1 { 2 "XDP pkt read, pkt_end mangling, bad access 1", 3 .insns = { 4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 5 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 6 offsetof(struct xdp_md, data_end)), 7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 9 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8), 10 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 11 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 12 BPF_MOV64_IMM(BPF_REG_0, 0), 13 BPF_EXIT_INSN(), 14 }, 15 .errstr = "R3 pointer arithmetic on pkt_end", 16 .result = REJECT, 17 .prog_type = BPF_PROG_TYPE_XDP, 18 }, 19 { 20 "XDP pkt read, pkt_end mangling, bad access 2", 21 .insns = { 22 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 23 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 24 offsetof(struct xdp_md, data_end)), 25 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 27 BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8), 28 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 29 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 30 BPF_MOV64_IMM(BPF_REG_0, 0), 31 BPF_EXIT_INSN(), 32 }, 33 .errstr = "R3 pointer arithmetic on pkt_end", 34 .result = REJECT, 35 .prog_type = BPF_PROG_TYPE_XDP, 36 }, 37 { 38 "XDP pkt read, pkt_data' > pkt_end, corner case, good access", 39 .insns = { 40 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 41 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 42 offsetof(struct xdp_md, data_end)), 43 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 44 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 45 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 46 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 47 BPF_MOV64_IMM(BPF_REG_0, 0), 48 BPF_EXIT_INSN(), 49 }, 50 .result = ACCEPT, 51 .prog_type = BPF_PROG_TYPE_XDP, 52 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 53 }, 54 { 55 "XDP pkt read, pkt_data' > pkt_end, bad access 1", 56 .insns = { 57 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 58 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 59 offsetof(struct xdp_md, data_end)), 60 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 62 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 63 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 64 BPF_MOV64_IMM(BPF_REG_0, 0), 65 BPF_EXIT_INSN(), 66 }, 67 .errstr = "R1 offset is outside of the packet", 68 .result = REJECT, 69 .prog_type = BPF_PROG_TYPE_XDP, 70 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 71 }, 72 { 73 "XDP pkt read, pkt_data' > pkt_end, bad access 2", 74 .insns = { 75 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 76 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 77 offsetof(struct xdp_md, data_end)), 78 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 79 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 80 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0), 81 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 82 BPF_MOV64_IMM(BPF_REG_0, 0), 83 BPF_EXIT_INSN(), 84 }, 85 .errstr = "R1 offset is outside of the packet", 86 .result = REJECT, 87 .prog_type = BPF_PROG_TYPE_XDP, 88 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 89 }, 90 { 91 "XDP pkt read, pkt_data' > pkt_end, corner case +1, good access", 92 .insns = { 93 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 94 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 95 offsetof(struct xdp_md, data_end)), 96 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 97 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 98 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 99 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 100 BPF_MOV64_IMM(BPF_REG_0, 0), 101 BPF_EXIT_INSN(), 102 }, 103 .result = ACCEPT, 104 .prog_type = BPF_PROG_TYPE_XDP, 105 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 106 }, 107 { 108 "XDP pkt read, pkt_data' > pkt_end, corner case -1, bad access", 109 .insns = { 110 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 111 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 112 offsetof(struct xdp_md, data_end)), 113 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 114 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 115 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 116 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 117 BPF_MOV64_IMM(BPF_REG_0, 0), 118 BPF_EXIT_INSN(), 119 }, 120 .errstr = "R1 offset is outside of the packet", 121 .result = REJECT, 122 .prog_type = BPF_PROG_TYPE_XDP, 123 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 124 }, 125 { 126 "XDP pkt read, pkt_end > pkt_data', good access", 127 .insns = { 128 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 129 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 130 offsetof(struct xdp_md, data_end)), 131 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 132 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 133 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 134 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 135 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 136 BPF_MOV64_IMM(BPF_REG_0, 0), 137 BPF_EXIT_INSN(), 138 }, 139 .result = ACCEPT, 140 .prog_type = BPF_PROG_TYPE_XDP, 141 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 142 }, 143 { 144 "XDP pkt read, pkt_end > pkt_data', corner case -1, bad access", 145 .insns = { 146 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 147 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 148 offsetof(struct xdp_md, data_end)), 149 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 150 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 151 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 152 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 153 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 154 BPF_MOV64_IMM(BPF_REG_0, 0), 155 BPF_EXIT_INSN(), 156 }, 157 .errstr = "R1 offset is outside of the packet", 158 .result = REJECT, 159 .prog_type = BPF_PROG_TYPE_XDP, 160 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 161 }, 162 { 163 "XDP pkt read, pkt_end > pkt_data', bad access 2", 164 .insns = { 165 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 166 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 167 offsetof(struct xdp_md, data_end)), 168 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 169 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 170 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 171 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 172 BPF_MOV64_IMM(BPF_REG_0, 0), 173 BPF_EXIT_INSN(), 174 }, 175 .errstr = "R1 offset is outside of the packet", 176 .result = REJECT, 177 .prog_type = BPF_PROG_TYPE_XDP, 178 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 179 }, 180 { 181 "XDP pkt read, pkt_end > pkt_data', corner case, good access", 182 .insns = { 183 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 184 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 185 offsetof(struct xdp_md, data_end)), 186 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 187 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 188 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 189 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 190 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 