1 {
2 "multiple registers share map_lookup_elem result",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_1, 10),
5 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
6 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8 BPF_LD_MAP_FD(BPF_REG_1, 0),
9 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
10 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
11 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
12 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
13 BPF_EXIT_INSN(),
14 },
15 .fixup_map_hash_8b = { 4 },
16 .result = ACCEPT,
17 .prog_type = BPF_PROG_TYPE_SCHED_CLS
18 },
19 {
20 "alu ops on ptr_to_map_value_or_null, 1",
21 .insns = {
22 BPF_MOV64_IMM(BPF_REG_1, 10),
23 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
24 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
25 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
26 BPF_LD_MAP_FD(BPF_REG_1, 0),
27 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
28 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
29 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
30 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
31 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
32 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
33 BPF_EXIT_INSN(),
34 },
35 .fixup_map_hash_8b = { 4 },
36 .errstr = "R4 pointer arithmetic on map_value_or_null",
37 .result = REJECT,
38 .prog_type = BPF_PROG_TYPE_SCHED_CLS
39 },
40 {
41 "alu ops on ptr_to_map_value_or_null, 2",
42 .insns = {
43 BPF_MOV64_IMM(BPF_REG_1, 10),
44 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
45 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
46 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
47 BPF_LD_MAP_FD(BPF_REG_1, 0),
48 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
49 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
50 BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
51 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
52 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
53 BPF_EXIT_INSN(),
54 },
55 .fixup_map_hash_8b = { 4 },
56 .errstr = "R4 pointer arithmetic on map_value_or_null",
57 .result = REJECT,
58 .prog_type = BPF_PROG_TYPE_SCHED_CLS
59 },
60 {
61 "alu ops on ptr_to_map_value_or_null, 3",
62 .insns = {
63 BPF_MOV64_IMM(BPF_REG_1, 10),
64 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
65 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
66 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
67 BPF_LD_MAP_FD(BPF_REG_1, 0),
68 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
69 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
70 BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
71 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
72 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
73 BPF_EXIT_INSN(),
74 },
75 .fixup_map_hash_8b = { 4 },
76 .errstr = "R4 pointer arithmetic on map_value_or_null",
77 .result = REJECT,
78 .prog_type = BPF_PROG_TYPE_SCHED_CLS
79 },
80 {
81 "invalid memory access with multiple map_lookup_elem calls",
82 .insns = {
83 BPF_MOV64_IMM(BPF_REG_1, 10),
84 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
85 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
86 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
87 BPF_LD_MAP_FD(BPF_REG_1, 0),
88 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
89 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
90 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
91 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
92 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
93 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
94 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
95 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
96 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
97 BPF_EXIT_INSN(),
98 },
99 .fixup_map_hash_8b = { 4 },
100 .result = REJECT,
101 .errstr = "R4 !read_ok",
102 .prog_type = BPF_PROG_TYPE_SCHED_CLS
103 },
104 {
105 "valid indirect map_lookup_elem access with 2nd lookup in branch",
106 .insns = {
107 BPF_MOV64_IMM(BPF_REG_1, 10),
108 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
109 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
111 BPF_LD_MAP_FD(BPF_REG_1, 0),
112 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
113 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
114 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
115 BPF_MOV64_IMM(BPF_REG_2, 10),
116 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
117 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
118 BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
119 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
120 BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
121 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
122 BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
123 BPF_EXIT_INSN(),
124 },
125 .fixup_map_hash_8b = { 4 },
126 .result = ACCEPT,
127 .prog_type = BPF_PROG_TYPE_SCHED_CLS
128 },
129 {
130 "invalid map access from else condition",
131 .insns = {
132 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
133 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
134 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
135 BPF_LD_MAP_FD(BPF_REG_1, 0),
136 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
137 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
138 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
139 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
140 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
141 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
142 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
143 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
144 BPF_EXIT_INSN(),
145 },
146 .fixup_map_hash_48b = { 3 },
147 .errstr = "R0 unbounded memory access",
148 .result = REJECT,
149 .errstr_unpriv = "R0 leaks addr",
150 .result_unpriv = REJECT,
151 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
152 },