1 {
2 	"access skb fields ok",
3 	.insns = {
4 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5 		    offsetof(struct __sk_buff, len)),
6 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
7 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8 		    offsetof(struct __sk_buff, mark)),
9 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
10 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
11 		    offsetof(struct __sk_buff, pkt_type)),
12 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
13 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
14 		    offsetof(struct __sk_buff, queue_mapping)),
15 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
16 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
17 		    offsetof(struct __sk_buff, protocol)),
18 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
19 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
20 		    offsetof(struct __sk_buff, vlan_present)),
21 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
22 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
23 		    offsetof(struct __sk_buff, vlan_tci)),
24 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
25 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
26 		    offsetof(struct __sk_buff, napi_id)),
27 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
28 	BPF_EXIT_INSN(),
29 	},
30 	.result = ACCEPT,
31 },
32 {
33 	"access skb fields bad1",
34 	.insns = {
35 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
36 	BPF_EXIT_INSN(),
37 	},
38 	.errstr = "invalid bpf_context access",
39 	.result = REJECT,
40 },
41 {
42 	"access skb fields bad2",
43 	.insns = {
44 	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
45 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
46 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
47 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
48 	BPF_LD_MAP_FD(BPF_REG_1, 0),
49 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
50 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
51 	BPF_EXIT_INSN(),
52 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
53 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
54 		    offsetof(struct __sk_buff, pkt_type)),
55 	BPF_EXIT_INSN(),
56 	},
57 	.fixup_map_hash_8b = { 4 },
58 	.errstr = "different pointers",
59 	.errstr_unpriv = "R1 pointer comparison",
60 	.result = REJECT,
61 },
62 {
63 	"access skb fields bad3",
64 	.insns = {
65 	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
66 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
67 		    offsetof(struct __sk_buff, pkt_type)),
68 	BPF_EXIT_INSN(),
69 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
70 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
71 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
72 	BPF_LD_MAP_FD(BPF_REG_1, 0),
73 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
74 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
75 	BPF_EXIT_INSN(),
76 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
77 	BPF_JMP_IMM(BPF_JA, 0, 0, -12),
78 	},
79 	.fixup_map_hash_8b = { 6 },
80 	.errstr = "different pointers",
81 	.errstr_unpriv = "R1 pointer comparison",
82 	.result = REJECT,
83 },
84 {
85 	"access skb fields bad4",
86 	.insns = {
87 	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
88 	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
89 		    offsetof(struct __sk_buff, len)),
90 	BPF_MOV64_IMM(BPF_REG_0, 0),
91 	BPF_EXIT_INSN(),
92 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
93 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
94 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
95 	BPF_LD_MAP_FD(BPF_REG_1, 0),
96 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
97 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
98 	BPF_EXIT_INSN(),
99 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
100 	BPF_JMP_IMM(BPF_JA, 0, 0, -13),
101 	},
102 	.fixup_map_hash_8b = { 7 },
103 	.errstr = "different pointers",
104 	.errstr_unpriv = "R1 pointer comparison",
105 	.result = REJECT,
106 },
107 {
108 	"invalid access __sk_buff family",
109 	.insns = {
110 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
111 		    offsetof(struct __sk_buff, family)),
112 	BPF_EXIT_INSN(),
113 	},
114 	.errstr = "invalid bpf_context access",
115 	.result = REJECT,
116 },
117 {
118 	"invalid access __sk_buff remote_ip4",
119 	.insns = {
120 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
121 		    offsetof(struct __sk_buff, remote_ip4)),
122 	BPF_EXIT_INSN(),
123 	},
124 	.errstr = "invalid bpf_context access",
125 	.result = REJECT,
126 },
127 {
128 	"invalid access __sk_buff local_ip4",
129 	.insns = {
130 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
131 		    offsetof(struct __sk_buff, local_ip4)),
132 	BPF_EXIT_INSN(),
133 	},
134 	.errstr = "invalid bpf_context access",
135 	.result = REJECT,
136 },
137 {
138 	"invalid access __sk_buff remote_ip6",
139 	.insns = {
140 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
141 		    offsetof(struct __sk_buff, remote_ip6)),
142 	BPF_EXIT_INSN(),
143 	},
144 	.errstr = "invalid bpf_context access",
145 	.result = REJECT,
146 },
147 {
148 	"invalid access __sk_buff local_ip6",
149 	.insns = {
150 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
151 		    offsetof(struct __sk_buff, local_ip6)),
