1 { 2 "XDP pkt read, pkt_end mangling, bad access 1", 3 .insns = { 4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 5 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 6 offsetof(struct xdp_md, data_end)), 7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 9 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8), 10 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 11 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 12 BPF_MOV64_IMM(BPF_REG_0, 0), 13 BPF_EXIT_INSN(), 14 }, 15 .errstr = "R3 pointer arithmetic on pkt_end", 16 .result = REJECT, 17 .prog_type = BPF_PROG_TYPE_XDP, 18 }, 19 { 20 "XDP pkt read, pkt_end mangling, bad access 2", 21 .insns = { 22 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 23 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 24 offsetof(struct xdp_md, data_end)), 25 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 27 BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8), 28 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 29 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 30 BPF_MOV64_IMM(BPF_REG_0, 0), 31 BPF_EXIT_INSN(), 32 }, 33 .errstr = "R3 pointer arithmetic on pkt_end", 34 .result = REJECT, 35 .prog_type = BPF_PROG_TYPE_XDP, 36 }, 37 { 38 "XDP pkt read, pkt_data' > pkt_end, good access", 39 .insns = { 40 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 41 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 42 offsetof(struct xdp_md, data_end)), 43 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 44 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 45 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 46 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 47 BPF_MOV64_IMM(BPF_REG_0, 0), 48 BPF_EXIT_INSN(), 49 }, 50 .result = ACCEPT, 51 .prog_type = BPF_PROG_TYPE_XDP, 52 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 53 }, 54 { 55 "XDP pkt read, pkt_data' > pkt_end, bad access 1", 56 .insns = { 57 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 58 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 59 offsetof(struct xdp_md, data_end)), 60 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 62 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 63 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 64 BPF_MOV64_IMM(BPF_REG_0, 0), 65 BPF_EXIT_INSN(), 66 }, 67 .errstr = "R1 offset is outside of the packet", 68 .result = REJECT, 69 .prog_type = BPF_PROG_TYPE_XDP, 70 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 71 }, 72 { 73 "XDP pkt read, pkt_data' > pkt_end, bad access 2", 74 .insns = { 75 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 76 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 77 offsetof(struct xdp_md, data_end)), 78 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 79 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 80 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0), 81 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 82 BPF_MOV64_IMM(BPF_REG_0, 0), 83 BPF_EXIT_INSN(), 84 }, 85 .errstr = "R1 offset is outside of the packet", 86 .result = REJECT, 87 .prog_type = BPF_PROG_TYPE_XDP, 88 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 89 }, 90 { 91 "XDP pkt read, pkt_end > pkt_data', good access", 92 .insns = { 93 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 94 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 95 offsetof(struct xdp_md, data_end)), 96 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 97 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 98 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 99 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 100 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 101 BPF_MOV64_IMM(BPF_REG_0, 0), 102 BPF_EXIT_INSN(), 103 }, 104 .result = ACCEPT, 105 .prog_type = BPF_PROG_TYPE_XDP, 106 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 107 }, 108 { 109 "XDP pkt read, pkt_end > pkt_data', bad access 1", 110 .insns = { 111 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 112 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 113 offsetof(struct xdp_md, data_end)), 114 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 115 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 116 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 117 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 118 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 119 BPF_MOV64_IMM(BPF_REG_0, 0), 120 BPF_EXIT_INSN(), 121 }, 122 .errstr = "R1 offset is outside of the packet", 123 .result = REJECT, 124 .prog_type = BPF_PROG_TYPE_XDP, 125 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 126 }, 127 { 128 "XDP pkt read, pkt_end > pkt_data', bad access 2", 129 .insns = { 130 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 131 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 132 offsetof(struct xdp_md, data_end)), 133 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 134 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 135 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 136 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 137 BPF_MOV64_IMM(BPF_REG_0, 0), 138 BPF_EXIT_INSN(), 139 }, 140 .errstr = "R1 offset is outside of the packet", 141 .result = REJECT, 142 .prog_type = BPF_PROG_TYPE_XDP, 143 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 144 }, 145 { 146 "XDP pkt read, pkt_data' < pkt_end, good access", 147 .insns = { 148 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 149 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 150 offsetof(struct xdp_md, data_end)), 151 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 153 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 154 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 155 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 