191 BPF_MOV64_IMM(BPF_REG_0, 0), 192 BPF_EXIT_INSN(), 193 }, 194 .result = ACCEPT, 195 .prog_type = BPF_PROG_TYPE_XDP, 196 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 197 }, 198 { 199 "XDP pkt read, pkt_end > pkt_data', corner case +1, good access", 200 .insns = { 201 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 202 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 203 offsetof(struct xdp_md, data_end)), 204 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 205 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 206 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 207 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 208 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 209 BPF_MOV64_IMM(BPF_REG_0, 0), 210 BPF_EXIT_INSN(), 211 }, 212 .result = ACCEPT, 213 .prog_type = BPF_PROG_TYPE_XDP, 214 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 215 }, 216 { 217 "XDP pkt read, pkt_data' < pkt_end, good access", 218 .insns = { 219 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 220 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 221 offsetof(struct xdp_md, data_end)), 222 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 223 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 224 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 225 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 226 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 227 BPF_MOV64_IMM(BPF_REG_0, 0), 228 BPF_EXIT_INSN(), 229 }, 230 .result = ACCEPT, 231 .prog_type = BPF_PROG_TYPE_XDP, 232 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 233 }, 234 { 235 "XDP pkt read, pkt_data' < pkt_end, corner case -1, bad access", 236 .insns = { 237 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 238 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 239 offsetof(struct xdp_md, data_end)), 240 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 241 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 242 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 243 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 244 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 245 BPF_MOV64_IMM(BPF_REG_0, 0), 246 BPF_EXIT_INSN(), 247 }, 248 .errstr = "R1 offset is outside of the packet", 249 .result = REJECT, 250 .prog_type = BPF_PROG_TYPE_XDP, 251 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 252 }, 253 { 254 "XDP pkt read, pkt_data' < pkt_end, bad access 2", 255 .insns = { 256 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 257 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 258 offsetof(struct xdp_md, data_end)), 259 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 261 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 262 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 263 BPF_MOV64_IMM(BPF_REG_0, 0), 264 BPF_EXIT_INSN(), 265 }, 266 .errstr = "R1 offset is outside of the packet", 267 .result = REJECT, 268 .prog_type = BPF_PROG_TYPE_XDP, 269 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 270 }, 271 { 272 "XDP pkt read, pkt_data' < pkt_end, corner case, good access", 273 .insns = { 274 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 275 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 276 offsetof(struct xdp_md, data_end)), 277 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 278 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 279 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 280 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 281 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 282 BPF_MOV64_IMM(BPF_REG_0, 0), 283 BPF_EXIT_INSN(), 284 }, 285 .result = ACCEPT, 286 .prog_type = BPF_PROG_TYPE_XDP, 287 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 288 }, 289 { 290 "XDP pkt read, pkt_data' < pkt_end, corner case +1, good access", 291 .insns = { 292 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 293 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 294 offsetof(struct xdp_md, data_end)), 295 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 296 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 297 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 298 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 299 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 300 BPF_MOV64_IMM(BPF_REG_0, 0), 301 BPF_EXIT_INSN(), 302 }, 303 .result = ACCEPT, 304 .prog_type = BPF_PROG_TYPE_XDP, 305 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 306 }, 307 { 308 "XDP pkt read, pkt_end < pkt_data', corner case, good access", 309 .insns = { 310 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 311 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 312 offsetof(struct xdp_md, data_end)), 313 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 314 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 315 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 316 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 317 BPF_MOV64_IMM(BPF_REG_0, 0), 318 BPF_EXIT_INSN(), 319 }, 320 .result = ACCEPT, 321 .prog_type = BPF_PROG_TYPE_XDP, 322 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 323 }, 324 { 325 "XDP pkt read, pkt_end < pkt_data', bad access 1", 326 .insns = { 327 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 328 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 329 offsetof(struct xdp_md, data_end)), 330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 331 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 332 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 333 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 334 BPF_MOV64_IMM(BPF_REG_0, 0), 335 BPF_EXIT_INSN(), 336 }, 337 .errstr = "R1 offset is outside of the packet", 338 .result = REJECT, 339 .prog_type = BPF_PROG_TYPE_XDP, 340 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 341 }, 342 { 343 "XDP pkt read, pkt_end < pkt_data', bad access 2", 344 .insns = { 345 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 346 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 347 offsetof(struct xdp_md, data_end)), 348 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 349 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 350 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0), 351 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 352 BPF_MOV64_IMM(BPF_REG_0, 0), 353 BPF_EXIT_INSN(), 354 }, 355 .errstr = "R1 offset is outside of the packet", 356 .result = REJECT, 357 .prog_type = BPF_PROG_TYPE_XDP, 358 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 359 }, 360 { 361 "XDP pkt read, pkt_end < pkt_data', corner case +1, good access", 362 .insns = { 363 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 364 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 365 offsetof(struct xdp_md, data_end)), 366 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 367 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 368 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 369 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 370 BPF_MOV64_IMM(BPF_REG_0, 0), 371 BPF_EXIT_INSN(), 372 }, 373 .result = ACCEPT, 374 .prog_type = BPF_PROG_TYPE_XDP, 375 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 376 }, 377 { 378 "XDP pkt read, pkt_end < pkt_data', corner