1 {
2 "XDP pkt read, pkt_end mangling, bad access 1",
3 .insns = {
4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
5 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6 offsetof(struct xdp_md, data_end)),
7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
10 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
11 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
12 BPF_MOV64_IMM(BPF_REG_0, 0),
13 BPF_EXIT_INSN(),
14 },
15 .errstr = "R3 pointer arithmetic on pkt_end",
16 .result = REJECT,
17 .prog_type = BPF_PROG_TYPE_XDP,
18 },
19 {
20 "XDP pkt read, pkt_end mangling, bad access 2",
21 .insns = {
22 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
23 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
24 offsetof(struct xdp_md, data_end)),
25 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
27 BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
28 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
29 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
30 BPF_MOV64_IMM(BPF_REG_0, 0),
31 BPF_EXIT_INSN(),
32 },
33 .errstr = "R3 pointer arithmetic on pkt_end",
34 .result = REJECT,
35 .prog_type = BPF_PROG_TYPE_XDP,
36 },
37 {
38 "XDP pkt read, pkt_data' > pkt_end, good access",
39 .insns = {
40 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
41 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
42 offsetof(struct xdp_md, data_end)),
43 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
44 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
45 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
46 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
47 BPF_MOV64_IMM(BPF_REG_0, 0),
48 BPF_EXIT_INSN(),
49 },
50 .result = ACCEPT,
51 .prog_type = BPF_PROG_TYPE_XDP,
52 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
53 },
54 {
55 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
56 .insns = {
57 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
58 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
59 offsetof(struct xdp_md, data_end)),
60 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
62 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
63 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
64 BPF_MOV64_IMM(BPF_REG_0, 0),
65 BPF_EXIT_INSN(),
66 },
67 .errstr = "R1 offset is outside of the packet",
68 .result = REJECT,
69 .prog_type = BPF_PROG_TYPE_XDP,
70 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
71 },
72 {
73 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
74 .insns = {
75 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
76 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
77 offsetof(struct xdp_md, data_end)),
78 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
79 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
80 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
81 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
82 BPF_MOV64_IMM(BPF_REG_0, 0),
83 BPF_EXIT_INSN(),
84 },
85 .errstr = "R1 offset is outside of the packet",
86 .result = REJECT,
87 .prog_type = BPF_PROG_TYPE_XDP,
88 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
89 },
90 {
91 "XDP pkt read, pkt_end > pkt_data', good access",
92 .insns = {
93 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
94 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
95 offsetof(struct xdp_md, data_end)),
96 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
97 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
98 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
99 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
100 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
101 BPF_MOV64_IMM(BPF_REG_0, 0),
102 BPF_EXIT_INSN(),
103 },
104 .result = ACCEPT,
105 .prog_type = BPF_PROG_TYPE_XDP,
106 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
107 },
108 {
109 "XDP pkt read, pkt_end > pkt_data', bad access 1",
110 .insns = {
111 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
112 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
113 offsetof(struct xdp_md, data_end)),
114 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
115 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
116 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
117 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
118 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
119 BPF_MOV64_IMM(BPF_REG_0, 0),
120 BPF_EXIT_INSN(),
121 },
122 .errstr = "R1 offset is outside of the packet",
123 .result = REJECT,
124 .prog_type = BPF_PROG_TYPE_XDP,
125 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
126 },
127 {
128 "XDP pkt read, pkt_end > pkt_data', bad access 2",
129 .insns = {
130 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
131 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
132 offsetof(struct xdp_md, data_end)),
133 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
134 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
135 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
136 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
137 BPF_MOV64_IMM(BPF_REG_0, 0),
138 BPF_EXIT_INSN(),
139 },
140 .errstr = "R1 offset is outside of the packet",
141 .result = REJECT,
142 .prog_type = BPF_PROG_TYPE_XDP,
143 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
144 },
145 {
146 "XDP pkt read, pkt_data' < pkt_end, good access",
147 .insns = {
148 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
149 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
150 offsetof(struct xdp_md, data_end)),
151 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
153 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
154 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
155 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
156 BPF_MOV64_IMM(BPF_REG_0, 0),
157 BPF_EXIT_INSN(),
158 },
159 .result = ACCEPT,
160 .prog_type = BPF_PROG_TYPE_XDP,
161 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
162 },
163 {
164 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
165 .insns = {
166 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
167 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
168 offsetof(struct xdp_md, data_end)),
169 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
170 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
171 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
172 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
173 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
174 BPF_MOV64_IMM(BPF_REG_0, 0),
175 BPF_EXIT_INSN(),
176 },
177 .errstr = "R1 offset is outside of the packet",
178 .result = REJECT,
179 .prog_type = BPF_PROG_TYPE_XDP,
180 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
181 },
182 {
183 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
184 .insns = {
185 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
186 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
187 offsetof(struct xdp_md, data_end)),
