                 .insns = {
1248                         BPF_MOV64_IMM(BPF_REG_0, 0),
1249                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1250                                     offsetof(struct __sk_buff, cb[0])),
1251                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1252                                     offsetof(struct __sk_buff, cb[1])),
1253                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1254                                     offsetof(struct __sk_buff, cb[2])),
1255                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1256                                     offsetof(struct __sk_buff, cb[3])),
1257                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1258                                     offsetof(struct __sk_buff, cb[4])),
1259                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1260                                     offsetof(struct __sk_buff, cb[0])),
1261                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1262                                     offsetof(struct __sk_buff, cb[1])),
1263                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1264                                     offsetof(struct __sk_buff, cb[2])),
1265                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1266                                     offsetof(struct __sk_buff, cb[3])),
1267                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1268                                     offsetof(struct __sk_buff, cb[4])),
1269                         BPF_EXIT_INSN(),
1270                 },
1271                 .result = ACCEPT,
1272         },
1273         {
1274                 "check cb access: word, unaligned 1",
1275                 .insns = {
1276                         BPF_MOV64_IMM(BPF_REG_0, 0),
1277                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1278                                     offsetof(struct __sk_buff, cb[0]) + 2),
1279                         BPF_EXIT_INSN(),
1280                 },
1281                 .errstr = "misaligned access",
1282                 .result = REJECT,
1283         },
1284         {
1285                 "check cb access: word, unaligned 2",
1286                 .insns = {
1287                         BPF_MOV64_IMM(BPF_REG_0, 0),
1288                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1289                                     offsetof(struct __sk_buff, cb[4]) + 1),
1290                         BPF_EXIT_INSN(),
1291                 },
1292                 .errstr = "misaligned access",
1293                 .result = REJECT,
1294         },
1295         {
1296                 "check cb access: word, unaligned 3",
1297                 .insns = {
1298                         BPF_MOV64_IMM(BPF_REG_0, 0),
1299                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1300                                     offsetof(struct __sk_buff, cb[4]) + 2),
1301                         BPF_EXIT_INSN(),
1302                 },
1303                 .errstr = "misaligned access",
1304                 .result = REJECT,
1305         },
1306         {
1307                 "check cb access: word, unaligned 4",
1308                 .insns = {
1309                         BPF_MOV64_IMM(BPF_REG_0, 0),
1310                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1311                                     offsetof(struct __sk_buff, cb[4]) + 3),
1312                         BPF_EXIT_INSN(),
1313                 },
1314                 .errstr = "misaligned access",
1315                 .result = REJECT,
1316         },
1317         {
1318                 "check cb access: double",
1319                 .insns = {
1320                         BPF_MOV64_IMM(BPF_REG_0, 0),
1321                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1322                                     offsetof(struct __sk_buff, cb[0])),
1323                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1324                                     offsetof(struct __sk_buff, cb[2])),
1325                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1326                                     offsetof(struct __sk_buff, cb[0])),
1327                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1328                                     offsetof(struct __sk_buff, cb[2])),
1329                         BPF_EXIT_INSN(),
1330                 },
1331                 .result = ACCEPT,
1332         },
1333         {
1334                 "check cb access: double, unaligned 1",
1335                 .insns = {
1336                         BPF_MOV64_IMM(BPF_REG_0, 0),
1337                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1338                                     offsetof(struct __sk_buff, cb[1])),
1339                         BPF_EXIT_INSN(),
1340                 },
1341                 .errstr = "misaligned access",
1342                 .result = REJECT,
1343         },
1344         {
1345                 "check cb access: double, unaligned 2",
1346                 .insns = {
1347                         BPF_MOV64_IMM(BPF_REG_0, 0),
1348                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1349                                     offsetof(struct __sk_buff, cb[3])),
1350                         BPF_EXIT_INSN(),
1351                 },
1352                 .errstr = "misaligned access",
1353                 .result = REJECT,
1354         },
1355         {
1356                 "check cb access: double, oob 1",
1357                 .insns = {
1358                         BPF_MOV64_IMM(BPF_REG_0, 0),
1359                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1360                                     offsetof(struct __sk_buff, cb[4])),
1361                         BPF_EXIT_INSN(),
1362                 },
1363                 .errstr = "invalid bpf_context access",
1364                 .result = REJECT,
1365         },
1366         {
1367                 "check cb access: double, oob 2",
1368                 .insns = {
1369                         BPF_MOV64_IMM(BPF_REG_0, 0),
1370                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1371                                     offsetof(struct __sk_buff, cb[4]) + 8),
1372                         BPF_EXIT_INSN(),
1373                 },
1374                 .errstr = "invalid bpf_context access",
1375                 .result = REJECT,
1376         },
1377         {
1378                 "check cb access: double, oob 3",
1379                 .insns = {
1380                         BPF_MOV64_IMM(BPF_REG_0, 0),
1381                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1382                                     offsetof(struct __sk_buff, cb[0]) - 8),
1383                         BPF_EXIT_INSN(),
1384                 },
1385                 .errstr = "invalid bpf_context access",
1386                 .result = REJECT,
1387         },
1388         {
1389                 "check cb access: double, oob 4",
1390                 .insns = {
1391                         BPF_MOV64_IMM(BPF_REG_0, 0),
1392                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1393                                     offsetof(struct __sk_buff, cb[4])),
1394                         BPF_EXIT_INSN(),
1395                 },
1396                 .errstr = "invalid bpf_context access",
1397                 .result = REJECT,
1398         },
1399         {
1400                 "check cb access: double, oob 5",
1401                 .insns = {
1402                         BPF_MOV64_IMM(BPF_REG_0, 0),
1403                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1404                                     offsetof(struct __sk_buff, cb[4]) + 8),
1405                         BPF_EXIT_INSN(),
1406                 },
1407                 .errstr = "invalid bpf_context access",
1408                 .result = REJECT,
1409         },
1410         {
1411                 "check cb access: double, oob 6",
1412                 .insns = {
1413                         BPF_MOV64_IMM(BPF_REG_0, 0),
1414                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1415                                     offsetof(struct __sk_buff, cb[0]) - 8),
1416                         BPF_EXIT_INSN(),
1417                 },
1418                 .errstr = "invalid bpf_context access",
1419                 .result = REJECT,
1420         },
1421         {
1422                 "check cb access: double, wrong type",
1423                 .insns = {
1424                         BPF_MOV64_IMM(BPF_REG_0, 0),
1425                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1426                                     offsetof(struct __sk_buff, cb[0])),
1427                         BPF_EXIT_INSN(),
1428                 },
1429                 .errstr = "invalid bpf_context access",
1430                 .result = REJECT,
1431                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1432         },
1433         {
1434                 "check out of range skb->cb access",
1435                 .insns = {
1436                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1437                                     offsetof(struct __sk_buff, cb[0]) + 256),
1438                         BPF_EXIT_INSN(),
1439                 },
1440                 .errstr = "invalid bpf_context access",
1441                 .errstr_unpriv = "",
1442                 .result = REJECT,
1443                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
1444         },
1445         {
1446                 "write skb fields from socket prog",
1447                 .insns = {
1448                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1449                                     offsetof(struct __sk_buff, cb[4])),
1450                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1451                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1452                                     offsetof(struct __sk_buff, mark)),
1453                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1454                                     offsetof(struct __sk_buff, tc_index)),
1455                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1456                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1457                                     offsetof(struct __sk_buff, cb[0])),
1458                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1459                                     offsetof(struct __sk_buff, cb[2])),
1460                         BPF_EXIT_INSN(),
1461                 },
1462                 .result = ACCEPT,
1463                 .errstr_unpriv = "R1 leaks addr",
1464                 .result_unpriv = REJECT,
1465         },
1466         {
1467                 "write skb fields from tc_cls_act prog",
1468                 .insns = {
1469                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1470                                     offsetof(struct __sk_buff, cb[0])),
1471                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1472                                     offsetof(struct __sk_buff, mark)),
1473                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1474                                     offsetof(struct __sk_buff, tc_index)),
1475                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1476                                     offsetof(struct __sk_buff, tc_index)),
1477                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1478                                     offsetof(struct __sk_buff, cb[3])),
1479                         BPF_EXIT_INSN(),
1480                 },
1481                 .errstr_unpriv = "",
1482                 .result_unpriv = REJECT,
1483                 .result = ACCEPT,
1484                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1485         },
1486         {
1487                 "PTR_TO_STACK store/load",
1488                 .insns = {
1489                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1490                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1491                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1492                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1493                         BPF_EXIT_INSN(),
1494                 },
1495                 .result = ACCEPT,
1496         },
1497         {
1498                 "PTR_TO_STACK store/load - bad alignment on off",
1499                 .insns = {
1500                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1501                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1502                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
1503                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
1504                         BPF_EXIT_INSN(),
1505                 },
1506                 .result = REJECT,
1507                 .errstr = "misaligned access off -6 size 8",
1508         },
1509         {
1510                 "PTR_TO_STACK store/load - bad alignment on reg",
1511                 .insns = {
1512                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1513                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
1514                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1515                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1516                         BPF_EXIT_INSN(),
1517                 },
1518                 .result = REJECT,
1519                 .errstr = "misaligned access off -2 size 8",
1520         },
1521         {
1522                 "PTR_TO_STACK store/load - out of bounds low",
1523                 .insns = {
1524                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1525                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
1526                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1527                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1528                         BPF_EXIT_INSN(),
1529                 },
1530                 .result = REJECT,
1531                 .errstr = "invalid stack off=-79992 size=8",
1532         },
1533         {
1534                 "PTR_TO_STACK store/load - out of bounds high",
1535                 .insns = {
1536                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1537                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1538                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
1539                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
1540                         BPF_EXIT_INSN(),
1541                 },
1542                 .result = REJECT,
1543                 .errstr = "invalid stack off=0 size=8",
1544         },
1545         {
1546                 "unpriv: return pointer",
1547                 .insns = {
1548                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1549                         BPF_EXIT_INSN(),
1550                 },
1551                 .result = ACCEPT,
1552                 .result_unpriv = REJECT,
1553                 .errstr_unpriv = "R0 leaks addr",
1554         },
1555         {
1556                 "unpriv: add const to pointer",
1557                 .insns = {
1558                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
1559                         BPF_MOV64_IMM(BPF_REG_0, 0),
1560                         BPF_EXIT_INSN(),
1561                 },
1562                 .result = ACCEPT,
1563                 .result_unpriv = REJECT,
1564                 .errstr_unpriv = "R1 pointer arithmetic",
1565         },
1566         {
1567                 "unpriv: add pointer to pointer",
1568                 .insns = {
1569                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1570                         BPF_MOV64_IMM(BPF_REG_0, 0),
1571                         BPF_EXIT_INSN(),
1572                 },
1573                 .result = ACCEPT,
1574                 .result_unpriv = REJECT,
1575                 .errstr_unpriv = "R1 pointer arithmetic",
1576         },
1577         {
1578                 "unpriv: neg pointer",
1579                 .insns = {
1580                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
1581                         BPF_MOV64_IMM(BPF_REG_0, 0),
1582                         BPF_EXIT_INSN(),
1583                 },
1584                 .result = ACCEPT,
1585                 .result_unpriv = REJECT,
1586                 .errstr_unpriv = "R1 pointer arithmetic",
1587         },
1588         {
1589                 "unpriv: cmp pointer with const",
1590                 .insns = {
1591                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1592                         BPF_MOV64_IMM(BPF_REG_0, 0),
1593                         BPF_EXIT_INSN(),
1594                 },
1595                 .result = ACCEPT,
1596                 .result_unpriv = REJECT,
1597                 .errstr_unpriv = "R1 pointer comparison",
1598         },
1599         {
1600                 "unpriv: cmp pointer with pointer",
1601                 .insns = {
1602                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1603                         BPF_MOV64_IMM(BPF_REG_0, 0),
1604                         BPF_EXIT_INSN(),
1605                 },
1606                 .result = ACCEPT,
1607                 .result_unpriv = REJECT,
1608                 .errstr_unpriv = "R10 pointer comparison",
1609         },
1610         {
1611                 "unpriv: check that printk is disallowed",
1612                 .insns = {
1613                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1614                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1615                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1616                         BPF_MOV64_IMM(BPF_REG_2, 8),
1617                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1618                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1619                                      BPF_FUNC_trace_printk),
1620                         BPF_MOV64_IMM(BPF_REG_0, 0),
1621                         BPF_EXIT_INSN(),
1622                 },
1623                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
1624                 .result_unpriv = REJECT,
1625                 .result = ACCEPT,
1626         },
1627         {
1628                 "unpriv: pass pointer to helper function",
1629                 .insns = {
1630                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1631                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1632                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1633                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1634                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1635                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
1636                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1637                                      BPF_FUNC_map_update_elem),
1638                         BPF_MOV64_IMM(BPF_REG_0, 0),
1639                         BPF_EXIT_INSN(),
1640                 },
1641                 .fixup_map1 = { 3 },
1642                 .errstr_unpriv = "R4 leaks addr",
1643                 .result_unpriv = REJECT,
1644                 .result = ACCEPT,
1645         },
1646         {
1647                 "unpriv: indirectly pass pointer on stack to helper function",
1648                 .insns = {
1649                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1650                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1652                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1653                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1654                                      BPF_FUNC_map_lookup_elem),
1655                         BPF_MOV64_IMM(BPF_REG_0, 0),
1656                         BPF_EXIT_INSN(),
1657                 },
1658                 .fixup_map1 = { 3 },
1659                 .errstr = "invalid indirect read from stack off -8+0 size 8",
1660                 .result = REJECT,
1661         },
1662         {
1663                 "unpriv: mangle pointer on stack 1",
1664                 .insns = {
1665                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1666                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
1667                         BPF_MOV64_IMM(BPF_REG_0, 0),
1668                         BPF_EXIT_INSN(),
1669                 },
1670                 .errstr_unpriv = "attempt to corrupt spilled",
1671                 .result_unpriv = REJECT,
1672                 .result = ACCEPT,
1673         },
1674         {
1675                 "unpriv: mangle pointer on stack 2",
1676                 .insns = {
1677                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1678                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
1679                         BPF_MOV64_IMM(BPF_REG_0, 0),
1680                         BPF_EXIT_INSN(),
1681                 },
1682                 .errstr_unpriv = "attempt to corrupt spilled",
1683                 .result_unpriv = REJECT,
1684                 .result = ACCEPT,
1685         },
1686         {
1687                 "unpriv: read pointer from stack in small chunks",
1688                 .insns = {
1689                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
1690                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
1691                         BPF_MOV64_IMM(BPF_REG_0, 0),
1692                         BPF_EXIT_INSN(),
1693                 },
1694                 .errstr = "invalid size",
1695                 .result = REJECT,
1696         },
1697         {
1698                 "unpriv: write pointer into ctx",
1699                 .insns = {
1700                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
1701                         BPF_MOV64_IMM(BPF_REG_0, 0),
1702                         BPF_EXIT_INSN(),
1703                 },
1704                 .errstr_unpriv = "R1 leaks addr",
1705                 .result_unpriv = REJECT,
1706                 .errstr = "invalid bpf_context access",
1707                 .result = REJECT,
1708         },
1709         {
1710                 "unpriv: spill/fill of ctx",
1711                 .insns = {
1712                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1713                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1714                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1715                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1716                         BPF_MOV64_IMM(BPF_REG_0, 0),
1717                         BPF_EXIT_INSN(),
1718                 },
1719                 .result = ACCEPT,
1720         },
1721         {
1722                 "unpriv: spill/fill of ctx 2",
1723                 .insns = {
1724                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1725                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1726                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1727                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1728                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1729                                      BPF_FUNC_get_hash_recalc),
1730                         BPF_EXIT_INSN(),
1731                 },
1732                 .result = ACCEPT,
1733                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1734         },
1735         {
1736                 "unpriv: spill/fill of ctx 3",
1737                 .insns = {
1738                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1740                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1741                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1742                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1743                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1744                                      BPF_FUNC_get_hash_recalc),
1745                         BPF_EXIT_INSN(),
1746                 },
1747                 .result = REJECT,
1748                 .errstr = "R1 type=fp expected=ctx",
1749                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1750         },
1751         {
1752                 "unpriv: spill/fill of ctx 4",
1753                 .insns = {
1754                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1756                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1757                         BPF_MOV64_IMM(BPF_REG_0, 1),
1758                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
1759                                      BPF_REG_0, -8, 0),
1760                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1761                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1762                                      BPF_FUNC_get_hash_recalc),
1763                         BPF_EXIT_INSN(),
1764                 },
1765                 .result = REJECT,
1766                 .errstr = "R1 type=inv expected=ctx",
1767                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1768         },
1769         {
1770                 "unpriv: spill/fill of different pointers stx",
1771                 .insns = {
1772                         BPF_MOV64_IMM(BPF_REG_3, 42),
1773                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1775                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1776                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1778                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1779                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1780                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1781                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1782                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
1783                                     offsetof(struct __sk_buff, mark)),
1784                         BPF_MOV64_IMM(BPF_REG_0, 0),
1785                         BPF_EXIT_INSN(),
1786                 },
1787                 .result = REJECT,
1788                 .errstr = "same insn cannot be used with different pointers",
1789                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1790         },
1791         {
1792                 "unpriv: spill/fill of different pointers ldx",
1793                 .insns = {