case -1, bad access", 379 .insns = { 380 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 381 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 382 offsetof(struct xdp_md, data_end)), 383 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 384 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 385 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 386 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 387 BPF_MOV64_IMM(BPF_REG_0, 0), 388 BPF_EXIT_INSN(), 389 }, 390 .errstr = "R1 offset is outside of the packet", 391 .result = REJECT, 392 .prog_type = BPF_PROG_TYPE_XDP, 393 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 394 }, 395 { 396 "XDP pkt read, pkt_data' >= pkt_end, good access", 397 .insns = { 398 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 399 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 400 offsetof(struct xdp_md, data_end)), 401 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 402 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 403 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 404 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 405 BPF_MOV64_IMM(BPF_REG_0, 0), 406 BPF_EXIT_INSN(), 407 }, 408 .result = ACCEPT, 409 .prog_type = BPF_PROG_TYPE_XDP, 410 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 411 }, 412 { 413 "XDP pkt read, pkt_data' >= pkt_end, corner case -1, bad access", 414 .insns = { 415 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 416 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 417 offsetof(struct xdp_md, data_end)), 418 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 419 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 420 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 421 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 422 BPF_MOV64_IMM(BPF_REG_0, 0), 423 BPF_EXIT_INSN(), 424 }, 425 .errstr = "R1 offset is outside of the packet", 426 .result = REJECT, 427 .prog_type = BPF_PROG_TYPE_XDP, 428 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 429 }, 430 { 431 "XDP pkt read, pkt_data' >= pkt_end, bad access 2", 432 .insns = { 433 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 434 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 435 offsetof(struct xdp_md, data_end)), 436 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 437 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 438 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0), 439 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 440 BPF_MOV64_IMM(BPF_REG_0, 0), 441 BPF_EXIT_INSN(), 442 }, 443 .errstr = "R1 offset is outside of the packet", 444 .result = REJECT, 445 .prog_type = BPF_PROG_TYPE_XDP, 446 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 447 }, 448 { 449 "XDP pkt read, pkt_data' >= pkt_end, corner case, good access", 450 .insns = { 451 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 452 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 453 offsetof(struct xdp_md, data_end)), 454 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 455 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 456 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 457 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 458 BPF_MOV64_IMM(BPF_REG_0, 0), 459 BPF_EXIT_INSN(), 460 }, 461 .result = ACCEPT, 462 .prog_type = BPF_PROG_TYPE_XDP, 463 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 464 }, 465 { 466 "XDP pkt read, pkt_data' >= pkt_end, corner case +1, good access", 467 .insns = { 468 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 469 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 470 offsetof(struct xdp_md, data_end)), 471 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 472 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 473 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 474 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 475 BPF_MOV64_IMM(BPF_REG_0, 0), 476 BPF_EXIT_INSN(), 477 }, 478 .result = ACCEPT, 479 .prog_type = BPF_PROG_TYPE_XDP, 480 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 481 }, 482 { 483 "XDP pkt read, pkt_end >= pkt_data', corner case, good access", 484 .insns = { 485 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 486 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 487 offsetof(struct xdp_md, data_end)), 488 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 489 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 490 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 491 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 492 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 493 BPF_MOV64_IMM(BPF_REG_0, 0), 494 BPF_EXIT_INSN(), 495 }, 496 .result = ACCEPT, 497 .prog_type = BPF_PROG_TYPE_XDP, 498 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 499 }, 500 { 501 "XDP pkt read, pkt_end >= pkt_data', bad access 1", 502 .insns = { 503 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 504 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 505 offsetof(struct xdp_md, data_end)), 506 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 507 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 508 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 509 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 510 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 511 BPF_MOV64_IMM(BPF_REG_0, 0), 512 BPF_EXIT_INSN(), 513 }, 514 .errstr = "R1 offset is outside of the packet", 515 .result = REJECT, 516 .prog_type = BPF_PROG_TYPE_XDP, 517 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 518 }, 519 { 520 "XDP pkt read, pkt_end >= pkt_data', bad access 2", 521 .insns = { 522 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 523 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 524 offsetof(struct xdp_md, data_end)), 525 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 526 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 527 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 528 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 529 BPF_MOV64_IMM(BPF_REG_0, 0), 530 BPF_EXIT_INSN(), 531 }, 532 .errstr = "R1 offset is outside of the packet", 533 .result = REJECT, 534 .prog_type = BPF_PROG_TYPE_XDP, 535 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 536 }, 537 { 538 "XDP pkt read, pkt_end >= pkt_data', corner case +1, good access", 539 .insns = { 540 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 541 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 542 offsetof(struct xdp_md, data_end)), 543 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 544 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 545 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 546 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 547 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 548 BPF_MOV64_IMM(BPF_REG_0, 0), 549 BPF_EXIT_INSN(), 550 }, 551 .result = ACCEPT, 552 .prog_type = BPF_PROG_TYPE_XDP, 553 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 554 }, 555 { 556 "XDP pkt read, pkt_end >= pkt_data', corner case -1, bad access", 557 .insns = { 558 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 559 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 560 offsetof(struct xdp_md, data_end)), 561 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 