152 	BPF_EXIT_INSN(),
153 	},
154 	.errstr = "invalid bpf_context access",
155 	.result = REJECT,
156 },
157 {
158 	"invalid access __sk_buff remote_port",
159 	.insns = {
160 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
161 		    offsetof(struct __sk_buff, remote_port)),
162 	BPF_EXIT_INSN(),
163 	},
164 	.errstr = "invalid bpf_context access",
165 	.result = REJECT,
166 },
167 {
168 	"invalid access __sk_buff remote_port",
169 	.insns = {
170 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
171 		    offsetof(struct __sk_buff, local_port)),
172 	BPF_EXIT_INSN(),
173 	},
174 	.errstr = "invalid bpf_context access",
175 	.result = REJECT,
176 },
177 {
178 	"valid access __sk_buff family",
179 	.insns = {
180 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
181 		    offsetof(struct __sk_buff, family)),
182 	BPF_EXIT_INSN(),
183 	},
184 	.result = ACCEPT,
185 	.prog_type = BPF_PROG_TYPE_SK_SKB,
186 },
187 {
188 	"valid access __sk_buff remote_ip4",
189 	.insns = {
190 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
191 		    offsetof(struct __sk_buff, remote_ip4)),
192 	BPF_EXIT_INSN(),
193 	},
194 	.result = ACCEPT,
195 	.prog_type = BPF_PROG_TYPE_SK_SKB,
196 },
197 {
198 	"valid access __sk_buff local_ip4",
199 	.insns = {
200 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
201 		    offsetof(struct __sk_buff, local_ip4)),
202 	BPF_EXIT_INSN(),
203 	},
204 	.result = ACCEPT,
205 	.prog_type = BPF_PROG_TYPE_SK_SKB,
206 },
207 {
208 	"valid access __sk_buff remote_ip6",
209 	.insns = {
210 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
211 		    offsetof(struct __sk_buff, remote_ip6[0])),
212 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
213 		    offsetof(struct __sk_buff, remote_ip6[1])),
214 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
215 		    offsetof(struct __sk_buff, remote_ip6[2])),
216 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
217 		    offsetof(struct __sk_buff, remote_ip6[3])),
218 	BPF_EXIT_INSN(),
219 	},
220 	.result = ACCEPT,
221 	.prog_type = BPF_PROG_TYPE_SK_SKB,
222 },
223 {
224 	"valid access __sk_buff local_ip6",
225 	.insns = {
226 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
227 		    offsetof(struct __sk_buff, local_ip6[0])),
228 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
229 		    offsetof(struct __sk_buff, local_ip6[1])),
230 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
231 		    offsetof(struct __sk_buff, local_ip6[2])),
232 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
233 		    offsetof(struct __sk_buff, local_ip6[3])),
234 	BPF_EXIT_INSN(),
235 	},
236 	.result = ACCEPT,
237 	.prog_type = BPF_PROG_TYPE_SK_SKB,
238 },
239 {
240 	"valid access __sk_buff remote_port",
241 	.insns = {
242 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
243 		    offsetof(struct __sk_buff, remote_port)),
244 	BPF_EXIT_INSN(),
245 	},
246 	.result = ACCEPT,
247 	.prog_type = BPF_PROG_TYPE_SK_SKB,
248 },
249 {
250 	"valid access __sk_buff remote_port",
251 	.insns = {
252 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
253 		    offsetof(struct __sk_buff, local_port)),
254 	BPF_EXIT_INSN(),
255 	},
256 	.result = ACCEPT,
257 	.prog_type = BPF_PROG_TYPE_SK_SKB,
258 },
259 {
260 	"invalid access of tc_classid for SK_SKB",
261 	.insns = {
262 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
263 		    offsetof(struct __sk_buff, tc_classid)),
264 	BPF_EXIT_INSN(),
265 	},
266 	.result = REJECT,
267 	.prog_type = BPF_PROG_TYPE_SK_SKB,
268 	.errstr = "invalid bpf_context access",
269 },
270 {
271 	"invalid access of skb->mark for SK_SKB",
272 	.insns = {
273 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
274 		    offsetof(struct __sk_buff, mark)),
275 	BPF_EXIT_INSN(),
276 	},
277 	.result =  REJECT,
278 	.prog_type = BPF_PROG_TYPE_SK_SKB,
279 	.errstr = "invalid bpf_context access",
280 },
281 {
282 	"check skb->mark is not writeable by SK_SKB",
283 	.insns = {
284 	BPF_MOV64_IMM(BPF_REG_0, 0),
285 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
286 		    offsetof(struct __sk_buff, mark)),
287 	BPF_EXIT_INSN(),
288 	},
289 	.result =  REJECT,
290 	.prog_type = BPF_PROG_TYPE_SK_SKB,
291 	.errstr = "invalid bpf_context access",
292 },
293 {
294 	"check skb->tc_index is writeable by SK_SKB",
295 	.insns = {
296 	BPF_MOV64_IMM(BPF_REG_0, 0),
297 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
298 		    offsetof(struct __sk_buff, tc_index)),
299 	BPF_EXIT_INSN(),
300 	},
301 	.result = ACCEPT,
302 	.prog_type = BPF_PROG_TYPE_SK_SKB,
303 },
304 {
305 	"check skb->priority is writeable by SK_SKB",
306 	.insns = {
307 	BPF_MOV64_IMM(BPF_REG_0, 0),
308 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
309 		    offsetof(struct __sk_buff, priority)),
310 	BPF_EXIT_INSN(),
311 	},
312 	.result = ACCEPT,
313 	.prog_type = BPF_PROG_TYPE_SK_SKB,
314 },
315 {
316 	"direct packet read for SK_SKB",
317 	.insns = {
318 	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
319 		    offsetof(struct __sk_buff, data)),
320 	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
321 		    offsetof(struct __sk_buff, data_end)),
322 	BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
323 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