1794                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1795                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1796                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1797                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1798                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
1799                                       -(__s32)offsetof(struct bpf_perf_event_data,
1800                                                        sample_period) - 8),
1801                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
1802                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
1803                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
1804                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
1805                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
1806                                     offsetof(struct bpf_perf_event_data,
1807                                              sample_period)),
1808                         BPF_MOV64_IMM(BPF_REG_0, 0),
1809                         BPF_EXIT_INSN(),
1810                 },
1811                 .result = REJECT,
1812                 .errstr = "same insn cannot be used with different pointers",
1813                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
1814         },
1815         {
1816                 "unpriv: write pointer into map elem value",
1817                 .insns = {
1818                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1819                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1820                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1821                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1822                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1823                                      BPF_FUNC_map_lookup_elem),
1824                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1825                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
1826                         BPF_EXIT_INSN(),
1827                 },
1828                 .fixup_map1 = { 3 },
1829                 .errstr_unpriv = "R0 leaks addr",
1830                 .result_unpriv = REJECT,
1831                 .result = ACCEPT,
1832         },
1833         {
1834                 "unpriv: partial copy of pointer",
1835                 .insns = {
1836                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
1837                         BPF_MOV64_IMM(BPF_REG_0, 0),
1838                         BPF_EXIT_INSN(),
1839                 },
1840                 .errstr_unpriv = "R10 partial copy",
1841                 .result_unpriv = REJECT,
1842                 .result = ACCEPT,
1843         },
1844         {
1845                 "unpriv: pass pointer to tail_call",
1846                 .insns = {
1847                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
1848                         BPF_LD_MAP_FD(BPF_REG_2, 0),
1849                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1850                                      BPF_FUNC_tail_call),
1851                         BPF_MOV64_IMM(BPF_REG_0, 0),
1852                         BPF_EXIT_INSN(),
1853                 },
1854                 .fixup_prog = { 1 },
1855                 .errstr_unpriv = "R3 leaks addr into helper",
1856                 .result_unpriv = REJECT,
1857                 .result = ACCEPT,
1858         },
1859         {
1860                 "unpriv: cmp map pointer with zero",
1861                 .insns = {
1862                         BPF_MOV64_IMM(BPF_REG_1, 0),
1863                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1864                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1865                         BPF_MOV64_IMM(BPF_REG_0, 0),
1866                         BPF_EXIT_INSN(),
1867                 },
1868                 .fixup_map1 = { 1 },
1869                 .errstr_unpriv = "R1 pointer comparison",
1870                 .result_unpriv = REJECT,
1871                 .result = ACCEPT,
1872         },
1873         {
1874                 "unpriv: write into frame pointer",
1875                 .insns = {
1876                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
1877                         BPF_MOV64_IMM(BPF_REG_0, 0),
1878                         BPF_EXIT_INSN(),
1879                 },
1880                 .errstr = "frame pointer is read only",
1881                 .result = REJECT,
1882         },
1883         {
1884                 "unpriv: spill/fill frame pointer",
1885                 .insns = {
1886                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1887                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1888                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
1889                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
1890                         BPF_MOV64_IMM(BPF_REG_0, 0),
1891                         BPF_EXIT_INSN(),
1892                 },
1893                 .errstr = "frame pointer is read only",
1894                 .result = REJECT,
1895         },
1896         {
1897                 "unpriv: cmp of frame pointer",
1898                 .insns = {
1899                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
1900                         BPF_MOV64_IMM(BPF_REG_0, 0),
1901                         BPF_EXIT_INSN(),
1902                 },
1903                 .errstr_unpriv = "R10 pointer comparison",
1904                 .result_unpriv = REJECT,
1905                 .result = ACCEPT,
1906         },
1907         {
1908                 "unpriv: adding of fp",
1909                 .insns = {
1910                         BPF_MOV64_IMM(BPF_REG_0, 0),
1911                         BPF_MOV64_IMM(BPF_REG_1, 0),
1912                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
1913                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
1914                         BPF_EXIT_INSN(),
1915                 },
1916                 .errstr_unpriv = "pointer arithmetic prohibited",
1917                 .result_unpriv = REJECT,
1918                 .errstr = "R1 invalid mem access",
1919                 .result = REJECT,
1920         },
1921         {
1922                 "unpriv: cmp of stack pointer",
1923                 .insns = {
1924                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1925                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1926                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
1927                         BPF_MOV64_IMM(BPF_REG_0, 0),
1928                         BPF_EXIT_INSN(),
1929                 },
1930                 .errstr_unpriv = "R2 pointer comparison",
1931                 .result_unpriv = REJECT,
1932                 .result = ACCEPT,
1933         },
1934         {
1935                 "unpriv: obfuscate stack pointer",
1936                 .insns = {
1937                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1938                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1939                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1940                         BPF_MOV64_IMM(BPF_REG_0, 0),
1941                         BPF_EXIT_INSN(),
1942                 },
1943                 .errstr_unpriv = "R2 pointer arithmetic",
1944                 .result_unpriv = REJECT,
1945                 .result = ACCEPT,
1946         },
1947         {
1948                 "raw_stack: no skb_load_bytes",
1949                 .insns = {
1950                         BPF_MOV64_IMM(BPF_REG_2, 4),
1951                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1953                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1954                         BPF_MOV64_IMM(BPF_REG_4, 8),
1955                         /* Call to skb_load_bytes() omitted. */
1956                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1957                         BPF_EXIT_INSN(),
1958                 },
1959                 .result = REJECT,
1960                 .errstr = "invalid read from stack off -8+0 size 8",
1961                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1962         },
1963         {
1964                 "raw_stack: skb_load_bytes, negative len",
1965                 .insns = {
1966                         BPF_MOV64_IMM(BPF_REG_2, 4),
1967                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1969                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1970                         BPF_MOV64_IMM(BPF_REG_4, -8),
1971                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1972                                      BPF_FUNC_skb_load_bytes),
1973                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1974                         BPF_EXIT_INSN(),
1975                 },
1976                 .result = REJECT,
1977                 .errstr = "invalid stack type R3",
1978                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1979         },
1980         {
1981                 "raw_stack: skb_load_bytes, negative len 2",
1982                 .insns = {
1983                         BPF_MOV64_IMM(BPF_REG_2, 4),
1984                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
1985                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
1986                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
1987                         BPF_MOV64_IMM(BPF_REG_4, ~0),
1988                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1989                                      BPF_FUNC_skb_load_bytes),
1990                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1991                         BPF_EXIT_INSN(),
1992                 },
1993                 .result = REJECT,
1994                 .errstr = "invalid stack type R3",
1995                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1996         },
1997         {
1998                 "raw_stack: skb_load_bytes, zero len",
1999                 .insns = {
2000                         BPF_MOV64_IMM(BPF_REG_2, 4),
2001                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2002                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2003                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2004                         BPF_MOV64_IMM(BPF_REG_4, 0),
2005                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2006                                      BPF_FUNC_skb_load_bytes),
2007                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2008                         BPF_EXIT_INSN(),
2009                 },
2010                 .result = REJECT,
2011                 .errstr = "invalid stack type R3",
2012                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2013         },
2014         {
2015                 "raw_stack: skb_load_bytes, no init",
2016                 .insns = {
2017                         BPF_MOV64_IMM(BPF_REG_2, 4),
2018                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2019                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2020                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2021                         BPF_MOV64_IMM(BPF_REG_4, 8),
2022                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2023                                      BPF_FUNC_skb_load_bytes),
2024                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2025                         BPF_EXIT_INSN(),
2026                 },
2027                 .result = ACCEPT,
2028                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2029         },
2030         {
2031                 "raw_stack: skb_load_bytes, init",
2032                 .insns = {
2033                         BPF_MOV64_IMM(BPF_REG_2, 4),
2034                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2035                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2036                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2037                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2038                         BPF_MOV64_IMM(BPF_REG_4, 8),
2039                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2040                                      BPF_FUNC_skb_load_bytes),
2041                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2042                         BPF_EXIT_INSN(),
2043                 },
2044                 .result = ACCEPT,
2045                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2046         },
2047         {
2048                 "raw_stack: skb_load_bytes, spilled regs around bounds",
2049                 .insns = {
2050                         BPF_MOV64_IMM(BPF_REG_2, 4),
2051                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2052                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2053                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2054                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2055                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2056                         BPF_MOV64_IMM(BPF_REG_4, 8),
2057                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2058                                      BPF_FUNC_skb_load_bytes),
2059                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2060                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2061                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2062                                     offsetof(struct __sk_buff, mark)),
2063                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2064                                     offsetof(struct __sk_buff, priority)),
2065                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2066                         BPF_EXIT_INSN(),
2067                 },
2068                 .result = ACCEPT,
2069                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2070         },
2071         {
2072                 "raw_stack: skb_load_bytes, spilled regs corruption",
2073                 .insns = {
2074                         BPF_MOV64_IMM(BPF_REG_2, 4),
2075                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2076                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2077                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2078                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2079                         BPF_MOV64_IMM(BPF_REG_4, 8),
2080                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2081                                      BPF_FUNC_skb_load_bytes),
2082                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2083                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2084                                     offsetof(struct __sk_buff, mark)),
2085                         BPF_EXIT_INSN(),
2086                 },
2087                 .result = REJECT,
2088                 .errstr = "R0 invalid mem access 'inv'",
2089                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2090         },
2091         {
2092                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2093                 .insns = {
2094                         BPF_MOV64_IMM(BPF_REG_2, 4),
2095                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2097                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2098                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2099                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2100                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2101                         BPF_MOV64_IMM(BPF_REG_4, 8),
2102                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2103                                      BPF_FUNC_skb_load_bytes),
2104                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2105                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2106                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2107                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2108                                     offsetof(struct __sk_buff, mark)),
2109                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2110                                     offsetof(struct __sk_buff, priority)),
2111                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2112                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2113                                     offsetof(struct __sk_buff, pkt_type)),
2114                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2115                         BPF_EXIT_INSN(),
2116                 },
2117                 .result = REJECT,
2118                 .errstr = "R3 invalid mem access 'inv'",
2119                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2120         },
2121         {
2122                 "raw_stack: skb_load_bytes, spilled regs + data",
2123                 .insns = {
2124                         BPF_MOV64_IMM(BPF_REG_2, 4),
2125                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2126                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2127                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2128                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2129                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2130                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2131                         BPF_MOV64_IMM(BPF_REG_4, 8),
2132                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2133                                      BPF_FUNC_skb_load_bytes),
2134                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2135                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2136                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2137                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2138                                     offsetof(struct __sk_buff, mark)),
2139                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2140                                     offsetof(struct __sk_buff, priority)),
2141                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2142                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2143                         BPF_EXIT_INSN(),
2144                 },
2145                 .result = ACCEPT,
2146                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2147         },
2148         {
2149                 "raw_stack: skb_load_bytes, invalid access 1",
2150                 .insns = {
2151                         BPF_MOV64_IMM(BPF_REG_2, 4),
2152                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2153                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2154                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2155                         BPF_MOV64_IMM(BPF_REG_4, 8),
2156                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2157                                      BPF_FUNC_skb_load_bytes),
2158                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2159                         BPF_EXIT_INSN(),
2160                 },
2161                 .result = REJECT,
2162                 .errstr = "invalid stack type R3 off=-513 access_size=8",
2163                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2164         },
2165         {
2166                 "raw_stack: skb_load_bytes, invalid access 2",
2167                 .insns = {
2168                         BPF_MOV64_IMM(BPF_REG_2, 4),
2169                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2171                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2172                         BPF_MOV64_IMM(BPF_REG_4, 8),
2173                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2174                                      BPF_FUNC_skb_load_bytes),
2175                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2176                         BPF_EXIT_INSN(),
2177                 },
2178                 .result = REJECT,
2179                 .errstr = "invalid stack type R3 off=-1 access_size=8",
2180                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2181         },
2182         {
2183                 "raw_stack: skb_load_bytes, invalid access 3",
2184                 .insns = {
2185                         BPF_MOV64_IMM(BPF_REG_2, 4),
2186                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2187                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2188                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2189                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2190                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2191                                      BPF_FUNC_skb_load_bytes),
2192                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2193                         BPF_EXIT_INSN(),
2194                 },
2195                 .result = REJECT,
2196                 .errstr = "invalid stack type R3 off=-1 access_size=-1",
2197                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2198         },
2199         {
2200                 "raw_stack: skb_load_bytes, invalid access 4",
2201                 .insns = {
2202                         BPF_MOV64_IMM(BPF_REG_2, 4),
2203                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2204                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2205                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2206                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2207                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2208                                      BPF_FUNC_skb_load_bytes),
2209                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2210                         BPF_EXIT_INSN(),
2211                 },
2212                 .result = REJECT,
2213                 .errstr = "invalid stack type R3 off=-1 access_size=2147483647",
2214                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2215         },
2216         {
2217                 "raw_stack: skb_load_bytes, invalid access 5",
2218                 .insns = {
2219                         BPF_MOV64_IMM(BPF_REG_2, 4),
2220                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2221                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2222                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2223                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
2224                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2225                                      BPF_FUNC_skb_load_bytes),
2226                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2227                         BPF_EXIT_INSN(),
2228                 },
2229                 .result = REJECT,
2230                 .errstr = "invalid stack type R3 off=-512 access_size=2147483647",
2231                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2232         },
2233         {
2234                 "raw_stack: skb_load_bytes, invalid access 6",
2235                 .insns = {
2236                         BPF_MOV64_IMM(BPF_REG_2, 4),
2237                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2239                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2240                         BPF_MOV64_IMM(BPF_REG_4, 0),
2241                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2242                                      BPF_FUNC_skb_load_bytes),
2243                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2244                         BPF_EXIT_INSN(),
2245                 },
2246                 .result = REJECT,
2247                 .errstr = "invalid stack type R3 off=-512 access_size=0",
2248                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2249         },
2250         {
2251                 "raw_stack: skb_load_bytes, large access",
2252                 .insns = {
2253                         BPF_MOV64_IMM(BPF_REG_2, 4),
2254                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2255                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
2256                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2257                         BPF_MOV64_IMM(BPF_REG_4, 512),
2258                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2259                                      BPF_FUNC_skb_load_bytes),
2260                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2261                         BPF_EXIT_INSN(),
2262                 },
2263                 .result = ACCEPT,
2264                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2265         },
2266         {
2267                 "direct packet access: test1",
2268                 .insns = {
2269                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2270                                     offsetof(struct __sk_buff, data)),
2271                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2272                                     offsetof(struct __sk_buff, data_end)),
2273                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2275                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2276                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2277                         BPF_MOV64_IMM(BPF_REG_0, 0),
2278                         BPF_EXIT_INSN(),
2279                 },
2280                 .result = ACCEPT,
2281                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2282         },
2283         {
2284                 "direct packet access: test2",
2285                 .insns = {
2286                         BPF_MOV64_IMM(BPF_REG_0, 1),
2287                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
2288                                     offsetof(struct __sk_buff, data_end)),
2289                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2290                                     offsetof(struct __sk_buff, data)),
2291                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2292                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
2293                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
