1 { 2 "multiple registers share map_lookup_elem result", 3 .insns = { 4 BPF_MOV64_IMM(BPF_REG_1, 10), 5 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 6 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 7 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 8 BPF_LD_MAP_FD(BPF_REG_1, 0), 9 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 10 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 11 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 12 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 13 BPF_EXIT_INSN(), 14 }, 15 .fixup_map_hash_8b = { 4 }, 16 .result = ACCEPT, 17 .prog_type = BPF_PROG_TYPE_SCHED_CLS 18 }, 19 { 20 "alu ops on ptr_to_map_value_or_null, 1", 21 .insns = { 22 BPF_MOV64_IMM(BPF_REG_1, 10), 23 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 24 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 25 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 26 BPF_LD_MAP_FD(BPF_REG_1, 0), 27 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 28 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 29 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2), 30 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2), 31 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 32 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 33 BPF_EXIT_INSN(), 34 }, 35 .fixup_map_hash_8b = { 4 }, 36 .errstr = "R4 pointer arithmetic on map_value_or_null", 37 .result = REJECT, 38 .prog_type = BPF_PROG_TYPE_SCHED_CLS 39 }, 40 { 41 "alu ops on ptr_to_map_value_or_null, 2", 42 .insns = { 43 BPF_MOV64_IMM(BPF_REG_1, 10), 44 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 45 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 46 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 47 BPF_LD_MAP_FD(BPF_REG_1, 0), 48 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 49 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 50 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1), 51 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 52 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 53 BPF_EXIT_INSN(), 54 }, 55 .fixup_map_hash_8b = { 4 }, 56 .errstr = "R4 pointer arithmetic on map_value_or_null", 57 .result = REJECT, 58 .prog_type = BPF_PROG_TYPE_SCHED_CLS 59 }, 60 { 61 "alu ops on ptr_to_map_value_or_null, 3", 62 .insns = { 63 BPF_MOV64_IMM(BPF_REG_1, 10), 64 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 65 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 66 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 67 BPF_LD_MAP_FD(BPF_REG_1, 0), 68 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 69 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 70 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1), 71 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 72 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 73 BPF_EXIT_INSN(), 74 }, 75 .fixup_map_hash_8b = { 4 }, 76 .errstr = "R4 pointer arithmetic on map_value_or_null", 77 .result = REJECT, 78 .prog_type = BPF_PROG_TYPE_SCHED_CLS 79 }, 80 { 81 "invalid memory access with multiple map_lookup_elem calls", 82 .insns = { 83 BPF_MOV64_IMM(BPF_REG_1, 10), 84 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 85 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 86 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 87 BPF_LD_MAP_FD(BPF_REG_1, 0), 88 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1), 89 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 90 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 91 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 92 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8), 93 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 94 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 95 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 96 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 97 BPF_EXIT_INSN(), 98 }, 99 .fixup_map_hash_8b = { 4 }, 100 .result = REJECT, 101 .errstr = "R4 !read_ok", 102 .prog_type = BPF_PROG_TYPE_SCHED_CLS 103 }, 104 { 105 "valid indirect map_lookup_elem access with 2nd lookup in branch", 106 .insns = { 107 BPF_MOV64_IMM(BPF_REG_1, 10), 108 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), 109 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 111 BPF_LD_MAP_FD(BPF_REG_1, 0), 112 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1), 113 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 114 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 115 BPF_MOV64_IMM(BPF_REG_2, 10), 116 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3), 117 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8), 118 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7), 119 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 120 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0), 121 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 122 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0), 123 BPF_EXIT_INSN(), 124 }, 125 .fixup_map_hash_8b = { 4 }, 126 .result = ACCEPT, 127 .prog_type = BPF_PROG_TYPE_SCHED_CLS 128 }, 129 { 130 "invalid map access from else condition", 131 .insns = { 132 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 133 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 134 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 135 BPF_LD_MAP_FD(BPF_REG_1, 0), 136 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 137 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 138 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 139 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1), 140 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1), 141 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 142 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 143 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 144 BPF_EXIT_INSN(), 145 }, 146 .fixup_map_hash_48b = { 3 }, 147 .errstr = "R0 unbounded memory access", 148 .result = REJECT, 149 .errstr_unpriv = "R0 leaks addr", 150 .result_unpriv = REJECT, 151 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 152 }, 153