1 { 2 "calls: basic sanity", 3 .insns = { 4 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 5 BPF_MOV64_IMM(BPF_REG_0, 1), 6 BPF_EXIT_INSN(), 7 BPF_MOV64_IMM(BPF_REG_0, 2), 8 BPF_EXIT_INSN(), 9 }, 10 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 11 .result = ACCEPT, 12 }, 13 { 14 "calls: not on unpriviledged", 15 .insns = { 16 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 17 BPF_MOV64_IMM(BPF_REG_0, 1), 18 BPF_EXIT_INSN(), 19 BPF_MOV64_IMM(BPF_REG_0, 2), 20 BPF_EXIT_INSN(), 21 }, 22 .errstr_unpriv = "loading/calling other bpf or kernel functions are allowed for", 23 .result_unpriv = REJECT, 24 .result = ACCEPT, 25 .retval = 1, 26 }, 27 { 28 "calls: div by 0 in subprog", 29 .insns = { 30 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 31 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8), 32 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 33 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 34 offsetof(struct __sk_buff, data_end)), 35 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), 36 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8), 37 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1), 38 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0), 39 BPF_MOV64_IMM(BPF_REG_0, 1), 40 BPF_EXIT_INSN(), 41 BPF_MOV32_IMM(BPF_REG_2, 0), 42 BPF_MOV32_IMM(BPF_REG_3, 1), 43 BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2), 44 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 45 offsetof(struct __sk_buff, data)), 46 BPF_EXIT_INSN(), 47 }, 48 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 49 .result = ACCEPT, 50 .retval = 1, 51 }, 52 { 53 "calls: multiple ret types in subprog 1", 54 .insns = { 55 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 56 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8), 57 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 58 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 59 offsetof(struct __sk_buff, data_end)), 60 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), 61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8), 62 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1), 63 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0), 64 BPF_MOV64_IMM(BPF_REG_0, 1), 65 BPF_EXIT_INSN(), 66 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 67 offsetof(struct __sk_buff, data)), 68 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 69 BPF_MOV32_IMM(BPF_REG_0, 42), 70 BPF_EXIT_INSN(), 71 }, 72 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 73 .result = REJECT, 74 .errstr = "R0 invalid mem access 'inv'", 75 }, 76 { 77 "calls: multiple ret types in subprog 2", 78 .insns = { 79 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 80 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8), 81 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 82 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 83 offsetof(struct __sk_buff, data_end)), 84 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0), 85 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8), 86 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1), 87 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0), 88 BPF_MOV64_IMM(BPF_REG_0, 1), 89 BPF_EXIT_INSN(), 90 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 91 offsetof(struct __sk_buff, data)), 92 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 93 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9), 94 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 95 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 96 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 97 BPF_LD_MAP_FD(BPF_REG_1, 0), 98 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 99 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 100 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, 101 offsetof(struct __sk_buff, data)), 102 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64), 103 BPF_EXIT_INSN(), 104 }, 105 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 106 .fixup_map_hash_8b = { 16 }, 107 .result = REJECT, 108 .errstr = "R0 min value is outside of the allowed memory range", 109 }, 110 { 111 "calls: overlapping caller/callee", 112 .insns = { 113 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0), 114 BPF_MOV64_IMM(BPF_REG_0, 1), 115 BPF_EXIT_INSN(), 116 }, 117 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 118 .errstr = "last insn is not an exit or jmp", 119 .result = REJECT, 120 }, 121 { 122 "calls: wrong recursive calls", 123 .insns = { 124 BPF_JMP_IMM(BPF_JA, 0, 0, 4), 125 BPF_JMP_IMM(BPF_JA, 0, 0, 4), 126 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2), 127 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2), 128 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2), 129 BPF_MOV64_IMM(BPF_REG_0, 1), 130 BPF_EXIT_INSN(), 131 }, 132 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 133 .errstr = "jump out of range", 134 .result = REJECT, 135 }, 136 { 137 "calls: wrong src reg", 138 .insns = { 139 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 3, 0, 0), 140 BPF_MOV64_IMM(BPF_REG_0, 1), 141 BPF_EXIT_INSN(), 142 }, 143 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 144 .errstr = "BPF_CALL uses reserved fields", 145 .result = REJECT, 146 }, 147 { 148 "calls: wrong off value", 149 .insns = { 150 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2), 151 BPF_MOV64_IMM(BPF_REG_0, 1), 152 BPF_EXIT_INSN(), 153 BPF_MOV64_IMM(BPF_REG_0, 2), 154 BPF_EXIT_INSN(), 155 }, 156 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 157 .errstr = "BPF_CALL uses reserved fields", 158 .result = REJECT, 159 }, 160 { 161 "calls: jump back loop", 162 .insns = { 163 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1), 164 BPF_MOV64_IMM(BPF_REG_0, 1), 165 BPF_EXIT_INSN(), 166 }, 167 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 168 .errstr = "back-edge from insn 0 to 0", 169 .result = REJECT, 170 }, 171 { 172 "calls: conditional call", 173 .insns = { 174 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 175 offsetof(struct __sk_buff, mark)), 176 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 177 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 178 BPF_MOV64_IMM(BPF_REG_0, 1), 179 BPF_EXIT_INSN(), 180 BPF_MOV64_IMM(BPF_REG_0, 2), 181 BPF_EXIT_INSN(), 182 }, 183 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 184 .errstr = "jump out of range", 185 .result = REJECT, 186 }, 187 { 188 "calls: conditional call 2", 189 .insns = { 190 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 191 offsetof(struct __sk_buff, mark)), 192 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 193 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 194 BPF_MOV64_IMM(BPF_REG_0, 1), 195 BPF_EXIT_INSN(), 196 BPF_MOV64_IMM(BPF_REG_0, 2), 197 BPF_EXIT_INSN(), 198 BPF_MOV64_IMM(BPF_REG_0, 3), 199 BPF_EXIT_INSN(), 200 }, 201 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 202 .result = ACCEPT, 203 }, 204 { 205 "calls: conditional call 3", 206 .insns = { 207 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 208 offsetof(struct __sk_buff, mark)), 209 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 210 BPF_JMP_IMM(BPF_JA, 0, 0, 4), 211 BPF_MOV64_IMM(BPF_REG_0, 1), 212 BPF_EXIT_INSN(), 213 BPF_MOV64_IMM(BPF_REG_0, 1), 214 BPF_JMP_IMM(BPF_JA, 0, 0, -6), 215 BPF_MOV64_IMM(BPF_REG_0, 3), 216 BPF_JMP_IMM(BPF_JA, 0, 0, -6), 217 }, 218 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, 219 .errstr_unpriv = "back-edge from insn", 220 .result_unpriv = REJECT, 221 .result = ACCEPT, 222 .retval = 1, 223 }, 224 { 225 "calls: conditional call 4", 226 .insns = { 227 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 228 offsetof(struct __sk_buff, mark)), 229 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 230 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 231 BPF_MOV64_IMM(BPF_REG_0, 1), 232 BPF_EXIT_INSN(), 233 BPF_MOV64_IMM(BPF_REG_0, 1), 234 BPF_JMP_IMM(BPF_JA, 0, 0, -5), 235 BPF_MOV64_IMM(BPF_REG_0, 3), 236 BPF_EXIT_INSN(), 237 }, 238 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 239 .result = ACCEPT, 240 }, 241 { 242 "calls: conditional call 5", 243 .insns = { 244 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 245 offsetof(struct __sk_buff, mark)), 246 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), 247 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 248 BPF_MOV64_IMM(BPF_REG_0, 1), 249 BPF_EXIT_INSN(), 250 BPF_MOV64_IMM(BPF_REG_0, 1), 251 BPF_JMP_IMM(BPF_JA, 0, 0, -6), 252 BPF_MOV64_IMM(BPF_REG_0, 3), 253 BPF_EXIT_INSN(), 254 }, 255 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 256 .result = ACCEPT, 257 .retval = 1, 258 }, 259 { 260 "calls: conditional call 6", 261 .insns = { 262 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 263 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 264 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 265 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3), 266 BPF_EXIT_INSN(), 267 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 268 offsetof(struct __sk_buff, mark)), 269 BPF_EXIT_INSN(), 270 }, 271 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 272 .errstr = "infinite loop detected", 273 .result = REJECT, 274 }, 275 { 276 "calls: using r0 returned by callee", 277 .insns = { 278 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 279 BPF_EXIT_INSN(), 280 BPF_MOV64_IMM(BPF_REG_0, 2), 281 BPF_EXIT_INSN(), 282 }, 283 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 284 .result = ACCEPT, 285 }, 286 { 287 "calls: using uninit r0 from callee", 288 .insns = { 289 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 290 