2294                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
2295                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
2296                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
2297                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2298                                     offsetof(struct __sk_buff, data)),
2299                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
2300                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
2301                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 48),
2302                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 48),
2303                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
2304                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
2305                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2306                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2307                                     offsetof(struct __sk_buff, data_end)),
2308                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
2309                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
2310                         BPF_MOV64_IMM(BPF_REG_0, 0),
2311                         BPF_EXIT_INSN(),
2312                 },
2313                 .result = ACCEPT,
2314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2315         },
2316         {
2317                 "direct packet access: test3",
2318                 .insns = {
2319                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2320                                     offsetof(struct __sk_buff, data)),
2321                         BPF_MOV64_IMM(BPF_REG_0, 0),
2322                         BPF_EXIT_INSN(),
2323                 },
2324                 .errstr = "invalid bpf_context access off=76",
2325                 .result = REJECT,
2326                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2327         },
2328         {
2329                 "direct packet access: test4 (write)",
2330                 .insns = {
2331                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2332                                     offsetof(struct __sk_buff, data)),
2333                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2334                                     offsetof(struct __sk_buff, data_end)),
2335                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2337                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2338                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2339                         BPF_MOV64_IMM(BPF_REG_0, 0),
2340                         BPF_EXIT_INSN(),
2341                 },
2342                 .result = ACCEPT,
2343                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2344         },
2345         {
2346                 "direct packet access: test5 (pkt_end >= reg, good access)",
2347                 .insns = {
2348                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2349                                     offsetof(struct __sk_buff, data)),
2350                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2351                                     offsetof(struct __sk_buff, data_end)),
2352                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2353                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2354                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2355                         BPF_MOV64_IMM(BPF_REG_0, 1),
2356                         BPF_EXIT_INSN(),
2357                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2358                         BPF_MOV64_IMM(BPF_REG_0, 0),
2359                         BPF_EXIT_INSN(),
2360                 },
2361                 .result = ACCEPT,
2362                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2363         },
2364         {
2365                 "direct packet access: test6 (pkt_end >= reg, bad access)",
2366                 .insns = {
2367                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2368                                     offsetof(struct __sk_buff, data)),
2369                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2370                                     offsetof(struct __sk_buff, data_end)),
2371                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2372                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2373                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2374                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2375                         BPF_MOV64_IMM(BPF_REG_0, 1),
2376                         BPF_EXIT_INSN(),
2377                         BPF_MOV64_IMM(BPF_REG_0, 0),
2378                         BPF_EXIT_INSN(),
2379                 },
2380                 .errstr = "invalid access to packet",
2381                 .result = REJECT,
2382                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2383         },
2384         {
2385                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
2386                 .insns = {
2387                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2388                                     offsetof(struct __sk_buff, data)),
2389                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2390                                     offsetof(struct __sk_buff, data_end)),
2391                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2392                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2393                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
2394                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2395                         BPF_MOV64_IMM(BPF_REG_0, 1),
2396                         BPF_EXIT_INSN(),
2397                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2398                         BPF_MOV64_IMM(BPF_REG_0, 0),
2399                         BPF_EXIT_INSN(),
2400                 },
2401                 .errstr = "invalid access to packet",
2402                 .result = REJECT,
2403                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2404         },
2405         {
2406                 "direct packet access: test8 (double test, variant 1)",
2407                 .insns = {
2408                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2409                                     offsetof(struct __sk_buff, data)),
2410                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2411                                     offsetof(struct __sk_buff, data_end)),
2412                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2413                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2414                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
2415                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2416                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2417                         BPF_MOV64_IMM(BPF_REG_0, 1),
2418                         BPF_EXIT_INSN(),
2419                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2420                         BPF_MOV64_IMM(BPF_REG_0, 0),
2421                         BPF_EXIT_INSN(),
2422                 },
2423                 .result = ACCEPT,
2424                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2425         },
2426         {
2427                 "direct packet access: test9 (double test, variant 2)",
2428                 .insns = {
2429                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2430                                     offsetof(struct __sk_buff, data)),
2431                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2432                                     offsetof(struct __sk_buff, data_end)),
2433                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2435                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
2436                         BPF_MOV64_IMM(BPF_REG_0, 1),
2437                         BPF_EXIT_INSN(),
2438                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2439                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2440                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
2441                         BPF_MOV64_IMM(BPF_REG_0, 0),
2442                         BPF_EXIT_INSN(),
2443                 },
2444                 .result = ACCEPT,
2445                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2446         },
2447         {
2448                 "direct packet access: test10 (write invalid)",
2449                 .insns = {
2450                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2451                                     offsetof(struct __sk_buff, data)),
2452                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2453                                     offsetof(struct __sk_buff, data_end)),
2454                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2455                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2456                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
2457                         BPF_MOV64_IMM(BPF_REG_0, 0),
2458                         BPF_EXIT_INSN(),
2459                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2460                         BPF_MOV64_IMM(BPF_REG_0, 0),
2461                         BPF_EXIT_INSN(),
2462                 },
2463                 .errstr = "invalid access to packet",
2464                 .result = REJECT,
2465                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2466         },
2467         {
2468                 "direct packet access: test11 (shift, good access)",
2469                 .insns = {
2470                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2471                                     offsetof(struct __sk_buff, data)),
2472                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2473                                     offsetof(struct __sk_buff, data_end)),
2474                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2475                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2476                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2477                         BPF_MOV64_IMM(BPF_REG_3, 144),
2478                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2480                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
2481                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2482                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2483                         BPF_MOV64_IMM(BPF_REG_0, 1),
2484                         BPF_EXIT_INSN(),
2485                         BPF_MOV64_IMM(BPF_REG_0, 0),
2486                         BPF_EXIT_INSN(),
2487                 },
2488                 .result = ACCEPT,
2489                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2490         },
2491         {
2492                 "direct packet access: test12 (and, good access)",
2493                 .insns = {
2494                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2495                                     offsetof(struct __sk_buff, data)),
2496                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2497                                     offsetof(struct __sk_buff, data_end)),
2498                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2500                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2501                         BPF_MOV64_IMM(BPF_REG_3, 144),
2502                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2503                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2504                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2505                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2506                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2507                         BPF_MOV64_IMM(BPF_REG_0, 1),
2508                         BPF_EXIT_INSN(),
2509                         BPF_MOV64_IMM(BPF_REG_0, 0),
2510                         BPF_EXIT_INSN(),
2511                 },
2512                 .result = ACCEPT,
2513                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2514         },
2515         {
2516                 "direct packet access: test13 (branches, good access)",
2517                 .insns = {
2518                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2519                                     offsetof(struct __sk_buff, data)),
2520                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2521                                     offsetof(struct __sk_buff, data_end)),
2522                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2524                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
2525                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2526                                     offsetof(struct __sk_buff, mark)),
2527                         BPF_MOV64_IMM(BPF_REG_4, 1),
2528                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
2529                         BPF_MOV64_IMM(BPF_REG_3, 14),
2530                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
2531                         BPF_MOV64_IMM(BPF_REG_3, 24),
2532                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
2533                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
2534                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
2535                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2536                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2537                         BPF_MOV64_IMM(BPF_REG_0, 1),
2538                         BPF_EXIT_INSN(),
2539                         BPF_MOV64_IMM(BPF_REG_0, 0),
2540                         BPF_EXIT_INSN(),
2541                 },
2542                 .result = ACCEPT,
2543                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2544         },
2545         {
2546                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
2547                 .insns = {
2548                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2549                                     offsetof(struct __sk_buff, data)),
2550                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2551                                     offsetof(struct __sk_buff, data_end)),
2552                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
2554                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
2555                         BPF_MOV64_IMM(BPF_REG_5, 12),
2556                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
2557                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
2558                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
2559                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
2560                         BPF_MOV64_IMM(BPF_REG_0, 1),
2561                         BPF_EXIT_INSN(),
2562                         BPF_MOV64_IMM(BPF_REG_0, 0),
2563                         BPF_EXIT_INSN(),
2564                 },
2565                 .result = ACCEPT,
2566                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2567         },
2568         {
2569                 "direct packet access: test15 (spill with xadd)",
2570                 .insns = {
2571                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2572                                     offsetof(struct __sk_buff, data)),
2573                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2574                                     offsetof(struct __sk_buff, data_end)),
2575                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2577                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
2578                         BPF_MOV64_IMM(BPF_REG_5, 4096),
2579                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
2580                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
2581                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
2582                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
2583                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
2584                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
2585                         BPF_MOV64_IMM(BPF_REG_0, 0),
2586                         BPF_EXIT_INSN(),
2587                 },
2588                 .errstr = "R2 invalid mem access 'inv'",
2589                 .result = REJECT,
2590                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2591         },
2592         {
2593                 "direct packet access: test16 (arith on data_end)",
2594                 .insns = {
2595                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2596                                     offsetof(struct __sk_buff, data)),
2597                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2598                                     offsetof(struct __sk_buff, data_end)),
2599                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
2600                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
2601                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
2602                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
2603                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
2604                         BPF_MOV64_IMM(BPF_REG_0, 0),
2605                         BPF_EXIT_INSN(),
2606                 },
2607                 .errstr = "invalid access to packet",
2608                 .result = REJECT,
2609                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2610         },
2611         {
2612                 "helper access to packet: test1, valid packet_ptr range",
2613                 .insns = {
2614                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2615                                     offsetof(struct xdp_md, data)),
2616                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2617                                     offsetof(struct xdp_md, data_end)),
2618                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2619                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2620                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2621                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2622                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2623                         BPF_MOV64_IMM(BPF_REG_4, 0),
2624                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2625                                      BPF_FUNC_map_update_elem),
2626                         BPF_MOV64_IMM(BPF_REG_0, 0),
2627                         BPF_EXIT_INSN(),
2628                 },
2629                 .fixup_map1 = { 5 },
2630                 .result_unpriv = ACCEPT,
2631                 .result = ACCEPT,
2632                 .prog_type = BPF_PROG_TYPE_XDP,
2633         },
2634         {
2635                 "helper access to packet: test2, unchecked packet_ptr",
2636                 .insns = {
2637                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2638                                     offsetof(struct xdp_md, data)),
2639                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2640                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2641                                      BPF_FUNC_map_lookup_elem),
2642                         BPF_MOV64_IMM(BPF_REG_0, 0),
2643                         BPF_EXIT_INSN(),
2644                 },
2645                 .fixup_map1 = { 1 },
2646                 .result = REJECT,
2647                 .errstr = "invalid access to packet",
2648                 .prog_type = BPF_PROG_TYPE_XDP,
2649         },
2650         {
2651                 "helper access to packet: test3, variable add",
2652                 .insns = {
2653                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2654                                         offsetof(struct xdp_md, data)),
2655                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2656                                         offsetof(struct xdp_md, data_end)),
2657                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2658                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2659                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2660                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2661                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2662                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2663                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2664                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2665                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2666                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2667                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2668                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2669                                      BPF_FUNC_map_lookup_elem),
2670                         BPF_MOV64_IMM(BPF_REG_0, 0),
2671                         BPF_EXIT_INSN(),
2672                 },
2673                 .fixup_map1 = { 11 },
2674                 .result = ACCEPT,
2675                 .prog_type = BPF_PROG_TYPE_XDP,
2676         },
2677         {
2678                 "helper access to packet: test4, packet_ptr with bad range",
2679                 .insns = {
2680                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2681                                     offsetof(struct xdp_md, data)),
2682                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2683                                     offsetof(struct xdp_md, data_end)),
2684                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2685                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2686                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2687                         BPF_MOV64_IMM(BPF_REG_0, 0),
2688                         BPF_EXIT_INSN(),
2689                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2690                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2691                                      BPF_FUNC_map_lookup_elem),
2692                         BPF_MOV64_IMM(BPF_REG_0, 0),
2693                         BPF_EXIT_INSN(),
2694                 },
2695                 .fixup_map1 = { 7 },
2696                 .result = REJECT,
2697                 .errstr = "invalid access to packet",
2698                 .prog_type = BPF_PROG_TYPE_XDP,
2699         },
2700         {
2701                 "helper access to packet: test5, packet_ptr with too short range",
2702                 .insns = {
2703                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2704                                     offsetof(struct xdp_md, data)),
2705                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2706                                     offsetof(struct xdp_md, data_end)),
2707                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2708                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2709                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2710                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2711                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2712                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2713                                      BPF_FUNC_map_lookup_elem),
2714                         BPF_MOV64_IMM(BPF_REG_0, 0),
2715                         BPF_EXIT_INSN(),
2716                 },
2717                 .fixup_map1 = { 6 },
2718                 .result = REJECT,
2719                 .errstr = "invalid access to packet",
2720                 .prog_type = BPF_PROG_TYPE_XDP,
2721         },
2722         {
2723                 "helper access to packet: test6, cls valid packet_ptr range",
2724                 .insns = {
2725                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2726                                     offsetof(struct __sk_buff, data)),
2727                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2728                                     offsetof(struct __sk_buff, data_end)),
2729                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
2730                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2731                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
2732                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2733                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2734                         BPF_MOV64_IMM(BPF_REG_4, 0),
2735                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2736                                      BPF_FUNC_map_update_elem),
2737                         BPF_MOV64_IMM(BPF_REG_0, 0),
2738                         BPF_EXIT_INSN(),
2739                 },
2740                 .fixup_map1 = { 5 },
2741                 .result = ACCEPT,
2742                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2743         },
2744         {
2745                 "helper access to packet: test7, cls unchecked packet_ptr",
2746                 .insns = {
2747                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2748                                     offsetof(struct __sk_buff, data)),
2749                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2750                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2751                                      BPF_FUNC_map_lookup_elem),
2752                         BPF_MOV64_IMM(BPF_REG_0, 0),
2753                         BPF_EXIT_INSN(),
2754                 },
2755                 .fixup_map1 = { 1 },
2756                 .result = REJECT,
2757                 .errstr = "invalid access to packet",
2758                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2759         },
2760         {
2761                 "helper access to packet: test8, cls variable add",
2762                 .insns = {
2763                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2764                                         offsetof(struct __sk_buff, data)),
