1 {
2 "bounds checks mixing signed and unsigned, positive bounds",
3 .insns = {
4 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7 BPF_LD_MAP_FD(BPF_REG_1, 0),
8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
10 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
11 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
12 BPF_MOV64_IMM(BPF_REG_2, 2),
13 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
14 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
15 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
16 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
17 BPF_MOV64_IMM(BPF_REG_0, 0),
18 BPF_EXIT_INSN(),
19 },
20 .fixup_map_hash_8b = { 3 },
21 .errstr = "unbounded min value",
22 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
23 .result = REJECT,
24 },
25 {
26 "bounds checks mixing signed and unsigned",
27 .insns = {
28 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
29 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
30 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
31 BPF_LD_MAP_FD(BPF_REG_1, 0),
32 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
33 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
34 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
35 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
36 BPF_MOV64_IMM(BPF_REG_2, -1),
37 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
38 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
39 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
40 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
41 BPF_MOV64_IMM(BPF_REG_0, 0),
42 BPF_EXIT_INSN(),
43 },
44 .fixup_map_hash_8b = { 3 },
45 .errstr = "unbounded min value",
46 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
47 .result = REJECT,
48 },
49 {
50 "bounds checks mixing signed and unsigned, variant 2",
51 .insns = {
52 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
53 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
54 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
55 BPF_LD_MAP_FD(BPF_REG_1, 0),
56 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
57 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
58 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
59 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
60 BPF_MOV64_IMM(BPF_REG_2, -1),
61 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
62 BPF_MOV64_IMM(BPF_REG_8, 0),
63 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
64 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
65 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
66 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
67 BPF_MOV64_IMM(BPF_REG_0, 0),
68 BPF_EXIT_INSN(),
69 },
70 .fixup_map_hash_8b = { 3 },
71 .errstr = "unbounded min value",
72 .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
73 .result = REJECT,
74 },
75 {
76 "bounds checks mixing signed and unsigned, variant 3",
77 .insns = {
78 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
79 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
80 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
81 BPF_LD_MAP_FD(BPF_REG_1, 0),
82 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
83 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
84 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
85 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
86 BPF_MOV64_IMM(BPF_REG_2, -1),
87 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
88 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
89 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
90 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
91 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
92 BPF_MOV64_IMM(BPF_REG_0, 0),
93 BPF_EXIT_INSN(),
94 },
95 .fixup_map_hash_8b = { 3 },
96 .errstr = "unbounded min value",
97 .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
98 .result = REJECT,
99 },
100 {
101 "bounds checks mixing signed and unsigned, variant 4",
102 .insns = {
103 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
104 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
105 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
106 BPF_LD_MAP_FD(BPF_REG_1, 0),
107 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
108 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
109 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
110 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
111 BPF_MOV64_IMM(BPF_REG_2, 1),
112 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
113 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
114 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
115 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
116 BPF_MOV64_IMM(BPF_REG_0, 0),
117 BPF_EXIT_INSN(),
118 },
119 .fixup_map_hash_8b = { 3 },
120 .result = ACCEPT,
121 },
122 {
123 "bounds checks mixing signed and unsigned, variant 5",
124 .insns = {
125 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
126 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
127 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
128 BPF_LD_MAP_FD(BPF_REG_1, 0),
129 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
130 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
131 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
132 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
133 BPF_MOV64_IMM(BPF_REG_2, -1),
134 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
135 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
136 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
137 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
138 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
139 BPF_MOV64_IMM(BPF_REG_0, 0),
140 BPF_EXIT_INSN(),
141 },
142 .fixup_map_hash_8b = { 3 },
143 .errstr = "unbounded min value",
144 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
145 .result = REJECT,
146 },
147 {
148 "bounds checks mixing signed and unsigned, variant 6",
149 .insns = {
150 BPF_MOV64_IMM(BPF_REG_2, 0),
151 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
153 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
154 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
155 BPF_MOV64_IMM(BPF_REG_6, -1),
156 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
157 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
158 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
159 BPF_MOV64_IMM(BPF_REG_5, 0),
160 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
161 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
162 BPF_MOV64_IMM(BPF_REG_0, 0),
163 BPF_EXIT_INSN(),
164 },
165 .errstr = "R4 min value is negative, either use unsigned",
166 .result = REJECT,
167 },
168 {
169 "bounds checks mixing signed and unsigned, variant 7",
170 .insns = {
171 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
172 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
173 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
174 BPF_LD_MAP_FD(BPF_REG_1, 0),
175 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
176 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
177 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
178 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
179 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
180 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
181 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
182 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
183 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
184 BPF_MOV64_IMM(BPF_REG_0, 0),
185 BPF_EXIT_INSN(),
186 },
187 .fixup_map_hash_8b = { 3 },
188 .result = ACCEPT,
189 },
190 {
191 "bounds checks mixing signed and unsigned, variant 8",
192 .insns = {
193 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
194 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
195 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
196 BPF_LD_MAP_FD(BPF_REG_1, 0),
197 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
198 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
199 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
200 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
201 BPF_MOV64_IMM(BPF_REG_2, -1),
202 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
203 BPF_MOV64_IMM(BPF_REG_0, 0),
