1{ 2 "access skb fields ok", 3 .insns = { 4 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 5 offsetof(struct __sk_buff, len)), 6 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1), 7 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 8 offsetof(struct __sk_buff, mark)), 9 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1), 10 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 11 offsetof(struct __sk_buff, pkt_type)), 12 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1), 13 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 14 offsetof(struct __sk_buff, queue_mapping)), 15 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0), 16 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 17 offsetof(struct __sk_buff, protocol)), 18 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0), 19 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 20 offsetof(struct __sk_buff, vlan_present)), 21 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0), 22 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 23 offsetof(struct __sk_buff, vlan_tci)), 24 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0), 25 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 26 offsetof(struct __sk_buff, napi_id)), 27 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0), 28 BPF_EXIT_INSN(), 29 }, 30 .result = ACCEPT, 31}, 32{ 33 "access skb fields bad1", 34 .insns = { 35 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4), 36 BPF_EXIT_INSN(), 37 }, 38 .errstr = "invalid bpf_context access", 39 .result = REJECT, 40}, 41{ 42 "access skb fields bad2", 43 .insns = { 44 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9), 45 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 46 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 47 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 48 BPF_LD_MAP_FD(BPF_REG_1, 0), 49 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 50 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 51 BPF_EXIT_INSN(), 52 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 53 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 54 offsetof(struct __sk_buff, pkt_type)), 55 BPF_EXIT_INSN(), 56 }, 57 .fixup_map_hash_8b = { 4 }, 58 .errstr = "different pointers", 59 .errstr_unpriv = "R1 pointer comparison", 60 .result = REJECT, 61}, 62{ 63 "access skb fields bad3", 64 .insns = { 65 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2), 66 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 67 offsetof(struct __sk_buff, pkt_type)), 68 BPF_EXIT_INSN(), 69 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 70 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 71 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 72 BPF_LD_MAP_FD(BPF_REG_1, 0), 73 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 74 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 75 BPF_EXIT_INSN(), 76 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 77 BPF_JMP_IMM(BPF_JA, 0, 0, -12), 78 }, 79 .fixup_map_hash_8b = { 6 }, 80 .errstr = "different pointers", 81 .errstr_unpriv = "R1 pointer comparison", 82 .result = REJECT, 83}, 84{ 85 "access skb fields bad4", 86 .insns = { 87 BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3), 88 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 89 offsetof(struct __sk_buff, len)), 90 BPF_MOV64_IMM(BPF_REG_0, 0), 91 BPF_EXIT_INSN(), 92 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 93 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 94 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 95 BPF_LD_MAP_FD(BPF_REG_1, 0), 96 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 97 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), 98 BPF_EXIT_INSN(), 99 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 100 BPF_JMP_IMM(BPF_JA, 0, 0, -13), 101 }, 102 .fixup_map_hash_8b = { 7 }, 103 .errstr = "different pointers", 104 .errstr_unpriv = "R1 pointer comparison", 105 .result = REJECT, 106}, 107{ 108 "invalid access __sk_buff family", 109 .insns = { 110 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 111 offsetof(struct __sk_buff, family)), 112 BPF_EXIT_INSN(), 113 }, 114 .errstr = "invalid bpf_context access", 115 .result = REJECT, 116}, 117{ 118 "invalid access __sk_buff remote_ip4", 119 .insns = { 120 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 121 offsetof(struct __sk_buff, remote_ip4)), 122 BPF_EXIT_INSN(), 123 }, 124 .errstr = "invalid bpf_context access", 125 .result = REJECT, 126}, 127{ 128 "invalid access __sk_buff local_ip4", 129 .insns = { 130 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 131 offsetof(struct __sk_buff, local_ip4)), 132 BPF_EXIT_INSN(), 133 }, 134 .errstr = "invalid bpf_context access", 135 .result = REJECT, 136}, 137{ 138 "invalid access __sk_buff remote_ip6", 139 .insns = { 140 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 141 offsetof(struct __sk_buff, remote_ip6)), 142 BPF_EXIT_INSN(), 143 }, 144 .errstr = "invalid bpf_context access", 145 .result = REJECT, 