2019-01-25 15:24:43 -08:00
{
" raw_stack: no skb_load_bytes " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
/* Call to skb_load_bytes() omitted. */
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2021-02-06 20:10:25 -05:00
. errstr = " invalid read from stack R6 off=-8 size=8 " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, negative len " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , - 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
. errstr = " R4 min value is negative " ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, negative len 2 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , ~ 0 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
. errstr = " R4 min value is negative " ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, zero len " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 0 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2021-02-06 20:10:25 -05:00
. errstr = " invalid zero-sized read " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, no init " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = ACCEPT ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, init " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_ST_MEM ( BPF_DW , BPF_REG_6 , 0 , 0xcafe ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = ACCEPT ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, spilled regs around bounds " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 16 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , - 8 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , - 8 ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_2 , BPF_REG_6 , 8 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_0 , BPF_REG_0 ,
offsetof ( struct __sk_buff , mark ) ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_2 , BPF_REG_2 ,
offsetof ( struct __sk_buff , priority ) ) ,
BPF_ALU64_REG ( BPF_ADD , BPF_REG_0 , BPF_REG_2 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = ACCEPT ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, spilled regs corruption " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 8 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 0 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_0 , BPF_REG_0 ,
offsetof ( struct __sk_buff , mark ) ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2022-03-01 14:27:45 -08:00
. errstr = " R0 invalid mem access 'scalar' " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
. flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS ,
} ,
{
" raw_stack: skb_load_bytes, spilled regs corruption 2 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 16 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , - 8 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 0 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , - 8 ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_2 , BPF_REG_6 , 8 ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_3 , BPF_REG_6 , 0 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_0 , BPF_REG_0 ,
offsetof ( struct __sk_buff , mark ) ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_2 , BPF_REG_2 ,
offsetof ( struct __sk_buff , priority ) ) ,
BPF_ALU64_REG ( BPF_ADD , BPF_REG_0 , BPF_REG_2 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_3 , BPF_REG_3 ,
offsetof ( struct __sk_buff , pkt_type ) ) ,
BPF_ALU64_REG ( BPF_ADD , BPF_REG_0 , BPF_REG_3 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2022-03-01 14:27:45 -08:00
. errstr = " R3 invalid mem access 'scalar' " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
. flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS ,
} ,
{
" raw_stack: skb_load_bytes, spilled regs + data " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 16 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , - 8 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 0 ) ,
BPF_STX_MEM ( BPF_DW , BPF_REG_6 , BPF_REG_1 , 8 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , - 8 ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_2 , BPF_REG_6 , 8 ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_3 , BPF_REG_6 , 0 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_0 , BPF_REG_0 ,
offsetof ( struct __sk_buff , mark ) ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_2 , BPF_REG_2 ,
offsetof ( struct __sk_buff , priority ) ) ,
BPF_ALU64_REG ( BPF_ADD , BPF_REG_0 , BPF_REG_2 ) ,
BPF_ALU64_REG ( BPF_ADD , BPF_REG_0 , BPF_REG_3 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = ACCEPT ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 1 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 513 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2021-02-06 20:10:25 -05:00
. errstr = " invalid indirect access to stack R3 off=-513 size=8 " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 2 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 1 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 8 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2021-02-06 20:10:25 -05:00
. errstr = " invalid indirect access to stack R3 off=-1 size=8 " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 3 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , 0xffffffff ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 0xffffffff ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
. errstr = " R4 min value is negative " ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 4 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 1 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 0x7fffffff ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
. errstr = " R4 unbounded memory access, use 'var &= const' or 'if (var < const)' " ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 5 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 512 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 0x7fffffff ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
. errstr = " R4 unbounded memory access, use 'var &= const' or 'if (var < const)' " ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, invalid access 6 " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 512 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 0 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = REJECT ,
2021-02-06 20:10:25 -05:00
. errstr = " invalid zero-sized read " ,
2019-01-25 15:24:43 -08:00
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,
{
" raw_stack: skb_load_bytes, large access " ,
. insns = {
BPF_MOV64_IMM ( BPF_REG_2 , 4 ) ,
BPF_ALU64_REG ( BPF_MOV , BPF_REG_6 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_6 , - 512 ) ,
BPF_MOV64_REG ( BPF_REG_3 , BPF_REG_6 ) ,
BPF_MOV64_IMM ( BPF_REG_4 , 512 ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_skb_load_bytes ) ,
BPF_LDX_MEM ( BPF_DW , BPF_REG_0 , BPF_REG_6 , 0 ) ,
BPF_EXIT_INSN ( ) ,
} ,
. result = ACCEPT ,
. prog_type = BPF_PROG_TYPE_SCHED_CLS ,
} ,