BPF_EXIT_INSN(), 291 BPF_EXIT_INSN(), 292 }, 293 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 294 .errstr = "!read_ok", 295 .result = REJECT, 296 }, 297 { 298 "calls: callee is using r1", 299 .insns = { 300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 301 BPF_EXIT_INSN(), 302 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 303 offsetof(struct __sk_buff, len)), 304 BPF_EXIT_INSN(), 305 }, 306 .prog_type = BPF_PROG_TYPE_SCHED_ACT, 307 .result = ACCEPT, 308 .retval = TEST_DATA_LEN, 309 }, 310 { 311 "calls: callee using args1", 312 .insns = { 313 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 314 BPF_EXIT_INSN(), 315 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1), 316 BPF_EXIT_INSN(), 317 }, 318 .errstr_unpriv = "allowed for", 319 .result_unpriv = REJECT, 320 .result = ACCEPT, 321 .retval = POINTER_VALUE, 322 }, 323 { 324 "calls: callee using wrong args2", 325 .insns = { 326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 327 BPF_EXIT_INSN(), 328 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 329 BPF_EXIT_INSN(), 330 }, 331 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 332 .errstr = "R2 !read_ok", 333 .result = REJECT, 334 }, 335 { 336 "calls: callee using two args", 337 .insns = { 338 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 339 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, 340 offsetof(struct __sk_buff, len)), 341 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6, 342 offsetof(struct __sk_buff, len)), 343 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 344 BPF_EXIT_INSN(), 345 BPF_MOV64_REG(BPF_REG_0, BPF_REG_1), 346 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2), 347 BPF_EXIT_INSN(), 348 }, 349 .errstr_unpriv = "allowed for", 350 .result_unpriv = REJECT, 351 .result = ACCEPT, 352 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN, 353 }, 354 { 355 "calls: callee changing pkt pointers", 356 .insns = { 357 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, offsetof(struct xdp_md, data)), 358 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 359 offsetof(struct xdp_md, data_end)), 360 BPF_MOV64_REG(BPF_REG_8, BPF_REG_6), 361 BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8), 362 BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2), 363 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 364 /* clear_all_pkt_pointers() has to walk all frames 365 * to make sure that pkt pointers in the caller 366 * are cleared when callee is calling a helper that 367 * adjusts packet size 368 */ 369 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0), 370 BPF_MOV32_IMM(BPF_REG_0, 0), 371 BPF_EXIT_INSN(), 372 BPF_MOV64_IMM(BPF_REG_2, 0), 373 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_xdp_adjust_head), 374 BPF_EXIT_INSN(), 375 }, 376 .result = REJECT, 377 .errstr = "R6 invalid mem access 'inv'", 378 .prog_type = BPF_PROG_TYPE_XDP, 379 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 380 }, 381 { 382 "calls: ptr null check in subprog", 383 .insns = { 384 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 385 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 386 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 387 BPF_LD_MAP_FD(BPF_REG_1, 0), 388 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), 389 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 390 BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), 391 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 392 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 393 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0), 394 BPF_EXIT_INSN(), 395 BPF_MOV64_IMM(BPF_REG_0, 0), 396 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1), 397 BPF_MOV64_IMM(BPF_REG_0, 1), 398 BPF_EXIT_INSN(), 399 }, 400 .errstr_unpriv = "loading/calling other bpf or kernel functions are allowed for", 401 .fixup_map_hash_48b = { 3 }, 402 .result_unpriv = REJECT, 403 .result = ACCEPT, 404 .retval = 0, 405 }, 406 { 407 "calls: two calls with args", 408 .insns = { 409 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 410 BPF_EXIT_INSN(), 411 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 412 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6), 413 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), 414 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 415 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 416 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0), 417 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7), 418 BPF_EXIT_INSN(), 419 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 420 offsetof(struct __sk_buff, len)), 421 BPF_EXIT_INSN(), 422 }, 423 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 424 .result = ACCEPT, 425 .retval = TEST_DATA_LEN + TEST_DATA_LEN, 426 }, 427 { 428 "calls: calls with stack arith", 429 .insns = { 430 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 431 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64), 432 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 433 BPF_EXIT_INSN(), 434 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64), 435 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 436 BPF_EXIT_INSN(), 437 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64), 438 BPF_MOV64_IMM(BPF_REG_0, 42), 439 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0), 440 BPF_EXIT_INSN(), 441 }, 442 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 443 .result = ACCEPT, 444 .retval = 42, 445 }, 446 { 447 "calls: calls with misaligned stack access", 448 .insns = { 449 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 450 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63), 451 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 452 BPF_EXIT_INSN(), 453 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61), 454 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 455 BPF_EXIT_INSN(), 456 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63), 457 BPF_MOV64_IMM(BPF_REG_0, 42), 458 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0), 459 BPF_EXIT_INSN(), 460 }, 461 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 462 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 463 .errstr = "misaligned stack access", 464 .result = REJECT, 465 }, 466 { 467 "calls: calls control flow, jump test", 468 .insns = { 469 BPF_MOV64_IMM(BPF_REG_0, 42), 470 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 471 BPF_MOV64_IMM(BPF_REG_0, 43), 472 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 473 BPF_JMP_IMM(BPF_JA, 0, 0, -3), 474 BPF_EXIT_INSN(), 475 }, 476 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 477 .result = ACCEPT, 478 .retval = 43, 479 }, 480 { 481 "calls: calls control flow, jump test 2", 482 .insns = { 483 BPF_MOV64_IMM(BPF_REG_0, 42), 484 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 485 BPF_MOV64_IMM(BPF_REG_0, 43), 486 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 487 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3), 488 BPF_EXIT_INSN(), 489 }, 490 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 491 .errstr = "jump out of range from insn 1 to 4", 492 .result = REJECT, 493 }, 494 { 495 "calls: two calls with bad jump", 496 .insns = { 497 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 498 BPF_EXIT_INSN(), 499 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 500 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6), 501 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), 502 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 503 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 504 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0), 505 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7), 506 BPF_EXIT_INSN(), 507 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 508 offsetof(struct __sk_buff, len)), 509 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3), 510 BPF_EXIT_INSN(), 511 }, 512 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 513 .errstr = "jump out of range from insn 11 to 9", 514 .result = REJECT, 515 }, 516 { 517 "calls: recursive call. test1", 518 .insns = { 519 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 520 BPF_EXIT_INSN(), 521 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1), 522 BPF_EXIT_INSN(), 523 }, 524 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 525 .errstr = "back-edge", 526 .result = REJECT, 527 }, 528 { 529 "calls: recursive call. test2", 530 .insns = { 531 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 532 BPF_EXIT_INSN(), 533 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3), 534 BPF_EXIT_INSN(), 535 }, 536 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 537 .errstr = "back-edge", 538 .result = REJECT, 539 }, 540 { 541 "calls: unreachable code", 542 .insns = { 543 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 544 BPF_EXIT_INSN(), 545 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 546 BPF_EXIT_INSN(), 547 BPF_MOV64_IMM(BPF_REG_0, 0), 548 BPF_EXIT_INSN(), 549 BPF_MOV64_IMM(BPF_REG_0, 0), 550 BPF_EXIT_INSN(), 551 }, 552 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 553 .errstr = "unreachable insn 6", 554 .result = REJECT, 555 }, 556 { 557 "calls: invalid call", 558 .insns = { 559 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 560 BPF_EXIT_INSN(), 561 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4), 562 BPF_EXIT_INSN(), 563 }, 564 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 565 .errstr = "invalid destination", 566 .result = REJECT, 567 }, 568 { 569 "calls: invalid call 2", 570 .insns = { 571 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 572 