146}, 147{ 148 "invalid access __sk_buff local_ip6", 149 .insns = { 150 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 151 offsetof(struct __sk_buff, local_ip6)), 152 BPF_EXIT_INSN(), 153 }, 154 .errstr = "invalid bpf_context access", 155 .result = REJECT, 156}, 157{ 158 "invalid access __sk_buff remote_port", 159 .insns = { 160 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 161 offsetof(struct __sk_buff, remote_port)), 162 BPF_EXIT_INSN(), 163 }, 164 .errstr = "invalid bpf_context access", 165 .result = REJECT, 166}, 167{ 168 "invalid access __sk_buff remote_port", 169 .insns = { 170 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 171 offsetof(struct __sk_buff, local_port)), 172 BPF_EXIT_INSN(), 173 }, 174 .errstr = "invalid bpf_context access", 175 .result = REJECT, 176}, 177{ 178 "valid access __sk_buff family", 179 .insns = { 180 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 181 offsetof(struct __sk_buff, family)), 182 BPF_EXIT_INSN(), 183 }, 184 .result = ACCEPT, 185 .prog_type = BPF_PROG_TYPE_SK_SKB, 186}, 187{ 188 "valid access __sk_buff remote_ip4", 189 .insns = { 190 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 191 offsetof(struct __sk_buff, remote_ip4)), 192 BPF_EXIT_INSN(), 193 }, 194 .result = ACCEPT, 195 .prog_type = BPF_PROG_TYPE_SK_SKB, 196}, 197{ 198 "valid access __sk_buff local_ip4", 199 .insns = { 200 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 201 offsetof(struct __sk_buff, local_ip4)), 202 BPF_EXIT_INSN(), 203 }, 204 .result = ACCEPT, 205 .prog_type = BPF_PROG_TYPE_SK_SKB, 206}, 207{ 208 "valid access __sk_buff remote_ip6", 209 .insns = { 210 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 211 offsetof(struct __sk_buff, remote_ip6[0])), 212 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 213 offsetof(struct __sk_buff, remote_ip6[1])), 214 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 215 offsetof(struct __sk_buff, remote_ip6[2])), 216 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 217 offsetof(struct __sk_buff, remote_ip6[3])), 218 BPF_EXIT_INSN(), 219 }, 220 .result = ACCEPT, 221 .prog_type = BPF_PROG_TYPE_SK_SKB, 222}, 223{ 224 "valid access __sk_buff local_ip6", 225 .insns = { 226 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 227 offsetof(struct __sk_buff, local_ip6[0])), 228 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 229 offsetof(struct __sk_buff, local_ip6[1])), 230 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 231 offsetof(struct __sk_buff, local_ip6[2])), 232 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 233 offsetof(struct __sk_buff, local_ip6[3])), 234 BPF_EXIT_INSN(), 235 }, 236 .result = ACCEPT, 237 .prog_type = BPF_PROG_TYPE_SK_SKB, 238}, 239{ 240 "valid access __sk_buff remote_port", 241 .insns = { 242 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 243 offsetof(struct __sk_buff, remote_port)), 244 BPF_EXIT_INSN(), 245 }, 246 .result = ACCEPT, 247 .prog_type = BPF_PROG_TYPE_SK_SKB, 248}, 249{ 250 "valid access __sk_buff remote_port", 251 .insns = { 252 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 253 offsetof(struct __sk_buff, local_port)), 254 BPF_EXIT_INSN(), 255 }, 256 .result = ACCEPT, 257 .prog_type = BPF_PROG_TYPE_SK_SKB, 258}, 259{ 260 "invalid access of tc_classid for SK_SKB", 261 .insns = { 262 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 263 offsetof(struct __sk_buff, tc_classid)), 264 BPF_EXIT_INSN(), 265 }, 266 .result = REJECT, 267 .prog_type = BPF_PROG_TYPE_SK_SKB, 268 .errstr = "invalid bpf_context access", 269}, 270{ 271 "invalid access of skb->mark for SK_SKB", 272 .insns = { 273 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 274 offsetof(struct __sk_buff, mark)), 275 BPF_EXIT_INSN(), 276 }, 277 .result = REJECT, 278 .prog_type = BPF_PROG_TYPE_SK_SKB, 279 .errstr = "invalid bpf_context access", 280}, 281{ 282 "check skb->mark is not writeable by SK_SKB", 283 .insns = { 284 BPF_MOV64_IMM(BPF_REG_0, 0), 285 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 286 offsetof(struct __sk_buff, mark)), 287 BPF_EXIT_INSN(), 288 }, 289 .result = REJECT, 290 .prog_type = BPF_PROG_TYPE_SK_SKB, 291 .errstr = "invalid bpf_context access", 292}, 293{ 294 "check skb->tc_index is writeable by SK_SKB", 295 .insns = { 296 BPF_MOV64_IMM(BPF_REG_0, 0), 297 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 298 offsetof(struct __sk_buff, tc_index)), 299 BPF_EXIT_INSN(), 300 }, 301 .result = ACCEPT, 302 .prog_type = BPF_PROG_TYPE_SK_SKB, 303}, 304{ 305 "check skb->priority is writeable by SK_SKB", 306 .insns = { 307 BPF_MOV64_IMM(BPF_REG_0, 0), 308 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 309 offsetof(struct __sk_buff, priority)), 310 BPF_EXIT_INSN(), 311 }, 312 .result = ACCEPT, 313 .prog_type = BPF_PROG_TYPE_SK_SKB, 314}, 315{ 316 "direct packet read for SK_SKB", 317 .insns = { 318 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 319 offsetof(struct __sk_buff, data)), 320 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 