156 BPF_MOV64_IMM(BPF_REG_0, 0), 157 BPF_EXIT_INSN(), 158 }, 159 .result = ACCEPT, 160 .prog_type = BPF_PROG_TYPE_XDP, 161 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 162 }, 163 { 164 "XDP pkt read, pkt_data' < pkt_end, bad access 1", 165 .insns = { 166 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 167 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 168 offsetof(struct xdp_md, data_end)), 169 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 170 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 171 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 172 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 173 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 174 BPF_MOV64_IMM(BPF_REG_0, 0), 175 BPF_EXIT_INSN(), 176 }, 177 .errstr = "R1 offset is outside of the packet", 178 .result = REJECT, 179 .prog_type = BPF_PROG_TYPE_XDP, 180 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 181 }, 182 { 183 "XDP pkt read, pkt_data' < pkt_end, bad access 2", 184 .insns = { 185 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 186 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 187 offsetof(struct xdp_md, data_end)), 188 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 189 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 190 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 191 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 192 BPF_MOV64_IMM(BPF_REG_0, 0), 193 BPF_EXIT_INSN(), 194 }, 195 .errstr = "R1 offset is outside of the packet", 196 .result = REJECT, 197 .prog_type = BPF_PROG_TYPE_XDP, 198 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 199 }, 200 { 201 "XDP pkt read, pkt_end < pkt_data', good access", 202 .insns = { 203 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 204 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 205 offsetof(struct xdp_md, data_end)), 206 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 207 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 208 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 209 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 210 BPF_MOV64_IMM(BPF_REG_0, 0), 211 BPF_EXIT_INSN(), 212 }, 213 .result = ACCEPT, 214 .prog_type = BPF_PROG_TYPE_XDP, 215 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 216 }, 217 { 218 "XDP pkt read, pkt_end < pkt_data', bad access 1", 219 .insns = { 220 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 221 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 222 offsetof(struct xdp_md, data_end)), 223 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 224 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 225 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 226 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 227 BPF_MOV64_IMM(BPF_REG_0, 0), 228 BPF_EXIT_INSN(), 229 }, 230 .errstr = "R1 offset is outside of the packet", 231 .result = REJECT, 232 .prog_type = BPF_PROG_TYPE_XDP, 233 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 234 }, 235 { 236 "XDP pkt read, pkt_end < pkt_data', bad access 2", 237 .insns = { 238 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 239 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 240 offsetof(struct xdp_md, data_end)), 241 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 242 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 243 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0), 244 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 245 BPF_MOV64_IMM(BPF_REG_0, 0), 246 BPF_EXIT_INSN(), 247 }, 248 .errstr = "R1 offset is outside of the packet", 249 .result = REJECT, 250 .prog_type = BPF_PROG_TYPE_XDP, 251 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 252 }, 253 { 254 "XDP pkt read, pkt_data' >= pkt_end, good access", 255 .insns = { 256 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 257 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 258 offsetof(struct xdp_md, data_end)), 259 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 261 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 262 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 263 BPF_MOV64_IMM(BPF_REG_0, 0), 264 BPF_EXIT_INSN(), 265 }, 266 .result = ACCEPT, 267 .prog_type = BPF_PROG_TYPE_XDP, 268 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 269 }, 270 { 271 "XDP pkt read, pkt_data' >= pkt_end, bad access 1", 272 .insns = { 273 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 274 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 275 offsetof(struct xdp_md, data_end)), 276 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 277 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 278 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 279 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 280 BPF_MOV64_IMM(BPF_REG_0, 0), 281 BPF_EXIT_INSN(), 282 }, 283 .errstr = "R1 offset is outside of the packet", 284 .result = REJECT, 285 .prog_type = BPF_PROG_TYPE_XDP, 286 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 287 }, 288 { 289 "XDP pkt read, pkt_data' >= pkt_end, bad access 2", 290 .insns = { 291 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 292 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 293 offsetof(struct xdp_md, data_end)), 294 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 296 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0), 297 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 298 BPF_MOV64_IMM(BPF_REG_0, 0), 299 BPF_EXIT_INSN(), 300 }, 301 .errstr = "R1 offset is outside of the packet", 302 .result = REJECT, 303 .prog_type = BPF_PROG_TYPE_XDP, 304 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 305 }, 306 { 307 "XDP pkt read, pkt_end >= pkt_data', good access", 308 .insns = { 309 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 