324 	BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
325 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
326 	BPF_MOV64_IMM(BPF_REG_0, 0),
327 	BPF_EXIT_INSN(),
328 	},
329 	.result = ACCEPT,
330 	.prog_type = BPF_PROG_TYPE_SK_SKB,
331 },
332 {
333 	"direct packet write for SK_SKB",
334 	.insns = {
335 	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
336 		    offsetof(struct __sk_buff, data)),
337 	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
338 		    offsetof(struct __sk_buff, data_end)),
339 	BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
340 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
341 	BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
342 	BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
343 	BPF_MOV64_IMM(BPF_REG_0, 0),
344 	BPF_EXIT_INSN(),
345 	},
346 	.result = ACCEPT,
347 	.prog_type = BPF_PROG_TYPE_SK_SKB,
348 },
349 {
350 	"overlapping checks for direct packet access SK_SKB",
351 	.insns = {
352 	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
353 		    offsetof(struct __sk_buff, data)),
354 	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
355 		    offsetof(struct __sk_buff, data_end)),
356 	BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
357 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
358 	BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
359 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
360 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
361 	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
362 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
363 	BPF_MOV64_IMM(BPF_REG_0, 0),
364 	BPF_EXIT_INSN(),
365 	},
366 	.result = ACCEPT,
367 	.prog_type = BPF_PROG_TYPE_SK_SKB,
368 },
369 {
370 	"check skb->mark is not writeable by sockets",
371 	.insns = {
372 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
373 		    offsetof(struct __sk_buff, mark)),
374 	BPF_EXIT_INSN(),
375 	},
376 	.errstr = "invalid bpf_context access",
377 	.errstr_unpriv = "R1 leaks addr",
378 	.result = REJECT,
379 },
380 {
381 	"check skb->tc_index is not writeable by sockets",
382 	.insns = {
383 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
384 		    offsetof(struct __sk_buff, tc_index)),
385 	BPF_EXIT_INSN(),
386 	},
387 	.errstr = "invalid bpf_context access",
388 	.errstr_unpriv = "R1 leaks addr",
389 	.result = REJECT,
390 },
391 {
392 	"check cb access: byte",
393 	.insns = {
394 	BPF_MOV64_IMM(BPF_REG_0, 0),
395 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
396 		    offsetof(struct __sk_buff, cb[0])),
397 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
398 		    offsetof(struct __sk_buff, cb[0]) + 1),
399 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
400 		    offsetof(struct __sk_buff, cb[0]) + 2),
401 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
402 		    offsetof(struct __sk_buff, cb[0]) + 3),
403 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
404 		    offsetof(struct __sk_buff, cb[1])),
405 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
406 		    offsetof(struct __sk_buff, cb[1]) + 1),
407 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
408 		    offsetof(struct __sk_buff, cb[1]) + 2),
409 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
410 		    offsetof(struct __sk_buff, cb[1]) + 3),
411 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
412 		    offsetof(struct __sk_buff, cb[2])),
413 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
414 		    offsetof(struct __sk_buff, cb[2]) + 1),
415 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
416 		    offsetof(struct __sk_buff, cb[2]) + 2),
417 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
418 		    offsetof(struct __sk_buff, cb[2]) + 3),
419 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
420 		    offsetof(struct __sk_buff, cb[3])),
421 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
422 		    offsetof(struct __sk_buff, cb[3]) + 1),
423 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
424 		    offsetof(struct __sk_buff, cb[3]) + 2),
425 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
426 		    offsetof(struct __sk_buff, cb[3]) + 3),
427 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
428 		    offsetof(struct __sk_buff, cb[4])),
429 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
430 		    offsetof(struct __sk_buff, cb[4]) + 1),
431 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
432 		    offsetof(struct __sk_buff, cb[4]) + 2),
433 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
434 		    offsetof(struct __sk_buff, cb[4]) + 3),
435 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
436 		    offsetof(struct __sk_buff, cb[0])),
437 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
438 		    offsetof(struct __sk_buff, cb[0]) + 1),
439 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
440 		    offsetof(struct __sk_buff, cb[0]) + 2),
441 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
442 		    offsetof(struct __sk_buff, cb[0]) + 3),
443 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
444 		    offsetof(struct __sk_buff, cb[1])),
445 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
446 		    offsetof(struct __sk_buff, cb[1]) + 1),
447 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
448 		    offsetof(struct __sk_buff, cb[1]) + 2),