2765                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2766                                         offsetof(struct __sk_buff, data_end)),
2767                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2768                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
2769                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
2770                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
2771                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2772                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
2773                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
2774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
2775                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
2776                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2777                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
2778                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2779                                      BPF_FUNC_map_lookup_elem),
2780                         BPF_MOV64_IMM(BPF_REG_0, 0),
2781                         BPF_EXIT_INSN(),
2782                 },
2783                 .fixup_map1 = { 11 },
2784                 .result = ACCEPT,
2785                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2786         },
2787         {
2788                 "helper access to packet: test9, cls packet_ptr with bad range",
2789                 .insns = {
2790                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2791                                     offsetof(struct __sk_buff, data)),
2792                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2793                                     offsetof(struct __sk_buff, data_end)),
2794                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2795                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
2796                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
2797                         BPF_MOV64_IMM(BPF_REG_0, 0),
2798                         BPF_EXIT_INSN(),
2799                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2800                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2801                                      BPF_FUNC_map_lookup_elem),
2802                         BPF_MOV64_IMM(BPF_REG_0, 0),
2803                         BPF_EXIT_INSN(),
2804                 },
2805                 .fixup_map1 = { 7 },
2806                 .result = REJECT,
2807                 .errstr = "invalid access to packet",
2808                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2809         },
2810         {
2811                 "helper access to packet: test10, cls packet_ptr with too short range",
2812                 .insns = {
2813                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
2814                                     offsetof(struct __sk_buff, data)),
2815                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
2816                                     offsetof(struct __sk_buff, data_end)),
2817                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
2818                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2819                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
2820                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
2821                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2822                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2823                                      BPF_FUNC_map_lookup_elem),
2824                         BPF_MOV64_IMM(BPF_REG_0, 0),
2825                         BPF_EXIT_INSN(),
2826                 },
2827                 .fixup_map1 = { 6 },
2828                 .result = REJECT,
2829                 .errstr = "invalid access to packet",
2830                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2831         },
2832         {
2833                 "helper access to packet: test11, cls unsuitable helper 1",
2834                 .insns = {
2835                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2836                                     offsetof(struct __sk_buff, data)),
2837                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2838                                     offsetof(struct __sk_buff, data_end)),
2839                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2840                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2841                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
2842                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
2843                         BPF_MOV64_IMM(BPF_REG_2, 0),
2844                         BPF_MOV64_IMM(BPF_REG_4, 42),
2845                         BPF_MOV64_IMM(BPF_REG_5, 0),
2846                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2847                                      BPF_FUNC_skb_store_bytes),
2848                         BPF_MOV64_IMM(BPF_REG_0, 0),
2849                         BPF_EXIT_INSN(),
2850                 },
2851                 .result = REJECT,
2852                 .errstr = "helper access to the packet",
2853                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2854         },
2855         {
2856                 "helper access to packet: test12, cls unsuitable helper 2",
2857                 .insns = {
2858                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2859                                     offsetof(struct __sk_buff, data)),
2860                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2861                                     offsetof(struct __sk_buff, data_end)),
2862                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2863                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
2864                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
2865                         BPF_MOV64_IMM(BPF_REG_2, 0),
2866                         BPF_MOV64_IMM(BPF_REG_4, 4),
2867                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2868                                      BPF_FUNC_skb_load_bytes),
2869                         BPF_MOV64_IMM(BPF_REG_0, 0),
2870                         BPF_EXIT_INSN(),
2871                 },
2872                 .result = REJECT,
2873                 .errstr = "helper access to the packet",
2874                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2875         },
2876         {
2877                 "helper access to packet: test13, cls helper ok",
2878                 .insns = {
2879                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2880                                     offsetof(struct __sk_buff, data)),
2881                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2882                                     offsetof(struct __sk_buff, data_end)),
2883                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2884                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2885                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2886                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2887                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2888                         BPF_MOV64_IMM(BPF_REG_2, 4),
2889                         BPF_MOV64_IMM(BPF_REG_3, 0),
2890                         BPF_MOV64_IMM(BPF_REG_4, 0),
2891                         BPF_MOV64_IMM(BPF_REG_5, 0),
2892                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2893                                      BPF_FUNC_csum_diff),
2894                         BPF_MOV64_IMM(BPF_REG_0, 0),
2895                         BPF_EXIT_INSN(),
2896                 },
2897                 .result = ACCEPT,
2898                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2899         },
2900         {
2901                 "helper access to packet: test14, cls helper fail sub",
2902                 .insns = {
2903                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2904                                     offsetof(struct __sk_buff, data)),
2905                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2906                                     offsetof(struct __sk_buff, data_end)),
2907                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2908                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2909                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2910                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2911                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
2912                         BPF_MOV64_IMM(BPF_REG_2, 4),
2913                         BPF_MOV64_IMM(BPF_REG_3, 0),
2914                         BPF_MOV64_IMM(BPF_REG_4, 0),
2915                         BPF_MOV64_IMM(BPF_REG_5, 0),
2916                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2917                                      BPF_FUNC_csum_diff),
2918                         BPF_MOV64_IMM(BPF_REG_0, 0),
2919                         BPF_EXIT_INSN(),
2920                 },
2921                 .result = REJECT,
2922                 .errstr = "type=inv expected=fp",
2923                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2924         },
2925         {
2926                 "helper access to packet: test15, cls helper fail range 1",
2927                 .insns = {
2928                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2929                                     offsetof(struct __sk_buff, data)),
2930                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2931                                     offsetof(struct __sk_buff, data_end)),
2932                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2933                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2934                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2935                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2936                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2937                         BPF_MOV64_IMM(BPF_REG_2, 8),
2938                         BPF_MOV64_IMM(BPF_REG_3, 0),
2939                         BPF_MOV64_IMM(BPF_REG_4, 0),
2940                         BPF_MOV64_IMM(BPF_REG_5, 0),
2941                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2942                                      BPF_FUNC_csum_diff),
2943                         BPF_MOV64_IMM(BPF_REG_0, 0),
2944                         BPF_EXIT_INSN(),
2945                 },
2946                 .result = REJECT,
2947                 .errstr = "invalid access to packet",
2948                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2949         },
2950         {
2951                 "helper access to packet: test16, cls helper fail range 2",
2952                 .insns = {
2953                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2954                                     offsetof(struct __sk_buff, data)),
2955                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2956                                     offsetof(struct __sk_buff, data_end)),
2957                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2958                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2959                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2960                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2961                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2962                         BPF_MOV64_IMM(BPF_REG_2, -9),
2963                         BPF_MOV64_IMM(BPF_REG_3, 0),
2964                         BPF_MOV64_IMM(BPF_REG_4, 0),
2965                         BPF_MOV64_IMM(BPF_REG_5, 0),
2966                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2967                                      BPF_FUNC_csum_diff),
2968                         BPF_MOV64_IMM(BPF_REG_0, 0),
2969                         BPF_EXIT_INSN(),
2970                 },
2971                 .result = REJECT,
2972                 .errstr = "invalid access to packet",
2973                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2974         },
2975         {
2976                 "helper access to packet: test17, cls helper fail range 3",
2977                 .insns = {
2978                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
2979                                     offsetof(struct __sk_buff, data)),
2980                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
2981                                     offsetof(struct __sk_buff, data_end)),
2982                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
2983                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
2985                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
2986                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
2987                         BPF_MOV64_IMM(BPF_REG_2, ~0),
2988                         BPF_MOV64_IMM(BPF_REG_3, 0),
2989                         BPF_MOV64_IMM(BPF_REG_4, 0),
2990                         BPF_MOV64_IMM(BPF_REG_5, 0),
2991                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2992                                      BPF_FUNC_csum_diff),
2993                         BPF_MOV64_IMM(BPF_REG_0, 0),
2994                         BPF_EXIT_INSN(),
2995                 },
2996                 .result = REJECT,
2997                 .errstr = "invalid access to packet",
2998                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2999         },
3000         {
3001                 "helper access to packet: test18, cls helper fail range zero",
3002                 .insns = {
3003                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3004                                     offsetof(struct __sk_buff, data)),
3005                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3006                                     offsetof(struct __sk_buff, data_end)),
3007                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3008                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3009                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3010                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3011                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3012                         BPF_MOV64_IMM(BPF_REG_2, 0),
3013                         BPF_MOV64_IMM(BPF_REG_3, 0),
3014                         BPF_MOV64_IMM(BPF_REG_4, 0),
3015                         BPF_MOV64_IMM(BPF_REG_5, 0),
3016                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3017                                      BPF_FUNC_csum_diff),
3018                         BPF_MOV64_IMM(BPF_REG_0, 0),
3019                         BPF_EXIT_INSN(),
3020                 },
3021                 .result = REJECT,
3022                 .errstr = "invalid access to packet",
3023                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3024         },
3025         {
3026                 "helper access to packet: test19, pkt end as input",
3027                 .insns = {
3028                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3029                                     offsetof(struct __sk_buff, data)),
3030                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3031                                     offsetof(struct __sk_buff, data_end)),
3032                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3033                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3034                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3035                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3036                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
3037                         BPF_MOV64_IMM(BPF_REG_2, 4),
3038                         BPF_MOV64_IMM(BPF_REG_3, 0),
3039                         BPF_MOV64_IMM(BPF_REG_4, 0),
3040                         BPF_MOV64_IMM(BPF_REG_5, 0),
3041                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3042                                      BPF_FUNC_csum_diff),
3043                         BPF_MOV64_IMM(BPF_REG_0, 0),
3044                         BPF_EXIT_INSN(),
3045                 },
3046                 .result = REJECT,
3047                 .errstr = "R1 type=pkt_end expected=fp",
3048                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3049         },
3050         {
3051                 "helper access to packet: test20, wrong reg",
3052                 .insns = {
3053                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3054                                     offsetof(struct __sk_buff, data)),
3055                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3056                                     offsetof(struct __sk_buff, data_end)),
3057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3058                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3059                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3060                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3061                         BPF_MOV64_IMM(BPF_REG_2, 4),
3062                         BPF_MOV64_IMM(BPF_REG_3, 0),
3063                         BPF_MOV64_IMM(BPF_REG_4, 0),
3064                         BPF_MOV64_IMM(BPF_REG_5, 0),
3065                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3066                                      BPF_FUNC_csum_diff),
3067                         BPF_MOV64_IMM(BPF_REG_0, 0),
3068                         BPF_EXIT_INSN(),
3069                 },
3070                 .result = REJECT,
3071                 .errstr = "invalid access to packet",
3072                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3073         },
3074         {
3075                 "valid map access into an array with a constant",
3076                 .insns = {
3077                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3078                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3080                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3081                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3082                                      BPF_FUNC_map_lookup_elem),
3083                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3084                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3085                                    offsetof(struct test_val, foo)),
3086                         BPF_EXIT_INSN(),
3087                 },
3088                 .fixup_map2 = { 3 },
3089                 .errstr_unpriv = "R0 leaks addr",
3090                 .result_unpriv = REJECT,
3091                 .result = ACCEPT,
3092         },
3093         {
3094                 "valid map access into an array with a register",
3095                 .insns = {
3096                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3097                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3099                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3100                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3101                                      BPF_FUNC_map_lookup_elem),
3102                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3103                         BPF_MOV64_IMM(BPF_REG_1, 4),
3104                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3105                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3106                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3107                                    offsetof(struct test_val, foo)),
3108                         BPF_EXIT_INSN(),
3109                 },
3110                 .fixup_map2 = { 3 },
3111                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3112                 .result_unpriv = REJECT,
3113                 .result = ACCEPT,
3114                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3115         },
3116         {
3117                 "valid map access into an array with a variable",
3118                 .insns = {
3119                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3120                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3121                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3122                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3123                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3124                                      BPF_FUNC_map_lookup_elem),
3125                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3126                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3127                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
3128                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3129                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3130                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3131                                    offsetof(struct test_val, foo)),
3132                         BPF_EXIT_INSN(),
3133                 },
3134                 .fixup_map2 = { 3 },
3135                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3136                 .result_unpriv = REJECT,
3137                 .result = ACCEPT,
3138                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3139         },
3140         {
3141                 "valid map access into an array with a signed variable",
3142                 .insns = {
3143                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3144                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3145                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3146                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3147                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3148                                      BPF_FUNC_map_lookup_elem),
3149                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
3150                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3151                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
3152                         BPF_MOV32_IMM(BPF_REG_1, 0),
3153                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3154                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3155                         BPF_MOV32_IMM(BPF_REG_1, 0),
3156                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3157                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3158                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3159                                    offsetof(struct test_val, foo)),
3160                         BPF_EXIT_INSN(),
3161                 },
3162                 .fixup_map2 = { 3 },
3163                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3164                 .result_unpriv = REJECT,
3165                 .result = ACCEPT,
3166                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3167         },
3168         {
3169                 "invalid map access into an array with a constant",
3170                 .insns = {
3171                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3172                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3173                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3174                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3175                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3176                                      BPF_FUNC_map_lookup_elem),
3177                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3178                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
3179                                    offsetof(struct test_val, foo)),
3180                         BPF_EXIT_INSN(),
3181                 },
3182                 .fixup_map2 = { 3 },
3183                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
3184                 .result = REJECT,
3185         },
3186         {
3187                 "invalid map access into an array with a register",
3188                 .insns = {
3189                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3190                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3191                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3192                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3193                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3194                                      BPF_FUNC_map_lookup_elem),
3195                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3196                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
3197                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3198                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3199                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3200                                    offsetof(struct test_val, foo)),
3201                         BPF_EXIT_INSN(),
3202                 },
3203                 .fixup_map2 = { 3 },
3204                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3205                 .errstr = "R0 min value is outside of the array range",
3206                 .result_unpriv = REJECT,
3207                 .result = REJECT,
3208                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3209         },
3210         {
3211                 "invalid map access into an array with a variable",
3212                 .insns = {
3213                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3214                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3215                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3216                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3217                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3218                                      BPF_FUNC_map_lookup_elem),
3219                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3220                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3221                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3222                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3223                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3224                                    offsetof(struct test_val, foo)),
