1 { 2 "bounds checks mixing signed and unsigned, positive bounds", 3 .insns = { 4 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 5 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 6 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 7 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 9 BPF_LD_MAP_FD(BPF_REG_1, 0), 10 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 11 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 12 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 13 BPF_MOV64_IMM(BPF_REG_2, 2), 14 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3), 15 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2), 16 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 17 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 18 BPF_MOV64_IMM(BPF_REG_0, 0), 19 BPF_EXIT_INSN(), 20 }, 21 .fixup_map_hash_8b = { 5 }, 22 .errstr = "unbounded min value", 23 .result = REJECT, 24 }, 25 { 26 "bounds checks mixing signed and unsigned", 27 .insns = { 28 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 29 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 30 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 31 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 32 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 33 BPF_LD_MAP_FD(BPF_REG_1, 0), 34 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 35 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 36 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 37 BPF_MOV64_IMM(BPF_REG_2, -1), 38 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3), 39 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 40 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 41 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 42 BPF_MOV64_IMM(BPF_REG_0, 0), 43 BPF_EXIT_INSN(), 44 }, 45 .fixup_map_hash_8b = { 5 }, 46 .errstr = "unbounded min value", 47 .result = REJECT, 48 }, 49 { 50 "bounds checks mixing signed and unsigned, variant 2", 51 .insns = { 52 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 53 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 54 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 55 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 56 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 57 BPF_LD_MAP_FD(BPF_REG_1, 0), 58 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 59 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 60 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 61 BPF_MOV64_IMM(BPF_REG_2, -1), 62 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5), 63 BPF_MOV64_IMM(BPF_REG_8, 0), 64 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1), 65 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2), 66 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8), 67 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0), 68 BPF_MOV64_IMM(BPF_REG_0, 0), 69 BPF_EXIT_INSN(), 70 }, 71 .fixup_map_hash_8b = { 5 }, 72 .errstr = "unbounded min value", 73 .result = REJECT, 74 }, 75 { 76 "bounds checks mixing signed and unsigned, variant 3", 77 .insns = { 78 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 79 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 80 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 81 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 82 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 83 BPF_LD_MAP_FD(BPF_REG_1, 0), 84 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 85 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 86 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 87 BPF_MOV64_IMM(BPF_REG_2, -1), 88 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4), 89 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1), 90 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2), 91 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8), 92 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0), 93 BPF_MOV64_IMM(BPF_REG_0, 0), 94 BPF_EXIT_INSN(), 95 }, 96 .fixup_map_hash_8b = { 5 }, 97 .errstr = "unbounded min value", 98 .result = REJECT, 99 }, 100 { 101 "bounds checks mixing signed and unsigned, variant 4", 102 .insns = { 103 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 104 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 105 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 106 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 107 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 108 BPF_LD_MAP_FD(BPF_REG_1, 0), 109 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 110 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 111 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 112 BPF_MOV64_IMM(BPF_REG_2, 1), 113 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2), 114 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 115 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 116 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 117 BPF_MOV64_IMM(BPF_REG_0, 0), 118 BPF_EXIT_INSN(), 119 }, 120 .fixup_map_hash_8b = { 5 }, 121 .result = ACCEPT, 122 }, 123 { 124 "bounds checks mixing signed and unsigned, variant 5", 125 .insns = { 126 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 127 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 128 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 129 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 130 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 131 BPF_LD_MAP_FD(BPF_REG_1, 0), 132 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 133 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 134 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 135 BPF_MOV64_IMM(BPF_REG_2, -1), 136 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5), 137 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4), 138 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4), 139 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 140 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 141 BPF_MOV64_IMM(BPF_REG_0, 0), 142 BPF_EXIT_INSN(), 143 }, 144 .fixup_map_hash_8b = { 5 }, 145 .errstr = "unbounded min value", 146 .result = REJECT, 147 }, 148 { 149 "bounds checks mixing signed and unsigned, variant 6", 150 .insns = { 151 BPF_MOV64_REG(BPF_REG_9, BPF_REG_1), 152 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 153 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 154 BPF_MOV64_REG(BPF_REG_1, BPF_REG_9), 155 BPF_MOV64_IMM(BPF_REG_2, 0), 156 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10), 157 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512), 158 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16), 159 BPF_MOV64_IMM(BPF_REG_6, -1), 160 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5), 161 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4), 162 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1), 163 BPF_MOV64_IMM(BPF_REG_5, 0), 164 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0), 165 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes), 166 BPF_MOV64_IMM(BPF_REG_0, 0), 167 BPF_EXIT_INSN(), 168 }, 169 .errstr = "R4 min value is negative, either use unsigned", 170 .result = REJECT, 171 }, 172 { 173 "bounds checks mixing signed and unsigned, variant 7", 174 .insns = { 175 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 176 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 177 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 178 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 179 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 180 BPF_LD_MAP_FD(BPF_REG_1, 0), 181 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 182 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 183 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 184 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024), 185 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3), 186 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 187 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 188 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 189 BPF_MOV64_IMM(BPF_REG_0, 0), 190 BPF_EXIT_INSN(), 191 }, 192 .fixup_map_hash_8b = { 5 }, 193 .result = ACCEPT, 194 }, 195 { 196 "bounds checks mixing signed and unsigned, variant 8", 197 .insns = { 198 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 199 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 200 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 201 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 202 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 203 BPF_LD_MAP_FD(BPF_REG_1, 