188 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
189 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
190 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
191 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
192 BPF_MOV64_IMM(BPF_REG_0, 0),
193 BPF_EXIT_INSN(),
194 },
195 .errstr = "R1 offset is outside of the packet",
196 .result = REJECT,
197 .prog_type = BPF_PROG_TYPE_XDP,
198 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
199 },
200 {
201 "XDP pkt read, pkt_end < pkt_data', good access",
202 .insns = {
203 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
204 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
205 offsetof(struct xdp_md, data_end)),
206 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
207 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
208 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
209 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
210 BPF_MOV64_IMM(BPF_REG_0, 0),
211 BPF_EXIT_INSN(),
212 },
213 .result = ACCEPT,
214 .prog_type = BPF_PROG_TYPE_XDP,
215 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
216 },
217 {
218 "XDP pkt read, pkt_end < pkt_data', bad access 1",
219 .insns = {
220 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
221 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
222 offsetof(struct xdp_md, data_end)),
223 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
224 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
225 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
226 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
227 BPF_MOV64_IMM(BPF_REG_0, 0),
228 BPF_EXIT_INSN(),
229 },
230 .errstr = "R1 offset is outside of the packet",
231 .result = REJECT,
232 .prog_type = BPF_PROG_TYPE_XDP,
233 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
234 },
235 {
236 "XDP pkt read, pkt_end < pkt_data', bad access 2",
237 .insns = {
238 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
239 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
240 offsetof(struct xdp_md, data_end)),
241 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
242 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
243 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
244 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
245 BPF_MOV64_IMM(BPF_REG_0, 0),
246 BPF_EXIT_INSN(),
247 },
248 .errstr = "R1 offset is outside of the packet",
249 .result = REJECT,
250 .prog_type = BPF_PROG_TYPE_XDP,
251 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
252 },
253 {
254 "XDP pkt read, pkt_data' >= pkt_end, good access",
255 .insns = {
256 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
257 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
258 offsetof(struct xdp_md, data_end)),
259 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
261 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
262 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
263 BPF_MOV64_IMM(BPF_REG_0, 0),
264 BPF_EXIT_INSN(),
265 },
266 .result = ACCEPT,
267 .prog_type = BPF_PROG_TYPE_XDP,
268 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
269 },
270 {
271 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
272 .insns = {
273 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
274 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
275 offsetof(struct xdp_md, data_end)),
276 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
277 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
278 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
279 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
280 BPF_MOV64_IMM(BPF_REG_0, 0),
281 BPF_EXIT_INSN(),
282 },
283 .errstr = "R1 offset is outside of the packet",
284 .result = REJECT,
285 .prog_type = BPF_PROG_TYPE_XDP,
286 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
287 },
288 {
289 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
290 .insns = {
291 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
292 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
293 offsetof(struct xdp_md, data_end)),
294 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
295 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
296 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
297 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
298 BPF_MOV64_IMM(BPF_REG_0, 0),
299 BPF_EXIT_INSN(),
300 },
301 .errstr = "R1 offset is outside of the packet",
302 .result = REJECT,
303 .prog_type = BPF_PROG_TYPE_XDP,
304 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
305 },
306 {
307 "XDP pkt read, pkt_end >= pkt_data', good access",
308 .insns = {
309 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
310 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
311 offsetof(struct xdp_md, data_end)),
312 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
313 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
314 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
315 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
316 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
317 BPF_MOV64_IMM(BPF_REG_0, 0),
318 BPF_EXIT_INSN(),
319 },
320 .result = ACCEPT,
321 .prog_type = BPF_PROG_TYPE_XDP,
322 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
323 },
324 {
325 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
326 .insns = {
327 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
328 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
329 offsetof(struct xdp_md, data_end)),
330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
331 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
332 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
333 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
334 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
335 BPF_MOV64_IMM(BPF_REG_0, 0),
336 BPF_EXIT_INSN(),
337 },
338 .errstr = "R1 offset is outside of the packet",
339 .result = REJECT,
340 .prog_type = BPF_PROG_TYPE_XDP,
341 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
342 },
343 {
344 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
345 .insns = {
346 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
347 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
348 offsetof(struct xdp_md, data_end)),
349 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
351 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
352 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
353 BPF_MOV64_IMM(BPF_REG_0, 0),
354 BPF_EXIT_INSN(),
355 },
356 .errstr = "R1 offset is outside of the packet",
357 .result = REJECT,
358 .prog_type = BPF_PROG_TYPE_XDP,
359 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
360 },
361 {
362 "XDP pkt read, pkt_data' <= pkt_end, good access",
363 .insns = {
364 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
365 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
366 offsetof(struct xdp_md, data_end)),
367 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
368 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
