1 {
2 "check deducing bounds from const, 1",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_0, 1),
5 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
6 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7 BPF_EXIT_INSN(),
8 },
9 .result = REJECT,
10 .errstr = "R0 tried to subtract pointer from scalar",
11 },
12 {
13 "check deducing bounds from const, 2",
14 .insns = {
15 BPF_MOV64_IMM(BPF_REG_0, 1),
16 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
17 BPF_EXIT_INSN(),
18 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
19 BPF_EXIT_INSN(),
20 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
21 BPF_EXIT_INSN(),
22 },
23 .result = ACCEPT,
24 .retval = 1,
25 },
26 {
27 "check deducing bounds from const, 3",
28 .insns = {
29 BPF_MOV64_IMM(BPF_REG_0, 0),
30 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
31 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
32 BPF_EXIT_INSN(),
33 },
34 .result = REJECT,
35 .errstr = "R0 tried to subtract pointer from scalar",
36 },
37 {
38 "check deducing bounds from const, 4",
39 .insns = {
40 BPF_MOV64_IMM(BPF_REG_0, 0),
41 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
42 BPF_EXIT_INSN(),
43 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
44 BPF_EXIT_INSN(),
45 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
46 BPF_EXIT_INSN(),
47 },
48 .result = ACCEPT,
49 },
50 {
51 "check deducing bounds from const, 5",
52 .insns = {
53 BPF_MOV64_IMM(BPF_REG_0, 0),
54 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
55 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
56 BPF_EXIT_INSN(),
57 },
58 .result = REJECT,
59 .errstr = "R0 tried to subtract pointer from scalar",
60 },
61 {
62 "check deducing bounds from const, 6",
63 .insns = {
64 BPF_MOV64_IMM(BPF_REG_0, 0),
65 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
66 BPF_EXIT_INSN(),
67 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
68 BPF_EXIT_INSN(),
69 },
70 .result = REJECT,
71 .errstr = "R0 tried to subtract pointer from scalar",
72 },
73 {
74 "check deducing bounds from const, 7",
75 .insns = {
76 BPF_MOV64_IMM(BPF_REG_0, ~0),
77 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
78 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
79 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
80 offsetof(struct __sk_buff, mark)),
81 BPF_EXIT_INSN(),
82 },
83 .result = REJECT,
84 .errstr = "dereference of modified ctx ptr",
85 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
86 },
87 {
88 "check deducing bounds from const, 8",
89 .insns = {
90 BPF_MOV64_IMM(BPF_REG_0, ~0),
91 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
92 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
93 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
94 offsetof(struct __sk_buff, mark)),
95 BPF_EXIT_INSN(),
96 },
97 .result = REJECT,
98 .errstr = "dereference of modified ctx ptr",
99 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
100 },
101 {
102 "check deducing bounds from const, 9",
103 .insns = {
104 BPF_MOV64_IMM(BPF_REG_0, 0),
105 BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
106 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
107 BPF_EXIT_INSN(),
108 },
109 .result = REJECT,
110 .errstr = "R0 tried to subtract pointer from scalar",
111 },
112 {
113 "check deducing bounds from const, 10",
114 .insns = {
115 BPF_MOV64_IMM(BPF_REG_0, 0),
116 BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
117
118 BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
119 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
120 BPF_EXIT_INSN(),
121 },
122 .result = REJECT,
123 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
124 },