1 {
2 "map in map access",
3 .insns = {
4 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7 BPF_LD_MAP_FD(BPF_REG_1, 0),
8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
10 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
11 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
13 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
14 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
15 BPF_MOV64_IMM(BPF_REG_0, 0),
16 BPF_EXIT_INSN(),
17 },
18 .fixup_map_in_map = { 3 },
19 .result = ACCEPT,
20 },
21 {
22 "invalid inner map pointer",
23 .insns = {
24 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
25 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
27 BPF_LD_MAP_FD(BPF_REG_1, 0),
28 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
29 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
30 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
31 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
32 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
33 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
34 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
35 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
36 BPF_MOV64_IMM(BPF_REG_0, 0),
37 BPF_EXIT_INSN(),
38 },
39 .fixup_map_in_map = { 3 },
40 .errstr = "R1 pointer arithmetic on map_ptr prohibited",
41 .result = REJECT,
42 },
43 {
44 "forgot null checking on the inner map pointer",
45 .insns = {
46 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
47 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
48 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
49 BPF_LD_MAP_FD(BPF_REG_1, 0),
50 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
51 BPF_ST_MEM(0, BPF_REG_10, -4, 0),
52 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
53 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
54 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
55 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
56 BPF_MOV64_IMM(BPF_REG_0, 0),
57 BPF_EXIT_INSN(),
58 },
59 .fixup_map_in_map = { 3 },
60 .errstr = "R1 type=map_value_or_null expected=map_ptr",
61 .result = REJECT,
62 },