BPF_EXIT_INSN(), 573 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff), 574 BPF_EXIT_INSN(), 575 }, 576 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 577 .errstr = "invalid destination", 578 .result = REJECT, 579 }, 580 { 581 "calls: jumping across function bodies. test1", 582 .insns = { 583 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 584 BPF_MOV64_IMM(BPF_REG_0, 0), 585 BPF_EXIT_INSN(), 586 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3), 587 BPF_EXIT_INSN(), 588 }, 589 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 590 .errstr = "jump out of range", 591 .result = REJECT, 592 }, 593 { 594 "calls: jumping across function bodies. test2", 595 .insns = { 596 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3), 597 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 598 BPF_MOV64_IMM(BPF_REG_0, 0), 599 BPF_EXIT_INSN(), 600 BPF_EXIT_INSN(), 601 }, 602 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 603 .errstr = "jump out of range", 604 .result = REJECT, 605 }, 606 { 607 "calls: call without exit", 608 .insns = { 609 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 610 BPF_EXIT_INSN(), 611 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 612 BPF_EXIT_INSN(), 613 BPF_MOV64_IMM(BPF_REG_0, 0), 614 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2), 615 }, 616 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 617 .errstr = "not an exit", 618 .result = REJECT, 619 }, 620 { 621 "calls: call into middle of ld_imm64", 622 .insns = { 623 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 624 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 625 BPF_MOV64_IMM(BPF_REG_0, 0), 626 BPF_EXIT_INSN(), 627 BPF_LD_IMM64(BPF_REG_0, 0), 628 BPF_EXIT_INSN(), 629 }, 630 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 631 .errstr = "last insn", 632 .result = REJECT, 633 }, 634 { 635 "calls: call into middle of other call", 636 .insns = { 637 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 638 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 639 BPF_MOV64_IMM(BPF_REG_0, 0), 640 BPF_EXIT_INSN(), 641 BPF_MOV64_IMM(BPF_REG_0, 0), 642 BPF_MOV64_IMM(BPF_REG_0, 0), 643 BPF_EXIT_INSN(), 644 }, 645 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 646 .errstr = "last insn", 647 .result = REJECT, 648 }, 649 { 650 "calls: subprog call with ld_abs in main prog", 651 .insns = { 652 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 653 BPF_LD_ABS(BPF_B, 0), 654 BPF_LD_ABS(BPF_H, 0), 655 BPF_LD_ABS(BPF_W, 0), 656 BPF_MOV64_REG(BPF_REG_7, BPF_REG_6), 657 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 658 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5), 659 BPF_MOV64_REG(BPF_REG_6, BPF_REG_7), 660 BPF_LD_ABS(BPF_B, 0), 661 BPF_LD_ABS(BPF_H, 0), 662 BPF_LD_ABS(BPF_W, 0), 663 BPF_EXIT_INSN(), 664 BPF_MOV64_IMM(BPF_REG_2, 1), 665 BPF_MOV64_IMM(BPF_REG_3, 2), 666 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_vlan_push), 667 BPF_EXIT_INSN(), 668 }, 669 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 670 .result = ACCEPT, 671 }, 672 { 673 "calls: two calls with bad fallthrough", 674 .insns = { 675 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 676 BPF_EXIT_INSN(), 677 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 678 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6), 679 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), 680 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 681 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 682 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0), 683 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7), 684 BPF_MOV64_REG(BPF_REG_0, BPF_REG_0), 685 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 686 offsetof(struct __sk_buff, len)), 687 BPF_EXIT_INSN(), 688 }, 689 .prog_type = BPF_PROG_TYPE_TRACEPOINT, 690 .errstr = "not an exit", 691 .result = REJECT, 692 }, 693 { 694 "calls: two calls with stack read", 695 .insns = { 696 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 697 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 698 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 699 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 700 BPF_EXIT_INSN(), 701 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 702 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6), 703 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0), 704 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 705 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 706 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0), 707 BPF_MOV64_REG(BPF_REG_0, BPF_REG_7), 708 BPF_EXIT_INSN(), 709 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0), 710 BPF_EXIT_INSN(), 711 }, 712 .prog_type = BPF_PROG_TYPE_XDP, 713 .result = ACCEPT, 714 }, 715 { 716 "calls: two calls with stack write", 717 .insns = { 718 /* main prog */ 719 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 720 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 721 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 722 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 723 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 724 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 725 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16), 726 BPF_EXIT_INSN(), 727 728 /* subprog 1 */ 729 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 730 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 731 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7), 732 BPF_MOV64_REG(BPF_REG_8, BPF_REG_0), 733 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 734 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 735 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0), 736 BPF_MOV64_REG(BPF_REG_0, BPF_REG_8), 737 /* write into stack frame of main prog */ 738 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 739 BPF_EXIT_INSN(), 740 741 /* subprog 2 */ 742 /* read from stack frame of main prog */ 743 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0), 744 BPF_EXIT_INSN(), 745 }, 746 .prog_type = BPF_PROG_TYPE_XDP, 747 .result = ACCEPT, 748 }, 749 { 750 "calls: stack overflow using two frames (pre-call access)", 751 .insns = { 752 /* prog 1 */ 753 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 754 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), 755 BPF_EXIT_INSN(), 756 757 /* prog 2 */ 758 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 759 BPF_MOV64_IMM(BPF_REG_0, 0), 760 BPF_EXIT_INSN(), 761 }, 762 .prog_type = BPF_PROG_TYPE_XDP, 763 .errstr = "combined stack size", 764 .result = REJECT, 765 }, 766 { 767 "calls: stack overflow using two frames (post-call access)", 768 .insns = { 769 /* prog 1 */ 770 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), 771 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 772 BPF_EXIT_INSN(), 773 774 /* prog 2 */ 775 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 776 BPF_MOV64_IMM(BPF_REG_0, 0), 777 BPF_EXIT_INSN(), 778 }, 779 .prog_type = BPF_PROG_TYPE_XDP, 780 .errstr = "combined stack size", 781 .result = REJECT, 782 }, 783 { 784 "calls: stack depth check using three frames. test1", 785 .insns = { 786 /* main */ 787 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */ 788 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */ 789 BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0), 790 BPF_MOV64_IMM(BPF_REG_0, 0), 791 BPF_EXIT_INSN(), 792 /* A */ 793 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0), 794 BPF_EXIT_INSN(), 795 /* B */ 796 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */ 797 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0), 798 BPF_EXIT_INSN(), 799 }, 800 .prog_type = BPF_PROG_TYPE_XDP, 801 /* stack_main=32, stack_A=256, stack_B=64 802 * and max(main+A, main+A+B) < 512 803 */ 804 .result = ACCEPT, 805 }, 806 { 807 "calls: stack depth check using three frames. test2", 808 .insns = { 809 /* main */ 810 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */ 811 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */ 812 BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0), 813 BPF_MOV64_IMM(BPF_REG_0, 0), 814 BPF_EXIT_INSN(), 815 /* A */ 816 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0), 817 BPF_EXIT_INSN(), 818 /* B */ 819 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */ 820 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0), 821 BPF_EXIT_INSN(), 822 }, 823 .prog_type = BPF_PROG_TYPE_XDP, 824 /* stack_main=32, stack_A=64, stack_B=256 825 * and max(main+A, main+A+B) < 512 826 */ 827 .result = ACCEPT, 828 }, 829 { 830 "calls: stack depth check using three frames. test3", 831 .insns = { 832 /* main */ 833 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 834 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */ 835 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 836 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */ 837 BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1), 838 BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0), 839 BPF_MOV64_IMM(BPF_REG_0, 0), 840 BPF_EXIT_INSN(), 841 /* A */ 842 BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1), 843 BPF_EXIT_INSN(), 844 BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0), 845 BPF_JMP_IMM(BPF_JA, 0, 0, -3), 846 /* B */ 847 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1), 848 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */ 849 BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0), 850 BPF_EXIT_INSN(), 851 }, 852 .prog_type = BPF_PROG_TYPE_XDP, 853 /* stack_main=64, stack_A=224, stack_B=256 854 * and max(main+A, main+A+B) > 512 855 */ 856 .errstr = "combined stack", 