321 offsetof(struct __sk_buff, data_end)), 322 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 323 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 324 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 325 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0), 326 BPF_MOV64_IMM(BPF_REG_0, 0), 327 BPF_EXIT_INSN(), 328 }, 329 .result = ACCEPT, 330 .prog_type = BPF_PROG_TYPE_SK_SKB, 331}, 332{ 333 "direct packet write for SK_SKB", 334 .insns = { 335 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 336 offsetof(struct __sk_buff, data)), 337 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 338 offsetof(struct __sk_buff, data_end)), 339 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 340 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 341 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 342 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0), 343 BPF_MOV64_IMM(BPF_REG_0, 0), 344 BPF_EXIT_INSN(), 345 }, 346 .result = ACCEPT, 347 .prog_type = BPF_PROG_TYPE_SK_SKB, 348}, 349{ 350 "overlapping checks for direct packet access SK_SKB", 351 .insns = { 352 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 353 offsetof(struct __sk_buff, data)), 354 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 355 offsetof(struct __sk_buff, data_end)), 356 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 357 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 358 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4), 359 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 360 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 361 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 362 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6), 363 BPF_MOV64_IMM(BPF_REG_0, 0), 364 BPF_EXIT_INSN(), 365 }, 366 .result = ACCEPT, 367 .prog_type = BPF_PROG_TYPE_SK_SKB, 368}, 369{ 370 "check skb->mark is not writeable by sockets", 371 .insns = { 372 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 373 offsetof(struct __sk_buff, mark)), 374 BPF_EXIT_INSN(), 375 }, 376 .errstr = "invalid bpf_context access", 377 .errstr_unpriv = "R1 leaks addr", 378 .result = REJECT, 379}, 380{ 381 "check skb->tc_index is not writeable by sockets", 382 .insns = { 383 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 384 offsetof(struct __sk_buff, tc_index)), 385 BPF_EXIT_INSN(), 386 }, 387 .errstr = "invalid bpf_context access", 388 .errstr_unpriv = "R1 leaks addr", 389 .result = REJECT, 390}, 391{ 392 "check cb access: byte", 393 .insns = { 394 BPF_MOV64_IMM(BPF_REG_0, 0), 395 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 396 offsetof(struct __sk_buff, cb[0])), 397 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 398 offsetof(struct __sk_buff, cb[0]) + 1), 399 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 400 offsetof(struct __sk_buff, cb[0]) + 2), 401 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 402 offsetof(struct __sk_buff, cb[0]) + 3), 403 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 404 offsetof(struct __sk_buff, cb[1])), 405 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 406 offsetof(struct __sk_buff, cb[1]) + 1), 407 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 408 offsetof(struct __sk_buff, cb[1]) + 2), 409 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 410 offsetof(struct __sk_buff, cb[1]) + 3), 411 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 412 offsetof(struct __sk_buff, cb[2])), 413 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 414 offsetof(struct __sk_buff, cb[2]) + 1), 415 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 416 offsetof(struct __sk_buff, cb[2]) + 2), 417 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 418 offsetof(struct __sk_buff, cb[2]) + 3), 419 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 420 offsetof(struct __sk_buff, cb[3])), 421 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 422 offsetof(struct __sk_buff, cb[3]) + 1), 423 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 424 offsetof(struct __sk_buff, cb[3]) + 2), 425 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 426 offsetof(struct __sk_buff, cb[3]) + 3), 427 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 428 offsetof(struct __sk_buff, cb[4])), 429 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 430 offsetof(struct __sk_buff, cb[4]) + 1), 431 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 432 offsetof(struct __sk_buff, cb[4]) + 2), 433 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 434 offsetof(struct __sk_buff, cb[4]) + 3), 435 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 436 offsetof(struct __sk_buff, cb[0])), 437 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 438 offsetof(struct __sk_buff, cb[0]) + 1), 439 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 440 offsetof(struct __sk_buff, cb[0]) + 2), 441 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 442 offsetof(struct __sk_buff, cb[0]) + 3), 443 