3225                         BPF_EXIT_INSN(),
3226                 },
3227                 .fixup_map2 = { 3 },
3228                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3229                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3230                 .result_unpriv = REJECT,
3231                 .result = REJECT,
3232                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3233         },
3234         {
3235                 "invalid map access into an array with no floor check",
3236                 .insns = {
3237                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3238                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3239                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3240                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3241                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3242                                      BPF_FUNC_map_lookup_elem),
3243                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3244                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3245                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
3246                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
3247                         BPF_MOV32_IMM(BPF_REG_1, 0),
3248                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3249                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3250                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3251                                    offsetof(struct test_val, foo)),
3252                         BPF_EXIT_INSN(),
3253                 },
3254                 .fixup_map2 = { 3 },
3255                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3256                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3257                 .result_unpriv = REJECT,
3258                 .result = REJECT,
3259                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3260         },
3261         {
3262                 "invalid map access into an array with a invalid max check",
3263                 .insns = {
3264                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3265                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3266                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3267                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3268                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3269                                      BPF_FUNC_map_lookup_elem),
3270                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
3271                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3272                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
3273                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3274                         BPF_MOV32_IMM(BPF_REG_1, 0),
3275                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
3276                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3277                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
3278                                    offsetof(struct test_val, foo)),
3279                         BPF_EXIT_INSN(),
3280                 },
3281                 .fixup_map2 = { 3 },
3282                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3283                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
3284                 .result_unpriv = REJECT,
3285                 .result = REJECT,
3286                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3287         },
3288         {
3289                 "invalid map access into an array with a invalid max check",
3290                 .insns = {
3291                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3292                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3293                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3294                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3295                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3296                                      BPF_FUNC_map_lookup_elem),
3297                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
3298                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
3299                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3300                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3301                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3302                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3303                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3304                                      BPF_FUNC_map_lookup_elem),
3305                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
3306                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
3307                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3308                                     offsetof(struct test_val, foo)),
3309                         BPF_EXIT_INSN(),
3310                 },
3311                 .fixup_map2 = { 3, 11 },
3312                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3313                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
3314                 .result_unpriv = REJECT,
3315                 .result = REJECT,
3316                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3317         },
3318         {
3319                 "multiple registers share map_lookup_elem result",
3320                 .insns = {
3321                         BPF_MOV64_IMM(BPF_REG_1, 10),
3322                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3323                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3324                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3325                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3326                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3327                                      BPF_FUNC_map_lookup_elem),
3328                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3329                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3330                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3331                         BPF_EXIT_INSN(),
3332                 },
3333                 .fixup_map1 = { 4 },
3334                 .result = ACCEPT,
3335                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3336         },
3337         {
3338                 "invalid memory access with multiple map_lookup_elem calls",
3339                 .insns = {
3340                         BPF_MOV64_IMM(BPF_REG_1, 10),
3341                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3342                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3343                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3344                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3345                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3346                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3347                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3348                                      BPF_FUNC_map_lookup_elem),
3349                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3350                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3351                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3352                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3353                                      BPF_FUNC_map_lookup_elem),
3354                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3355                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3356                         BPF_EXIT_INSN(),
3357                 },
3358                 .fixup_map1 = { 4 },
3359                 .result = REJECT,
3360                 .errstr = "R4 !read_ok",
3361                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3362         },
3363         {
3364                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
3365                 .insns = {
3366                         BPF_MOV64_IMM(BPF_REG_1, 10),
3367                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3368                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3369                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3370                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3371                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
3372                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
3373                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3374                                      BPF_FUNC_map_lookup_elem),
3375                         BPF_MOV64_IMM(BPF_REG_2, 10),
3376                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
3377                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
3378                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
3379                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3380                                      BPF_FUNC_map_lookup_elem),
3381                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3382                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3383                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
3384                         BPF_EXIT_INSN(),
3385                 },
3386                 .fixup_map1 = { 4 },
3387                 .result = ACCEPT,
3388                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3389         },
3390         {
3391                 "multiple registers share map_lookup_elem bad reg type",
3392                 .insns = {
3393                         BPF_MOV64_IMM(BPF_REG_1, 10),
3394                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
3395                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3396                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3397                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3398                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3399                                      BPF_FUNC_map_lookup_elem),
3400                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
3401                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
3402                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3403                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3404                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3405                         BPF_MOV64_IMM(BPF_REG_1, 1),
3406                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
3407                         BPF_MOV64_IMM(BPF_REG_1, 2),
3408                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1),
3409                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 0),
3410                         BPF_MOV64_IMM(BPF_REG_1, 3),
3411                         BPF_EXIT_INSN(),
3412                 },
3413                 .fixup_map1 = { 4 },
3414                 .result = REJECT,
3415                 .errstr = "R3 invalid mem access 'inv'",
3416                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
3417         },
3418         {
3419                 "invalid map access from else condition",
3420                 .insns = {
3421                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
3422                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3424                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3425                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
3426                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3427                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
3428                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
3429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
3430                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
3431                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
3432                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
3433                         BPF_EXIT_INSN(),
3434                 },
3435                 .fixup_map2 = { 3 },
3436                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
3437                 .result = REJECT,
3438                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
3439                 .result_unpriv = REJECT,
3440                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
3441         },
3442         {
3443                 "constant register |= constant should keep constant type",
3444                 .insns = {
3445                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3446                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3447                         BPF_MOV64_IMM(BPF_REG_2, 34),
3448                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
3449                         BPF_MOV64_IMM(BPF_REG_3, 0),
3450                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3451                         BPF_EXIT_INSN(),
3452                 },
3453                 .result = ACCEPT,
3454                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3455         },
3456         {
3457                 "constant register |= constant should not bypass stack boundary checks",
3458                 .insns = {
3459                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3461                         BPF_MOV64_IMM(BPF_REG_2, 34),
3462                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
3463                         BPF_MOV64_IMM(BPF_REG_3, 0),
3464                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3465                         BPF_EXIT_INSN(),
3466                 },
3467                 .errstr = "invalid stack type R1 off=-48 access_size=58",
3468                 .result = REJECT,
3469                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3470         },
3471         {
3472                 "constant register |= constant register should keep constant type",
3473                 .insns = {
3474                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3475                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3476                         BPF_MOV64_IMM(BPF_REG_2, 34),
3477                         BPF_MOV64_IMM(BPF_REG_4, 13),
3478                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3479                         BPF_MOV64_IMM(BPF_REG_3, 0),
3480                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3481                         BPF_EXIT_INSN(),
3482                 },
3483                 .result = ACCEPT,
3484                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3485         },
3486         {
3487                 "constant register |= constant register should not bypass stack boundary checks",
3488                 .insns = {
3489                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
3490                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
3491                         BPF_MOV64_IMM(BPF_REG_2, 34),
3492                         BPF_MOV64_IMM(BPF_REG_4, 24),
3493                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
3494                         BPF_MOV64_IMM(BPF_REG_3, 0),
3495                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3496                         BPF_EXIT_INSN(),
3497                 },
3498                 .errstr = "invalid stack type R1 off=-48 access_size=58",
3499                 .result = REJECT,
3500                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3501         },
3502         {
3503                 "invalid direct packet write for LWT_IN",
3504                 .insns = {
3505                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3506                                     offsetof(struct __sk_buff, data)),
3507                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3508                                     offsetof(struct __sk_buff, data_end)),
3509                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3510                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3511                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3512                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3513                         BPF_MOV64_IMM(BPF_REG_0, 0),
3514                         BPF_EXIT_INSN(),
3515                 },
3516                 .errstr = "cannot write into packet",
3517                 .result = REJECT,
3518                 .prog_type = BPF_PROG_TYPE_LWT_IN,
3519         },
3520         {
3521                 "invalid direct packet write for LWT_OUT",
3522                 .insns = {
3523                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3524                                     offsetof(struct __sk_buff, data)),
3525                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3526                                     offsetof(struct __sk_buff, data_end)),
3527                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3528                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3529                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3530                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3531                         BPF_MOV64_IMM(BPF_REG_0, 0),
3532                         BPF_EXIT_INSN(),
3533                 },
3534                 .errstr = "cannot write into packet",
3535                 .result = REJECT,
3536                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3537         },
3538         {
3539                 "direct packet write for LWT_XMIT",
3540                 .insns = {
3541                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3542                                     offsetof(struct __sk_buff, data)),
3543                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3544                                     offsetof(struct __sk_buff, data_end)),
3545                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3546                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3547                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3548                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3549                         BPF_MOV64_IMM(BPF_REG_0, 0),
3550                         BPF_EXIT_INSN(),
3551                 },
3552                 .result = ACCEPT,
3553                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3554         },
3555         {
3556                 "direct packet read for LWT_IN",
3557                 .insns = {
3558                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3559                                     offsetof(struct __sk_buff, data)),
3560                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3561                                     offsetof(struct __sk_buff, data_end)),
3562                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3563                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3564                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3565                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3566                         BPF_MOV64_IMM(BPF_REG_0, 0),
3567                         BPF_EXIT_INSN(),
3568                 },
3569                 .result = ACCEPT,
3570                 .prog_type = BPF_PROG_TYPE_LWT_IN,
3571         },
3572         {
3573                 "direct packet read for LWT_OUT",
3574                 .insns = {
3575                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3576                                     offsetof(struct __sk_buff, data)),
3577                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3578                                     offsetof(struct __sk_buff, data_end)),
3579                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3580                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3581                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3582                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3583                         BPF_MOV64_IMM(BPF_REG_0, 0),
3584                         BPF_EXIT_INSN(),
3585                 },
3586                 .result = ACCEPT,
3587                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
3588         },
3589         {
3590                 "direct packet read for LWT_XMIT",
3591                 .insns = {
3592                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3593                                     offsetof(struct __sk_buff, data)),
3594                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3595                                     offsetof(struct __sk_buff, data_end)),
3596                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3597                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3598                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3599                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3600                         BPF_MOV64_IMM(BPF_REG_0, 0),
3601                         BPF_EXIT_INSN(),
3602                 },
3603                 .result = ACCEPT,
3604                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3605         },
3606         {
3607                 "overlapping checks for direct packet access",
3608                 .insns = {
3609                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3610                                     offsetof(struct __sk_buff, data)),
3611                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3612                                     offsetof(struct __sk_buff, data_end)),
3613                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3614                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3615                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
3616                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3617                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
3618                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
3619                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
3620                         BPF_MOV64_IMM(BPF_REG_0, 0),
3621                         BPF_EXIT_INSN(),
3622                 },
3623                 .result = ACCEPT,
3624                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
3625         },
3626         {
3627                 "invalid access of tc_classid for LWT_IN",
3628                 .insns = {
3629                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3630                                     offsetof(struct __sk_buff, tc_classid)),
3631                         BPF_EXIT_INSN(),
3632                 },
3633                 .result = REJECT,
3634                 .errstr = "invalid bpf_context access",
3635         },
3636         {
3637                 "invalid access of tc_classid for LWT_OUT",
3638                 .insns = {
3639                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3640                                     offsetof(struct __sk_buff, tc_classid)),
3641                         BPF_EXIT_INSN(),
3642                 },
3643                 .result = REJECT,
3644                 .errstr = "invalid bpf_context access",
3645         },
3646         {
3647                 "invalid access of tc_classid for LWT_XMIT",
3648                 .insns = {
3649                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
3650                                     offsetof(struct __sk_buff, tc_classid)),
3651                         BPF_EXIT_INSN(),
3652                 },
3653                 .result = REJECT,
3654                 .errstr = "invalid bpf_context access",
3655         },
3656         {
3657                 "helper access to map: full range",
3658                 .insns = {
3659                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3661                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3662                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3663                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3664                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3665                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3666                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
3667                         BPF_MOV64_IMM(BPF_REG_3, 0),
3668                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3669                         BPF_EXIT_INSN(),
3670                 },
3671                 .fixup_map2 = { 3 },
3672                 .result = ACCEPT,
3673                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3674         },
3675         {
3676                 "helper access to map: partial range",
3677                 .insns = {
3678                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3679                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3680                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3681                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3682                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3683                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3684                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3685                         BPF_MOV64_IMM(BPF_REG_2, 8),
3686                         BPF_MOV64_IMM(BPF_REG_3, 0),
3687                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3688                         BPF_EXIT_INSN(),
3689                 },
3690                 .fixup_map2 = { 3 },
3691                 .result = ACCEPT,
3692                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3693         },
3694         {
3695                 "helper access to map: empty range",
3696                 .insns = {