857 .result = REJECT, 858 }, 859 { 860 "calls: stack depth check using three frames. test4", 861 /* void main(void) { 862 * func1(0); 863 * func1(1); 864 * func2(1); 865 * } 866 * void func1(int alloc_or_recurse) { 867 * if (alloc_or_recurse) { 868 * frame_pointer[-300] = 1; 869 * } else { 870 * func2(alloc_or_recurse); 871 * } 872 * } 873 * void func2(int alloc_or_recurse) { 874 * if (alloc_or_recurse) { 875 * frame_pointer[-300] = 1; 876 * } 877 * } 878 */ 879 .insns = { 880 /* main */ 881 BPF_MOV64_IMM(BPF_REG_1, 0), 882 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */ 883 BPF_MOV64_IMM(BPF_REG_1, 1), 884 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */ 885 BPF_MOV64_IMM(BPF_REG_1, 1), 886 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */ 887 BPF_MOV64_IMM(BPF_REG_0, 0), 888 BPF_EXIT_INSN(), 889 /* A */ 890 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2), 891 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 892 BPF_EXIT_INSN(), 893 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */ 894 BPF_EXIT_INSN(), 895 /* B */ 896 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1), 897 BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0), 898 BPF_EXIT_INSN(), 899 }, 900 .prog_type = BPF_PROG_TYPE_XDP, 901 .result = REJECT, 902 .errstr = "combined stack", 903 }, 904 { 905 "calls: stack depth check using three frames. test5", 906 .insns = { 907 /* main */ 908 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */ 909 BPF_EXIT_INSN(), 910 /* A */ 911 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */ 912 BPF_EXIT_INSN(), 913 /* B */ 914 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */ 915 BPF_EXIT_INSN(), 916 /* C */ 917 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */ 918 BPF_EXIT_INSN(), 919 /* D */ 920 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */ 921 BPF_EXIT_INSN(), 922 /* E */ 923 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */ 924 BPF_EXIT_INSN(), 925 /* F */ 926 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */ 927 BPF_EXIT_INSN(), 928 /* G */ 929 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */ 930 BPF_EXIT_INSN(), 931 /* H */ 932 BPF_MOV64_IMM(BPF_REG_0, 0), 933 BPF_EXIT_INSN(), 934 }, 935 .prog_type = BPF_PROG_TYPE_XDP, 936 .errstr = "call stack", 937 .result = REJECT, 938 }, 939 { 940 "calls: stack depth check in dead code", 941 .insns = { 942 /* main */ 943 BPF_MOV64_IMM(BPF_REG_1, 0), 944 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */ 945 BPF_EXIT_INSN(), 946 /* A */ 947 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1), 948 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */ 949 BPF_MOV64_IMM(BPF_REG_0, 0), 950 BPF_EXIT_INSN(), 951 /* B */ 952 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */ 953 BPF_EXIT_INSN(), 954 /* C */ 955 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */ 956 BPF_EXIT_INSN(), 957 /* D */ 958 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */ 959 BPF_EXIT_INSN(), 960 /* E */ 961 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */ 962 BPF_EXIT_INSN(), 963 /* F */ 964 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */ 965 BPF_EXIT_INSN(), 966 /* G */ 967 BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */ 968 BPF_EXIT_INSN(), 969 /* H */ 970 BPF_MOV64_IMM(BPF_REG_0, 0), 971 BPF_EXIT_INSN(), 972 }, 973 .prog_type = BPF_PROG_TYPE_XDP, 974 .errstr = "call stack", 975 .result = REJECT, 976 }, 977 { 978 "calls: spill into caller stack frame", 979 .insns = { 980 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 981 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 982 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 983 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 984 BPF_EXIT_INSN(), 985 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0), 986 BPF_MOV64_IMM(BPF_REG_0, 0), 987 BPF_EXIT_INSN(), 988 }, 989 .prog_type = BPF_PROG_TYPE_XDP, 990 .errstr = "cannot spill", 991 .result = REJECT, 992 }, 993 { 994 "calls: write into caller stack frame", 995 .insns = { 996 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 997 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 998 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 999 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1000 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0), 1001 BPF_EXIT_INSN(), 1002 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42), 1003 BPF_MOV64_IMM(BPF_REG_0, 0), 1004 BPF_EXIT_INSN(), 1005 }, 1006 .prog_type = BPF_PROG_TYPE_XDP, 1007 .result = ACCEPT, 1008 .retval = 42, 1009 }, 1010 { 1011 "calls: write into callee stack frame", 1012 .insns = { 1013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1014 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42), 1015 BPF_EXIT_INSN(), 1016 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10), 1017 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8), 1018 BPF_EXIT_INSN(), 1019 }, 1020 .prog_type = BPF_PROG_TYPE_XDP, 1021 .errstr = "cannot return stack pointer", 1022 .result = REJECT, 1023 }, 1024 { 1025 "calls: two calls with stack write and void return", 1026 .insns = { 1027 /* main prog */ 1028 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1029 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1030 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1031 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1032 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1033 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1034 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16), 1035 BPF_EXIT_INSN(), 1036 1037 /* subprog 1 */ 1038 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1039 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1040 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1041 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1042 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 1043 BPF_EXIT_INSN(), 1044 1045 /* subprog 2 */ 1046 /* write into stack frame of main prog */ 1047 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0), 1048 BPF_EXIT_INSN(), /* void return */ 1049 }, 1050 .prog_type = BPF_PROG_TYPE_XDP, 1051 .result = ACCEPT, 1052 }, 1053 { 1054 "calls: ambiguous return value", 1055 .insns = { 1056 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1057 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5), 1058 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 1059 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 1060 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1061 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 1062 BPF_EXIT_INSN(), 1063 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1), 1064 BPF_MOV64_IMM(BPF_REG_0, 0), 1065 BPF_EXIT_INSN(), 1066 }, 1067 .errstr_unpriv = "allowed for", 1068 .result_unpriv = REJECT, 1069 .errstr = "R0 !read_ok", 1070 .result = REJECT, 1071 }, 1072 { 1073 "calls: two calls that return map_value", 1074 .insns = { 1075 /* main prog */ 1076 /* pass fp-16, fp-8 into a function */ 1077 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1078 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1079 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1080 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1081 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8), 1082 1083 /* fetch map_value_ptr from the stack of this function */ 1084 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), 1085 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 1086 /* write into map value */ 1087 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1088 /* fetch secound map_value_ptr from the stack */ 1089 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16), 1090 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 1091 /* write into map value */ 1092 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1093 BPF_MOV64_IMM(BPF_REG_0, 0), 1094 BPF_EXIT_INSN(), 1095 1096 /* subprog 1 */ 1097 /* call 3rd function twice */ 1098 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1099 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1100 /* first time with fp-8 */ 1101 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1102 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1103 /* second time with fp-16 */ 1104 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 1105 BPF_EXIT_INSN(), 1106 1107 /* subprog 2 */ 1108 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1109 /* lookup from map */ 1110 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1111 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1112 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1113 BPF_LD_MAP_FD(BPF_REG_1, 0), 1114 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1115 /* write map_value_ptr into stack frame of main prog */ 1116 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1117 BPF_MOV64_IMM(BPF_REG_0, 0), 1118 BPF_EXIT_INSN(), /* return 0 */ 1119 }, 1120 .prog_type = BPF_PROG_TYPE_XDP, 1121 .fixup_map_hash_8b = { 23 }, 1122 .result = ACCEPT, 1123 }, 1124 { 1125 "calls: two calls that return map_value with bool condition", 1126 .insns = { 1127 /* main prog */ 1128 /* pass fp-16, fp-8 into a function */ 1129 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1130 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1131 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1132 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1133 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1134 BPF_MOV64_IMM(BPF_REG_0, 0), 1135 BPF_EXIT_INSN(), 1136 1137 /* subprog 1 */ 1138 /* call 3rd function twice */ 1139 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1140 