445 lines · c
1/* Common tests */2{3 "map_kptr: BPF_ST imm != 0",4 .insns = {5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),6 BPF_LD_MAP_FD(BPF_REG_6, 0),7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),9 BPF_MOV64_IMM(BPF_REG_0, 0),10 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),11 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),12 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),13 BPF_EXIT_INSN(),14 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),15 BPF_EXIT_INSN(),16 },17 .prog_type = BPF_PROG_TYPE_SCHED_CLS,18 .fixup_map_kptr = { 1 },19 .result = REJECT,20 .errstr = "BPF_ST imm must be 0 when storing to kptr at off=0",21},22{23 "map_kptr: size != bpf_size_to_bytes(BPF_DW)",24 .insns = {25 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),26 BPF_LD_MAP_FD(BPF_REG_6, 0),27 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),28 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),29 BPF_MOV64_IMM(BPF_REG_0, 0),30 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),31 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),32 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),33 BPF_EXIT_INSN(),34 BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),35 BPF_EXIT_INSN(),36 },37 .prog_type = BPF_PROG_TYPE_SCHED_CLS,38 .fixup_map_kptr = { 1 },39 .result = REJECT,40 .errstr = "kptr access size must be BPF_DW",41},42{43 "map_kptr: map_value non-const var_off",44 .insns = {45 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),46 BPF_LD_MAP_FD(BPF_REG_6, 0),47 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),48 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),49 BPF_MOV64_IMM(BPF_REG_0, 0),50 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),51 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),52 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),53 BPF_EXIT_INSN(),54 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),55 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),56 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),57 BPF_EXIT_INSN(),58 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2, 0),59 BPF_JMP_IMM(BPF_JLE, BPF_REG_2, 4, 1),60 BPF_EXIT_INSN(),61 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),62 BPF_EXIT_INSN(),63 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),64 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),65 BPF_EXIT_INSN(),66 },67 .prog_type = BPF_PROG_TYPE_SCHED_CLS,68 .fixup_map_kptr = { 1 },69 .result = REJECT,70 .errstr = "kptr access cannot have variable offset",71 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,72},73{74 "map_kptr: bpf_kptr_xchg non-const var_off",75 .insns = {76 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),77 BPF_LD_MAP_FD(BPF_REG_6, 0),78 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),79 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),80 BPF_MOV64_IMM(BPF_REG_0, 0),81 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),82 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),83 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),84 BPF_EXIT_INSN(),85 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),86 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),87 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),88 BPF_EXIT_INSN(),89 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2, 0),90 BPF_JMP_IMM(BPF_JLE, BPF_REG_2, 4, 1),91 BPF_EXIT_INSN(),92 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),93 BPF_EXIT_INSN(),94 BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),95 BPF_MOV64_REG(BPF_REG_1, BPF_REG_3),96 BPF_MOV64_IMM(BPF_REG_2, 0),97 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_kptr_xchg),98 BPF_EXIT_INSN(),99 },100 .prog_type = BPF_PROG_TYPE_SCHED_CLS,101 .fixup_map_kptr = { 1 },102 .result = REJECT,103 .errstr = "R1 doesn't have constant offset. kptr has to be at the constant offset",104},105{106 "map_kptr: unaligned boundary load/store",107 .insns = {108 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),109 BPF_LD_MAP_FD(BPF_REG_6, 0),110 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),111 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),112 BPF_MOV64_IMM(BPF_REG_0, 0),113 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),114 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),115 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),116 BPF_EXIT_INSN(),117 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 7),118 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),119 BPF_EXIT_INSN(),120 },121 .prog_type = BPF_PROG_TYPE_SCHED_CLS,122 .fixup_map_kptr = { 1 },123 .result = REJECT,124 .errstr = "kptr access misaligned expected=0 off=7",125 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,126},127{128 "map_kptr: reject var_off != 0",129 .insns = {130 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),131 BPF_LD_MAP_FD(BPF_REG_6, 0),132 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),133 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),134 BPF_MOV64_IMM(BPF_REG_0, 0),135 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),136 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),137 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),138 BPF_EXIT_INSN(),139 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),140 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),141 BPF_EXIT_INSN(),142 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),143 BPF_JMP_IMM(BPF_JLE, BPF_REG_2, 4, 1),144 BPF_EXIT_INSN(),145 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),146 BPF_EXIT_INSN(),147 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),148 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),149 BPF_EXIT_INSN(),150 },151 .prog_type = BPF_PROG_TYPE_SCHED_CLS,152 .fixup_map_kptr = { 1 },153 .result = REJECT,154 .errstr = "variable untrusted_ptr_ access var_off=(0x0; 0x7) disallowed",155},156/* Tests for unreferenced PTR_TO_BTF_ID */157{158 "map_kptr: unref: reject btf_struct_ids_match == false",159 .insns = {160 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),161 BPF_LD_MAP_FD(BPF_REG_6, 0),162 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),163 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),164 BPF_MOV64_IMM(BPF_REG_0, 0),165 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),166 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),167 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),168 BPF_EXIT_INSN(),169 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),170 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),171 BPF_EXIT_INSN(),172 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 4),173 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),174 BPF_EXIT_INSN(),175 },176 .prog_type = BPF_PROG_TYPE_SCHED_CLS,177 .fixup_map_kptr = { 1 },178 .result = REJECT,179 .errstr = "invalid kptr access, R1 type=untrusted_ptr_prog_test_ref_kfunc expected=ptr_prog_test",180},181{182 "map_kptr: unref: loaded pointer marked as untrusted",183 .insns = {184 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),185 BPF_LD_MAP_FD(BPF_REG_6, 0),186 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),187 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),188 BPF_MOV64_IMM(BPF_REG_0, 0),189 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),190 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),191 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),192 BPF_EXIT_INSN(),193 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),194 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),195 BPF_EXIT_INSN(),196 },197 .prog_type = BPF_PROG_TYPE_SCHED_CLS,198 .fixup_map_kptr = { 1 },199 .result = REJECT,200 .errstr = "R0 invalid mem access 'untrusted_ptr_or_null_'",201},202{203 "map_kptr: unref: correct in kernel type size",204 .insns = {205 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),206 BPF_LD_MAP_FD(BPF_REG_6, 0),207 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),208 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),209 BPF_MOV64_IMM(BPF_REG_0, 0),210 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),211 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),212 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),213 BPF_EXIT_INSN(),214 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),215 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),216 BPF_EXIT_INSN(),217 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 32),218 BPF_EXIT_INSN(),219 },220 .prog_type = BPF_PROG_TYPE_SCHED_CLS,221 .fixup_map_kptr = { 1 },222 .result = REJECT,223 .errstr = "access beyond struct prog_test_ref_kfunc at off 32 size 8",224},225{226 "map_kptr: unref: inherit PTR_UNTRUSTED on struct walk",227 .insns = {228 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),229 BPF_LD_MAP_FD(BPF_REG_6, 0),230 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),231 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),232 BPF_MOV64_IMM(BPF_REG_0, 0),233 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),234 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),235 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),236 BPF_EXIT_INSN(),237 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),238 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),239 BPF_EXIT_INSN(),240 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 16),241 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_this_cpu_ptr),242 BPF_EXIT_INSN(),243 },244 .prog_type = BPF_PROG_TYPE_SCHED_CLS,245 .fixup_map_kptr = { 1 },246 .result = REJECT,247 .errstr = "R1 type=untrusted_ptr_ expected=percpu_ptr_",248},249{250 "map_kptr: unref: no reference state created",251 .insns = {252 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),253 BPF_LD_MAP_FD(BPF_REG_6, 0),254 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),255 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),256 BPF_MOV64_IMM(BPF_REG_0, 0),257 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),258 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),259 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),260 BPF_EXIT_INSN(),261 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),262 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),263 BPF_EXIT_INSN(),264 BPF_EXIT_INSN(),265 },266 .prog_type = BPF_PROG_TYPE_SCHED_CLS,267 .fixup_map_kptr = { 1 },268 .result = ACCEPT,269},270{271 "map_kptr: unref: bpf_kptr_xchg rejected",272 .insns = {273 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),274 BPF_LD_MAP_FD(BPF_REG_6, 0),275 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),276 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),277 BPF_MOV64_IMM(BPF_REG_0, 0),278 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),279 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),280 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),281 BPF_EXIT_INSN(),282 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),283 BPF_MOV64_IMM(BPF_REG_2, 0),284 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_kptr_xchg),285 BPF_MOV64_IMM(BPF_REG_0, 0),286 BPF_EXIT_INSN(),287 },288 .prog_type = BPF_PROG_TYPE_SCHED_CLS,289 .fixup_map_kptr = { 1 },290 .result = REJECT,291 .errstr = "off=0 kptr isn't referenced kptr",292},293/* Tests for referenced PTR_TO_BTF_ID */294{295 "map_kptr: ref: loaded pointer marked as untrusted",296 .insns = {297 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),298 BPF_LD_MAP_FD(BPF_REG_6, 0),299 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),300 