1 { 2 "invalid and of negative number", 3 .insns = { 4 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 7 BPF_LD_MAP_FD(BPF_REG_1, 0), 8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), 10 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0), 11 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4), 12 BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 13 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 14 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 15 BPF_EXIT_INSN(), 16 }, 17 .fixup_map_hash_48b = { 3 }, 18 .errstr = "R0 max value is outside of the allowed memory range", 19 .result = REJECT, 20 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 21 }, 22 { 23 "invalid range check", 24 .insns = { 25 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 26 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 27 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 28 BPF_LD_MAP_FD(BPF_REG_1, 0), 29 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 30 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12), 31 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 32 BPF_MOV64_IMM(BPF_REG_9, 1), 33 BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2), 34 BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1), 35 BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1), 36 BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1), 37 BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1), 38 BPF_MOV32_IMM(BPF_REG_3, 1), 39 BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9), 40 BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000), 41 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3), 42 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0), 43 BPF_MOV64_REG(BPF_REG_0, 0), 44 BPF_EXIT_INSN(), 45 }, 46 .fixup_map_hash_48b = { 3 }, 47 .errstr = "R0 max value is outside of the allowed memory range", 48 .result = REJECT, 49 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 50 }, 51 { 52 "check known subreg with unknown reg", 53 .insns = { 54 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), 55 BPF_ALU64_IMM(BPF_LSH, BPF_REG_0, 32), 56 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), 57 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xFFFF1234), 58 /* Upper bits are unknown but AND above masks out 1 zero'ing lower bits */ 59 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 1, 1), 60 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 512), 61 BPF_MOV64_IMM(BPF_REG_0, 0), 62 BPF_EXIT_INSN(), 63 }, 64 .errstr_unpriv = "R1 !read_ok", 65 .result_unpriv = REJECT, 66 .result = ACCEPT, 67 .retval = 0 68 }, 69