449 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
450 		    offsetof(struct __sk_buff, cb[1]) + 3),
451 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
452 		    offsetof(struct __sk_buff, cb[2])),
453 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
454 		    offsetof(struct __sk_buff, cb[2]) + 1),
455 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
456 		    offsetof(struct __sk_buff, cb[2]) + 2),
457 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
458 		    offsetof(struct __sk_buff, cb[2]) + 3),
459 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
460 		    offsetof(struct __sk_buff, cb[3])),
461 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
462 		    offsetof(struct __sk_buff, cb[3]) + 1),
463 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
464 		    offsetof(struct __sk_buff, cb[3]) + 2),
465 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
466 		    offsetof(struct __sk_buff, cb[3]) + 3),
467 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
468 		    offsetof(struct __sk_buff, cb[4])),
469 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
470 		    offsetof(struct __sk_buff, cb[4]) + 1),
471 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
472 		    offsetof(struct __sk_buff, cb[4]) + 2),
473 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
474 		    offsetof(struct __sk_buff, cb[4]) + 3),
475 	BPF_EXIT_INSN(),
476 	},
477 	.result = ACCEPT,
478 },
479 {
480 	"__sk_buff->hash, offset 0, byte store not permitted",
481 	.insns = {
482 	BPF_MOV64_IMM(BPF_REG_0, 0),
483 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
484 		    offsetof(struct __sk_buff, hash)),
485 	BPF_EXIT_INSN(),
486 	},
487 	.errstr = "invalid bpf_context access",
488 	.result = REJECT,
489 },
490 {
491 	"__sk_buff->tc_index, offset 3, byte store not permitted",
492 	.insns = {
493 	BPF_MOV64_IMM(BPF_REG_0, 0),
494 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
495 		    offsetof(struct __sk_buff, tc_index) + 3),
496 	BPF_EXIT_INSN(),
497 	},
498 	.errstr = "invalid bpf_context access",
499 	.result = REJECT,
500 },
501 {
502 	"check skb->hash byte load permitted",
503 	.insns = {
504 	BPF_MOV64_IMM(BPF_REG_0, 0),
505 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
506 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
507 		    offsetof(struct __sk_buff, hash)),
508 #else
509 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
510 		    offsetof(struct __sk_buff, hash) + 3),
511 #endif
512 	BPF_EXIT_INSN(),
513 	},
514 	.result = ACCEPT,
515 },
516 {
517 	"check skb->hash byte load permitted 1",
518 	.insns = {
519 	BPF_MOV64_IMM(BPF_REG_0, 0),
520 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
521 		    offsetof(struct __sk_buff, hash) + 1),
522 	BPF_EXIT_INSN(),
523 	},
524 	.result = ACCEPT,
525 },
526 {
527 	"check skb->hash byte load permitted 2",
528 	.insns = {
529 	BPF_MOV64_IMM(BPF_REG_0, 0),
530 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
531 		    offsetof(struct __sk_buff, hash) + 2),
532 	BPF_EXIT_INSN(),
533 	},
534 	.result = ACCEPT,
535 },
536 {
537 	"check skb->hash byte load permitted 3",
538 	.insns = {
539 	BPF_MOV64_IMM(BPF_REG_0, 0),
540 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
541 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
542 		    offsetof(struct __sk_buff, hash) + 3),
543 #else
544 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
545 		    offsetof(struct __sk_buff, hash)),
546 #endif
547 	BPF_EXIT_INSN(),
548 	},
549 	.result = ACCEPT,
550 },
551 {
552 	"check cb access: byte, wrong type",
553 	.insns = {
554 	BPF_MOV64_IMM(BPF_REG_0, 0),
555 	BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
556 		    offsetof(struct __sk_buff, cb[0])),
557 	BPF_EXIT_INSN(),
558 	},
559 	.errstr = "invalid bpf_context access",
560 	.result = REJECT,
561 	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
562 },
563 {
564 	"check cb access: half",
565 	.insns = {
566 	BPF_MOV64_IMM(BPF_REG_0, 0),
567 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
568 		    offsetof(struct __sk_buff, cb[0])),
569 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
570 		    offsetof(struct __sk_buff, cb[0]) + 2),
571 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
572 		    offsetof(struct __sk_buff, cb[1])),
573 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
574 		    offsetof(struct __sk_buff, cb[1]) + 2),
575 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
576 		    offsetof(struct __sk_buff, cb[2])),
577 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
578 		    offsetof(struct __sk_buff, cb[2]) + 2),
579 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
580 		    offsetof(struct __sk_buff, cb[3])),
581 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
582 		    offsetof(struct __sk_buff, cb[3]) + 2),
583 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
584 		    offsetof(struct __sk_buff, cb[4])),
585 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
586 		    offsetof(struct __sk_buff, cb[4]) + 2),
587 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
588 		    offsetof(struct __sk_buff, cb[0])),
589 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
590 		    offsetof(struct __sk_buff, cb[0]) + 2),