310 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 311 offsetof(struct xdp_md, data_end)), 312 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 313 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 314 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 315 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 316 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 317 BPF_MOV64_IMM(BPF_REG_0, 0), 318 BPF_EXIT_INSN(), 319 }, 320 .result = ACCEPT, 321 .prog_type = BPF_PROG_TYPE_XDP, 322 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 323 }, 324 { 325 "XDP pkt read, pkt_end >= pkt_data', bad access 1", 326 .insns = { 327 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 328 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 329 offsetof(struct xdp_md, data_end)), 330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 331 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 332 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 333 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 334 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 335 BPF_MOV64_IMM(BPF_REG_0, 0), 336 BPF_EXIT_INSN(), 337 }, 338 .errstr = "R1 offset is outside of the packet", 339 .result = REJECT, 340 .prog_type = BPF_PROG_TYPE_XDP, 341 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 342 }, 343 { 344 "XDP pkt read, pkt_end >= pkt_data', bad access 2", 345 .insns = { 346 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 347 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 348 offsetof(struct xdp_md, data_end)), 349 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 351 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 352 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 353 BPF_MOV64_IMM(BPF_REG_0, 0), 354 BPF_EXIT_INSN(), 355 }, 356 .errstr = "R1 offset is outside of the packet", 357 .result = REJECT, 358 .prog_type = BPF_PROG_TYPE_XDP, 359 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 360 }, 361 { 362 "XDP pkt read, pkt_data' <= pkt_end, good access", 363 .insns = { 364 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 365 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 366 offsetof(struct xdp_md, data_end)), 367 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 368 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 369 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 370 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 371 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 372 BPF_MOV64_IMM(BPF_REG_0, 0), 373 BPF_EXIT_INSN(), 374 }, 375 .result = ACCEPT, 376 .prog_type = BPF_PROG_TYPE_XDP, 377 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 378 }, 379 { 380 "XDP pkt read, pkt_data' <= pkt_end, bad access 1", 381 .insns = { 382 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 383 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 384 offsetof(struct xdp_md, data_end)), 385 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 386 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 387 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 388 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 389 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 390 BPF_MOV64_IMM(BPF_REG_0, 0), 391 BPF_EXIT_INSN(), 392 }, 393 .errstr = "R1 offset is outside of the packet", 394 .result = REJECT, 395 .prog_type = BPF_PROG_TYPE_XDP, 396 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 397 }, 398 { 399 "XDP pkt read, pkt_data' <= pkt_end, bad access 2", 400 .insns = { 401 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 402 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 403 offsetof(struct xdp_md, data_end)), 404 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 405 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 406 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 407 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 408 BPF_MOV64_IMM(BPF_REG_0, 0), 409 BPF_EXIT_INSN(), 410 }, 411 .errstr = "R1 offset is outside of the packet", 412 .result = REJECT, 413 .prog_type = BPF_PROG_TYPE_XDP, 414 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 415 }, 416 { 417 "XDP pkt read, pkt_end <= pkt_data', good access", 418 .insns = { 419 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 420 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 421 offsetof(struct xdp_md, data_end)), 422 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 423 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 424 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 425 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 426 BPF_MOV64_IMM(BPF_REG_0, 0), 427 BPF_EXIT_INSN(), 428 }, 429 .result = ACCEPT, 430 .prog_type = BPF_PROG_TYPE_XDP, 431 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 432 }, 433 { 434 "XDP pkt read, pkt_end <= pkt_data', bad access 1", 435 .insns = { 436 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 437 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 438 offsetof(struct xdp_md, data_end)), 439 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 440 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 441 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 442 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 443 BPF_MOV64_IMM(BPF_REG_0, 0), 444 BPF_EXIT_INSN(), 445 }, 446 .errstr = "R1 offset is outside of the packet", 447 .result = REJECT, 448 .prog_type = BPF_PROG_TYPE_XDP, 449 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 450 }, 451 { 452 "XDP pkt read, pkt_end <= pkt_data', bad access 2", 453 .insns = { 454 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 455 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 456 offsetof(struct xdp_md, data_end)), 457 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 