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1141 /* first time with fp-8 */ 1142 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9), 1143 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 1144 /* fetch map_value_ptr from the stack of this function */ 1145 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0), 1146 /* write into map value */ 1147 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1148 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1149 /* second time with fp-16 */ 1150 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1151 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 1152 /* fetch secound map_value_ptr from the stack */ 1153 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), 1154 /* write into map value */ 1155 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1156 BPF_EXIT_INSN(), 1157 1158 /* subprog 2 */ 1159 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1160 /* lookup from map */ 1161 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1162 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1163 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1164 BPF_LD_MAP_FD(BPF_REG_1, 0), 1165 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1166 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1167 BPF_MOV64_IMM(BPF_REG_0, 0), 1168 BPF_EXIT_INSN(), /* return 0 */ 1169 /* write map_value_ptr into stack frame of main prog */ 1170 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1171 BPF_MOV64_IMM(BPF_REG_0, 1), 1172 BPF_EXIT_INSN(), /* return 1 */ 1173 }, 1174 .prog_type = BPF_PROG_TYPE_XDP, 1175 .fixup_map_hash_8b = { 23 }, 1176 .result = ACCEPT, 1177 }, 1178 { 1179 "calls: two calls that return map_value with incorrect bool check", 1180 .insns = { 1181 /* main prog */ 1182 /* pass fp-16, fp-8 into a function */ 1183 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1184 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1185 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1186 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1187 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1188 BPF_MOV64_IMM(BPF_REG_0, 0), 1189 BPF_EXIT_INSN(), 1190 1191 /* subprog 1 */ 1192 /* call 3rd function twice */ 1193 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1194 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1195 /* first time with fp-8 */ 1196 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9), 1197 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2), 1198 /* fetch map_value_ptr from the stack of this function */ 1199 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0), 1200 /* write into map value */ 1201 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1202 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 1203 /* second time with fp-16 */ 1204 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1205 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1206 /* fetch secound map_value_ptr from the stack */ 1207 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), 1208 /* write into map value */ 1209 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1210 BPF_EXIT_INSN(), 1211 1212 /* subprog 2 */ 1213 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1214 /* lookup from map */ 1215 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1216 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1217 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1218 BPF_LD_MAP_FD(BPF_REG_1, 0), 1219 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1220 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1221 BPF_MOV64_IMM(BPF_REG_0, 0), 1222 BPF_EXIT_INSN(), /* return 0 */ 1223 /* write map_value_ptr into stack frame of main prog */ 1224 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1225 BPF_MOV64_IMM(BPF_REG_0, 1), 1226 BPF_EXIT_INSN(), /* return 1 */ 1227 }, 1228 .prog_type = BPF_PROG_TYPE_XDP, 1229 .fixup_map_hash_8b = { 23 }, 1230 .result = REJECT, 1231 .errstr = "invalid read from stack R7 off=-16 size=8", 1232 }, 1233 { 1234 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1", 1235 .insns = { 1236 /* main prog */ 1237 /* pass fp-16, fp-8 into a function */ 1238 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1239 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1240 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1241 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1242 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1243 BPF_MOV64_IMM(BPF_REG_0, 0), 1244 BPF_EXIT_INSN(), 1245 1246 /* subprog 1 */ 1247 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1248 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1249 /* 1st lookup from map */ 1250 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1251 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1252 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1253 BPF_LD_MAP_FD(BPF_REG_1, 0), 1254 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1255 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1256 BPF_MOV64_IMM(BPF_REG_8, 0), 1257 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1258 /* write map_value_ptr into stack frame of main prog at fp-8 */ 1259 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1260 BPF_MOV64_IMM(BPF_REG_8, 1), 1261 1262 /* 2nd lookup from map */ 1263 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */ 1264 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1265 BPF_LD_MAP_FD(BPF_REG_1, 0), 1266 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */ 1267 BPF_FUNC_map_lookup_elem), 1268 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1269 BPF_MOV64_IMM(BPF_REG_9, 0), 1270 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1271 /* write map_value_ptr into stack frame of main prog at fp-16 */ 1272 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1273 BPF_MOV64_IMM(BPF_REG_9, 1), 1274 1275 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */ 1276 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */ 1277 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8), 1278 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7), 1279 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9), 1280 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), /* 34 */ 1281 BPF_EXIT_INSN(), 1282 1283 /* subprog 2 */ 1284 /* if arg2 == 1 do *arg1 = 0 */ 1285 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2), 1286 /* fetch map_value_ptr from the stack of this function */ 1287 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0), 1288 /* write into map value */ 1289 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1290 1291 /* if arg4 == 1 do *arg3 = 0 */ 1292 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2), 1293 /* fetch map_value_ptr from the stack of this function */ 1294 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), 1295 /* write into map value */ 1296 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0), 1297 BPF_EXIT_INSN(), 1298 }, 1299 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1300 .fixup_map_hash_8b = { 12, 22 }, 1301 .result = REJECT, 1302 .errstr = "invalid access to map value, value_size=8 off=2 size=8", 1303 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1304 }, 1305 { 1306 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2", 1307 .insns = { 1308 /* main prog */ 1309 /* pass fp-16, fp-8 into a function */ 1310 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1311 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1312 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1313 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1314 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1315 BPF_MOV64_IMM(BPF_REG_0, 0), 1316 BPF_EXIT_INSN(), 1317 1318 /* subprog 1 */ 1319 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1320 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1321 /* 1st lookup from map */ 1322 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1323 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1324 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1325 BPF_LD_MAP_FD(BPF_REG_1, 0), 1326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1327 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1328 BPF_MOV64_IMM(BPF_REG_8, 0), 1329 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1330 /* write map_value_ptr into stack frame of main prog at fp-8 */ 1331 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1332 BPF_MOV64_IMM(BPF_REG_8, 1), 1333 1334 /* 2nd lookup from map */ 1335 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */ 1336 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1337 BPF_LD_MAP_FD(BPF_REG_1, 0), 1338 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */ 1339 BPF_FUNC_map_lookup_elem), 1340 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1341 BPF_MOV64_IMM(BPF_REG_9, 0), 1342 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1343 /* write map_value_ptr into stack frame of main prog at fp-16 */ 1344 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1345 BPF_MOV64_IMM(BPF_REG_9, 1), 1346 1347 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */ 1348 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */ 1349 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8), 1350 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7), 1351 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9), 1352 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), /* 34 */ 1353 BPF_EXIT_INSN(), 1354 1355 /* subprog 2 */ 1356 /* if arg2 == 1 do *arg1 = 0 */ 1357 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2), 1358 /* fetch map_value_ptr from the stack of this