1 { 2 "map in map access", 3 .insns = { 4 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 7 BPF_LD_MAP_FD(BPF_REG_1, 0), 8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5), 10 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 11 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 12 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 13 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 14 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 15 BPF_MOV64_IMM(BPF_REG_0, 0), 16 BPF_EXIT_INSN(), 17 }, 18 .fixup_map_in_map = { 3 }, 19 .result = ACCEPT, 20 }, 21 { 22 "invalid inner map pointer", 23 .insns = { 24 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 25 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 26 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 27 BPF_LD_MAP_FD(BPF_REG_1, 0), 28 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 29 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 30 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 31 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 32 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 33 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 34 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 35 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 36 BPF_MOV64_IMM(BPF_REG_0, 0), 37 BPF_EXIT_INSN(), 38 }, 39 .fixup_map_in_map = { 3 }, 40 .errstr = "R1 pointer arithmetic on map_ptr prohibited", 41 .result = REJECT, 42 }, 43 { 44 "forgot null checking on the inner map pointer", 45 .insns = { 46 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 47 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 48 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 49 BPF_LD_MAP_FD(BPF_REG_1, 0), 50 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 51 BPF_ST_MEM(0, BPF_REG_10, -4, 0), 52 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 53 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), 54 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 55 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 56 BPF_MOV64_IMM(BPF_REG_0, 0), 57 BPF_EXIT_INSN(), 58 }, 59 .fixup_map_in_map = { 3 }, 60 .errstr = "R1 type=map_value_or_null expected=map_ptr", 61 .result = REJECT, 62 }, 63
