1 { 2 "bounds checks mixing signed and unsigned, positive bounds", 3 .insns = { 4 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 7 BPF_LD_MAP_FD(BPF_REG_1, 0), 8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 10 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 11 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 12 BPF_MOV64_IMM(BPF_REG_2, 2), 13 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3), 14 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2), 15 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 16 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 17 BPF_MOV64_IMM(BPF_REG_0, 0), 18 BPF_EXIT_INSN(), 19 }, 20 .fixup_map_hash_8b = { 3 }, 21 .errstr = "unbounded min value", 22 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 23 .result = REJECT, 24 }, 25 { 26 "bounds checks mixing signed and unsigned", 27 .insns = { 28 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 29 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 30 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 31 BPF_LD_MAP_FD(BPF_REG_1, 0), 32 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 33 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 34 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 35 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 36 BPF_MOV64_IMM(BPF_REG_2, -1), 37 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3), 38 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 39 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 40 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 41 BPF_MOV64_IMM(BPF_REG_0, 0), 42 BPF_EXIT_INSN(), 43 }, 44 .fixup_map_hash_8b = { 3 }, 45 .errstr = "unbounded min value", 46 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 47 .result = REJECT, 48 }, 49 { 50 "bounds checks mixing signed and unsigned, variant 2", 51 .insns = { 52 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 53 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 54 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 55 BPF_LD_MAP_FD(BPF_REG_1, 0), 56 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 57 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 58 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 59 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 60 BPF_MOV64_IMM(BPF_REG_2, -1), 61 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5), 62 BPF_MOV64_IMM(BPF_REG_8, 0), 63 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1), 64 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2), 65 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8), 66 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0), 67 BPF_MOV64_IMM(BPF_REG_0, 0), 68 BPF_EXIT_INSN(), 69 }, 70 .fixup_map_hash_8b = { 3 }, 71 .errstr = "unbounded min value", 72 .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", 73 .result = REJECT, 74 }, 75 { 76 "bounds checks mixing signed and unsigned, variant 3", 77 .insns = { 78 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 79 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 80 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 81 BPF_LD_MAP_FD(BPF_REG_1, 0), 82 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 83 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 84 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 85 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 86 BPF_MOV64_IMM(BPF_REG_2, -1), 87 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4), 88 BPF_MOV64_REG(BPF_REG_8, BPF_REG_1), 89 BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2), 90 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8), 91 BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0), 92 BPF_MOV64_IMM(BPF_REG_0, 0), 93 BPF_EXIT_INSN(), 94 }, 95 .fixup_map_hash_8b = { 3 }, 96 .errstr = "unbounded min value", 97 .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", 98 .result = REJECT, 99 }, 100 { 101 "bounds checks mixing signed and unsigned, variant 4", 102 .insns = { 103 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 104 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 105 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 106 BPF_LD_MAP_FD(BPF_REG_1, 0), 107 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 108 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 109 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 110 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 111 BPF_MOV64_IMM(BPF_REG_2, 1), 112 BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2), 113 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 114 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 115 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 116 BPF_MOV64_IMM(BPF_REG_0, 0), 117 BPF_EXIT_INSN(), 118 }, 119 .fixup_map_hash_8b = { 3 }, 120 .result = ACCEPT, 121 }, 122 { 123 "bounds checks mixing signed and unsigned, variant 5", 124 .insns = { 125 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 126 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 127 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 128 BPF_LD_MAP_FD(BPF_REG_1, 0), 129 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 130 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 131 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 132 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 133 BPF_MOV64_IMM(BPF_REG_2, -1), 134 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5), 135 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4), 136 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4), 137 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), 138 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 139 BPF_MOV64_IMM(BPF_REG_0, 0), 140 BPF_EXIT_INSN(), 141 }, 142 .fixup_map_hash_8b = { 3 }, 143 .errstr = "unbounded min value", 144 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 145 .result = REJECT, 146 }, 147 { 148 "bounds checks mixing signed and unsigned, variant 6", 149 .insns = { 150 BPF_MOV64_IMM(BPF_REG_2, 0), 151 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10), 152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512), 153 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 154 BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16), 155 BPF_MOV64_IMM(BPF_REG_6, -1), 156 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5), 157 BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4), 158 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1), 159 BPF_MOV64_IMM(BPF_REG_5, 0), 160 BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0), 161 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes), 162 BPF_MOV64_IMM(BPF_REG_0, 0), 163 BPF_EXIT_INSN(), 164 }, 165 .errstr = "R4 min value is negative, either use unsigned", 166 .result = REJECT, 167 }, 168 { 169 "bounds checks mixing signed and unsigned, variant 7", 170 .insns = { 171 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 172 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 173 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 174 BPF_LD_MAP_FD(BPF_REG_1, 0), 175 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 176 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 177 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 178 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 179 BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024), 180 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3), 181 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 182 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 183 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 184 BPF_MOV64_IMM(BPF_REG_0, 0), 185 BPF_EXIT_INSN(), 186 }, 187 .fixup_map_hash_8b = { 3 }, 188 .result = ACCEPT, 189 }, 190 { 191 "bounds checks mixing signed and unsigned, variant 8", 192 .insns = { 193 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 194 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 195 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 196 BPF_LD_MAP_FD(BPF_REG_1, 0), 197 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 198 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 199 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 200 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 201 BPF_MOV64_IMM(BPF_REG_2, -1), 202 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 203 