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),301 BPF_MOV64_IMM(BPF_REG_0, 0),302 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),303 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),304 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),305 BPF_EXIT_INSN(),306 BPF_MOV64_IMM(BPF_REG_1, 0),307 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 8),308 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_this_cpu_ptr),309 BPF_EXIT_INSN(),310 },311 .prog_type = BPF_PROG_TYPE_SCHED_CLS,312 .fixup_map_kptr = { 1 },313 .result = REJECT,314 .errstr = "R1 type=rcu_ptr_or_null_ expected=percpu_ptr_",315},316{317 "map_kptr: ref: reject off != 0",318 .insns = {319 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),320 BPF_LD_MAP_FD(BPF_REG_6, 0),321 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),322 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),323 BPF_MOV64_IMM(BPF_REG_0, 0),324 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),325 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),326 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),327 BPF_EXIT_INSN(),328 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),329 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),331 BPF_MOV64_IMM(BPF_REG_2, 0),332 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_kptr_xchg),333 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),334 BPF_EXIT_INSN(),335 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),336 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),337 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),338 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),339 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_kptr_xchg),340 BPF_EXIT_INSN(),341 },342 .prog_type = BPF_PROG_TYPE_SCHED_CLS,343 .fixup_map_kptr = { 1 },344 .result = REJECT,345 .errstr = "invalid kptr access, R2 type=ptr_prog_test_ref_kfunc expected=ptr_prog_test_member",346},347{348 "map_kptr: ref: reference state created and released on xchg",349 .insns = {350 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),351 BPF_LD_MAP_FD(BPF_REG_6, 0),352 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),353 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),354 BPF_MOV64_IMM(BPF_REG_0, 0),355 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),356 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),357 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),358 BPF_EXIT_INSN(),359 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),360 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),361 BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),362 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),363 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),364 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_KFUNC_CALL, 0, 0),365 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),366 BPF_EXIT_INSN(),367 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),368 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),369 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_kptr_xchg),370 BPF_MOV64_IMM(BPF_REG_0, 0),371 BPF_EXIT_INSN(),372 },373 .prog_type = BPF_PROG_TYPE_SCHED_CLS,374 .fixup_map_kptr = { 1 },375 .result = REJECT,376 .errstr = "Unreleased reference id=5 alloc_insn=20",377 .fixup_kfunc_btf_id = {378 { "bpf_kfunc_call_test_acquire", 15 },379 }380},381{382 "map_kptr: ref: reject STX",383 .insns = {384 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),385 BPF_LD_MAP_FD(BPF_REG_6, 0),386 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),387 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),388 BPF_MOV64_IMM(BPF_REG_0, 0),389 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),390 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),391 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),392 BPF_EXIT_INSN(),393 BPF_MOV64_REG(BPF_REG_1, 0),394 BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),395 BPF_EXIT_INSN(),396 },397 .prog_type = BPF_PROG_TYPE_SCHED_CLS,398 .fixup_map_kptr = { 1 },399 .result = REJECT,400 .errstr = "store to referenced kptr disallowed",401},402{403 "map_kptr: ref: reject ST",404 .insns = {405 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),406 BPF_LD_MAP_FD(BPF_REG_6, 0),407 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),408 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),409 BPF_MOV64_IMM(BPF_REG_0, 0),410 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),411 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),412 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),413 BPF_EXIT_INSN(),414 BPF_ST_MEM(BPF_DW, BPF_REG_0, 8, 0),415 BPF_EXIT_INSN(),416 },417 .prog_type = BPF_PROG_TYPE_SCHED_CLS,418 .fixup_map_kptr = { 1 },419 .result = REJECT,420 .errstr = "store to referenced kptr disallowed",421},422{423 "map_kptr: reject helper access to kptr",424 .insns = {425 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),426 BPF_LD_MAP_FD(BPF_REG_6, 0),427 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),428 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),429 BPF_MOV64_IMM(BPF_REG_0, 0),430 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),431 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),432 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),433 BPF_EXIT_INSN(),434 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),435 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),436 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),437 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_delete_elem),438 BPF_EXIT_INSN(),439 },440 .prog_type = BPF_PROG_TYPE_SCHED_CLS,441 .fixup_map_kptr = { 1 },442 .result = REJECT,443 .errstr = "kptr cannot be accessed indirectly by helper",444},445