562 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 563 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 564 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 565 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 566 BPF_MOV64_IMM(BPF_REG_0, 0), 567 BPF_EXIT_INSN(), 568 }, 569 .errstr = "R1 offset is outside of the packet", 570 .result = REJECT, 571 .prog_type = BPF_PROG_TYPE_XDP, 572 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 573 }, 574 { 575 "XDP pkt read, pkt_data' <= pkt_end, corner case, good access", 576 .insns = { 577 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 578 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 579 offsetof(struct xdp_md, data_end)), 580 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 581 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 582 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 583 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 584 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 585 BPF_MOV64_IMM(BPF_REG_0, 0), 586 BPF_EXIT_INSN(), 587 }, 588 .result = ACCEPT, 589 .prog_type = BPF_PROG_TYPE_XDP, 590 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 591 }, 592 { 593 "XDP pkt read, pkt_data' <= pkt_end, bad access 1", 594 .insns = { 595 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 596 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 597 offsetof(struct xdp_md, data_end)), 598 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 599 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 600 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 601 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 602 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 603 BPF_MOV64_IMM(BPF_REG_0, 0), 604 BPF_EXIT_INSN(), 605 }, 606 .errstr = "R1 offset is outside of the packet", 607 .result = REJECT, 608 .prog_type = BPF_PROG_TYPE_XDP, 609 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 610 }, 611 { 612 "XDP pkt read, pkt_data' <= pkt_end, bad access 2", 613 .insns = { 614 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 615 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 616 offsetof(struct xdp_md, data_end)), 617 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 618 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 619 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 620 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 621 BPF_MOV64_IMM(BPF_REG_0, 0), 622 BPF_EXIT_INSN(), 623 }, 624 .errstr = "R1 offset is outside of the packet", 625 .result = REJECT, 626 .prog_type = BPF_PROG_TYPE_XDP, 627 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 628 }, 629 { 630 "XDP pkt read, pkt_data' <= pkt_end, corner case +1, good access", 631 .insns = { 632 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 633 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 634 offsetof(struct xdp_md, data_end)), 635 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 636 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 637 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 638 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 639 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 640 BPF_MOV64_IMM(BPF_REG_0, 0), 641 BPF_EXIT_INSN(), 642 }, 643 .result = ACCEPT, 644 .prog_type = BPF_PROG_TYPE_XDP, 645 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 646 }, 647 { 648 "XDP pkt read, pkt_data' <= pkt_end, corner case -1, bad access", 649 .insns = { 650 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 651 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 652 offsetof(struct xdp_md, data_end)), 653 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 654 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 655 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 656 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 657 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 658 BPF_MOV64_IMM(BPF_REG_0, 0), 659 BPF_EXIT_INSN(), 660 }, 661 .errstr = "R1 offset is outside of the packet", 662 .result = REJECT, 663 .prog_type = BPF_PROG_TYPE_XDP, 664 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 665 }, 666 { 667 "XDP pkt read, pkt_end <= pkt_data', good access", 668 .insns = { 669 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 670 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 671 offsetof(struct xdp_md, data_end)), 672 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 673 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 674 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 675 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 676 BPF_MOV64_IMM(BPF_REG_0, 0), 677 BPF_EXIT_INSN(), 678 }, 679 .result = ACCEPT, 680 .prog_type = BPF_PROG_TYPE_XDP, 681 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 682 }, 683 { 684 "XDP pkt read, pkt_end <= pkt_data', corner case -1, bad access", 685 .insns = { 686 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 687 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 688 offsetof(struct xdp_md, data_end)), 689 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 690 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 691 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 692 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 693 BPF_MOV64_IMM(BPF_REG_0, 0), 694 BPF_EXIT_INSN(), 695 }, 696 .errstr = "R1 offset is outside of the packet", 697 .result = REJECT, 698 .prog_type = BPF_PROG_TYPE_XDP, 699 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 700 }, 701 { 702 "XDP pkt read, pkt_end <= pkt_data', bad access 2", 703 .insns = { 704 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 705 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 706 offsetof(struct xdp_md, data_end)), 707 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 708 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 709 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0), 710 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 711 BPF_MOV64_IMM(BPF_REG_0, 0), 712 BPF_EXIT_INSN(), 713 }, 714 .errstr = "R1 offset is outside of the packet", 715 .result = REJECT, 716 .prog_type = BPF_PROG_TYPE_XDP, 717 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 718 }, 719 { 720 "XDP pkt read, pkt_end <= pkt_data', corner case, good access", 721 .insns = { 722 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 723 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 724 offsetof(struct xdp_md, data_end)), 725 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 726 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 727 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 728 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 729 BPF_MOV64_IMM(BPF_REG_0, 0), 730 BPF_EXIT_INSN(), 731 }, 732 .result = ACCEPT, 733 .prog_type = BPF_PROG_TYPE_XDP, 734 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 735 }, 736 { 737 "XDP pkt read, pkt_end <= pkt_data', corner case +1, good access", 738 .insns = { 739 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 740 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 741 offsetof(struct xdp_md, data_end)), 742 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 743 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 