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 444 offsetof(struct __sk_buff, cb[1])), 445 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 446 offsetof(struct __sk_buff, cb[1]) + 1), 447 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 448 offsetof(struct __sk_buff, cb[1]) + 2), 449 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 450 offsetof(struct __sk_buff, cb[1]) + 3), 451 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 452 offsetof(struct __sk_buff, cb[2])), 453 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 454 offsetof(struct __sk_buff, cb[2]) + 1), 455 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 456 offsetof(struct __sk_buff, cb[2]) + 2), 457 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 458 offsetof(struct __sk_buff, cb[2]) + 3), 459 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 460 offsetof(struct __sk_buff, cb[3])), 461 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 462 offsetof(struct __sk_buff, cb[3]) + 1), 463 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 464 offsetof(struct __sk_buff, cb[3]) + 2), 465 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 466 offsetof(struct __sk_buff, cb[3]) + 3), 467 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 468 offsetof(struct __sk_buff, cb[4])), 469 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 470 offsetof(struct __sk_buff, cb[4]) + 1), 471 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 472 offsetof(struct __sk_buff, cb[4]) + 2), 473 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 474 offsetof(struct __sk_buff, cb[4]) + 3), 475 BPF_EXIT_INSN(), 476 }, 477 .result = ACCEPT, 478}, 479{ 480 "__sk_buff->hash, offset 0, byte store not permitted", 481 .insns = { 482 BPF_MOV64_IMM(BPF_REG_0, 0), 483 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 484 offsetof(struct __sk_buff, hash)), 485 BPF_EXIT_INSN(), 486 }, 487 .errstr = "invalid bpf_context access", 488 .result = REJECT, 489}, 490{ 491 "__sk_buff->tc_index, offset 3, byte store not permitted", 492 .insns = { 493 BPF_MOV64_IMM(BPF_REG_0, 0), 494 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 495 offsetof(struct __sk_buff, tc_index) + 3), 496 BPF_EXIT_INSN(), 497 }, 498 .errstr = "invalid bpf_context access", 499 .result = REJECT, 500}, 501{ 502 "check skb->hash byte load permitted", 503 .insns = { 504 BPF_MOV64_IMM(BPF_REG_0, 0), 505#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 506 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 507 offsetof(struct __sk_buff, hash)), 508#else 509 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 510 offsetof(struct __sk_buff, hash) + 3), 511#endif 512 BPF_EXIT_INSN(), 513 }, 514 .result = ACCEPT, 515}, 516{ 517 "check skb->hash byte load permitted 1", 518 .insns = { 519 BPF_MOV64_IMM(BPF_REG_0, 0), 520 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 521 offsetof(struct __sk_buff, hash) + 1), 522 BPF_EXIT_INSN(), 523 }, 524 .result = ACCEPT, 525}, 526{ 527 "check skb->hash byte load permitted 2", 528 .insns = { 529 BPF_MOV64_IMM(BPF_REG_0, 0), 530 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 531 offsetof(struct __sk_buff, hash) + 2), 532 BPF_EXIT_INSN(), 533 }, 534 .result = ACCEPT, 535}, 536{ 537 "check skb->hash byte load permitted 3", 538 .insns = { 539 BPF_MOV64_IMM(BPF_REG_0, 0), 540#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 541 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 542 offsetof(struct __sk_buff, hash) + 3), 543#else 544 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 545 offsetof(struct __sk_buff, hash)), 546#endif 547 BPF_EXIT_INSN(), 548 }, 549 .result = ACCEPT, 550}, 551{ 552 "check cb access: byte, wrong type", 553 .insns = { 554 BPF_MOV64_IMM(BPF_REG_0, 0), 555 BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 556 offsetof(struct __sk_buff, cb[0])), 557 BPF_EXIT_INSN(), 558 }, 559 .errstr = "invalid bpf_context access", 560 .result = REJECT, 561 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK, 562}, 563{ 564 "check cb access: half", 565 .insns = { 566 BPF_MOV64_IMM(BPF_REG_0, 0), 567 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 568 offsetof(struct __sk_buff, cb[0])), 569 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 570 offsetof(struct __sk_buff, cb[0]) + 2), 571 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 572 offsetof(struct __sk_buff, cb[1])), 573 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 574 offsetof(struct __sk_buff, cb[1]) + 2), 575 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 576 offsetof(struct __sk_buff, cb[2])), 577 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 578 offsetof(struct __sk_buff, cb[2]) + 2), 579 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 580 offsetof(struct __sk_buff, cb[3])), 581 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 582 offsetof(struct __sk_buff, cb[3]) + 2), 583 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 584 offsetof(struct __sk_buff, cb[4])), 585 