3697                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3698                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3699                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3700                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3701                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3702                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3703                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3704                         BPF_MOV64_IMM(BPF_REG_2, 0),
3705                         BPF_MOV64_IMM(BPF_REG_3, 0),
3706                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3707                         BPF_EXIT_INSN(),
3708                 },
3709                 .fixup_map2 = { 3 },
3710                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
3711                 .result = REJECT,
3712                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3713         },
3714         {
3715                 "helper access to map: out-of-bound range",
3716                 .insns = {
3717                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3718                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3719                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3720                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3721                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3722                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3723                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3724                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
3725                         BPF_MOV64_IMM(BPF_REG_3, 0),
3726                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3727                         BPF_EXIT_INSN(),
3728                 },
3729                 .fixup_map2 = { 3 },
3730                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
3731                 .result = REJECT,
3732                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3733         },
3734         {
3735                 "helper access to map: negative range",
3736                 .insns = {
3737                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3739                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3740                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3741                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3742                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
3743                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3744                         BPF_MOV64_IMM(BPF_REG_2, -8),
3745                         BPF_MOV64_IMM(BPF_REG_3, 0),
3746                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3747                         BPF_EXIT_INSN(),
3748                 },
3749                 .fixup_map2 = { 3 },
3750                 .errstr = "invalid access to map value, value_size=48 off=0 size=-8",
3751                 .result = REJECT,
3752                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3753         },
3754         {
3755                 "helper access to adjusted map (via const imm): full range",
3756                 .insns = {
3757                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3758                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3759                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3760                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3761                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3762                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3763                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3765                                 offsetof(struct test_val, foo)),
3766                         BPF_MOV64_IMM(BPF_REG_2,
3767                                 sizeof(struct test_val) -
3768                                 offsetof(struct test_val, foo)),
3769                         BPF_MOV64_IMM(BPF_REG_3, 0),
3770                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3771                         BPF_EXIT_INSN(),
3772                 },
3773                 .fixup_map2 = { 3 },
3774                 .result = ACCEPT,
3775                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3776         },
3777         {
3778                 "helper access to adjusted map (via const imm): partial range",
3779                 .insns = {
3780                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3781                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3782                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3783                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3784                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3785                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3786                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3788                                 offsetof(struct test_val, foo)),
3789                         BPF_MOV64_IMM(BPF_REG_2, 8),
3790                         BPF_MOV64_IMM(BPF_REG_3, 0),
3791                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3792                         BPF_EXIT_INSN(),
3793                 },
3794                 .fixup_map2 = { 3 },
3795                 .result = ACCEPT,
3796                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3797         },
3798         {
3799                 "helper access to adjusted map (via const imm): empty range",
3800                 .insns = {
3801                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3802                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3803                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3804                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3805                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3806                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3807                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3809                                 offsetof(struct test_val, foo)),
3810                         BPF_MOV64_IMM(BPF_REG_2, 0),
3811                         BPF_MOV64_IMM(BPF_REG_3, 0),
3812                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3813                         BPF_EXIT_INSN(),
3814                 },
3815                 .fixup_map2 = { 3 },
3816                 .errstr = "R1 min value is outside of the array range",
3817                 .result = REJECT,
3818                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3819         },
3820         {
3821                 "helper access to adjusted map (via const imm): out-of-bound range",
3822                 .insns = {
3823                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3824                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3825                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3826                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3827                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3828                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3829                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3830                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3831                                 offsetof(struct test_val, foo)),
3832                         BPF_MOV64_IMM(BPF_REG_2,
3833                                 sizeof(struct test_val) -
3834                                 offsetof(struct test_val, foo) + 8),
3835                         BPF_MOV64_IMM(BPF_REG_3, 0),
3836                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3837                         BPF_EXIT_INSN(),
3838                 },
3839                 .fixup_map2 = { 3 },
3840                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3841                 .result = REJECT,
3842                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3843         },
3844         {
3845                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
3846                 .insns = {
3847                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3849                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3850                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3851                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3852                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3853                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3855                                 offsetof(struct test_val, foo)),
3856                         BPF_MOV64_IMM(BPF_REG_2, -8),
3857                         BPF_MOV64_IMM(BPF_REG_3, 0),
3858                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3859                         BPF_EXIT_INSN(),
3860                 },
3861                 .fixup_map2 = { 3 },
3862                 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
3863                 .result = REJECT,
3864                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3865         },
3866         {
3867                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
3868                 .insns = {
3869                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3870                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3871                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3872                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3873                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3874                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
3875                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3876                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
3877                                 offsetof(struct test_val, foo)),
3878                         BPF_MOV64_IMM(BPF_REG_2, -1),
3879                         BPF_MOV64_IMM(BPF_REG_3, 0),
3880                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3881                         BPF_EXIT_INSN(),
3882                 },
3883                 .fixup_map2 = { 3 },
3884                 .errstr = "R1 min value is outside of the array range",
3885                 .result = REJECT,
3886                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3887         },
3888         {
3889                 "helper access to adjusted map (via const reg): full range",
3890                 .insns = {
3891                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3892                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3893                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3895                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3896                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3897                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3898                         BPF_MOV64_IMM(BPF_REG_3,
3899                                 offsetof(struct test_val, foo)),
3900                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3901                         BPF_MOV64_IMM(BPF_REG_2,
3902                                 sizeof(struct test_val) -
3903                                 offsetof(struct test_val, foo)),
3904                         BPF_MOV64_IMM(BPF_REG_3, 0),
3905                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3906                         BPF_EXIT_INSN(),
3907                 },
3908                 .fixup_map2 = { 3 },
3909                 .result = ACCEPT,
3910                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3911         },
3912         {
3913                 "helper access to adjusted map (via const reg): partial range",
3914                 .insns = {
3915                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3916                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3917                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3918                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3919                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3920                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3921                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3922                         BPF_MOV64_IMM(BPF_REG_3,
3923                                 offsetof(struct test_val, foo)),
3924                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3925                         BPF_MOV64_IMM(BPF_REG_2, 8),
3926                         BPF_MOV64_IMM(BPF_REG_3, 0),
3927                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3928                         BPF_EXIT_INSN(),
3929                 },
3930                 .fixup_map2 = { 3 },
3931                 .result = ACCEPT,
3932                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3933         },
3934         {
3935                 "helper access to adjusted map (via const reg): empty range",
3936                 .insns = {
3937                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3938                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3939                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3940                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3941                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3942                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3943                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3944                         BPF_MOV64_IMM(BPF_REG_3, 0),
3945                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3946                         BPF_MOV64_IMM(BPF_REG_2, 0),
3947                         BPF_MOV64_IMM(BPF_REG_3, 0),
3948                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3949                         BPF_EXIT_INSN(),
3950                 },
3951                 .fixup_map2 = { 3 },
3952                 .errstr = "R1 min value is outside of the array range",
3953                 .result = REJECT,
3954                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3955         },
3956         {
3957                 "helper access to adjusted map (via const reg): out-of-bound range",
3958                 .insns = {
3959                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3960                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3961                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3962                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3963                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3964                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3965                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3966                         BPF_MOV64_IMM(BPF_REG_3,
3967                                 offsetof(struct test_val, foo)),
3968                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3969                         BPF_MOV64_IMM(BPF_REG_2,
3970                                 sizeof(struct test_val) -
3971                                 offsetof(struct test_val, foo) + 8),
3972                         BPF_MOV64_IMM(BPF_REG_3, 0),
3973                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3974                         BPF_EXIT_INSN(),
3975                 },
3976                 .fixup_map2 = { 3 },
3977                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
3978                 .result = REJECT,
3979                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
3980         },
3981         {
3982                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
3983                 .insns = {
3984                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
3985                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
3986                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
3987                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3988                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
3989                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
3990                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
3991                         BPF_MOV64_IMM(BPF_REG_3,
3992                                 offsetof(struct test_val, foo)),
3993                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
3994                         BPF_MOV64_IMM(BPF_REG_2, -8),
3995                         BPF_MOV64_IMM(BPF_REG_3, 0),
3996                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
3997                         BPF_EXIT_INSN(),
3998                 },
3999                 .fixup_map2 = { 3 },
4000                 .errstr = "invalid access to map value, value_size=48 off=4 size=-8",
4001                 .result = REJECT,
4002                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4003         },
4004         {
4005                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
4006                 .insns = {
4007                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4008                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4009                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4010                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4011                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4012                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4013                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4014                         BPF_MOV64_IMM(BPF_REG_3,
4015                                 offsetof(struct test_val, foo)),
4016                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4017                         BPF_MOV64_IMM(BPF_REG_2, -1),
4018                         BPF_MOV64_IMM(BPF_REG_3, 0),
4019                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4020                         BPF_EXIT_INSN(),
4021                 },
4022                 .fixup_map2 = { 3 },
4023                 .errstr = "R1 min value is outside of the array range",
4024                 .result = REJECT,
4025                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4026         },
4027         {
4028                 "helper access to adjusted map (via variable): full range",
4029                 .insns = {
4030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4032                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4033                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4034                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4036                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4037                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4038                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4039                                 offsetof(struct test_val, foo), 4),
4040                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4041                         BPF_MOV64_IMM(BPF_REG_2,
4042                                 sizeof(struct test_val) -
4043                                 offsetof(struct test_val, foo)),
4044                         BPF_MOV64_IMM(BPF_REG_3, 0),
4045                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4046                         BPF_EXIT_INSN(),
4047                 },
4048                 .fixup_map2 = { 3 },
4049                 .result = ACCEPT,
4050                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4051         },
4052         {
4053                 "helper access to adjusted map (via variable): partial range",
4054                 .insns = {
4055                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4057                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4059                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4060                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4061                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4062                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4063                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4064                                 offsetof(struct test_val, foo), 4),
4065                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4066                         BPF_MOV64_IMM(BPF_REG_2, 8),
4067                         BPF_MOV64_IMM(BPF_REG_3, 0),
4068                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4069                         BPF_EXIT_INSN(),
4070                 },
4071                 .fixup_map2 = { 3 },
4072                 .result = ACCEPT,
4073                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4074         },
4075         {
4076                 "helper access to adjusted map (via variable): empty range",
4077                 .insns = {
4078                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4080                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4081                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4082                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4083                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4084                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4085                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4086                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4087                                 offsetof(struct test_val, foo), 4),
4088                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4089                         BPF_MOV64_IMM(BPF_REG_2, 0),
4090                         BPF_MOV64_IMM(BPF_REG_3, 0),
4091                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4092                         BPF_EXIT_INSN(),
4093                 },
4094                 .fixup_map2 = { 3 },
4095                 .errstr = "R1 min value is outside of the array range",
4096                 .result = REJECT,
4097                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4098         },
4099         {
4100                 "helper access to adjusted map (via variable): no max check",
4101                 .insns = {
4102                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4103                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4104                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4105                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4106                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4107                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4108                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4109                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4110                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4111                         BPF_MOV64_IMM(BPF_REG_2, 0),
4112                         BPF_MOV64_IMM(BPF_REG_3, 0),
4113                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4114                         BPF_EXIT_INSN(),
4115                 },
4116                 .fixup_map2 = { 3 },
4117                 .errstr = "R1 min value is negative, either use unsigned index or do a if (index >=0) check",
4118                 .result = REJECT,
4119                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4120         },
4121         {
4122                 "helper access to adjusted map (via variable): wrong max check",
4123                 .insns = {
4124                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4126                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4127                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4128                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4129                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4130                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4131                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
4132                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
4133                                 offsetof(struct test_val, foo), 4),
4134                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
4135                         BPF_MOV64_IMM(BPF_REG_2,
4136                                 sizeof(struct test_val) -
4137                                 offsetof(struct test_val, foo) + 1),
4138                         BPF_MOV64_IMM(BPF_REG_3, 0),
4139                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4140                         BPF_EXIT_INSN(),
4141                 },
4142                 .fixup_map2 = { 3 },
4143                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
4144                 .result = REJECT,
4145                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4146         },
4147         {
4148                 "map element value is preserved across register spilling",
4149                 .insns = {
4150                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4151                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4152                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4153                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4154                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4155                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4156                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4157                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4158                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4159                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4160                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4161                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4162                         BPF_EXIT_INSN(),
4163                 },
4164                 .fixup_map2 = { 3 },
4165                 .errstr_unpriv = "R0 leaks addr",
4166                 .result = ACCEPT,
4167                 .result_unpriv = REJECT,
4168         },
4169         {
4170                 "map element value or null is marked on register spilling",
4171                 .insns = {