369 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
370 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
371 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
372 BPF_MOV64_IMM(BPF_REG_0, 0),
373 BPF_EXIT_INSN(),
374 },
375 .result = ACCEPT,
376 .prog_type = BPF_PROG_TYPE_XDP,
377 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
378 },
379 {
380 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
381 .insns = {
382 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
383 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
384 offsetof(struct xdp_md, data_end)),
385 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
386 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
387 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
388 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
389 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
390 BPF_MOV64_IMM(BPF_REG_0, 0),
391 BPF_EXIT_INSN(),
392 },
393 .errstr = "R1 offset is outside of the packet",
394 .result = REJECT,
395 .prog_type = BPF_PROG_TYPE_XDP,
396 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
397 },
398 {
399 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
400 .insns = {
401 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
402 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
403 offsetof(struct xdp_md, data_end)),
404 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
405 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
406 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
407 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
408 BPF_MOV64_IMM(BPF_REG_0, 0),
409 BPF_EXIT_INSN(),
410 },
411 .errstr = "R1 offset is outside of the packet",
412 .result = REJECT,
413 .prog_type = BPF_PROG_TYPE_XDP,
414 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
415 },
416 {
417 "XDP pkt read, pkt_end <= pkt_data', good access",
418 .insns = {
419 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
420 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
421 offsetof(struct xdp_md, data_end)),
422 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
423 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
424 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
425 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
426 BPF_MOV64_IMM(BPF_REG_0, 0),
427 BPF_EXIT_INSN(),
428 },
429 .result = ACCEPT,
430 .prog_type = BPF_PROG_TYPE_XDP,
431 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
432 },
433 {
434 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
435 .insns = {
436 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
437 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
438 offsetof(struct xdp_md, data_end)),
439 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
440 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
441 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
442 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
443 BPF_MOV64_IMM(BPF_REG_0, 0),
444 BPF_EXIT_INSN(),
445 },
446 .errstr = "R1 offset is outside of the packet",
447 .result = REJECT,
448 .prog_type = BPF_PROG_TYPE_XDP,
449 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
450 },
451 {
452 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
453 .insns = {
454 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
455 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
456 offsetof(struct xdp_md, data_end)),
457 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
458 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
459 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
460 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
461 BPF_MOV64_IMM(BPF_REG_0, 0),
462 BPF_EXIT_INSN(),
463 },
464 .errstr = "R1 offset is outside of the packet",
465 .result = REJECT,
466 .prog_type = BPF_PROG_TYPE_XDP,
467 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
468 },
469 {
470 "XDP pkt read, pkt_meta' > pkt_data, good access",
471 .insns = {
472 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
473 offsetof(struct xdp_md, data_meta)),
474 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
475 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
476 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
477 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
478 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
479 BPF_MOV64_IMM(BPF_REG_0, 0),
480 BPF_EXIT_INSN(),
481 },
482 .result = ACCEPT,
483 .prog_type = BPF_PROG_TYPE_XDP,
484 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
485 },
486 {
487 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
488 .insns = {
489 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
490 offsetof(struct xdp_md, data_meta)),
491 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
492 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
493 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
494 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
495 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
496 BPF_MOV64_IMM(BPF_REG_0, 0),
497 BPF_EXIT_INSN(),
498 },
499 .errstr = "R1 offset is outside of the packet",
500 .result = REJECT,
501 .prog_type = BPF_PROG_TYPE_XDP,
502 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
503 },
504 {
505 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
506 .insns = {
507 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
508 offsetof(struct xdp_md, data_meta)),
509 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
510 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
511 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
512 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
513 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
514 BPF_MOV64_IMM(BPF_REG_0, 0),
515 BPF_EXIT_INSN(),
516 },
517 .errstr = "R1 offset is outside of the packet",
518 .result = REJECT,
519 .prog_type = BPF_PROG_TYPE_XDP,
520 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
521 },
522 {
523 "XDP pkt read, pkt_data > pkt_meta', good access",
524 .insns = {
525 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
526 offsetof(struct xdp_md, data_meta)),
527 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
528 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
529 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
530 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
531 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
532 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
533 BPF_MOV64_IMM(BPF_REG_0, 0),
534 BPF_EXIT_INSN(),
535 },
536 .result = ACCEPT,
537 .prog_type = BPF_PROG_TYPE_XDP,
538 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
539 },
540 {
541 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
542 .insns = {
543 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
544 offsetof(struct xdp_md, data_meta)),
545 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
546 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