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 586 offsetof(struct __sk_buff, cb[4]) + 2), 587 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 588 offsetof(struct __sk_buff, cb[0])), 589 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 590 offsetof(struct __sk_buff, cb[0]) + 2), 591 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 592 offsetof(struct __sk_buff, cb[1])), 593 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 594 offsetof(struct __sk_buff, cb[1]) + 2), 595 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 596 offsetof(struct __sk_buff, cb[2])), 597 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 598 offsetof(struct __sk_buff, cb[2]) + 2), 599 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 600 offsetof(struct __sk_buff, cb[3])), 601 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 602 offsetof(struct __sk_buff, cb[3]) + 2), 603 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 604 offsetof(struct __sk_buff, cb[4])), 605 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 606 offsetof(struct __sk_buff, cb[4]) + 2), 607 BPF_EXIT_INSN(), 608 }, 609 .result = ACCEPT, 610}, 611{ 612 "check cb access: half, unaligned", 613 .insns = { 614 BPF_MOV64_IMM(BPF_REG_0, 0), 615 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 616 offsetof(struct __sk_buff, cb[0]) + 1), 617 BPF_EXIT_INSN(), 618 }, 619 .errstr = "misaligned context access", 620 .result = REJECT, 621 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 622}, 623{ 624 "check __sk_buff->hash, offset 0, half store not permitted", 625 .insns = { 626 BPF_MOV64_IMM(BPF_REG_0, 0), 627 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 628 offsetof(struct __sk_buff, hash)), 629 BPF_EXIT_INSN(), 630 }, 631 .errstr = "invalid bpf_context access", 632 .result = REJECT, 633}, 634{ 635 "check __sk_buff->tc_index, offset 2, half store not permitted", 636 .insns = { 637 BPF_MOV64_IMM(BPF_REG_0, 0), 638 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 639 offsetof(struct __sk_buff, tc_index) + 2), 640 BPF_EXIT_INSN(), 641 }, 642 .errstr = "invalid bpf_context access", 643 .result = REJECT, 644}, 645{ 646 "check skb->hash half load permitted", 647 .insns = { 648 BPF_MOV64_IMM(BPF_REG_0, 0), 649#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 650 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 651 offsetof(struct __sk_buff, hash)), 652#else 653 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 654 offsetof(struct __sk_buff, hash) + 2), 655#endif 656 BPF_EXIT_INSN(), 657 }, 658 .result = ACCEPT, 659}, 660{ 661 "check skb->hash half load permitted 2", 662 .insns = { 663 BPF_MOV64_IMM(BPF_REG_0, 0), 664#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 665 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 666 offsetof(struct __sk_buff, hash) + 2), 667#else 668 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 669 offsetof(struct __sk_buff, hash)), 670#endif 671 BPF_EXIT_INSN(), 672 }, 673 .result = ACCEPT, 674}, 675{ 676 "check skb->hash half load not permitted, unaligned 1", 677 .insns = { 678 BPF_MOV64_IMM(BPF_REG_0, 0), 679#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 680 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 681 offsetof(struct __sk_buff, hash) + 1), 682#else 683 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 684 offsetof(struct __sk_buff, hash) + 3), 685#endif 686 BPF_EXIT_INSN(), 687 }, 688 .errstr = "invalid bpf_context access", 689 .result = REJECT, 690 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 691}, 692{ 693 "check skb->hash half load not permitted, unaligned 3", 694 .insns = { 695 BPF_MOV64_IMM(BPF_REG_0, 0), 696#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 697 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 698 offsetof(struct __sk_buff, hash) + 3), 699#else 700 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 701 offsetof(struct __sk_buff, hash) + 1), 702#endif 703 BPF_EXIT_INSN(), 704 }, 705 .errstr = "invalid bpf_context access", 706 .result = REJECT, 707 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 708}, 709{ 710 "check cb access: half, wrong type", 711 .insns = { 712 BPF_MOV64_IMM(BPF_REG_0, 0), 713 BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0, 714 offsetof(struct __sk_buff, cb[0])), 715 BPF_EXIT_INSN(), 716 }, 717 .errstr = "invalid bpf_context access", 718 .result = REJECT, 719 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK, 720}, 721{ 722 "check cb access: word", 723 .insns = { 724 BPF_MOV64_IMM(BPF_REG_0, 0), 725 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 726 offsetof(struct __sk_buff, cb[0])), 727 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 728 offsetof(struct __sk_buff, cb[1])), 729 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 730 offsetof(struct __sk_buff, cb[2])), 731 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 732 offsetof(struct __sk_buff, cb[3])), 733 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 734 offsetof(struct __sk_buff, cb[4])), 