BPF_MOV64_IMM(BPF_REG_0, 0), 204 BPF_EXIT_INSN(), 205 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 206 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 207 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 208 BPF_MOV64_IMM(BPF_REG_0, 0), 209 BPF_EXIT_INSN(), 210 }, 211 .fixup_map_hash_8b = { 3 }, 212 .errstr = "unbounded min value", 213 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 214 .result = REJECT, 215 }, 216 { 217 "bounds checks mixing signed and unsigned, variant 9", 218 .insns = { 219 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 220 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 221 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 222 BPF_LD_MAP_FD(BPF_REG_1, 0), 223 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 224 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10), 225 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 226 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 227 BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL), 228 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 229 BPF_MOV64_IMM(BPF_REG_0, 0), 230 BPF_EXIT_INSN(), 231 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 232 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 233 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 234 BPF_MOV64_IMM(BPF_REG_0, 0), 235 BPF_EXIT_INSN(), 236 }, 237 .fixup_map_hash_8b = { 3 }, 238 .result = ACCEPT, 239 }, 240 { 241 "bounds checks mixing signed and unsigned, variant 10", 242 .insns = { 243 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 244 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 245 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 246 BPF_LD_MAP_FD(BPF_REG_1, 0), 247 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 248 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 249 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 250 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 251 BPF_MOV64_IMM(BPF_REG_2, 0), 252 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2), 253 BPF_MOV64_IMM(BPF_REG_0, 0), 254 BPF_EXIT_INSN(), 255 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 256 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 257 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 258 BPF_MOV64_IMM(BPF_REG_0, 0), 259 BPF_EXIT_INSN(), 260 }, 261 .fixup_map_hash_8b = { 3 }, 262 .errstr = "unbounded min value", 263 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 264 .result = REJECT, 265 }, 266 { 267 "bounds checks mixing signed and unsigned, variant 11", 268 .insns = { 269 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 270 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 271 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 272 BPF_LD_MAP_FD(BPF_REG_1, 0), 273 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 274 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 275 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 276 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 277 BPF_MOV64_IMM(BPF_REG_2, -1), 278 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 279 /* Dead branch. */ 280 BPF_MOV64_IMM(BPF_REG_0, 0), 281 BPF_EXIT_INSN(), 282 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 283 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 284 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 285 BPF_MOV64_IMM(BPF_REG_0, 0), 286 BPF_EXIT_INSN(), 287 }, 288 .fixup_map_hash_8b = { 3 }, 289 .errstr = "unbounded min value", 290 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 291 .result = REJECT, 292 }, 293 { 294 "bounds checks mixing signed and unsigned, variant 12", 295 .insns = { 296 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 297 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 298 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 299 BPF_LD_MAP_FD(BPF_REG_1, 0), 300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 301 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 302 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 303 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 304 BPF_MOV64_IMM(BPF_REG_2, -6), 305 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 306 BPF_MOV64_IMM(BPF_REG_0, 0), 307 BPF_EXIT_INSN(), 308 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 309 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 310 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 311 BPF_MOV64_IMM(BPF_REG_0, 0), 312 BPF_EXIT_INSN(), 313 }, 314 .fixup_map_hash_8b = { 3 }, 315 .errstr = "unbounded min value", 316 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 317 .result = REJECT, 318 }, 319 { 320 "bounds checks mixing signed and unsigned, variant 13", 321 .insns = { 322 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 323 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 324 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 325 BPF_LD_MAP_FD(BPF_REG_1, 0), 326 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 327 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 328 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 329 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 330 BPF_MOV64_IMM(BPF_REG_2, 2), 331 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 332 BPF_MOV64_IMM(BPF_REG_7, 1), 333 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2), 334 BPF_MOV64_IMM(BPF_REG_0, 0), 335 BPF_EXIT_INSN(), 336 BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1), 337 BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2), 338 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7), 339 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 340 BPF_MOV64_IMM(BPF_REG_0, 0), 341 BPF_EXIT_INSN(), 342 }, 343 .fixup_map_hash_8b = { 3 }, 344 .errstr = "unbounded min value", 345 .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds", 346 .result = REJECT, 347 }, 348 { 349 "bounds checks mixing signed and unsigned, variant 14", 350 .insns = { 351 BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1, 352 offsetof(struct __sk_buff, mark)), 353 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 354 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 355 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 356 BPF_LD_MAP_FD(BPF_REG_1, 0), 357 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 358 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8), 359 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 360 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 361 BPF_MOV64_IMM(BPF_REG_2, -1), 362 BPF_MOV64_IMM(BPF_REG_8, 2), 363 BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6), 364 BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3), 365 BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2), 366 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 367 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 368 BPF_MOV64_IMM(BPF_REG_0, 0), 369 BPF_EXIT_INSN(), 370 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3), 371 BPF_JMP_IMM(BPF_JA, 0, 0, -7), 372 }, 373 .fixup_map_hash_8b = { 4 }, 374 .errstr = "unbounded min value", 375 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 376 .result = REJECT, 377 }, 378 { 379 "bounds checks mixing signed and unsigned, variant 15", 380 .insns = { 381 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 382 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 383 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 384 BPF_LD_MAP_FD(BPF_REG_1, 0), 385 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 386 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), 387 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8), 388 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), 389 BPF_MOV64_IMM(BPF_REG_2, -6), 390 BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2), 391 BPF_MOV64_IMM(BPF_REG_0, 0), 392 BPF_EXIT_INSN(), 393 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 394 BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2), 395 BPF_MOV64_IMM(BPF_REG_0, 0), 396 BPF_EXIT_INSN(), 397 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 398 BPF_MOV64_IMM(BPF_REG_0, 0), 399 BPF_EXIT_INSN(), 400 }, 401 .fixup_map_hash_8b = { 3 }, 402 .errstr = "unbounded min value", 403 .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", 404 .result = REJECT, 405 .result_unpriv = REJECT, 406 }, 407