547 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
548 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
549 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
550 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
551 BPF_MOV64_IMM(BPF_REG_0, 0),
552 BPF_EXIT_INSN(),
553 },
554 .errstr = "R1 offset is outside of the packet",
555 .result = REJECT,
556 .prog_type = BPF_PROG_TYPE_XDP,
557 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
558 },
559 {
560 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
561 .insns = {
562 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
563 offsetof(struct xdp_md, data_meta)),
564 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
565 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
566 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
567 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
568 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
569 BPF_MOV64_IMM(BPF_REG_0, 0),
570 BPF_EXIT_INSN(),
571 },
572 .errstr = "R1 offset is outside of the packet",
573 .result = REJECT,
574 .prog_type = BPF_PROG_TYPE_XDP,
575 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
576 },
577 {
578 "XDP pkt read, pkt_meta' < pkt_data, good access",
579 .insns = {
580 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
581 offsetof(struct xdp_md, data_meta)),
582 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
583 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
584 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
585 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
586 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
587 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
588 BPF_MOV64_IMM(BPF_REG_0, 0),
589 BPF_EXIT_INSN(),
590 },
591 .result = ACCEPT,
592 .prog_type = BPF_PROG_TYPE_XDP,
593 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
594 },
595 {
596 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
597 .insns = {
598 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
599 offsetof(struct xdp_md, data_meta)),
600 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
601 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
602 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
603 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
604 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
605 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
606 BPF_MOV64_IMM(BPF_REG_0, 0),
607 BPF_EXIT_INSN(),
608 },
609 .errstr = "R1 offset is outside of the packet",
610 .result = REJECT,
611 .prog_type = BPF_PROG_TYPE_XDP,
612 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
613 },
614 {
615 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
616 .insns = {
617 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
618 offsetof(struct xdp_md, data_meta)),
619 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
620 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
621 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
622 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
623 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
624 BPF_MOV64_IMM(BPF_REG_0, 0),
625 BPF_EXIT_INSN(),
626 },
627 .errstr = "R1 offset is outside of the packet",
628 .result = REJECT,
629 .prog_type = BPF_PROG_TYPE_XDP,
630 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
631 },
632 {
633 "XDP pkt read, pkt_data < pkt_meta', good access",
634 .insns = {
635 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
636 offsetof(struct xdp_md, data_meta)),
637 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
638 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
639 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
640 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
641 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
642 BPF_MOV64_IMM(BPF_REG_0, 0),
643 BPF_EXIT_INSN(),
644 },
645 .result = ACCEPT,
646 .prog_type = BPF_PROG_TYPE_XDP,
647 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
648 },
649 {
650 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
651 .insns = {
652 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
653 offsetof(struct xdp_md, data_meta)),
654 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
655 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
656 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
657 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
658 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
659 BPF_MOV64_IMM(BPF_REG_0, 0),
660 BPF_EXIT_INSN(),
661 },
662 .errstr = "R1 offset is outside of the packet",
663 .result = REJECT,
664 .prog_type = BPF_PROG_TYPE_XDP,
665 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
666 },
667 {
668 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
669 .insns = {
670 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
671 offsetof(struct xdp_md, data_meta)),
672 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
673 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
674 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
675 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
676 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
677 BPF_MOV64_IMM(BPF_REG_0, 0),
678 BPF_EXIT_INSN(),
679 },
680 .errstr = "R1 offset is outside of the packet",
681 .result = REJECT,
682 .prog_type = BPF_PROG_TYPE_XDP,
683 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
684 },
685 {
686 "XDP pkt read, pkt_meta' >= pkt_data, good access",
687 .insns = {
688 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
689 offsetof(struct xdp_md, data_meta)),
690 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
691 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
692 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
693 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
694 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
695 BPF_MOV64_IMM(BPF_REG_0, 0),
696 BPF_EXIT_INSN(),
697 },
698 .result = ACCEPT,
699 .prog_type = BPF_PROG_TYPE_XDP,
700 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
701 },
702 {
703 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
704 .insns = {
705 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
706 offsetof(struct xdp_md, data_meta)),
707 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
708 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
709 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
710 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
711 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
712 BPF_MOV64_IMM(BPF_REG_0, 0),
713 BPF_EXIT_INSN(),
714 },
715 .errstr = "R1 offset is outside of the packet",
716 .result = REJECT,
717 .prog_type = BPF_PROG_TYPE_XDP,
718 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
719 },
720 {
721 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
722 .insns = {
723 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