function */ 1359 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0), 1360 /* write into map value */ 1361 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1362 1363 /* if arg4 == 1 do *arg3 = 0 */ 1364 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2), 1365 /* fetch map_value_ptr from the stack of this function */ 1366 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), 1367 /* write into map value */ 1368 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1369 BPF_EXIT_INSN(), 1370 }, 1371 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1372 .fixup_map_hash_8b = { 12, 22 }, 1373 .result = ACCEPT, 1374 }, 1375 { 1376 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3", 1377 .insns = { 1378 /* main prog */ 1379 /* pass fp-16, fp-8 into a function */ 1380 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1381 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1382 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1383 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1384 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2), 1385 BPF_MOV64_IMM(BPF_REG_0, 0), 1386 BPF_EXIT_INSN(), 1387 1388 /* subprog 1 */ 1389 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1390 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1391 /* 1st lookup from map */ 1392 BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0), 1393 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1394 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24), 1395 BPF_LD_MAP_FD(BPF_REG_1, 0), 1396 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1397 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1398 BPF_MOV64_IMM(BPF_REG_8, 0), 1399 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1400 /* write map_value_ptr into stack frame of main prog at fp-8 */ 1401 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1402 BPF_MOV64_IMM(BPF_REG_8, 1), 1403 1404 /* 2nd lookup from map */ 1405 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1406 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24), 1407 BPF_LD_MAP_FD(BPF_REG_1, 0), 1408 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1409 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1410 BPF_MOV64_IMM(BPF_REG_9, 0), // 26 1411 BPF_JMP_IMM(BPF_JA, 0, 0, 2), 1412 /* write map_value_ptr into stack frame of main prog at fp-16 */ 1413 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1414 BPF_MOV64_IMM(BPF_REG_9, 1), 1415 1416 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */ 1417 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30 1418 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8), 1419 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7), 1420 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9), 1421 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34 1422 BPF_JMP_IMM(BPF_JA, 0, 0, -30), 1423 1424 /* subprog 2 */ 1425 /* if arg2 == 1 do *arg1 = 0 */ 1426 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2), 1427 /* fetch map_value_ptr from the stack of this function */ 1428 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0), 1429 /* write into map value */ 1430 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1431 1432 /* if arg4 == 1 do *arg3 = 0 */ 1433 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2), 1434 /* fetch map_value_ptr from the stack of this function */ 1435 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), 1436 /* write into map value */ 1437 BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0), 1438 BPF_JMP_IMM(BPF_JA, 0, 0, -8), 1439 }, 1440 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1441 .fixup_map_hash_8b = { 12, 22 }, 1442 .result = REJECT, 1443 .errstr = "invalid access to map value, value_size=8 off=2 size=8", 1444 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1445 }, 1446 { 1447 "calls: two calls that receive map_value_ptr_or_null via arg. test1", 1448 .insns = { 1449 /* main prog */ 1450 /* pass fp-16, fp-8 into a function */ 1451 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1452 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1453 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1454 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1455 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1456 BPF_MOV64_IMM(BPF_REG_0, 0), 1457 BPF_EXIT_INSN(), 1458 1459 /* subprog 1 */ 1460 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1461 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1462 /* 1st lookup from map */ 1463 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1464 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1465 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1466 BPF_LD_MAP_FD(BPF_REG_1, 0), 1467 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1468 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */ 1469 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1470 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1471 BPF_MOV64_IMM(BPF_REG_8, 0), 1472 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1473 BPF_MOV64_IMM(BPF_REG_8, 1), 1474 1475 /* 2nd lookup from map */ 1476 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1477 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1478 BPF_LD_MAP_FD(BPF_REG_1, 0), 1479 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1480 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */ 1481 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1482 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1483 BPF_MOV64_IMM(BPF_REG_9, 0), 1484 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1485 BPF_MOV64_IMM(BPF_REG_9, 1), 1486 1487 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */ 1488 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 1489 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8), 1490 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7), 1491 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9), 1492 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 1493 BPF_EXIT_INSN(), 1494 1495 /* subprog 2 */ 1496 /* if arg2 == 1 do *arg1 = 0 */ 1497 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2), 1498 /* fetch map_value_ptr from the stack of this function */ 1499 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0), 1500 /* write into map value */ 1501 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1502 1503 /* if arg4 == 1 do *arg3 = 0 */ 1504 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2), 1505 /* fetch map_value_ptr from the stack of this function */ 1506 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), 1507 /* write into map value */ 1508 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1509 BPF_EXIT_INSN(), 1510 }, 1511 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1512 .fixup_map_hash_8b = { 12, 22 }, 1513 .result = ACCEPT, 1514 }, 1515 { 1516 "calls: two calls that receive map_value_ptr_or_null via arg. test2", 1517 .insns = { 1518 /* main prog */ 1519 /* pass fp-16, fp-8 into a function */ 1520 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), 1521 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), 1522 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1523 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16), 1524 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1525 BPF_MOV64_IMM(BPF_REG_0, 0), 1526 BPF_EXIT_INSN(), 1527 1528 /* subprog 1 */ 1529 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1530 BPF_MOV64_REG(BPF_REG_7, BPF_REG_2), 1531 /* 1st lookup from map */ 1532 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1533 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1534 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1535 BPF_LD_MAP_FD(BPF_REG_1, 0), 1536 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1537 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */ 1538 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1539 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1540 BPF_MOV64_IMM(BPF_REG_8, 0), 1541 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1542 BPF_MOV64_IMM(BPF_REG_8, 1), 1543 1544 /* 2nd lookup from map */ 1545 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1546 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1547 BPF_LD_MAP_FD(BPF_REG_1, 0), 1548 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1549 /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */ 1550 BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0), 1551 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2), 1552 BPF_MOV64_IMM(BPF_REG_9, 0), 1553 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1554 BPF_MOV64_IMM(BPF_REG_9, 1), 1555 1556 /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */ 1557 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 1558 BPF_MOV64_REG(BPF_REG_2, BPF_REG_8), 1559 BPF_MOV64_REG(BPF_REG_3, BPF_REG_7), 1560 BPF_MOV64_REG(BPF_REG_4, BPF_REG_9), 1561 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 1562 BPF_EXIT_INSN(), 1563 1564 /* subprog 2 */ 1565 /* if arg2 == 1 do *arg1 = 0 */ 1566 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2), 1567 /* fetch map_value_ptr from the stack of this function */ 1568 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0), 1569 /* write into map value */ 1570 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1571 1572 /* if arg4 == 0 do *arg3 = 0 */ 1573 BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2), 1574 /* fetch map_value_ptr from the stack of this function */ 1575 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), 1576 /* write into map value */ 1577 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0), 1578 