458 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 459 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0), 460 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 461 BPF_MOV64_IMM(BPF_REG_0, 0), 462 BPF_EXIT_INSN(), 463 }, 464 .errstr = "R1 offset is outside of the packet", 465 .result = REJECT, 466 .prog_type = BPF_PROG_TYPE_XDP, 467 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 468 }, 469 { 470 "XDP pkt read, pkt_meta' > pkt_data, good access", 471 .insns = { 472 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 473 offsetof(struct xdp_md, data_meta)), 474 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 475 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 476 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 477 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 478 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 479 BPF_MOV64_IMM(BPF_REG_0, 0), 480 BPF_EXIT_INSN(), 481 }, 482 .result = ACCEPT, 483 .prog_type = BPF_PROG_TYPE_XDP, 484 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 485 }, 486 { 487 "XDP pkt read, pkt_meta' > pkt_data, bad access 1", 488 .insns = { 489 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 490 offsetof(struct xdp_md, data_meta)), 491 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 492 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 493 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 494 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 495 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 496 BPF_MOV64_IMM(BPF_REG_0, 0), 497 BPF_EXIT_INSN(), 498 }, 499 .errstr = "R1 offset is outside of the packet", 500 .result = REJECT, 501 .prog_type = BPF_PROG_TYPE_XDP, 502 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 503 }, 504 { 505 "XDP pkt read, pkt_meta' > pkt_data, bad access 2", 506 .insns = { 507 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 508 offsetof(struct xdp_md, data_meta)), 509 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 510 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 511 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 512 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0), 513 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 514 BPF_MOV64_IMM(BPF_REG_0, 0), 515 BPF_EXIT_INSN(), 516 }, 517 .errstr = "R1 offset is outside of the packet", 518 .result = REJECT, 519 .prog_type = BPF_PROG_TYPE_XDP, 520 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 521 }, 522 { 523 "XDP pkt read, pkt_data > pkt_meta', good access", 524 .insns = { 525 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 526 offsetof(struct xdp_md, data_meta)), 527 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 528 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 529 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 530 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 531 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 532 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 533 BPF_MOV64_IMM(BPF_REG_0, 0), 534 BPF_EXIT_INSN(), 535 }, 536 .result = ACCEPT, 537 .prog_type = BPF_PROG_TYPE_XDP, 538 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 539 }, 540 { 541 "XDP pkt read, pkt_data > pkt_meta', bad access 1", 542 .insns = { 543 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 544 offsetof(struct xdp_md, data_meta)), 545 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 546 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 547 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 548 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 549 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 550 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 551 BPF_MOV64_IMM(BPF_REG_0, 0), 552 BPF_EXIT_INSN(), 553 }, 554 .errstr = "R1 offset is outside of the packet", 555 .result = REJECT, 556 .prog_type = BPF_PROG_TYPE_XDP, 557 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 558 }, 559 { 560 "XDP pkt read, pkt_data > pkt_meta', bad access 2", 561 .insns = { 562 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 563 offsetof(struct xdp_md, data_meta)), 564 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 565 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 566 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 567 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 568 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 569 BPF_MOV64_IMM(BPF_REG_0, 0), 570 BPF_EXIT_INSN(), 571 }, 572 .errstr = "R1 offset is outside of the packet", 573 .result = REJECT, 574 .prog_type = BPF_PROG_TYPE_XDP, 575 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 576 }, 577 { 578 "XDP pkt read, pkt_meta' < pkt_data, good access", 579 .insns = { 580 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 581 offsetof(struct xdp_md, data_meta)), 582 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 583 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 584 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 585 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 586 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 587 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 588 BPF_MOV64_IMM(BPF_REG_0, 0), 589 BPF_EXIT_INSN(), 590 }, 591 .result = ACCEPT, 592 .prog_type = BPF_PROG_TYPE_XDP, 593 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 594 }, 595 { 596 "XDP pkt read, pkt_meta' < pkt_data, bad access 1", 597 .insns = { 598 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 599 offsetof(struct xdp_md, data_meta)), 600 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 601 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 602 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 603 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 