204 BPF_EXIT_INSN(),
205 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
206 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
207 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
208 BPF_MOV64_IMM(BPF_REG_0, 0),
209 BPF_EXIT_INSN(),
210 },
211 .fixup_map_hash_8b = { 3 },
212 .errstr = "unbounded min value",
213 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
214 .result = REJECT,
215 },
216 {
217 "bounds checks mixing signed and unsigned, variant 9",
218 .insns = {
219 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
220 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
221 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
222 BPF_LD_MAP_FD(BPF_REG_1, 0),
223 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
224 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
225 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
226 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
227 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
228 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
229 BPF_MOV64_IMM(BPF_REG_0, 0),
230 BPF_EXIT_INSN(),
231 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
232 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
233 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
234 BPF_MOV64_IMM(BPF_REG_0, 0),
235 BPF_EXIT_INSN(),
236 },
237 .fixup_map_hash_8b = { 3 },
238 .result = ACCEPT,
239 },
240 {
241 "bounds checks mixing signed and unsigned, variant 10",
242 .insns = {
243 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
244 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
245 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
246 BPF_LD_MAP_FD(BPF_REG_1, 0),
247 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
248 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
249 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
250 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
251 BPF_MOV64_IMM(BPF_REG_2, 0),
252 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
253 BPF_MOV64_IMM(BPF_REG_0, 0),
254 BPF_EXIT_INSN(),
255 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
256 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
257 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
258 BPF_MOV64_IMM(BPF_REG_0, 0),
259 BPF_EXIT_INSN(),
260 },
261 .fixup_map_hash_8b = { 3 },
262 .errstr = "unbounded min value",
263 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
264 .result = REJECT,
265 },
266 {
267 "bounds checks mixing signed and unsigned, variant 11",
268 .insns = {
269 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
270 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
271 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
272 BPF_LD_MAP_FD(BPF_REG_1, 0),
273 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
274 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
275 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
276 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
277 BPF_MOV64_IMM(BPF_REG_2, -1),
278 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
279
280 BPF_MOV64_IMM(BPF_REG_0, 0),
281 BPF_EXIT_INSN(),
282 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
283 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
284 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
285 BPF_MOV64_IMM(BPF_REG_0, 0),
286 BPF_EXIT_INSN(),
287 },
288 .fixup_map_hash_8b = { 3 },
289 .errstr = "unbounded min value",
290 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
291 .result = REJECT,
292 },
293 {
294 "bounds checks mixing signed and unsigned, variant 12",
295 .insns = {
296 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
297 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
298 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
299 BPF_LD_MAP_FD(BPF_REG_1, 0),
300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
301 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
302 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
303 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
304 BPF_MOV64_IMM(BPF_REG_2, -6),
305 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
306 BPF_MOV64_IMM(BPF_REG_0, 0),
307 BPF_EXIT_INSN(),
308 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
309 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
310 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
311 BPF_MOV64_IMM(BPF_REG_0, 0),
312 BPF_EXIT_INSN(),
313 },
314 .fixup_map_hash_8b = { 3 },
315 .errstr = "unbounded min value",
316 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
317 .result = REJECT,
318 },
319 {
320 "bounds checks mixing signed and unsigned, variant 13",
321 .insns = {
322 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
323 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
324 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
325 BPF_LD_MAP_FD(BPF_REG_1, 0),
326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
327 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
328 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
329 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
330 BPF_MOV64_IMM(BPF_REG_2, 2),
331 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
332 BPF_MOV64_IMM(BPF_REG_7, 1),
333 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
334 BPF_MOV64_IMM(BPF_REG_0, 0),
335 BPF_EXIT_INSN(),
336 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
337 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
338 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
339 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
340 BPF_MOV64_IMM(BPF_REG_0, 0),
341 BPF_EXIT_INSN(),
342 },
343 .fixup_map_hash_8b = { 3 },
344 .errstr = "unbounded min value",
345 .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds",
346 .result = REJECT,
347 },
348 {
349 "bounds checks mixing signed and unsigned, variant 14",
350 .insns = {
351 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
352 offsetof(struct __sk_buff, mark)),
353 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
354 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
355 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
356 BPF_LD_MAP_FD(BPF_REG_1, 0),
357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
358 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
359 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
360 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
361 BPF_MOV64_IMM(BPF_REG_2, -1),
362 BPF_MOV64_IMM(BPF_REG_8, 2),
363 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
364 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
365 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
366 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
367 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
368 BPF_MOV64_IMM(BPF_REG_0, 0),
369 BPF_EXIT_INSN(),
370 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
371 BPF_JMP_IMM(BPF_JA, 0, 0, -7),
372 },
373 .fixup_map_hash_8b = { 4 },
374 .errstr = "unbounded min value",
375 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
376 .result = REJECT,
377 },
378 {
379 "bounds checks mixing signed and unsigned, variant 15",
380 .insns = {
381 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
382 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
383 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
384 BPF_LD_MAP_FD(BPF_REG_1, 0),
385 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
386 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
387 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
388 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
389 BPF_MOV64_IMM(BPF_REG_2, -6),
390 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
391 BPF_MOV64_IMM(BPF_REG_0, 0),
392 BPF_EXIT_INSN(),
393 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
394 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
395 BPF_MOV64_IMM(BPF_REG_0, 0),
396 BPF_EXIT_INSN(),
397 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
398 BPF_MOV64_IMM(BPF_REG_0, 0),
399 BPF_EXIT_INSN(),
400 },
401 .fixup_map_hash_8b = { 3 },
402 .errstr = "unbounded min value",
403 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
404 .result = REJECT,
405 .result_unpriv = REJECT,
406 },