BPF_EXIT_INSN(), 1579 }, 1580 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1581 .fixup_map_hash_8b = { 12, 22 }, 1582 .result = REJECT, 1583 .errstr = "R0 invalid mem access 'inv'", 1584 }, 1585 { 1586 "calls: pkt_ptr spill into caller stack", 1587 .insns = { 1588 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1589 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1590 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), 1591 BPF_EXIT_INSN(), 1592 1593 /* subprog 1 */ 1594 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1595 offsetof(struct __sk_buff, data)), 1596 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1597 offsetof(struct __sk_buff, data_end)), 1598 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1599 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1600 /* spill unchecked pkt_ptr into stack of caller */ 1601 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1602 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2), 1603 /* now the pkt range is verified, read pkt_ptr from stack */ 1604 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0), 1605 /* write 4 bytes into packet */ 1606 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1607 BPF_EXIT_INSN(), 1608 }, 1609 .result = ACCEPT, 1610 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1611 .retval = POINTER_VALUE, 1612 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1613 }, 1614 { 1615 "calls: pkt_ptr spill into caller stack 2", 1616 .insns = { 1617 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1618 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1619 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1620 /* Marking is still kept, but not in all cases safe. */ 1621 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1622 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0), 1623 BPF_EXIT_INSN(), 1624 1625 /* subprog 1 */ 1626 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1627 offsetof(struct __sk_buff, data)), 1628 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1629 offsetof(struct __sk_buff, data_end)), 1630 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1631 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1632 /* spill unchecked pkt_ptr into stack of caller */ 1633 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1634 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2), 1635 /* now the pkt range is verified, read pkt_ptr from stack */ 1636 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0), 1637 /* write 4 bytes into packet */ 1638 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1639 BPF_EXIT_INSN(), 1640 }, 1641 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1642 .errstr = "invalid access to packet", 1643 .result = REJECT, 1644 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1645 }, 1646 { 1647 "calls: pkt_ptr spill into caller stack 3", 1648 .insns = { 1649 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1650 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1651 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1652 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), 1653 /* Marking is still kept and safe here. */ 1654 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1655 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0), 1656 BPF_EXIT_INSN(), 1657 1658 /* subprog 1 */ 1659 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1660 offsetof(struct __sk_buff, data)), 1661 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1662 offsetof(struct __sk_buff, data_end)), 1663 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1664 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1665 /* spill unchecked pkt_ptr into stack of caller */ 1666 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1667 BPF_MOV64_IMM(BPF_REG_5, 0), 1668 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3), 1669 BPF_MOV64_IMM(BPF_REG_5, 1), 1670 /* now the pkt range is verified, read pkt_ptr from stack */ 1671 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0), 1672 /* write 4 bytes into packet */ 1673 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1674 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1675 BPF_EXIT_INSN(), 1676 }, 1677 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1678 .result = ACCEPT, 1679 .retval = 1, 1680 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1681 }, 1682 { 1683 "calls: pkt_ptr spill into caller stack 4", 1684 .insns = { 1685 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1686 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1687 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1688 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), 1689 /* Check marking propagated. */ 1690 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1691 BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0), 1692 BPF_EXIT_INSN(), 1693 1694 /* subprog 1 */ 1695 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1696 offsetof(struct __sk_buff, data)), 1697 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1698 offsetof(struct __sk_buff, data_end)), 1699 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1700 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1701 /* spill unchecked pkt_ptr into stack of caller */ 1702 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1703 BPF_MOV64_IMM(BPF_REG_5, 0), 1704 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2), 1705 BPF_MOV64_IMM(BPF_REG_5, 1), 1706 /* don't read back pkt_ptr from stack here */ 1707 /* write 4 bytes into packet */ 1708 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1709 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1710 BPF_EXIT_INSN(), 1711 }, 1712 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1713 .result = ACCEPT, 1714 .retval = 1, 1715 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1716 }, 1717 { 1718 "calls: pkt_ptr spill into caller stack 5", 1719 .insns = { 1720 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1721 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1722 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0), 1723 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1724 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1725 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0), 1726 BPF_EXIT_INSN(), 1727 1728 /* subprog 1 */ 1729 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1730 offsetof(struct __sk_buff, data)), 1731 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1732 offsetof(struct __sk_buff, data_end)), 1733 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1734 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1735 BPF_MOV64_IMM(BPF_REG_5, 0), 1736 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3), 1737 /* spill checked pkt_ptr into stack of caller */ 1738 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1739 BPF_MOV64_IMM(BPF_REG_5, 1), 1740 /* don't read back pkt_ptr from stack here */ 1741 /* write 4 bytes into packet */ 1742 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1743 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1744 BPF_EXIT_INSN(), 1745 }, 1746 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1747 .errstr = "same insn cannot be used with different", 1748 .result = REJECT, 1749 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1750 }, 1751 { 1752 "calls: pkt_ptr spill into caller stack 6", 1753 .insns = { 1754 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1755 offsetof(struct __sk_buff, data_end)), 1756 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1757 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1758 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1759 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1760 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1761 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0), 1762 BPF_EXIT_INSN(), 1763 1764 /* subprog 1 */ 1765 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1766 offsetof(struct __sk_buff, data)), 1767 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1768 offsetof(struct __sk_buff, data_end)), 1769 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1771 BPF_MOV64_IMM(BPF_REG_5, 0), 1772 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3), 1773 /* spill checked pkt_ptr into stack of caller */ 1774 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1775 BPF_MOV64_IMM(BPF_REG_5, 1), 1776 /* don't read back pkt_ptr from stack here */ 1777 /* write 4 bytes into packet */ 1778 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1779 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1780 BPF_EXIT_INSN(), 1781 }, 1782 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1783 .errstr = "R4 invalid mem access", 1784 .result = REJECT, 1785 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1786 }, 1787 { 1788 "calls: pkt_ptr spill into caller stack 7", 1789 .insns = { 1790 BPF_MOV64_IMM(BPF_REG_2, 0), 1791 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1792 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1793 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1794 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1795 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1796 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0), 1797 BPF_EXIT_INSN(), 1798 1799 /* subprog 1 */ 1800 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1801 offsetof(struct __sk_buff, data)), 1802 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1803 offsetof(struct __sk_buff, data_end)), 1804 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1805 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1806 