604 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 605 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 606 BPF_MOV64_IMM(BPF_REG_0, 0), 607 BPF_EXIT_INSN(), 608 }, 609 .errstr = "R1 offset is outside of the packet", 610 .result = REJECT, 611 .prog_type = BPF_PROG_TYPE_XDP, 612 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 613 }, 614 { 615 "XDP pkt read, pkt_meta' < pkt_data, bad access 2", 616 .insns = { 617 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 618 offsetof(struct xdp_md, data_meta)), 619 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 620 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 621 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 622 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 623 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 624 BPF_MOV64_IMM(BPF_REG_0, 0), 625 BPF_EXIT_INSN(), 626 }, 627 .errstr = "R1 offset is outside of the packet", 628 .result = REJECT, 629 .prog_type = BPF_PROG_TYPE_XDP, 630 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 631 }, 632 { 633 "XDP pkt read, pkt_data < pkt_meta', good access", 634 .insns = { 635 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 636 offsetof(struct xdp_md, data_meta)), 637 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 638 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 639 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 640 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 641 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 642 BPF_MOV64_IMM(BPF_REG_0, 0), 643 BPF_EXIT_INSN(), 644 }, 645 .result = ACCEPT, 646 .prog_type = BPF_PROG_TYPE_XDP, 647 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 648 }, 649 { 650 "XDP pkt read, pkt_data < pkt_meta', bad access 1", 651 .insns = { 652 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 653 offsetof(struct xdp_md, data_meta)), 654 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 655 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 656 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 657 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 658 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 659 BPF_MOV64_IMM(BPF_REG_0, 0), 660 BPF_EXIT_INSN(), 661 }, 662 .errstr = "R1 offset is outside of the packet", 663 .result = REJECT, 664 .prog_type = BPF_PROG_TYPE_XDP, 665 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 666 }, 667 { 668 "XDP pkt read, pkt_data < pkt_meta', bad access 2", 669 .insns = { 670 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 671 offsetof(struct xdp_md, data_meta)), 672 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 673 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 674 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 675 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0), 676 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 677 BPF_MOV64_IMM(BPF_REG_0, 0), 678 BPF_EXIT_INSN(), 679 }, 680 .errstr = "R1 offset is outside of the packet", 681 .result = REJECT, 682 .prog_type = BPF_PROG_TYPE_XDP, 683 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 684 }, 685 { 686 "XDP pkt read, pkt_meta' >= pkt_data, good access", 687 .insns = { 688 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 689 offsetof(struct xdp_md, data_meta)), 690 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 691 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 692 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 693 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 694 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 695 BPF_MOV64_IMM(BPF_REG_0, 0), 696 BPF_EXIT_INSN(), 697 }, 698 .result = ACCEPT, 699 .prog_type = BPF_PROG_TYPE_XDP, 700 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 701 }, 702 { 703 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1", 704 .insns = { 705 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 706 offsetof(struct xdp_md, data_meta)), 707 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 708 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 709 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 710 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 711 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 712 BPF_MOV64_IMM(BPF_REG_0, 0), 713 BPF_EXIT_INSN(), 714 }, 715 .errstr = "R1 offset is outside of the packet", 716 .result = REJECT, 717 .prog_type = BPF_PROG_TYPE_XDP, 718 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 719 }, 720 { 721 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2", 722 .insns = { 723 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 724 offsetof(struct xdp_md, data_meta)), 725 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 726 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 727 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 728 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0), 729 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 730 BPF_MOV64_IMM(BPF_REG_0, 0), 731 BPF_EXIT_INSN(), 732 }, 733 .errstr = "R1 offset is outside of the packet", 734 .result = REJECT, 735 .prog_type = BPF_PROG_TYPE_XDP, 736 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 737 }, 738 { 739 "XDP pkt read, pkt_data >= pkt_meta', good access", 740 .insns = { 741 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 742 offsetof(struct xdp_md, data_meta)), 743 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 744 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 745 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 746 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 747 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 748 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 749 BPF_MOV64_IMM(BPF_REG_0, 0), 750 BPF_EXIT_INSN(), 751 }, 