591 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
592 		    offsetof(struct __sk_buff, cb[1])),
593 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
594 		    offsetof(struct __sk_buff, cb[1]) + 2),
595 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
596 		    offsetof(struct __sk_buff, cb[2])),
597 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
598 		    offsetof(struct __sk_buff, cb[2]) + 2),
599 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
600 		    offsetof(struct __sk_buff, cb[3])),
601 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
602 		    offsetof(struct __sk_buff, cb[3]) + 2),
603 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
604 		    offsetof(struct __sk_buff, cb[4])),
605 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
606 		    offsetof(struct __sk_buff, cb[4]) + 2),
607 	BPF_EXIT_INSN(),
608 	},
609 	.result = ACCEPT,
610 },
611 {
612 	"check cb access: half, unaligned",
613 	.insns = {
614 	BPF_MOV64_IMM(BPF_REG_0, 0),
615 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
616 		    offsetof(struct __sk_buff, cb[0]) + 1),
617 	BPF_EXIT_INSN(),
618 	},
619 	.errstr = "misaligned context access",
620 	.result = REJECT,
621 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
622 },
623 {
624 	"check __sk_buff->hash, offset 0, half store not permitted",
625 	.insns = {
626 	BPF_MOV64_IMM(BPF_REG_0, 0),
627 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
628 		    offsetof(struct __sk_buff, hash)),
629 	BPF_EXIT_INSN(),
630 	},
631 	.errstr = "invalid bpf_context access",
632 	.result = REJECT,
633 },
634 {
635 	"check __sk_buff->tc_index, offset 2, half store not permitted",
636 	.insns = {
637 	BPF_MOV64_IMM(BPF_REG_0, 0),
638 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
639 		    offsetof(struct __sk_buff, tc_index) + 2),
640 	BPF_EXIT_INSN(),
641 	},
642 	.errstr = "invalid bpf_context access",
643 	.result = REJECT,
644 },
645 {
646 	"check skb->hash half load permitted",
647 	.insns = {
648 	BPF_MOV64_IMM(BPF_REG_0, 0),
649 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
650 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
651 		    offsetof(struct __sk_buff, hash)),
652 #else
653 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
654 		    offsetof(struct __sk_buff, hash) + 2),
655 #endif
656 	BPF_EXIT_INSN(),
657 	},
658 	.result = ACCEPT,
659 },
660 {
661 	"check skb->hash half load permitted 2",
662 	.insns = {
663 	BPF_MOV64_IMM(BPF_REG_0, 0),
664 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
665 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
666 		    offsetof(struct __sk_buff, hash) + 2),
667 #else
668 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
669 		    offsetof(struct __sk_buff, hash)),
670 #endif
671 	BPF_EXIT_INSN(),
672 	},
673 	.result = ACCEPT,
674 },
675 {
676 	"check skb->hash half load not permitted, unaligned 1",
677 	.insns = {
678 	BPF_MOV64_IMM(BPF_REG_0, 0),
679 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
680 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
681 		    offsetof(struct __sk_buff, hash) + 1),
682 #else
683 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
684 		    offsetof(struct __sk_buff, hash) + 3),
685 #endif
686 	BPF_EXIT_INSN(),
687 	},
688 	.errstr = "invalid bpf_context access",
689 	.result = REJECT,
690 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
691 },
692 {
693 	"check skb->hash half load not permitted, unaligned 3",
694 	.insns = {
695 	BPF_MOV64_IMM(BPF_REG_0, 0),
696 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
697 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
698 		    offsetof(struct __sk_buff, hash) + 3),
699 #else
700 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
701 		    offsetof(struct __sk_buff, hash) + 1),
702 #endif
703 	BPF_EXIT_INSN(),
704 	},
705 	.errstr = "invalid bpf_context access",
706 	.result = REJECT,
707 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
708 },
709 {
710 	"check cb access: half, wrong type",
711 	.insns = {
712 	BPF_MOV64_IMM(BPF_REG_0, 0),
713 	BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
714 		    offsetof(struct __sk_buff, cb[0])),
715 	BPF_EXIT_INSN(),
716 	},
717 	.errstr = "invalid bpf_context access",
718 	.result = REJECT,
719 	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
720 },
721 {
722 	"check cb access: word",
723 	.insns = {
724 	BPF_MOV64_IMM(BPF_REG_0, 0),
725 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
726 		    offsetof(struct __sk_buff, cb[0])),
727 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
728 		    offsetof(struct __sk_buff, cb[1])),
729 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
730 		    offsetof(struct __sk_buff, cb[2])),
731 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
732 		    offsetof(struct __sk_buff, cb[3])),
733 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
734 		    offsetof(struct __sk_buff, cb[4])),
735 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
736 		    offsetof(struct __sk_buff, cb[0])),
737 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
738 		    offsetof(struct __sk_buff, cb[1])),
739 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
740 		    offsetof(struct __sk_buff, cb[2])),
741 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