4172                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4173                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4175                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4176                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4177                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4178                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
4179                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4180                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4181                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4182                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4183                         BPF_EXIT_INSN(),
4184                 },
4185                 .fixup_map2 = { 3 },
4186                 .errstr_unpriv = "R0 leaks addr",
4187                 .result = ACCEPT,
4188                 .result_unpriv = REJECT,
4189         },
4190         {
4191                 "map element value store of cleared call register",
4192                 .insns = {
4193                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4195                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4196                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4197                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4198                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4199                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
4200                         BPF_EXIT_INSN(),
4201                 },
4202                 .fixup_map2 = { 3 },
4203                 .errstr_unpriv = "R1 !read_ok",
4204                 .errstr = "R1 !read_ok",
4205                 .result = REJECT,
4206                 .result_unpriv = REJECT,
4207         },
4208         {
4209                 "map element value with unaligned store",
4210                 .insns = {
4211                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4213                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4214                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4215                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4216                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
4217                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4218                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4219                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
4220                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
4221                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4222                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
4223                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
4224                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
4225                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
4226                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
4227                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
4228                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
4229                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
4230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
4231                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
4232                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
4233                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
4234                         BPF_EXIT_INSN(),
4235                 },
4236                 .fixup_map2 = { 3 },
4237                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4238                 .result = ACCEPT,
4239                 .result_unpriv = REJECT,
4240                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4241         },
4242         {
4243                 "map element value with unaligned load",
4244                 .insns = {
4245                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4247                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4248                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4249                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4250                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4251                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4252                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
4253                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
4254                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4255                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
4256                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4257                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
4258                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
4259                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
4260                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
4261                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
4262                         BPF_EXIT_INSN(),
4263                 },
4264                 .fixup_map2 = { 3 },
4265                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4266                 .result = ACCEPT,
4267                 .result_unpriv = REJECT,
4268                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4269         },
4270         {
4271                 "map element value illegal alu op, 1",
4272                 .insns = {
4273                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4275                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4276                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4277                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4278                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4279                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
4280                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4281                         BPF_EXIT_INSN(),
4282                 },
4283                 .fixup_map2 = { 3 },
4284                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4285                 .errstr = "invalid mem access 'inv'",
4286                 .result = REJECT,
4287                 .result_unpriv = REJECT,
4288         },
4289         {
4290                 "map element value illegal alu op, 2",
4291                 .insns = {
4292                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4293                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4294                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4295                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4296                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4297                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4298                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
4299                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4300                         BPF_EXIT_INSN(),
4301                 },
4302                 .fixup_map2 = { 3 },
4303                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4304                 .errstr = "invalid mem access 'inv'",
4305                 .result = REJECT,
4306                 .result_unpriv = REJECT,
4307         },
4308         {
4309                 "map element value illegal alu op, 3",
4310                 .insns = {
4311                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4312                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4313                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4314                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4315                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4316                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4317                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
4318                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4319                         BPF_EXIT_INSN(),
4320                 },
4321                 .fixup_map2 = { 3 },
4322                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4323                 .errstr = "invalid mem access 'inv'",
4324                 .result = REJECT,
4325                 .result_unpriv = REJECT,
4326         },
4327         {
4328                 "map element value illegal alu op, 4",
4329                 .insns = {
4330                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4332                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4333                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4334                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4335                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4336                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
4337                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4338                         BPF_EXIT_INSN(),
4339                 },
4340                 .fixup_map2 = { 3 },
4341                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4342                 .errstr = "invalid mem access 'inv'",
4343                 .result = REJECT,
4344                 .result_unpriv = REJECT,
4345         },
4346         {
4347                 "map element value illegal alu op, 5",
4348                 .insns = {
4349                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4351                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4352                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4353                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4354                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4355                         BPF_MOV64_IMM(BPF_REG_3, 4096),
4356                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4357                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4358                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
4359                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
4360                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
4361                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
4362                         BPF_EXIT_INSN(),
4363                 },
4364                 .fixup_map2 = { 3 },
4365                 .errstr_unpriv = "R0 invalid mem access 'inv'",
4366                 .errstr = "R0 invalid mem access 'inv'",
4367                 .result = REJECT,
4368                 .result_unpriv = REJECT,
4369         },
4370         {
4371                 "map element value is preserved across register spilling",
4372                 .insns = {
4373                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4374                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4375                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4376                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4377                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4378                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4379                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
4380                                 offsetof(struct test_val, foo)),
4381                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
4382                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4383                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
4384                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4385                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
4386                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
4387                         BPF_EXIT_INSN(),
4388                 },
4389                 .fixup_map2 = { 3 },
4390                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4391                 .result = ACCEPT,
4392                 .result_unpriv = REJECT,
4393                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4394         },
4395         {
4396                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
4397                 .insns = {
4398                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4399                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4400                         BPF_MOV64_IMM(BPF_REG_0, 0),
4401                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4402                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4403                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4404                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4405                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4406                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4407                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4408                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4409                         BPF_MOV64_IMM(BPF_REG_2, 16),
4410                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4411                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4412                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4413                         BPF_MOV64_IMM(BPF_REG_4, 0),
4414                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4415                         BPF_MOV64_IMM(BPF_REG_3, 0),
4416                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4417                         BPF_MOV64_IMM(BPF_REG_0, 0),
4418                         BPF_EXIT_INSN(),
4419                 },
4420                 .result = ACCEPT,
4421                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4422         },
4423         {
4424                 "helper access to variable memory: stack, bitwise AND, zero included",
4425                 .insns = {
4426                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4427                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4428                         BPF_MOV64_IMM(BPF_REG_2, 16),
4429                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4430                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4431                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4432                         BPF_MOV64_IMM(BPF_REG_3, 0),
4433                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4434                         BPF_EXIT_INSN(),
4435                 },
4436                 .errstr = "invalid stack type R1 off=-64 access_size=0",
4437                 .result = REJECT,
4438                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4439         },
4440         {
4441                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
4442                 .insns = {
4443                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4445                         BPF_MOV64_IMM(BPF_REG_2, 16),
4446                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4447                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4448                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
4449                         BPF_MOV64_IMM(BPF_REG_4, 0),
4450                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4451                         BPF_MOV64_IMM(BPF_REG_3, 0),
4452                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4453                         BPF_MOV64_IMM(BPF_REG_0, 0),
4454                         BPF_EXIT_INSN(),
4455                 },
4456                 .errstr = "invalid stack type R1 off=-64 access_size=65",
4457                 .result = REJECT,
4458                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4459         },
4460         {
4461                 "helper access to variable memory: stack, JMP, correct bounds",
4462                 .insns = {
4463                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4464                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4465                         BPF_MOV64_IMM(BPF_REG_0, 0),
4466                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4467                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4468                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4469                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4470                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4471                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4472                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4473                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4474                         BPF_MOV64_IMM(BPF_REG_2, 16),
4475                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4476                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4477                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
4478                         BPF_MOV64_IMM(BPF_REG_4, 0),
4479                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4480                         BPF_MOV64_IMM(BPF_REG_3, 0),
4481                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4482                         BPF_MOV64_IMM(BPF_REG_0, 0),
4483                         BPF_EXIT_INSN(),
4484                 },
4485                 .result = ACCEPT,
4486                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4487         },
4488         {
4489                 "helper access to variable memory: stack, JMP (signed), correct bounds",
4490                 .insns = {
4491                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4492                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4493                         BPF_MOV64_IMM(BPF_REG_0, 0),
4494                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4495                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4496                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4497                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4498                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4499                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4500                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4501                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4502                         BPF_MOV64_IMM(BPF_REG_2, 16),
4503                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4504                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4505                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
4506                         BPF_MOV64_IMM(BPF_REG_4, 0),
4507                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
4508                         BPF_MOV64_IMM(BPF_REG_3, 0),
4509                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4510                         BPF_MOV64_IMM(BPF_REG_0, 0),
4511                         BPF_EXIT_INSN(),
4512                 },
4513                 .result = ACCEPT,
4514                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4515         },
4516         {
4517                 "helper access to variable memory: stack, JMP, bounds + offset",
4518                 .insns = {
4519                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4521                         BPF_MOV64_IMM(BPF_REG_2, 16),
4522                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4523                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4524                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
4525                         BPF_MOV64_IMM(BPF_REG_4, 0),
4526                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
4527                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4528                         BPF_MOV64_IMM(BPF_REG_3, 0),
4529                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4530                         BPF_MOV64_IMM(BPF_REG_0, 0),
4531                         BPF_EXIT_INSN(),
4532                 },
4533                 .errstr = "invalid stack type R1 off=-64 access_size=65",
4534                 .result = REJECT,
4535                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4536         },
4537         {
4538                 "helper access to variable memory: stack, JMP, wrong max",
4539                 .insns = {
4540                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4541                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4542                         BPF_MOV64_IMM(BPF_REG_2, 16),
4543                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4544                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4545                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
4546                         BPF_MOV64_IMM(BPF_REG_4, 0),
4547                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4548                         BPF_MOV64_IMM(BPF_REG_3, 0),
4549                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4550                         BPF_MOV64_IMM(BPF_REG_0, 0),
4551                         BPF_EXIT_INSN(),
4552                 },
4553                 .errstr = "invalid stack type R1 off=-64 access_size=65",
4554                 .result = REJECT,
4555                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4556         },
4557         {
4558                 "helper access to variable memory: stack, JMP, no max check",
4559                 .insns = {
4560                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4561                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4562                         BPF_MOV64_IMM(BPF_REG_2, 16),
4563                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4564                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4565                         BPF_MOV64_IMM(BPF_REG_4, 0),
4566                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4567                         BPF_MOV64_IMM(BPF_REG_3, 0),
4568                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4569                         BPF_MOV64_IMM(BPF_REG_0, 0),
4570                         BPF_EXIT_INSN(),
4571                 },
4572                 .errstr = "R2 unbounded memory access",
4573                 .result = REJECT,
4574                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4575         },
4576         {
4577                 "helper access to variable memory: stack, JMP, no min check",
4578                 .insns = {
4579                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4580                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4581                         BPF_MOV64_IMM(BPF_REG_2, 16),
4582                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4583                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4584                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
4585                         BPF_MOV64_IMM(BPF_REG_3, 0),
4586                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4587                         BPF_MOV64_IMM(BPF_REG_0, 0),
4588                         BPF_EXIT_INSN(),
4589                 },
4590                 .errstr = "invalid stack type R1 off=-64 access_size=0",
4591                 .result = REJECT,
4592                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4593         },
4594         {
4595                 "helper access to variable memory: stack, JMP (signed), no min check",
4596                 .insns = {
4597                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4598                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4599                         BPF_MOV64_IMM(BPF_REG_2, 16),
4600                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
4601                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
4602                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
4603                         BPF_MOV64_IMM(BPF_REG_3, 0),
4604                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4605                         BPF_MOV64_IMM(BPF_REG_0, 0),
4606                         BPF_EXIT_INSN(),
4607                 },
4608                 .errstr = "R2 min value is negative",
4609                 .result = REJECT,
4610                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4611         },
4612         {
4613                 "helper access to variable memory: map, JMP, correct bounds",
4614                 .insns = {
4615                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4616                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4617                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4618                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4619                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4620                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4621                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4622                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4623                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4624                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4625                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4626                                 sizeof(struct test_val), 4),
4627                         BPF_MOV64_IMM(BPF_REG_4, 0),
4628                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4629                         BPF_MOV64_IMM(BPF_REG_3, 0),
4630                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4631                         BPF_MOV64_IMM(BPF_REG_0, 0),
4632                         BPF_EXIT_INSN(),
4633                 },
4634                 .fixup_map2 = { 3 },
4635                 .result = ACCEPT,
4636                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4637         },
4638         {
4639                 "helper access to variable memory: map, JMP, wrong max",
4640                 .insns = {