744 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 745 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 746 BPF_MOV64_IMM(BPF_REG_0, 0), 747 BPF_EXIT_INSN(), 748 }, 749 .result = ACCEPT, 750 .prog_type = BPF_PROG_TYPE_XDP, 751 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 752 }, 753 { 754 "XDP pkt read, pkt_meta' > pkt_data, corner case, good access", 755 .insns = { 756 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 757 offsetof(struct xdp_md, data_meta)), 758 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 759 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 760 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 761 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 762 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 763 BPF_MOV64_IMM(BPF_REG_0, 0), 764 BPF_EXIT_INSN(), 765 }, 766 .result = ACCEPT, 767 .prog_type = BPF_PROG_TYPE_XDP, 768 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 769 }, 770 { 771 "XDP pkt read, pkt_meta' > pkt_data, bad access 1", 772 .insns = { 773 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 774 offsetof(struct xdp_md, data_meta)), 775 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 776 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 777 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 778 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 779 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 780 BPF_MOV64_IMM(BPF_REG_0, 0), 781 BPF_EXIT_INSN(), 782 }, 783 .errstr = "R1 offset is outside of the packet", 784 .result = REJECT, 785 .prog_type = BPF_PROG_TYPE_XDP, 786 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 787 }, 788 { 789 "XDP pkt read, pkt_meta' > pkt_data, bad access 2", 790 .insns = { 791 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 792 offsetof(struct xdp_md, data_meta)), 793 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 794 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 795 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 796 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0), 797 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 798 BPF_MOV64_IMM(BPF_REG_0, 0), 799 BPF_EXIT_INSN(), 800 }, 801 .errstr = "R1 offset is outside of the packet", 802 .result = REJECT, 803 .prog_type = BPF_PROG_TYPE_XDP, 804 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 805 }, 806 { 807 "XDP pkt read, pkt_meta' > pkt_data, corner case +1, good access", 808 .insns = { 809 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 810 offsetof(struct xdp_md, data_meta)), 811 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 812 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 813 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 814 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 815 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 816 BPF_MOV64_IMM(BPF_REG_0, 0), 817 BPF_EXIT_INSN(), 818 }, 819 .result = ACCEPT, 820 .prog_type = BPF_PROG_TYPE_XDP, 821 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 822 }, 823 { 824 "XDP pkt read, pkt_meta' > pkt_data, corner case -1, bad access", 825 .insns = { 826 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 827 offsetof(struct xdp_md, data_meta)), 828 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 829 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 830 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 831 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 832 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 833 BPF_MOV64_IMM(BPF_REG_0, 0), 834 BPF_EXIT_INSN(), 835 }, 836 .errstr = "R1 offset is outside of the packet", 837 .result = REJECT, 838 .prog_type = BPF_PROG_TYPE_XDP, 839 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 840 }, 841 { 842 "XDP pkt read, pkt_data > pkt_meta', good access", 843 .insns = { 844 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 845 offsetof(struct xdp_md, data_meta)), 846 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 847 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 848 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 849 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 850 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 851 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 852 BPF_MOV64_IMM(BPF_REG_0, 0), 853 BPF_EXIT_INSN(), 854 }, 855 .result = ACCEPT, 856 .prog_type = BPF_PROG_TYPE_XDP, 857 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 858 }, 859 { 860 "XDP pkt read, pkt_data > pkt_meta', corner case -1, bad access", 861 .insns = { 862 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 863 offsetof(struct xdp_md, data_meta)), 864 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 865 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 866 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 867 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 868 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 869 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 870 BPF_MOV64_IMM(BPF_REG_0, 0), 871 BPF_EXIT_INSN(), 872 }, 873 .errstr = "R1 offset is outside of the packet", 874 .result = REJECT, 875 .prog_type = BPF_PROG_TYPE_XDP, 876 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 877 }, 878 { 879 "XDP pkt read, pkt_data > pkt_meta', bad access 2", 880 .insns = { 881 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 882 offsetof(struct xdp_md, data_meta)), 883 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 884 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 885 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 886 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 887 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 888 BPF_MOV64_IMM(BPF_REG_0, 0), 889 BPF_EXIT_INSN(), 890 }, 891 .errstr = "R1 offset is outside of the packet", 892 .result = REJECT, 893 .prog_type = BPF_PROG_TYPE_XDP, 894 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 895 }, 896 { 897 "XDP pkt read, pkt_data > pkt_meta', corner case, good access", 898 .insns = { 899 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 900 offsetof(struct xdp_md, data_meta)), 901 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 902 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 903 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 904 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 905 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 906 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 907 BPF_MOV64_IMM(BPF_REG_0, 0), 908 BPF_EXIT_INSN(), 909 }, 910 .result = ACCEPT, 911 .prog_type = BPF_PROG_TYPE_XDP, 912 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 913 }, 914 { 915 "XDP pkt read, pkt_data > pkt_meta', corner case +1, good access", 916 .insns = { 917 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 918 offsetof(struct xdp_md, data_meta)), 919 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 920 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 921 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 922 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), 923 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 924 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 925 BPF_MOV64_IMM(BPF_REG_0, 0), 926 BPF_EXIT_INSN(), 