742 		    offsetof(struct __sk_buff, cb[3])),
743 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
744 		    offsetof(struct __sk_buff, cb[4])),
745 	BPF_EXIT_INSN(),
746 	},
747 	.result = ACCEPT,
748 },
749 {
750 	"check cb access: word, unaligned 1",
751 	.insns = {
752 	BPF_MOV64_IMM(BPF_REG_0, 0),
753 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
754 		    offsetof(struct __sk_buff, cb[0]) + 2),
755 	BPF_EXIT_INSN(),
756 	},
757 	.errstr = "misaligned context access",
758 	.result = REJECT,
759 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
760 },
761 {
762 	"check cb access: word, unaligned 2",
763 	.insns = {
764 	BPF_MOV64_IMM(BPF_REG_0, 0),
765 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
766 		    offsetof(struct __sk_buff, cb[4]) + 1),
767 	BPF_EXIT_INSN(),
768 	},
769 	.errstr = "misaligned context access",
770 	.result = REJECT,
771 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
772 },
773 {
774 	"check cb access: word, unaligned 3",
775 	.insns = {
776 	BPF_MOV64_IMM(BPF_REG_0, 0),
777 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
778 		    offsetof(struct __sk_buff, cb[4]) + 2),
779 	BPF_EXIT_INSN(),
780 	},
781 	.errstr = "misaligned context access",
782 	.result = REJECT,
783 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
784 },
785 {
786 	"check cb access: word, unaligned 4",
787 	.insns = {
788 	BPF_MOV64_IMM(BPF_REG_0, 0),
789 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
790 		    offsetof(struct __sk_buff, cb[4]) + 3),
791 	BPF_EXIT_INSN(),
792 	},
793 	.errstr = "misaligned context access",
794 	.result = REJECT,
795 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
796 },
797 {
798 	"check cb access: double",
799 	.insns = {
800 	BPF_MOV64_IMM(BPF_REG_0, 0),
801 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
802 		    offsetof(struct __sk_buff, cb[0])),
803 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
804 		    offsetof(struct __sk_buff, cb[2])),
805 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
806 		    offsetof(struct __sk_buff, cb[0])),
807 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
808 		    offsetof(struct __sk_buff, cb[2])),
809 	BPF_EXIT_INSN(),
810 	},
811 	.result = ACCEPT,
812 },
813 {
814 	"check cb access: double, unaligned 1",
815 	.insns = {
816 	BPF_MOV64_IMM(BPF_REG_0, 0),
817 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
818 		    offsetof(struct __sk_buff, cb[1])),
819 	BPF_EXIT_INSN(),
820 	},
821 	.errstr = "misaligned context access",
822 	.result = REJECT,
823 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
824 },
825 {
826 	"check cb access: double, unaligned 2",
827 	.insns = {
828 	BPF_MOV64_IMM(BPF_REG_0, 0),
829 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
830 		    offsetof(struct __sk_buff, cb[3])),
831 	BPF_EXIT_INSN(),
832 	},
833 	.errstr = "misaligned context access",
834 	.result = REJECT,
835 	.flags = F_LOAD_WITH_STRICT_ALIGNMENT,
836 },
837 {
838 	"check cb access: double, oob 1",
839 	.insns = {
840 	BPF_MOV64_IMM(BPF_REG_0, 0),
841 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
842 		    offsetof(struct __sk_buff, cb[4])),
843 	BPF_EXIT_INSN(),
844 	},
845 	.errstr = "invalid bpf_context access",
846 	.result = REJECT,
847 },
848 {
849 	"check cb access: double, oob 2",
850 	.insns = {
851 	BPF_MOV64_IMM(BPF_REG_0, 0),
852 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
853 		    offsetof(struct __sk_buff, cb[4])),
854 	BPF_EXIT_INSN(),
855 	},
856 	.errstr = "invalid bpf_context access",
857 	.result = REJECT,
858 },
859 {
860 	"check __sk_buff->ifindex dw store not permitted",
861 	.insns = {
862 	BPF_MOV64_IMM(BPF_REG_0, 0),
863 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
864 		    offsetof(struct __sk_buff, ifindex)),
865 	BPF_EXIT_INSN(),
866 	},
867 	.errstr = "invalid bpf_context access",
868 	.result = REJECT,
869 },
870 {
871 	"check __sk_buff->ifindex dw load not permitted",
872 	.insns = {
873 	BPF_MOV64_IMM(BPF_REG_0, 0),
874 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
875 		    offsetof(struct __sk_buff, ifindex)),
876 	BPF_EXIT_INSN(),
877 	},
878 	.errstr = "invalid bpf_context access",
879 	.result = REJECT,
880 },
881 {
882 	"check cb access: double, wrong type",
883 	.insns = {
884 	BPF_MOV64_IMM(BPF_REG_0, 0),
885 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
886 		    offsetof(struct __sk_buff, cb[0])),
887 	BPF_EXIT_INSN(),
888 	},
889 	.errstr = "invalid bpf_context access",
890 	.result = REJECT,
891 	.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
892 },
893 {
894 	"check out of range skb->cb access",
895 	.insns = {
896 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
897 		    offsetof(struct __sk_buff, cb[0]) + 256),
898 	BPF_EXIT_INSN(),
899 	},
900 	.errstr = "invalid bpf_context access",
901 	.errstr_unpriv = "",
902 	.result = REJECT,
903 	.prog_type = BPF_PROG_TYPE_SCHED_ACT,
904 },
905 {
906 	"write skb fields from socket prog",
907 	.insns = {
908 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
909 		    offsetof(struct __sk_buff, cb[4])),
910 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
911 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
912 		    offsetof(struct __sk_buff, mark)),