BPF_MOV64_IMM(BPF_REG_5, 0), 1807 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3), 1808 /* spill checked pkt_ptr into stack of caller */ 1809 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1810 BPF_MOV64_IMM(BPF_REG_5, 1), 1811 /* don't read back pkt_ptr from stack here */ 1812 /* write 4 bytes into packet */ 1813 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1814 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1815 BPF_EXIT_INSN(), 1816 }, 1817 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1818 .errstr = "R4 invalid mem access", 1819 .result = REJECT, 1820 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1821 }, 1822 { 1823 "calls: pkt_ptr spill into caller stack 8", 1824 .insns = { 1825 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1826 offsetof(struct __sk_buff, data)), 1827 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1828 offsetof(struct __sk_buff, data_end)), 1829 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1830 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1831 BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1), 1832 BPF_EXIT_INSN(), 1833 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1834 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1835 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1836 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1837 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1838 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0), 1839 BPF_EXIT_INSN(), 1840 1841 /* subprog 1 */ 1842 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1843 offsetof(struct __sk_buff, data)), 1844 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1845 offsetof(struct __sk_buff, data_end)), 1846 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1847 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1848 BPF_MOV64_IMM(BPF_REG_5, 0), 1849 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3), 1850 /* spill checked pkt_ptr into stack of caller */ 1851 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1852 BPF_MOV64_IMM(BPF_REG_5, 1), 1853 /* don't read back pkt_ptr from stack here */ 1854 /* write 4 bytes into packet */ 1855 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1856 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1857 BPF_EXIT_INSN(), 1858 }, 1859 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1860 .result = ACCEPT, 1861 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1862 }, 1863 { 1864 "calls: pkt_ptr spill into caller stack 9", 1865 .insns = { 1866 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1867 offsetof(struct __sk_buff, data)), 1868 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1869 offsetof(struct __sk_buff, data_end)), 1870 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1871 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1872 BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1), 1873 BPF_EXIT_INSN(), 1874 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), 1875 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), 1876 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1877 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3), 1878 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8), 1879 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0), 1880 BPF_EXIT_INSN(), 1881 1882 /* subprog 1 */ 1883 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1884 offsetof(struct __sk_buff, data)), 1885 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 1886 offsetof(struct __sk_buff, data_end)), 1887 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 1888 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 1889 BPF_MOV64_IMM(BPF_REG_5, 0), 1890 /* spill unchecked pkt_ptr into stack of caller */ 1891 BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0), 1892 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2), 1893 BPF_MOV64_IMM(BPF_REG_5, 1), 1894 /* don't read back pkt_ptr from stack here */ 1895 /* write 4 bytes into packet */ 1896 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), 1897 BPF_MOV64_REG(BPF_REG_0, BPF_REG_5), 1898 BPF_EXIT_INSN(), 1899 }, 1900 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1901 .errstr = "invalid access to packet", 1902 .result = REJECT, 1903 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1904 }, 1905 { 1906 "calls: caller stack init to zero or map_value_or_null", 1907 .insns = { 1908 BPF_MOV64_IMM(BPF_REG_0, 0), 1909 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), 1910 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1911 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1912 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1913 /* fetch map_value_or_null or const_zero from stack */ 1914 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), 1915 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 1916 /* store into map_value */ 1917 BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0), 1918 BPF_EXIT_INSN(), 1919 1920 /* subprog 1 */ 1921 /* if (ctx == 0) return; */ 1922 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8), 1923 /* else bpf_map_lookup() and *(fp - 8) = r0 */ 1924 BPF_MOV64_REG(BPF_REG_6, BPF_REG_2), 1925 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1926 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1927 BPF_LD_MAP_FD(BPF_REG_1, 0), 1928 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1929 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1930 /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */ 1931 BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), 1932 BPF_EXIT_INSN(), 1933 }, 1934 .fixup_map_hash_8b = { 13 }, 1935 .result = ACCEPT, 1936 .prog_type = BPF_PROG_TYPE_XDP, 1937 }, 1938 { 1939 "calls: stack init to zero and pruning", 1940 .insns = { 1941 /* first make allocated_stack 16 byte */ 1942 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0), 1943 /* now fork the execution such that the false branch 1944 * of JGT insn will be verified second and it skisp zero 1945 * init of fp-8 stack slot. If stack liveness marking 1946 * is missing live_read marks from call map_lookup 1947 * processing then pruning will incorrectly assume 1948 * that fp-8 stack slot was unused in the fall-through 1949 * branch and will accept the program incorrectly 1950 */ 1951 BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2), 1952 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1953 BPF_JMP_IMM(BPF_JA, 0, 0, 0), 1954 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1955 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1956 BPF_LD_MAP_FD(BPF_REG_1, 0), 1957 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1958 BPF_EXIT_INSN(), 1959 }, 1960 .fixup_map_hash_48b = { 6 }, 1961 .errstr = "invalid indirect read from stack R2 off -8+0 size 8", 1962 .result = REJECT, 1963 .prog_type = BPF_PROG_TYPE_XDP, 1964 }, 1965 { 1966 "calls: ctx read at start of subprog", 1967 .insns = { 1968 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 1969 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5), 1970 BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0), 1971 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 1972 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), 1973 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 1974 BPF_EXIT_INSN(), 1975 BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0), 1976 BPF_MOV64_IMM(BPF_REG_0, 0), 1977 BPF_EXIT_INSN(), 1978 }, 1979 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, 1980 .errstr_unpriv = "loading/calling other bpf or kernel functions are allowed for", 1981 .result_unpriv = REJECT, 1982 .result = ACCEPT, 1983 }, 1984 { 1985 "calls: cross frame pruning", 1986 .insns = { 1987 /* r8 = !!random(); 1988 * call pruner() 1989 * if (r8) 1990 * do something bad; 1991 */ 1992 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), 1993 BPF_MOV64_IMM(BPF_REG_8, 0), 1994 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 1995 BPF_MOV64_IMM(BPF_REG_8, 1), 1996 BPF_MOV64_REG(BPF_REG_1, BPF_REG_8), 1997 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 1998 BPF_JMP_IMM(BPF_JEQ, BPF_REG_8, 1, 1), 1999 BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0), 2000 BPF_MOV64_IMM(BPF_REG_0, 0), 2001 BPF_EXIT_INSN(), 2002 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0), 2003 BPF_EXIT_INSN(), 2004 }, 2005 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, 2006 .errstr_unpriv = "loading/calling other bpf or kernel functions are allowed for", 2007 .errstr = "!read_ok", 2008 .result = REJECT, 2009 }, 2010 { 2011 "calls: cross frame pruning - liveness propagation", 2012 .insns = { 2013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), 2014 BPF_MOV64_IMM(BPF_REG_8, 0), 2015 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 2016 BPF_MOV64_IMM(BPF_REG_8, 1), 2017 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), 2018 BPF_MOV64_IMM(BPF_REG_9, 0), 2019 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 2020 BPF_MOV64_IMM(BPF_REG_9, 1), 2021 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 2022 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), 2023 BPF_JMP_IMM(BPF_JEQ, BPF_REG_8, 1, 1), 2024 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_2, 0), 2025 BPF_MOV64_IMM(BPF_REG_0, 0), 2026 BPF_EXIT_INSN(), 2027 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0), 2028 BPF_EXIT_INSN(), 2029 }, 2030 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, 2031 .errstr_unpriv = "loading/calling other bpf or kernel functions are allowed for", 2032 .errstr = "!read_ok", 2033 .result = REJECT, 2034 }, 2035