1 { 2 "check deducing bounds from const, 1", 3 .insns = { 4 BPF_MOV64_IMM(BPF_REG_0, 1), 5 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0), 6 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 7 BPF_EXIT_INSN(), 8 }, 9 .result = REJECT, 10 .errstr = "R0 tried to subtract pointer from scalar", 11 }, 12 { 13 "check deducing bounds from const, 2", 14 .insns = { 15 BPF_MOV64_IMM(BPF_REG_0, 1), 16 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1), 17 BPF_EXIT_INSN(), 18 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1), 19 BPF_EXIT_INSN(), 20 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), 21 BPF_EXIT_INSN(), 22 }, 23 .result = ACCEPT, 24 .retval = 1, 25 }, 26 { 27 "check deducing bounds from const, 3", 28 .insns = { 29 BPF_MOV64_IMM(BPF_REG_0, 0), 30 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0), 31 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 32 BPF_EXIT_INSN(), 33 }, 34 .result = REJECT, 35 .errstr = "R0 tried to subtract pointer from scalar", 36 }, 37 { 38 "check deducing bounds from const, 4", 39 .insns = { 40 BPF_MOV64_IMM(BPF_REG_0, 0), 41 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1), 42 BPF_EXIT_INSN(), 43 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1), 44 BPF_EXIT_INSN(), 45 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), 46 BPF_EXIT_INSN(), 47 }, 48 .result = ACCEPT, 49 }, 50 { 51 "check deducing bounds from const, 5", 52 .insns = { 53 BPF_MOV64_IMM(BPF_REG_0, 0), 54 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1), 55 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 56 BPF_EXIT_INSN(), 57 }, 58 .result = REJECT, 59 .errstr = "R0 tried to subtract pointer from scalar", 60 }, 61 { 62 "check deducing bounds from const, 6", 63 .insns = { 64 BPF_MOV64_IMM(BPF_REG_0, 0), 65 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1), 66 BPF_EXIT_INSN(), 67 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 68 BPF_EXIT_INSN(), 69 }, 70 .result = REJECT, 71 .errstr = "R0 tried to subtract pointer from scalar", 72 }, 73 { 74 "check deducing bounds from const, 7", 75 .insns = { 76 BPF_MOV64_IMM(BPF_REG_0, ~0), 77 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0), 78 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), 79 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 80 offsetof(struct __sk_buff, mark)), 81 BPF_EXIT_INSN(), 82 }, 83 .result = REJECT, 84 .errstr = "dereference of modified ctx ptr", 85 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 86 }, 87 { 88 "check deducing bounds from const, 8", 89 .insns = { 90 BPF_MOV64_IMM(BPF_REG_0, ~0), 91 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1), 92 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0), 93 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 94 offsetof(struct __sk_buff, mark)), 95 BPF_EXIT_INSN(), 96 }, 97 .result = REJECT, 98 .errstr = "dereference of modified ctx ptr", 99 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 100 }, 101 { 102 "check deducing bounds from const, 9", 103 .insns = { 104 BPF_MOV64_IMM(BPF_REG_0, 0), 105 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0), 106 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 107 BPF_EXIT_INSN(), 108 }, 109 .result = REJECT, 110 .errstr = "R0 tried to subtract pointer from scalar", 111 }, 112 { 113 "check deducing bounds from const, 10", 114 .insns = { 115 BPF_MOV64_IMM(BPF_REG_0, 0), 116 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0), 117 /* Marks reg as unknown. */ 118 BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0), 119 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 120 BPF_EXIT_INSN(), 121 }, 122 .result = REJECT, 123 .errstr = "math between ctx pointer and register with unbounded min value is not allowed", 124 }, 125