913 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
914 		    offsetof(struct __sk_buff, tc_index)),
915 	BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
916 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
917 		    offsetof(struct __sk_buff, cb[0])),
918 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
919 		    offsetof(struct __sk_buff, cb[2])),
920 	BPF_EXIT_INSN(),
921 	},
922 	.result = ACCEPT,
923 	.errstr_unpriv = "R1 leaks addr",
924 	.result_unpriv = REJECT,
925 },
926 {
927 	"write skb fields from tc_cls_act prog",
928 	.insns = {
929 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
930 		    offsetof(struct __sk_buff, cb[0])),
931 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
932 		    offsetof(struct __sk_buff, mark)),
933 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
934 		    offsetof(struct __sk_buff, tc_index)),
935 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
936 		    offsetof(struct __sk_buff, tc_index)),
937 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
938 		    offsetof(struct __sk_buff, cb[3])),
939 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
940 		    offsetof(struct __sk_buff, tstamp)),
941 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
942 		    offsetof(struct __sk_buff, tstamp)),
943 	BPF_EXIT_INSN(),
944 	},
945 	.errstr_unpriv = "",
946 	.result_unpriv = REJECT,
947 	.result = ACCEPT,
948 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
949 },
950 {
951 	"check skb->data half load not permitted",
952 	.insns = {
953 	BPF_MOV64_IMM(BPF_REG_0, 0),
954 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
955 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
956 		    offsetof(struct __sk_buff, data)),
957 #else
958 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
959 		    offsetof(struct __sk_buff, data) + 2),
960 #endif
961 	BPF_EXIT_INSN(),
962 	},
963 	.result = REJECT,
964 	.errstr = "invalid bpf_context access",
965 },
966 {
967 	"read gso_segs from CGROUP_SKB",
968 	.insns = {
969 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
970 		    offsetof(struct __sk_buff, gso_segs)),
971 	BPF_MOV64_IMM(BPF_REG_0, 0),
972 	BPF_EXIT_INSN(),
973 	},
974 	.result = ACCEPT,
975 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
976 },
977 {
978 	"read gso_segs from CGROUP_SKB",
979 	.insns = {
980 	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
981 		    offsetof(struct __sk_buff, gso_segs)),
982 	BPF_MOV64_IMM(BPF_REG_0, 0),
983 	BPF_EXIT_INSN(),
984 	},
985 	.result = ACCEPT,
986 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
987 },
988 {
989 	"write gso_segs from CGROUP_SKB",
990 	.insns = {
991 	BPF_MOV64_IMM(BPF_REG_0, 0),
992 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
993 		    offsetof(struct __sk_buff, gso_segs)),
994 	BPF_MOV64_IMM(BPF_REG_0, 0),
995 	BPF_EXIT_INSN(),
996 	},
997 	.result = REJECT,
998 	.result_unpriv = REJECT,
999 	.errstr = "invalid bpf_context access off=164 size=4",
1000 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1001 },
1002 {
1003 	"read gso_segs from CLS",
1004 	.insns = {
1005 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1006 		    offsetof(struct __sk_buff, gso_segs)),
1007 	BPF_MOV64_IMM(BPF_REG_0, 0),
1008 	BPF_EXIT_INSN(),
1009 	},
1010 	.result = ACCEPT,
1011 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1012 },
1013 {
1014 	"read gso_size from CGROUP_SKB",
1015 	.insns = {
1016 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1017 		    offsetof(struct __sk_buff, gso_size)),
1018 	BPF_MOV64_IMM(BPF_REG_0, 0),
1019 	BPF_EXIT_INSN(),
1020 	},
1021 	.result = ACCEPT,
1022 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1023 },
1024 {
1025 	"read gso_size from CGROUP_SKB",
1026 	.insns = {
1027 	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1028 		    offsetof(struct __sk_buff, gso_size)),
1029 	BPF_MOV64_IMM(BPF_REG_0, 0),
1030 	BPF_EXIT_INSN(),
1031 	},
1032 	.result = ACCEPT,
1033 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1034 },
1035 {
1036 	"write gso_size from CGROUP_SKB",
1037 	.insns = {
1038 	BPF_MOV64_IMM(BPF_REG_0, 0),
1039 	BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1040 		    offsetof(struct __sk_buff, gso_size)),
1041 	BPF_MOV64_IMM(BPF_REG_0, 0),
1042 	BPF_EXIT_INSN(),
1043 	},
1044 	.result = REJECT,
1045 	.result_unpriv = REJECT,
1046 	.errstr = "invalid bpf_context access off=176 size=4",
1047 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1048 },
1049 {
1050 	"read gso_size from CLS",
1051 	.insns = {
1052 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1053 		    offsetof(struct __sk_buff, gso_size)),
1054 	BPF_MOV64_IMM(BPF_REG_0, 0),
1055 	BPF_EXIT_INSN(),
1056 	},
1057 	.result = ACCEPT,
1058 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1059 },
1060 {
1061 	"padding after gso_size is not accessible",
1062 	.insns = {
1063 	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1064 		    offsetofend(struct __sk_buff, gso_size)),
1065 	BPF_MOV64_IMM(BPF_REG_0, 0),
1066 	BPF_EXIT_INSN(),
1067 	},
1068 	.result = REJECT,
1069 	.result_unpriv = REJECT,
1070 	.errstr = "invalid bpf_context access off=180 size=4",
1071 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1072 },
1073 {
1074 	"read hwtstamp from CGROUP_SKB",
1075 	.insns = {