735 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 736 offsetof(struct __sk_buff, cb[0])), 737 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 738 offsetof(struct __sk_buff, cb[1])), 739 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 740 offsetof(struct __sk_buff, cb[2])), 741 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 742 offsetof(struct __sk_buff, cb[3])), 743 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 744 offsetof(struct __sk_buff, cb[4])), 745 BPF_EXIT_INSN(), 746 }, 747 .result = ACCEPT, 748}, 749{ 750 "check cb access: word, unaligned 1", 751 .insns = { 752 BPF_MOV64_IMM(BPF_REG_0, 0), 753 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 754 offsetof(struct __sk_buff, cb[0]) + 2), 755 BPF_EXIT_INSN(), 756 }, 757 .errstr = "misaligned context access", 758 .result = REJECT, 759 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 760}, 761{ 762 "check cb access: word, unaligned 2", 763 .insns = { 764 BPF_MOV64_IMM(BPF_REG_0, 0), 765 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 766 offsetof(struct __sk_buff, cb[4]) + 1), 767 BPF_EXIT_INSN(), 768 }, 769 .errstr = "misaligned context access", 770 .result = REJECT, 771 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 772}, 773{ 774 "check cb access: word, unaligned 3", 775 .insns = { 776 BPF_MOV64_IMM(BPF_REG_0, 0), 777 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 778 offsetof(struct __sk_buff, cb[4]) + 2), 779 BPF_EXIT_INSN(), 780 }, 781 .errstr = "misaligned context access", 782 .result = REJECT, 783 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 784}, 785{ 786 "check cb access: word, unaligned 4", 787 .insns = { 788 BPF_MOV64_IMM(BPF_REG_0, 0), 789 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 790 offsetof(struct __sk_buff, cb[4]) + 3), 791 BPF_EXIT_INSN(), 792 }, 793 .errstr = "misaligned context access", 794 .result = REJECT, 795 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 796}, 797{ 798 "check cb access: double", 799 .insns = { 800 BPF_MOV64_IMM(BPF_REG_0, 0), 801 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 802 offsetof(struct __sk_buff, cb[0])), 803 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 804 offsetof(struct __sk_buff, cb[2])), 805 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 806 offsetof(struct __sk_buff, cb[0])), 807 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 808 offsetof(struct __sk_buff, cb[2])), 809 BPF_EXIT_INSN(), 810 }, 811 .result = ACCEPT, 812}, 813{ 814 "check cb access: double, unaligned 1", 815 .insns = { 816 BPF_MOV64_IMM(BPF_REG_0, 0), 817 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 818 offsetof(struct __sk_buff, cb[1])), 819 BPF_EXIT_INSN(), 820 }, 821 .errstr = "misaligned context access", 822 .result = REJECT, 823 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 824}, 825{ 826 "check cb access: double, unaligned 2", 827 .insns = { 828 BPF_MOV64_IMM(BPF_REG_0, 0), 829 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 830 offsetof(struct __sk_buff, cb[3])), 831 BPF_EXIT_INSN(), 832 }, 833 .errstr = "misaligned context access", 834 .result = REJECT, 835 .flags = F_LOAD_WITH_STRICT_ALIGNMENT, 836}, 837{ 838 "check cb access: double, oob 1", 839 .insns = { 840 BPF_MOV64_IMM(BPF_REG_0, 0), 841 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 842 offsetof(struct __sk_buff, cb[4])), 843 BPF_EXIT_INSN(), 844 }, 845 .errstr = "invalid bpf_context access", 846 .result = REJECT, 847}, 848{ 849 "check cb access: double, oob 2", 850 .insns = { 851 BPF_MOV64_IMM(BPF_REG_0, 0), 852 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 853 offsetof(struct __sk_buff, cb[4])), 854 BPF_EXIT_INSN(), 855 }, 856 .errstr = "invalid bpf_context access", 857 .result = REJECT, 858}, 859{ 860 "check __sk_buff->ifindex dw store not permitted", 861 .insns = { 862 BPF_MOV64_IMM(BPF_REG_0, 0), 863 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 864 offsetof(struct __sk_buff, ifindex)), 865 BPF_EXIT_INSN(), 866 }, 867 .errstr = "invalid bpf_context access", 868 .result = REJECT, 869}, 870{ 871 "check __sk_buff->ifindex dw load not permitted", 872 .insns = { 873 BPF_MOV64_IMM(BPF_REG_0, 0), 874 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 875 offsetof(struct __sk_buff, ifindex)), 876 BPF_EXIT_INSN(), 877 }, 878 .errstr = "invalid bpf_context access", 879 .result = REJECT, 880}, 881{ 882 "check cb access: double, wrong type", 883 .insns = { 884 BPF_MOV64_IMM(BPF_REG_0, 0), 885 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 886 offsetof(struct __sk_buff, cb[0])), 887 BPF_EXIT_INSN(), 888 }, 889 .errstr = "invalid bpf_context access", 890 .result = REJECT, 891 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK, 892}, 893{ 894 "check out of range skb->cb access", 895 .insns = { 896 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 897 offsetof(struct __sk_buff, cb[0]) + 256), 898 BPF_EXIT_INSN(), 899 }, 900 .errstr = "invalid bpf_context access", 901 .errstr_unpriv = "", 