4641                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4642                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4643                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4644                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4645                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4646                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4647                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4648                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4649                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4650                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4651                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4652                                 sizeof(struct test_val) + 1, 4),
4653                         BPF_MOV64_IMM(BPF_REG_4, 0),
4654                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4655                         BPF_MOV64_IMM(BPF_REG_3, 0),
4656                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4657                         BPF_MOV64_IMM(BPF_REG_0, 0),
4658                         BPF_EXIT_INSN(),
4659                 },
4660                 .fixup_map2 = { 3 },
4661                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
4662                 .result = REJECT,
4663                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4664         },
4665         {
4666                 "helper access to variable memory: map adjusted, JMP, correct bounds",
4667                 .insns = {
4668                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4669                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4670                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4671                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4672                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4673                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4674                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4675                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4676                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4677                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4678                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4679                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4680                                 sizeof(struct test_val) - 20, 4),
4681                         BPF_MOV64_IMM(BPF_REG_4, 0),
4682                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4683                         BPF_MOV64_IMM(BPF_REG_3, 0),
4684                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4685                         BPF_MOV64_IMM(BPF_REG_0, 0),
4686                         BPF_EXIT_INSN(),
4687                 },
4688                 .fixup_map2 = { 3 },
4689                 .result = ACCEPT,
4690                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4691         },
4692         {
4693                 "helper access to variable memory: map adjusted, JMP, wrong max",
4694                 .insns = {
4695                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4696                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4697                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4698                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4699                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4700                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
4701                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
4703                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4704                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4705                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4706                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
4707                                 sizeof(struct test_val) - 19, 4),
4708                         BPF_MOV64_IMM(BPF_REG_4, 0),
4709                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
4710                         BPF_MOV64_IMM(BPF_REG_3, 0),
4711                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4712                         BPF_MOV64_IMM(BPF_REG_0, 0),
4713                         BPF_EXIT_INSN(),
4714                 },
4715                 .fixup_map2 = { 3 },
4716                 .errstr = "R1 min value is outside of the array range",
4717                 .result = REJECT,
4718                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4719         },
4720         {
4721                 "helper access to variable memory: size > 0 not allowed on NULL",
4722                 .insns = {
4723                         BPF_MOV64_IMM(BPF_REG_1, 0),
4724                         BPF_MOV64_IMM(BPF_REG_2, 0),
4725                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4726                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4727                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
4728                         BPF_MOV64_IMM(BPF_REG_3, 0),
4729                         BPF_MOV64_IMM(BPF_REG_4, 0),
4730                         BPF_MOV64_IMM(BPF_REG_5, 0),
4731                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4732                         BPF_EXIT_INSN(),
4733                 },
4734                 .errstr = "R1 type=imm expected=fp",
4735                 .result = REJECT,
4736                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4737         },
4738         {
4739                 "helper access to variable memory: size = 0 not allowed on != NULL",
4740                 .insns = {
4741                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
4743                         BPF_MOV64_IMM(BPF_REG_2, 0),
4744                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
4745                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
4746                         BPF_MOV64_IMM(BPF_REG_3, 0),
4747                         BPF_MOV64_IMM(BPF_REG_4, 0),
4748                         BPF_MOV64_IMM(BPF_REG_5, 0),
4749                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
4750                         BPF_EXIT_INSN(),
4751                 },
4752                 .errstr = "invalid stack type R1 off=-8 access_size=0",
4753                 .result = REJECT,
4754                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4755         },
4756         {
4757                 "helper access to variable memory: 8 bytes leak",
4758                 .insns = {
4759                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4760                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4761                         BPF_MOV64_IMM(BPF_REG_0, 0),
4762                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4763                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4764                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4765                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4766                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4767                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4768                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4769                         BPF_MOV64_IMM(BPF_REG_2, 0),
4770                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
4771                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
4772                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
4773                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4774                         BPF_MOV64_IMM(BPF_REG_3, 0),
4775                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4776                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4777                         BPF_EXIT_INSN(),
4778                 },
4779                 .errstr = "invalid indirect read from stack off -64+32 size 64",
4780                 .result = REJECT,
4781                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4782         },
4783         {
4784                 "helper access to variable memory: 8 bytes no leak (init memory)",
4785                 .insns = {
4786                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4787                         BPF_MOV64_IMM(BPF_REG_0, 0),
4788                         BPF_MOV64_IMM(BPF_REG_0, 0),
4789                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
4790                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
4791                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
4792                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
4793                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
4794                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
4795                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
4796                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
4797                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
4798                         BPF_MOV64_IMM(BPF_REG_2, 0),
4799                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
4800                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
4801                         BPF_MOV64_IMM(BPF_REG_3, 0),
4802                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4803                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
4804                         BPF_EXIT_INSN(),
4805                 },
4806                 .result = ACCEPT,
4807                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4808         },
4809         {
4810                 "invalid and of negative number",
4811                 .insns = {
4812                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4813                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4814                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4815                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4816                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4817                                      BPF_FUNC_map_lookup_elem),
4818                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4819                         BPF_MOV64_IMM(BPF_REG_1, 6),
4820                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
4821                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4822                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4823                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4824                                    offsetof(struct test_val, foo)),
4825                         BPF_EXIT_INSN(),
4826                 },
4827                 .fixup_map2 = { 3 },
4828                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4829                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4830                 .result = REJECT,
4831                 .result_unpriv = REJECT,
4832                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4833         },
4834         {
4835                 "invalid range check",
4836                 .insns = {
4837                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4838                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4839                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4840                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4841                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4842                                      BPF_FUNC_map_lookup_elem),
4843                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
4844                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4845                         BPF_MOV64_IMM(BPF_REG_9, 1),
4846                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
4847                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
4848                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
4849                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
4850                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
4851                         BPF_MOV32_IMM(BPF_REG_3, 1),
4852                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
4853                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
4854                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
4855                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
4856                         BPF_MOV64_REG(BPF_REG_0, 0),
4857                         BPF_EXIT_INSN(),
4858                 },
4859                 .fixup_map2 = { 3 },
4860                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
4861                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
4862                 .result = REJECT,
4863                 .result_unpriv = REJECT,
4864                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4865         },
4866         {
4867                 "map in map access",
4868                 .insns = {
4869                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4870                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4871                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4872                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4873                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4874                                      BPF_FUNC_map_lookup_elem),
4875                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4876                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4877                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4878                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4879                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4880                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4881                                      BPF_FUNC_map_lookup_elem),
4882                         BPF_MOV64_REG(BPF_REG_0, 0),
4883                         BPF_EXIT_INSN(),
4884                 },
4885                 .fixup_map_in_map = { 3 },
4886                 .result = ACCEPT,
4887         },
4888         {
4889                 "invalid inner map pointer",
4890                 .insns = {
4891                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4892                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4893                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4896                                      BPF_FUNC_map_lookup_elem),
4897                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4898                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4899                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4900                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4903                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4904                                      BPF_FUNC_map_lookup_elem),
4905                         BPF_MOV64_REG(BPF_REG_0, 0),
4906                         BPF_EXIT_INSN(),
4907                 },
4908                 .fixup_map_in_map = { 3 },
4909                 .errstr = "R1 type=inv expected=map_ptr",
4910                 .errstr_unpriv = "R1 pointer arithmetic prohibited",
4911                 .result = REJECT,
4912         },
4913         {
4914                 "forgot null checking on the inner map pointer",
4915                 .insns = {
4916                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4917                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4919                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4920                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4921                                      BPF_FUNC_map_lookup_elem),
4922                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
4923                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4924                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
4925                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4926                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4927                                      BPF_FUNC_map_lookup_elem),
4928                         BPF_MOV64_REG(BPF_REG_0, 0),
4929                         BPF_EXIT_INSN(),
4930                 },
4931                 .fixup_map_in_map = { 3 },
4932                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
4933                 .result = REJECT,
4934         }
4935 };
4936
4937 static int probe_filter_length(const struct bpf_insn *fp)
4938 {
4939         int len;
4940
4941         for (len = MAX_INSNS - 1; len > 0; --len)
4942                 if (fp[len].code != 0 || fp[len].imm != 0)
4943                         break;
4944         return len + 1;
4945 }
4946
4947 static int create_map(uint32_t size_value, uint32_t max_elem)
4948 {
4949         int fd;
4950
4951         fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
4952                             size_value, max_elem, BPF_F_NO_PREALLOC);
4953         if (fd < 0)
4954                 printf("Failed to create hash map '%s'!\n", strerror(errno));
4955
4956         return fd;
4957 }
4958
4959 static int create_prog_array(void)
4960 {
4961         int fd;
4962
4963         fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
4964                             sizeof(int), 4, 0);
4965         if (fd < 0)
4966                 printf("Failed to create prog array '%s'!\n", strerror(errno));
4967
4968         return fd;
4969 }
4970
4971 static int create_map_in_map(void)
4972 {
4973         int inner_map_fd, outer_map_fd;
4974
4975         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
4976                                       sizeof(int), 1, 0);
4977         if (inner_map_fd < 0) {
4978                 printf("Failed to create array '%s'!\n", strerror(errno));
4979                 return inner_map_fd;
4980         }
4981
4982         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS,
4983                                              sizeof(int), inner_map_fd, 1, 0);
4984         if (outer_map_fd < 0)
4985                 printf("Failed to create array of maps '%s'!\n",
4986                        strerror(errno));
4987
4988         close(inner_map_fd);
4989
4990         return outer_map_fd;
4991 }
4992
4993 static char bpf_vlog[32768];
4994
4995 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
4996                           int *map_fds)
4997 {
4998         int *fixup_map1 = test->fixup_map1;
4999         int *fixup_map2 = test->fixup_map2;
5000         int *fixup_prog = test->fixup_prog;
5001         int *fixup_map_in_map = test->fixup_map_in_map;
5002
5003         /* Allocating HTs with 1 elem is fine here, since we only test
5004          * for verifier and not do a runtime lookup, so the only thing
5005          * that really matters is value size in this case.
5006          */
5007         if (*fixup_map1) {
5008                 map_fds[0] = create_map(sizeof(long long), 1);
5009                 do {
5010                         prog[*fixup_map1].imm = map_fds[0];
5011                         fixup_map1++;
5012                 } while (*fixup_map1);
5013         }
5014
5015         if (*fixup_map2) {
5016                 map_fds[1] = create_map(sizeof(struct test_val), 1);
5017                 do {
5018                         prog[*fixup_map2].imm = map_fds[1];
5019                         fixup_map2++;
5020                 } while (*fixup_map2);
5021         }
5022
5023         if (*fixup_prog) {
5024                 map_fds[2] = create_prog_array();
5025                 do {
5026                         prog[*fixup_prog].imm = map_fds[2];
5027                         fixup_prog++;
5028                 } while (*fixup_prog);
5029         }
5030
5031         if (*fixup_map_in_map) {
5032                 map_fds[3] = create_map_in_map();
5033                 do {
5034                         prog[*fixup_map_in_map].imm = map_fds[3];
5035                         fixup_map_in_map++;
5036                 } while (*fixup_map_in_map);
5037         }
5038 }
5039
5040 static void do_test_single(struct bpf_test *test, bool unpriv,
5041                            int *passes, int *errors)
5042 {
5043         int fd_prog, expected_ret, reject_from_alignment;
5044         struct bpf_insn *prog = test->insns;
5045         int prog_len = probe_filter_length(prog);
5046         int prog_type = test->prog_type;
5047         int map_fds[MAX_NR_MAPS];
5048         const char *expected_err;
5049         int i;
5050
5051         for (i = 0; i < MAX_NR_MAPS; i++)
5052                 map_fds[i] = -1;
5053
5054         do_test_fixup(test, prog, map_fds);
5055
5056         fd_prog = bpf_load_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
5057                                    prog, prog_len, "GPL", 0, bpf_vlog,
5058                                    sizeof(bpf_vlog));
5059
5060         expected_ret = unpriv && test->result_unpriv != UNDEF ?
5061                        test->result_unpriv : test->result;
5062         expected_err = unpriv && test->errstr_unpriv ?
5063                        test->errstr_unpriv : test->errstr;
5064
5065         reject_from_alignment = fd_prog < 0 &&
5066                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
5067                                 strstr(bpf_vlog, "Unknown alignment.");
5068 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
5069         if (reject_from_alignment) {
5070                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
5071                        strerror(errno));
5072                 goto fail_log;
5073         }
5074 #endif
5075         if (expected_ret == ACCEPT) {
5076                 if (fd_prog < 0 && !reject_from_alignment) {
5077                         printf("FAIL\nFailed to load prog '%s'!\n",
5078                                strerror(errno));
5079                         goto fail_log;
5080                 }
5081         } else {
5082                 if (fd_prog >= 0) {
5083                         printf("FAIL\nUnexpected success to load!\n");
5084                         goto fail_log;
5085                 }
5086                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
5087                         printf("FAIL\nUnexpected error message!\n");
5088                         goto fail_log;
5089                 }
5090         }
5091
5092         (*passes)++;
5093         printf("OK%s\n", reject_from_alignment ?
5094                " (NOTE: reject due to unknown alignment)" : "");
5095 close_fds:
5096         close(fd_prog);
5097         for (i = 0; i < MAX_NR_MAPS; i++)
5098                 close(map_fds[i]);
5099         sched_yield();
5100         return;
5101 fail_log:
5102         (*errors)++;
5103         printf("%s", bpf_vlog);
5104         goto close_fds;
5105 }
5106
5107 static bool is_admin(void)
5108 {
5109         cap_t caps;
5110         cap_flag_value_t sysadmin = CAP_CLEAR;
5111         const cap_value_t cap_val = CAP_SYS_ADMIN;
5112
5113 #ifdef CAP_IS_SUPPORTED
5114         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
5115                 perror("cap_get_flag");
5116                 return false;
5117         }
5118 #endif
5119         caps = cap_get_proc();
5120         if (!caps) {
5121                 perror("cap_get_proc");
5122                 return false;
5123         }
5124         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
5125                 perror("cap_get_flag");
5126         if (cap_free(caps))
5127                 perror("cap_free");
5128         return (sysadmin == CAP_SET);
5129 }
5130
5131 static int set_admin(bool admin)
5132 {
5133         cap_t caps;
5134         const cap_value_t cap_val = CAP_SYS_ADMIN;
5135         int ret = -1;
5136
5137         caps = cap_get_proc();
5138         if (!caps) {
5139                 perror("cap_get_proc");
5140                 return -1;
5141         }
5142         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
5143                                 admin ? CAP_SET : CAP_CLEAR)) {
5144                 perror("cap_set_flag");
5145                 goto out;
5146         }
5147         if (cap_set_proc(caps)) {
5148                 perror("cap_set_proc");
5149                 goto out;
5150         }
5151         ret = 0;
5152 out:
5153         if (cap_free(caps))
5154                 perror("cap_free");
5155         return ret;
5156 }
5157
5158 static int do_test(bool unpriv, unsigned int from, unsigned int to)
5159 {
5160         int i, passes = 0, errors = 0;
5161
5162         for (i = from; i < to; i++) {
5163                 struct bpf_test *test = &tests[i];
5164
5165                 /* Program types that are not supported by non-root we
5166                  * skip right away.
5167                  */
5168                 if (!test->prog_type) {
5169                         if (!unpriv)
5170                                 set_admin(false);
5171                         printf("#%d/u %s ", i, test->descr);
5172                         do_test_single(test, true, &passes, &errors);
5173                         if (!unpriv)
5174                                 set_admin(true);
5175                 }
5176
5177                 if (!unpriv) {
5178                         printf("#%d/p %s ", i, test->descr);
5179                         do_test_single(test, false, &passes, &errors);
5180                 }
5181         }
5182
5183         printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
5184         return errors ? -errors : 0;
5185 }
5186
5187 int main(int argc, char **argv)
5188 {
5189         struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
5190         struct rlimit rlim = { 1 << 20, 1 << 20 };
5191         unsigned int from = 0, to = ARRAY_SIZE(tests);
5192         bool unpriv = !is_admin();
5193
5194         if (argc == 3) {
5195                 unsigned int l = atoi(argv[argc - 2]);
5196                 unsigned int u = atoi(argv[argc - 1]);
5197
5198                 if (l < to && u < to) {
5199                         from = l;
5200                         to   = u + 1;
5201                 }
5202         } else if (argc == 2) {
5203                 unsigned int t = atoi(argv[argc - 1]);
5204
5205                 if (t < to) {
5206                         from = t;
5207                         to   = t + 1;
5208                 }
5209         }
5210
5211         setrlimit(RLIMIT_MEMLOCK, unpriv ? &rlim : &rinf);
5212         return do_test(unpriv, from, to);
5213 }