1076 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1077 		    offsetof(struct __sk_buff, hwtstamp)),
1078 	BPF_MOV64_IMM(BPF_REG_0, 0),
1079 	BPF_EXIT_INSN(),
1080 	},
1081 	.result = ACCEPT,
1082 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1083 },
1084 {
1085 	"read hwtstamp from CGROUP_SKB",
1086 	.insns = {
1087 	BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
1088 		    offsetof(struct __sk_buff, hwtstamp)),
1089 	BPF_MOV64_IMM(BPF_REG_0, 0),
1090 	BPF_EXIT_INSN(),
1091 	},
1092 	.result = ACCEPT,
1093 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1094 },
1095 {
1096 	"write hwtstamp from CGROUP_SKB",
1097 	.insns = {
1098 	BPF_MOV64_IMM(BPF_REG_0, 0),
1099 	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
1100 		    offsetof(struct __sk_buff, hwtstamp)),
1101 	BPF_MOV64_IMM(BPF_REG_0, 0),
1102 	BPF_EXIT_INSN(),
1103 	},
1104 	.result = REJECT,
1105 	.result_unpriv = REJECT,
1106 	.errstr = "invalid bpf_context access off=184 size=8",
1107 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
1108 },
1109 {
1110 	"read hwtstamp from CLS",
1111 	.insns = {
1112 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
1113 		    offsetof(struct __sk_buff, hwtstamp)),
1114 	BPF_MOV64_IMM(BPF_REG_0, 0),
1115 	BPF_EXIT_INSN(),
1116 	},
1117 	.result = ACCEPT,
1118 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1119 },
1120 {
1121 	"check wire_len is not readable by sockets",
1122 	.insns = {
1123 		BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1124 			    offsetof(struct __sk_buff, wire_len)),
1125 		BPF_EXIT_INSN(),
1126 	},
1127 	.errstr = "invalid bpf_context access",
1128 	.result = REJECT,
1129 },
1130 {
1131 	"check wire_len is readable by tc classifier",
1132 	.insns = {
1133 		BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1134 			    offsetof(struct __sk_buff, wire_len)),
1135 		BPF_EXIT_INSN(),
1136 	},
1137 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1138 	.result = ACCEPT,
1139 },
1140 {
1141 	"check wire_len is not writable by tc classifier",
1142 	.insns = {
1143 		BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1144 			    offsetof(struct __sk_buff, wire_len)),
1145 		BPF_EXIT_INSN(),
1146 	},
1147 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
1148 	.errstr = "invalid bpf_context access",
1149 	.errstr_unpriv = "R1 leaks addr",
1150 	.result = REJECT,
1151 },
1152 {
1153        "pkt > pkt_end taken check",
1154        .insns = {
1155        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,                //  0. r2 = *(u32 *)(r1 + data_end)
1156                    offsetof(struct __sk_buff, data_end)),
1157        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,                //  1. r4 = *(u32 *)(r1 + data)
1158                    offsetof(struct __sk_buff, data)),
1159        BPF_MOV64_REG(BPF_REG_3, BPF_REG_4),                    //  2. r3 = r4
1160        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 42),                  //  3. r3 += 42
1161        BPF_MOV64_IMM(BPF_REG_1, 0),                            //  4. r1 = 0
1162        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 2),          //  5. if r3 > r2 goto 8
1163        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 14),                  //  6. r4 += 14
1164        BPF_MOV64_REG(BPF_REG_1, BPF_REG_4),                    //  7. r1 = r4
1165        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 1),          //  8. if r3 > r2 goto 10
1166        BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_1, 9),            //  9. r2 = *(u8 *)(r1 + 9)
1167        BPF_MOV64_IMM(BPF_REG_0, 0),                            // 10. r0 = 0
1168        BPF_EXIT_INSN(),                                        // 11. exit
1169        },
1170        .result = ACCEPT,
1171        .prog_type = BPF_PROG_TYPE_SK_SKB,
1172 },
1173 {
1174        "pkt_end < pkt taken check",
1175        .insns = {
1176        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,                //  0. r2 = *(u32 *)(r1 + data_end)
1177                    offsetof(struct __sk_buff, data_end)),
1178        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,                //  1. r4 = *(u32 *)(r1 + data)
1179                    offsetof(struct __sk_buff, data)),
1180        BPF_MOV64_REG(BPF_REG_3, BPF_REG_4),                    //  2. r3 = r4
1181        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 42),                  //  3. r3 += 42
1182        BPF_MOV64_IMM(BPF_REG_1, 0),                            //  4. r1 = 0
1183        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 2),          //  5. if r3 > r2 goto 8
1184        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 14),                  //  6. r4 += 14
1185        BPF_MOV64_REG(BPF_REG_1, BPF_REG_4),                    //  7. r1 = r4
1186        BPF_JMP_REG(BPF_JLT, BPF_REG_2, BPF_REG_3, 1),          //  8. if r2 < r3 goto 10
1187        BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_1, 9),            //  9. r2 = *(u8 *)(r1 + 9)
1188        BPF_MOV64_IMM(BPF_REG_0, 0),                            // 10. r0 = 0
1189        BPF_EXIT_INSN(),                                        // 11. exit
1190        },
1191        .result = ACCEPT,
1192        .prog_type = BPF_PROG_TYPE_SK_SKB,
1193 },
1194