902 .result = REJECT, 903 .prog_type = BPF_PROG_TYPE_SCHED_ACT, 904}, 905{ 906 "write skb fields from socket prog", 907 .insns = { 908 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 909 offsetof(struct __sk_buff, cb[4])), 910 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1), 911 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 912 offsetof(struct __sk_buff, mark)), 913 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 914 offsetof(struct __sk_buff, tc_index)), 915 BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1), 916 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 917 offsetof(struct __sk_buff, cb[0])), 918 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 919 offsetof(struct __sk_buff, cb[2])), 920 BPF_EXIT_INSN(), 921 }, 922 .result = ACCEPT, 923 .errstr_unpriv = "R1 leaks addr", 924 .result_unpriv = REJECT, 925}, 926{ 927 "write skb fields from tc_cls_act prog", 928 .insns = { 929 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 930 offsetof(struct __sk_buff, cb[0])), 931 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 932 offsetof(struct __sk_buff, mark)), 933 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 934 offsetof(struct __sk_buff, tc_index)), 935 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 936 offsetof(struct __sk_buff, tc_index)), 937 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 938 offsetof(struct __sk_buff, cb[3])), 939 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 940 offsetof(struct __sk_buff, tstamp)), 941 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 942 offsetof(struct __sk_buff, tstamp)), 943 BPF_EXIT_INSN(), 944 }, 945 .errstr_unpriv = "", 946 .result_unpriv = REJECT, 947 .result = ACCEPT, 948 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 949}, 950{ 951 "check skb->data half load not permitted", 952 .insns = { 953 BPF_MOV64_IMM(BPF_REG_0, 0), 954#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 955 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 956 offsetof(struct __sk_buff, data)), 957#else 958 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 959 offsetof(struct __sk_buff, data) + 2), 960#endif 961 BPF_EXIT_INSN(), 962 }, 963 .result = REJECT, 964 .errstr = "invalid bpf_context access", 965}, 966{ 967 "read gso_segs from CGROUP_SKB", 968 .insns = { 969 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 970 offsetof(struct __sk_buff, gso_segs)), 971 BPF_MOV64_IMM(BPF_REG_0, 0), 972 BPF_EXIT_INSN(), 973 }, 974 .result = ACCEPT, 975 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 976}, 977{ 978 "read gso_segs from CGROUP_SKB", 979 .insns = { 980 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 981 offsetof(struct __sk_buff, gso_segs)), 982 BPF_MOV64_IMM(BPF_REG_0, 0), 983 BPF_EXIT_INSN(), 984 }, 985 .result = ACCEPT, 986 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 987}, 988{ 989 "write gso_segs from CGROUP_SKB", 990 .insns = { 991 BPF_MOV64_IMM(BPF_REG_0, 0), 992 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 993 offsetof(struct __sk_buff, gso_segs)), 994 BPF_MOV64_IMM(BPF_REG_0, 0), 995 BPF_EXIT_INSN(), 996 }, 997 .result = REJECT, 998 .result_unpriv = REJECT, 999 .errstr = "invalid bpf_context access off=164 size=4", 1000 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1001}, 1002{ 1003 "read gso_segs from CLS", 1004 .insns = { 1005 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1006 offsetof(struct __sk_buff, gso_segs)), 1007 BPF_MOV64_IMM(BPF_REG_0, 0), 1008 BPF_EXIT_INSN(), 1009 }, 1010 .result = ACCEPT, 1011 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1012}, 1013{ 1014 "read gso_size from CGROUP_SKB", 1015 .insns = { 1016 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1017 offsetof(struct __sk_buff, gso_size)), 1018 BPF_MOV64_IMM(BPF_REG_0, 0), 1019 BPF_EXIT_INSN(), 1020 }, 1021 .result = ACCEPT, 1022 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1023}, 1024{ 1025 "read gso_size from CGROUP_SKB", 1026 .insns = { 1027 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 1028 offsetof(struct __sk_buff, gso_size)), 1029 BPF_MOV64_IMM(BPF_REG_0, 0), 1030 BPF_EXIT_INSN(), 1031 }, 1032 .result = ACCEPT, 1033 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1034}, 1035{ 1036 "write gso_size from CGROUP_SKB", 1037 .insns = { 1038 BPF_MOV64_IMM(BPF_REG_0, 0), 1039 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 1040 offsetof(struct __sk_buff, gso_size)), 1041 BPF_MOV64_IMM(BPF_REG_0, 0), 1042 BPF_EXIT_INSN(), 1043 }, 1044 .result = REJECT, 1045 .result_unpriv = REJECT, 1046 .errstr = "invalid bpf_context access off=176 size=4", 1047 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1048}, 1049{ 1050 "read gso_size from CLS", 1051 .insns = { 1052 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1053 offsetof(struct __sk_buff, gso_size)), 1054 BPF_MOV64_IMM(BPF_REG_0, 0), 1055 BPF_EXIT_INSN(), 1056 }, 1057 .result = ACCEPT, 1058 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1059}, 1060{ 1061 "padding after gso_size is not accessible", 1062 .insns = { 1063 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1064 offsetofend(struct __sk_buff, gso_size)), 1065 BPF_MOV64_IMM(BPF_REG_0, 0), 1066 BPF_EXIT_INSN(), 1067 }, 1068 .result = REJECT, 1069 .result_unpriv = REJECT, 1070 .errstr = "invalid bpf_context access off=180 size=4", 1071 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1072}, 1073{ 1074 "read hwtstamp from CGROUP_SKB", 1075 .insns = { 1076 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 1077 offsetof(struct __sk_buff, hwtstamp)), 1078 BPF_MOV64_IMM(BPF_REG_0, 0), 1079 BPF_EXIT_INSN(), 1080 }, 1081 .result = ACCEPT, 1082 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1083}, 1084{ 1085 "read hwtstamp from CGROUP_SKB", 1086 .insns = { 1087 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 1088 offsetof(struct __sk_buff, hwtstamp)), 1089 BPF_MOV64_IMM(BPF_REG_0, 0), 1090 BPF_EXIT_INSN(), 1091 }, 1092 .result = ACCEPT, 1093 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1094}, 1095{ 1096 "write hwtstamp from CGROUP_SKB", 1097 .insns = { 1098 BPF_MOV64_IMM(BPF_REG_0, 0), 1099 BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 1100 offsetof(struct __sk_buff, hwtstamp)), 1101 BPF_MOV64_IMM(BPF_REG_0, 0), 1102 BPF_EXIT_INSN(), 1103 }, 1104 .result = REJECT, 1105 .result_unpriv = REJECT, 1106 .errstr = "invalid bpf_context access off=184 size=8", 1107 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 1108}, 1109{ 1110 "read hwtstamp from CLS", 1111 .insns = { 1112 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 1113 offsetof(struct __sk_buff, hwtstamp)), 1114 BPF_MOV64_IMM(BPF_REG_0, 0), 1115 BPF_EXIT_INSN(), 1116 }, 1117 .result = ACCEPT, 1118 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1119}, 1120{ 1121 "check wire_len is not readable by sockets", 1122 .insns = { 1123 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1124 offsetof(struct __sk_buff, wire_len)), 1125 BPF_EXIT_INSN(), 1126 }, 1127 .errstr = "invalid bpf_context access", 1128 .result = REJECT, 1129}, 1130{ 1131 "check wire_len is readable by tc classifier", 1132 .insns = { 1133 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 1134 offsetof(struct __sk_buff, wire_len)), 1135 BPF_EXIT_INSN(), 1136 }, 1137 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1138 .result = ACCEPT, 1139}, 1140{ 1141 "check wire_len is not writable by tc classifier", 1142 .insns = { 1143 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, 1144 offsetof(struct __sk_buff, wire_len)), 1145 BPF_EXIT_INSN(), 1146 }, 1147 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 1148 .errstr = "invalid bpf_context access", 1149 .errstr_unpriv = "R1 leaks addr", 1150 .result = REJECT, 1151}, 1152{ 1153 "pkt > pkt_end taken check", 1154 .insns = { 1155 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, // 0. r2 = *(u32 *)(r1 + data_end) 1156 offsetof(struct __sk_buff, data_end)), 1157 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, // 1. r4 = *(u32 *)(r1 + data) 1158 offsetof(struct __sk_buff, data)), 1159 BPF_MOV64_REG(BPF_REG_3, BPF_REG_4), // 2. r3 = r4 1160 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 42), // 3. r3 += 42 1161 BPF_MOV64_IMM(BPF_REG_1, 0), // 4. r1 = 0 1162 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 2), // 5. if r3 > r2 goto 8 1163 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 14), // 6. r4 += 14 1164 BPF_MOV64_REG(BPF_REG_1, BPF_REG_4), // 7. r1 = r4 1165 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 1), // 8. if r3 > r2 goto 10 1166 BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_1, 9), // 9. r2 = *(u8 *)(r1 + 9) 1167 BPF_MOV64_IMM(BPF_REG_0, 0), // 10. r0 = 0 1168 BPF_EXIT_INSN(), // 11. exit 1169 }, 1170 .result = ACCEPT, 1171 .prog_type = BPF_PROG_TYPE_SK_SKB, 1172 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1173}, 1174{ 1175 "pkt_end < pkt taken check", 1176 .insns = { 1177 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, // 0. r2 = *(u32 *)(r1 + data_end) 1178 offsetof(struct __sk_buff, data_end)), 1179 BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, // 1. r4 = *(u32 *)(r1 + data) 1180 offsetof(struct __sk_buff, data)), 1181 BPF_MOV64_REG(BPF_REG_3, BPF_REG_4), // 2. r3 = r4 1182 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 42), // 3. r3 += 42 1183 BPF_MOV64_IMM(BPF_REG_1, 0), // 4. r1 = 0 1184 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 2), // 5. if r3 > r2 goto 8 1185 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 14), // 6. r4 += 14 1186 BPF_MOV64_REG(BPF_REG_1, BPF_REG_4), // 7. r1 = r4 1187 BPF_JMP_REG(BPF_JLT, BPF_REG_2, BPF_REG_3, 1), // 8. if r2 < r3 goto 10 1188 BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_1, 9), // 9. r2 = *(u8 *)(r1 + 9) 1189 BPF_MOV64_IMM(BPF_REG_0, 0), // 10. r0 = 0 1190 BPF_EXIT_INSN(), // 11. exit 1191 }, 1192 .result = ACCEPT, 1193 .prog_type = BPF_PROG_TYPE_SK_SKB, 1194 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1195}, 1196