927 }, 928 .result = ACCEPT, 929 .prog_type = BPF_PROG_TYPE_XDP, 930 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 931 }, 932 { 933 "XDP pkt read, pkt_meta' < pkt_data, good access", 934 .insns = { 935 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 936 offsetof(struct xdp_md, data_meta)), 937 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 938 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 939 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 940 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 941 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 942 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 943 BPF_MOV64_IMM(BPF_REG_0, 0), 944 BPF_EXIT_INSN(), 945 }, 946 .result = ACCEPT, 947 .prog_type = BPF_PROG_TYPE_XDP, 948 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 949 }, 950 { 951 "XDP pkt read, pkt_meta' < pkt_data, corner case -1, bad access", 952 .insns = { 953 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 954 offsetof(struct xdp_md, data_meta)), 955 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 956 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 957 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 958 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 959 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 960 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 961 BPF_MOV64_IMM(BPF_REG_0, 0), 962 BPF_EXIT_INSN(), 963 }, 964 .errstr = "R1 offset is outside of the packet", 965 .result = REJECT, 966 .prog_type = BPF_PROG_TYPE_XDP, 967 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 968 }, 969 { 970 "XDP pkt read, pkt_meta' < pkt_data, bad access 2", 971 .insns = { 972 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 973 offsetof(struct xdp_md, data_meta)), 974 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 975 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 976 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 977 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 978 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 979 BPF_MOV64_IMM(BPF_REG_0, 0), 980 BPF_EXIT_INSN(), 981 }, 982 .errstr = "R1 offset is outside of the packet", 983 .result = REJECT, 984 .prog_type = BPF_PROG_TYPE_XDP, 985 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 986 }, 987 { 988 "XDP pkt read, pkt_meta' < pkt_data, corner case, good access", 989 .insns = { 990 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 991 offsetof(struct xdp_md, data_meta)), 992 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 993 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 994 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 995 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 996 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 997 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 998 BPF_MOV64_IMM(BPF_REG_0, 0), 999 BPF_EXIT_INSN(), 1000 }, 1001 .result = ACCEPT, 1002 .prog_type = BPF_PROG_TYPE_XDP, 1003 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1004 }, 1005 { 1006 "XDP pkt read, pkt_meta' < pkt_data, corner case +1, good access", 1007 .insns = { 1008 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1009 offsetof(struct xdp_md, data_meta)), 1010 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1011 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1012 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1013 BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), 1014 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1015 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1016 BPF_MOV64_IMM(BPF_REG_0, 0), 1017 BPF_EXIT_INSN(), 1018 }, 1019 .result = ACCEPT, 1020 .prog_type = BPF_PROG_TYPE_XDP, 1021 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1022 }, 1023 { 1024 "XDP pkt read, pkt_data < pkt_meta', corner case, good access", 1025 .insns = { 1026 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1027 offsetof(struct xdp_md, data_meta)), 1028 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1029 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1030 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1031 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 1032 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1033 BPF_MOV64_IMM(BPF_REG_0, 0), 1034 BPF_EXIT_INSN(), 1035 }, 1036 .result = ACCEPT, 1037 .prog_type = BPF_PROG_TYPE_XDP, 1038 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1039 }, 1040 { 1041 "XDP pkt read, pkt_data < pkt_meta', bad access 1", 1042 .insns = { 1043 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1044 offsetof(struct xdp_md, data_meta)), 1045 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1046 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1047 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1048 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 1049 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 1050 BPF_MOV64_IMM(BPF_REG_0, 0), 1051 BPF_EXIT_INSN(), 1052 }, 1053 .errstr = "R1 offset is outside of the packet", 1054 .result = REJECT, 1055 .prog_type = BPF_PROG_TYPE_XDP, 1056 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1057 }, 1058 { 1059 "XDP pkt read, pkt_data < pkt_meta', bad access 2", 1060 .insns = { 1061 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1062 offsetof(struct xdp_md, data_meta)), 1063 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1064 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1065 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1066 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0), 1067 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1068 BPF_MOV64_IMM(BPF_REG_0, 0), 1069 BPF_EXIT_INSN(), 1070 }, 1071 .errstr = "R1 offset is outside of the packet", 1072 .result = REJECT, 1073 .prog_type = BPF_PROG_TYPE_XDP, 1074 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1075 }, 1076 { 1077 "XDP pkt read, pkt_data < pkt_meta', corner case +1, good access", 1078 .insns = { 1079 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1080 offsetof(struct xdp_md, data_meta)), 1081 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1082 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1083 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 1084 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 1085 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 1086 BPF_MOV64_IMM(BPF_REG_0, 0), 1087 BPF_EXIT_INSN(), 1088 }, 1089 .result = ACCEPT, 1090 .prog_type = BPF_PROG_TYPE_XDP, 1091 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1092 }, 1093 { 1094 "XDP pkt read, pkt_data < pkt_meta', corner case -1, bad access", 1095 .insns = { 1096 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1097 offsetof(struct xdp_md, data_meta)), 1098 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1099 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1100 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 1101 BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1), 1102 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 1103 BPF_MOV64_IMM(BPF_REG_0, 0), 1104 BPF_EXIT_INSN(), 1105 }, 1106 .errstr = "R1 offset is outside of the packet", 1107 .result = REJECT, 1108 .prog_type = BPF_PROG_TYPE_XDP, 1109 