724 offsetof(struct xdp_md, data_meta)),
725 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
726 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
727 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
728 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
729 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
730 BPF_MOV64_IMM(BPF_REG_0, 0),
731 BPF_EXIT_INSN(),
732 },
733 .errstr = "R1 offset is outside of the packet",
734 .result = REJECT,
735 .prog_type = BPF_PROG_TYPE_XDP,
736 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
737 },
738 {
739 "XDP pkt read, pkt_data >= pkt_meta', good access",
740 .insns = {
741 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
742 offsetof(struct xdp_md, data_meta)),
743 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
744 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
745 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
746 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
747 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
748 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
749 BPF_MOV64_IMM(BPF_REG_0, 0),
750 BPF_EXIT_INSN(),
751 },
752 .result = ACCEPT,
753 .prog_type = BPF_PROG_TYPE_XDP,
754 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
755 },
756 {
757 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
758 .insns = {
759 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
760 offsetof(struct xdp_md, data_meta)),
761 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
762 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
763 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
764 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
765 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
766 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
767 BPF_MOV64_IMM(BPF_REG_0, 0),
768 BPF_EXIT_INSN(),
769 },
770 .errstr = "R1 offset is outside of the packet",
771 .result = REJECT,
772 .prog_type = BPF_PROG_TYPE_XDP,
773 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
774 },
775 {
776 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
777 .insns = {
778 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
779 offsetof(struct xdp_md, data_meta)),
780 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
781 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
782 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
783 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
784 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
785 BPF_MOV64_IMM(BPF_REG_0, 0),
786 BPF_EXIT_INSN(),
787 },
788 .errstr = "R1 offset is outside of the packet",
789 .result = REJECT,
790 .prog_type = BPF_PROG_TYPE_XDP,
791 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
792 },
793 {
794 "XDP pkt read, pkt_meta' <= pkt_data, good access",
795 .insns = {
796 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
797 offsetof(struct xdp_md, data_meta)),
798 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
799 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
800 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
801 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
802 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
803 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
804 BPF_MOV64_IMM(BPF_REG_0, 0),
805 BPF_EXIT_INSN(),
806 },
807 .result = ACCEPT,
808 .prog_type = BPF_PROG_TYPE_XDP,
809 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
810 },
811 {
812 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
813 .insns = {
814 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
815 offsetof(struct xdp_md, data_meta)),
816 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
817 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
818 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
819 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
820 BPF_JMP_IMM(BPF_JA, 0, 0, 1),
821 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
822 BPF_MOV64_IMM(BPF_REG_0, 0),
823 BPF_EXIT_INSN(),
824 },
825 .errstr = "R1 offset is outside of the packet",
826 .result = REJECT,
827 .prog_type = BPF_PROG_TYPE_XDP,
828 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
829 },
830 {
831 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
832 .insns = {
833 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
834 offsetof(struct xdp_md, data_meta)),
835 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
836 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
837 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
838 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
839 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
840 BPF_MOV64_IMM(BPF_REG_0, 0),
841 BPF_EXIT_INSN(),
842 },
843 .errstr = "R1 offset is outside of the packet",
844 .result = REJECT,
845 .prog_type = BPF_PROG_TYPE_XDP,
846 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
847 },
848 {
849 "XDP pkt read, pkt_data <= pkt_meta', good access",
850 .insns = {
851 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
852 offsetof(struct xdp_md, data_meta)),
853 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
854 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
855 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
856 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
857 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
858 BPF_MOV64_IMM(BPF_REG_0, 0),
859 BPF_EXIT_INSN(),
860 },
861 .result = ACCEPT,
862 .prog_type = BPF_PROG_TYPE_XDP,
863 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
864 },
865 {
866 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
867 .insns = {
868 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
869 offsetof(struct xdp_md, data_meta)),
870 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
871 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
872 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
873 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
874 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
875 BPF_MOV64_IMM(BPF_REG_0, 0),
876 BPF_EXIT_INSN(),
877 },
878 .errstr = "R1 offset is outside of the packet",
879 .result = REJECT,
880 .prog_type = BPF_PROG_TYPE_XDP,
881 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
882 },
883 {
884 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
885 .insns = {
886 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
887 offsetof(struct xdp_md, data_meta)),
888 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
889 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
890 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
891 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
892 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
893 BPF_MOV64_IMM(BPF_REG_0, 0),
894 BPF_EXIT_INSN(),
895 },
896 .errstr = "R1 offset is outside of the packet",
897 .result = REJECT,
898 .prog_type = BPF_PROG_TYPE_XDP,
899 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
900 },