752 .result = ACCEPT, 753 .prog_type = BPF_PROG_TYPE_XDP, 754 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 755 }, 756 { 757 "XDP pkt read, pkt_data >= pkt_meta', bad access 1", 758 .insns = { 759 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 760 offsetof(struct xdp_md, data_meta)), 761 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 762 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 763 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 764 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 765 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 766 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 767 BPF_MOV64_IMM(BPF_REG_0, 0), 768 BPF_EXIT_INSN(), 769 }, 770 .errstr = "R1 offset is outside of the packet", 771 .result = REJECT, 772 .prog_type = BPF_PROG_TYPE_XDP, 773 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 774 }, 775 { 776 "XDP pkt read, pkt_data >= pkt_meta', bad access 2", 777 .insns = { 778 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 779 offsetof(struct xdp_md, data_meta)), 780 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 781 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 782 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 783 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 784 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 785 BPF_MOV64_IMM(BPF_REG_0, 0), 786 BPF_EXIT_INSN(), 787 }, 788 .errstr = "R1 offset is outside of the packet", 789 .result = REJECT, 790 .prog_type = BPF_PROG_TYPE_XDP, 791 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 792 }, 793 { 794 "XDP pkt read, pkt_meta' <= pkt_data, good access", 795 .insns = { 796 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 797 offsetof(struct xdp_md, data_meta)), 798 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 799 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 800 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 801 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 802 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 803 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 804 BPF_MOV64_IMM(BPF_REG_0, 0), 805 BPF_EXIT_INSN(), 806 }, 807 .result = ACCEPT, 808 .prog_type = BPF_PROG_TYPE_XDP, 809 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 810 }, 811 { 812 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1", 813 .insns = { 814 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 815 offsetof(struct xdp_md, data_meta)), 816 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 817 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 818 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 819 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 820 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 821 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 822 BPF_MOV64_IMM(BPF_REG_0, 0), 823 BPF_EXIT_INSN(), 824 }, 825 .errstr = "R1 offset is outside of the packet", 826 .result = REJECT, 827 .prog_type = BPF_PROG_TYPE_XDP, 828 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 829 }, 830 { 831 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2", 832 .insns = { 833 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 834 offsetof(struct xdp_md, data_meta)), 835 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 836 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 837 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 838 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 839 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 840 BPF_MOV64_IMM(BPF_REG_0, 0), 841 BPF_EXIT_INSN(), 842 }, 843 .errstr = "R1 offset is outside of the packet", 844 .result = REJECT, 845 .prog_type = BPF_PROG_TYPE_XDP, 846 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 847 }, 848 { 849 "XDP pkt read, pkt_data <= pkt_meta', good access", 850 .insns = { 851 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 852 offsetof(struct xdp_md, data_meta)), 853 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 854 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 855 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 856 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 857 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 858 BPF_MOV64_IMM(BPF_REG_0, 0), 859 BPF_EXIT_INSN(), 860 }, 861 .result = ACCEPT, 862 .prog_type = BPF_PROG_TYPE_XDP, 863 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 864 }, 865 { 866 "XDP pkt read, pkt_data <= pkt_meta', bad access 1", 867 .insns = { 868 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 869 offsetof(struct xdp_md, data_meta)), 870 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 871 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 873 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 874 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 875 BPF_MOV64_IMM(BPF_REG_0, 0), 876 BPF_EXIT_INSN(), 877 }, 878 .errstr = "R1 offset is outside of the packet", 879 .result = REJECT, 880 .prog_type = BPF_PROG_TYPE_XDP, 881 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 882 }, 883 { 884 "XDP pkt read, pkt_data <= pkt_meta', bad access 2", 885 .insns = { 886 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 887 offsetof(struct xdp_md, data_meta)), 888 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 889 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 890 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 891 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0), 892 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 893 BPF_MOV64_IMM(BPF_REG_0, 0), 894 BPF_EXIT_INSN(), 895 }, 896 .errstr = "R1 offset is outside of the packet", 897 .result = REJECT, 898 .prog_type = BPF_PROG_TYPE_XDP, 899 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 900 }, 901