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1110 }, 1111 { 1112 "XDP pkt read, pkt_meta' >= pkt_data, good access", 1113 .insns = { 1114 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1115 offsetof(struct xdp_md, data_meta)), 1116 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1117 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1118 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1119 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 1120 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 1121 BPF_MOV64_IMM(BPF_REG_0, 0), 1122 BPF_EXIT_INSN(), 1123 }, 1124 .result = ACCEPT, 1125 .prog_type = BPF_PROG_TYPE_XDP, 1126 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1127 }, 1128 { 1129 "XDP pkt read, pkt_meta' >= pkt_data, corner case -1, bad access", 1130 .insns = { 1131 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1132 offsetof(struct xdp_md, data_meta)), 1133 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1134 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1135 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 1136 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 1137 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 1138 BPF_MOV64_IMM(BPF_REG_0, 0), 1139 BPF_EXIT_INSN(), 1140 }, 1141 .errstr = "R1 offset is outside of the packet", 1142 .result = REJECT, 1143 .prog_type = BPF_PROG_TYPE_XDP, 1144 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1145 }, 1146 { 1147 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2", 1148 .insns = { 1149 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1150 offsetof(struct xdp_md, data_meta)), 1151 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1152 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1153 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1154 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0), 1155 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 1156 BPF_MOV64_IMM(BPF_REG_0, 0), 1157 BPF_EXIT_INSN(), 1158 }, 1159 .errstr = "R1 offset is outside of the packet", 1160 .result = REJECT, 1161 .prog_type = BPF_PROG_TYPE_XDP, 1162 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1163 }, 1164 { 1165 "XDP pkt read, pkt_meta' >= pkt_data, corner case, good access", 1166 .insns = { 1167 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1168 offsetof(struct xdp_md, data_meta)), 1169 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1170 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1171 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 1172 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 1173 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 1174 BPF_MOV64_IMM(BPF_REG_0, 0), 1175 BPF_EXIT_INSN(), 1176 }, 1177 .result = ACCEPT, 1178 .prog_type = BPF_PROG_TYPE_XDP, 1179 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1180 }, 1181 { 1182 "XDP pkt read, pkt_meta' >= pkt_data, corner case +1, good access", 1183 .insns = { 1184 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1185 offsetof(struct xdp_md, data_meta)), 1186 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1187 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1188 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1189 BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), 1190 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1191 BPF_MOV64_IMM(BPF_REG_0, 0), 1192 BPF_EXIT_INSN(), 1193 }, 1194 .result = ACCEPT, 1195 .prog_type = BPF_PROG_TYPE_XDP, 1196 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1197 }, 1198 { 1199 "XDP pkt read, pkt_data >= pkt_meta', corner case, good access", 1200 .insns = { 1201 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1202 offsetof(struct xdp_md, data_meta)), 1203 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1204 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1205 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1206 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 1207 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1208 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1209 BPF_MOV64_IMM(BPF_REG_0, 0), 1210 BPF_EXIT_INSN(), 1211 }, 1212 .result = ACCEPT, 1213 .prog_type = BPF_PROG_TYPE_XDP, 1214 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1215 }, 1216 { 1217 "XDP pkt read, pkt_data >= pkt_meta', bad access 1", 1218 .insns = { 1219 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1220 offsetof(struct xdp_md, data_meta)), 1221 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1222 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1223 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1224 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 1225 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1226 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 1227 BPF_MOV64_IMM(BPF_REG_0, 0), 1228 BPF_EXIT_INSN(), 1229 }, 1230 .errstr = "R1 offset is outside of the packet", 1231 .result = REJECT, 1232 .prog_type = BPF_PROG_TYPE_XDP, 1233 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1234 }, 1235 { 1236 "XDP pkt read, pkt_data >= pkt_meta', bad access 2", 1237 .insns = { 1238 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1239 offsetof(struct xdp_md, data_meta)), 1240 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1241 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1242 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1243 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 1244 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1245 BPF_MOV64_IMM(BPF_REG_0, 0), 1246 BPF_EXIT_INSN(), 1247 }, 1248 .errstr = "R1 offset is outside of the packet", 1249 .result = REJECT, 1250 .prog_type = BPF_PROG_TYPE_XDP, 1251 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1252 }, 1253 { 1254 "XDP pkt read, pkt_data >= pkt_meta', corner case +1, good access", 1255 .insns = { 1256 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1257 offsetof(struct xdp_md, data_meta)), 1258 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1259 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1260 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 1261 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 1262 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1263 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 1264 BPF_MOV64_IMM(BPF_REG_0, 0), 1265 BPF_EXIT_INSN(), 1266 }, 1267 .result = ACCEPT, 1268 .prog_type = BPF_PROG_TYPE_XDP, 1269 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1270 }, 1271 { 1272 "XDP pkt read, pkt_data >= pkt_meta', corner case -1, bad access", 1273 .insns = { 1274 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1275 offsetof(struct xdp_md, data_meta)), 1276 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1277 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1278 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 1279 BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1), 1280 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1281 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 1282 BPF_MOV64_IMM(BPF_REG_0, 0), 1283 BPF_EXIT_INSN(), 1284 }, 1285 .errstr = "R1 offset is outside of the packet", 1286 .result = REJECT, 1287 .prog_type = BPF_PROG_TYPE_XDP, 1288 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1289 }, 1290 { 1291 "XDP pkt read, pkt_meta' <= pkt_data, corner case, good access", 1292 .insns = { 1293 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1294 offsetof(struct xdp_md, data_meta)), 1295 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1296 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1297 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1298 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 1299 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1300 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1301 BPF_MOV64_IMM(BPF_REG_0, 0), 1302 BPF_EXIT_INSN(), 1303 }, 1304 .result = ACCEPT, 1305 .prog_type = BPF_PROG_TYPE_XDP, 1306 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1307 }, 1308 { 1309 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1", 1310 .insns = { 1311 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1312 offsetof(struct xdp_md, data_meta)), 1313 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1314 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1315 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1316 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 1317 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1318 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4), 1319 BPF_MOV64_IMM(BPF_REG_0, 0), 1320 BPF_EXIT_INSN(), 1321 }, 1322 .errstr = "R1 offset is outside of the packet", 1323 .result = REJECT, 1324 .prog_type = BPF_PROG_TYPE_XDP, 1325 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1326 }, 1327 { 1328 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2", 1329 .insns = { 1330 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1331 offsetof(struct xdp_md, data_meta)), 1332 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1333 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1334 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1335 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 1336 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1337 BPF_MOV64_IMM(BPF_REG_0, 0), 1338 BPF_EXIT_INSN(), 1339 }, 1340 .errstr = "R1 offset is outside of the packet", 1341 .result = REJECT, 1342 .prog_type = BPF_PROG_TYPE_XDP, 1343 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1344 }, 1345 { 1346 "XDP pkt read, pkt_meta' <= pkt_data, corner case +1, good access", 1347 .insns = { 1348 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1349 offsetof(struct xdp_md, data_meta)), 1350 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1351 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1352 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9), 1353 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 1354 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1355 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9), 1356 BPF_MOV64_IMM(BPF_REG_0, 0), 1357 BPF_EXIT_INSN(), 1358 }, 1359 .result = ACCEPT, 1360 .prog_type = BPF_PROG_TYPE_XDP, 1361 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1362 }, 1363 { 1364 "XDP pkt read, pkt_meta' <= pkt_data, corner case -1, bad access", 1365 .insns = { 1366 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1367 offsetof(struct xdp_md, data_meta)), 1368 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1369 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1370 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 1371 BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1), 1372 BPF_JMP_IMM(BPF_JA, 0, 0, 1), 1373 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 1374 BPF_MOV64_IMM(BPF_REG_0, 0), 1375 BPF_EXIT_INSN(), 1376 }, 1377 .errstr = "R1 offset is outside of the packet", 1378 .result = REJECT, 1379 .prog_type = BPF_PROG_TYPE_XDP, 1380 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1381 }, 1382 { 1383 "XDP pkt read, pkt_data <= pkt_meta', good access", 1384 .insns = { 1385 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1386 offsetof(struct xdp_md, data_meta)), 1387 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1388 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1389 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1390 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 1391 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 1392 BPF_MOV64_IMM(BPF_REG_0, 0), 1393 BPF_EXIT_INSN(), 1394 }, 1395 .result = ACCEPT, 1396 .prog_type = BPF_PROG_TYPE_XDP, 1397 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1398 }, 1399 { 1400 "XDP pkt read, pkt_data <= pkt_meta', corner case -1, bad access", 1401 .insns = { 1402 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1403 offsetof(struct xdp_md, data_meta)), 1404 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1405 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1406 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 1407 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 1408 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), 1409 BPF_MOV64_IMM(BPF_REG_0, 0), 1410 BPF_EXIT_INSN(), 1411 }, 1412 .errstr = "R1 offset is outside of the packet", 1413 .result = REJECT, 1414 .prog_type = BPF_PROG_TYPE_XDP, 1415 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1416 }, 1417 { 1418 "XDP pkt read, pkt_data <= pkt_meta', bad access 2", 1419 .insns = { 1420 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1421 offsetof(struct xdp_md, data_meta)), 1422 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1423 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1424 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1425 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0), 1426 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5), 1427 BPF_MOV64_IMM(BPF_REG_0, 0), 1428 BPF_EXIT_INSN(), 1429 }, 1430 .errstr = "R1 offset is outside of the packet", 1431 .result = REJECT, 1432 .prog_type = BPF_PROG_TYPE_XDP, 1433 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1434 }, 1435 { 1436 "XDP pkt read, pkt_data <= pkt_meta', corner case, good access", 1437 .insns = { 1438 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1439 offsetof(struct xdp_md, data_meta)), 1440 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1441 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1442 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 1443 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 1444 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7), 1445 BPF_MOV64_IMM(BPF_REG_0, 0), 1446 BPF_EXIT_INSN(), 1447 }, 1448 .result = ACCEPT, 1449 .prog_type = BPF_PROG_TYPE_XDP, 1450 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1451 }, 1452 { 1453 "XDP pkt read, pkt_data <= pkt_meta', corner case +1, good access", 1454 .insns = { 1455 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 1456 offsetof(struct xdp_md, data_meta)), 1457 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)), 1458 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 1459 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 1460 BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), 1461 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), 1462 BPF_MOV64_IMM(BPF_REG_0, 0), 1463 BPF_EXIT_INSN(), 1464 }, 1465 .result = ACCEPT, 1466 .prog_type = BPF_PROG_TYPE_XDP, 1467 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1468 }, 1469