0), 204 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 205 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 206 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 207 BPF_MOV64_IMM(BPF_REG_2, -1), 208 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 209 BPF_MOV64_IMM(BPF_REG_0, 0), 210 BPF_EXIT_INSN(), 211 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 212 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 213 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 214 BPF_MOV64_IMM(BPF_REG_0, 0), 215 BPF_EXIT_INSN(), 216 }, 217 .fixup_map_hash_8b = { 5 }, 218 .errstr = "unbounded min value", 219 .result = REJECT, 220 }, 221 { 222 "bounds checks mixing signed and unsigned, variant 9", 223 .insns = { 224 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 225 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 226 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 227 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 228 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 229 BPF_LD_MAP_FD(BPF_REG_1, 0), 230 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 231 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 232 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 233 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL), 234 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 235 BPF_MOV64_IMM(BPF_REG_0, 0), 236 BPF_EXIT_INSN(), 237 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 238 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 239 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 240 BPF_MOV64_IMM(BPF_REG_0, 0), 241 BPF_EXIT_INSN(), 242 }, 243 .fixup_map_hash_8b = { 5 }, 244 .result = ACCEPT, 245 }, 246 { 247 "bounds checks mixing signed and unsigned, variant 10", 248 .insns = { 249 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 250 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 251 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 252 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 253 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 254 BPF_LD_MAP_FD(BPF_REG_1, 0), 255 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 256 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 257 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 258 BPF_MOV64_IMM(BPF_REG_2, 0), 259 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 260 BPF_MOV64_IMM(BPF_REG_0, 0), 261 BPF_EXIT_INSN(), 262 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 263 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 264 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 265 BPF_MOV64_IMM(BPF_REG_0, 0), 266 BPF_EXIT_INSN(), 267 }, 268 .fixup_map_hash_8b = { 5 }, 269 .errstr = "unbounded min value", 270 .result = REJECT, 271 }, 272 { 273 "bounds checks mixing signed and unsigned, variant 11", 274 .insns = { 275 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 276 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 277 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 278 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 280 BPF_LD_MAP_FD(BPF_REG_1, 0), 281 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 282 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 283 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 284 BPF_MOV64_IMM(BPF_REG_2, -1), 285 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 286 /* Dead branch. */ 287 BPF_MOV64_IMM(BPF_REG_0, 0), 288 BPF_EXIT_INSN(), 289 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 290 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 291 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 292 BPF_MOV64_IMM(BPF_REG_0, 0), 293 BPF_EXIT_INSN(), 294 }, 295 .fixup_map_hash_8b = { 5 }, 296 .errstr = "unbounded min value", 297 .result = REJECT, 298 }, 299 { 300 "bounds checks mixing signed and unsigned, variant 12", 301 .insns = { 302 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 303 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 304 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 305 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 306 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 307 BPF_LD_MAP_FD(BPF_REG_1, 0), 308 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 309 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 310 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 311 BPF_MOV64_IMM(BPF_REG_2, -6), 312 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 313 BPF_MOV64_IMM(BPF_REG_0, 0), 314 BPF_EXIT_INSN(), 315 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 316 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 317 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 318 BPF_MOV64_IMM(BPF_REG_0, 0), 319 BPF_EXIT_INSN(), 320 }, 321 .fixup_map_hash_8b = { 5 }, 322 .errstr = "unbounded min value", 323 .result = REJECT, 324 }, 325 { 326 "bounds checks mixing signed and unsigned, variant 13", 327 .insns = { 328 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 329 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 330 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 331 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 332 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 333 BPF_LD_MAP_FD(BPF_REG_1, 0), 334 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 335 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5), 336 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 337 BPF_MOV64_IMM(BPF_REG_2, 2), 338 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 339 BPF_MOV64_IMM(BPF_REG_7, 1), 340 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2), 341 BPF_MOV64_IMM(BPF_REG_0, 0), 342 BPF_EXIT_INSN(), 343 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1), 344 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2), 345 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7), 346 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 347 BPF_MOV64_IMM(BPF_REG_0, 0), 348 BPF_EXIT_INSN(), 349 }, 350 .fixup_map_hash_8b = { 5 }, 351 .errstr = "unbounded min value", 352 .result = REJECT, 353 }, 354 { 355 "bounds checks mixing signed and unsigned, variant 14", 356 .insns = { 357 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1, 358 offsetof(struct __sk_buff, mark)), 359 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 360 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 361 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 362 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 363 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 364 BPF_LD_MAP_FD(BPF_REG_1, 0), 365 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 366 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 367 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 368 BPF_MOV64_IMM(BPF_REG_2, -1), 369 BPF_MOV64_IMM(BPF_REG_8, 2), 370 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6), 371 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3), 372 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 373 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 374 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 375 BPF_MOV64_IMM(BPF_REG_0, 0), 376 BPF_EXIT_INSN(), 377 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3), 378 BPF_JMP_IMM(BPF_JA, 0, 0, -7), 379 }, 380 .fixup_map_hash_8b = { 6 }, 381 .errstr = "unbounded min value", 382 .result = REJECT, 383 }, 384 { 385 "bounds checks mixing signed and unsigned, variant 15", 386 .insns = { 387 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 388 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), 389 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 390 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 391 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 392 BPF_LD_MAP_FD(BPF_REG_1, 0), 393 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 394 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 395 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 396 BPF_MOV64_IMM(BPF_REG_2, -6), 397 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 398 BPF_MOV64_IMM(BPF_REG_0, 0), 399 BPF_EXIT_INSN(), 400 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 401 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2), 402 BPF_MOV64_IMM(BPF_REG_0, 0), 403 BPF_EXIT_INSN(), 404 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 405 BPF_MOV64_IMM(BPF_REG_0, 0), 406 BPF_EXIT_INSN(), 407 }, 408 .fixup_map_hash_8b = { 5 }, 409 .errstr = "unbounded min value", 410 .result = REJECT, 411 }, 412