0001 {
0002 "map element value illegal alu op, 1",
0003 .insns = {
0004 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0005 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0006 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0007 BPF_LD_MAP_FD(BPF_REG_1, 0),
0008 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0009 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0010 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
0011 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
0012 BPF_EXIT_INSN(),
0013 },
0014 .fixup_map_hash_48b = { 3 },
0015 .errstr = "R0 bitwise operator &= on pointer",
0016 .result = REJECT,
0017 },
0018 {
0019 "map element value illegal alu op, 2",
0020 .insns = {
0021 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0022 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0023 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0024 BPF_LD_MAP_FD(BPF_REG_1, 0),
0025 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0026 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0027 BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
0028 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
0029 BPF_EXIT_INSN(),
0030 },
0031 .fixup_map_hash_48b = { 3 },
0032 .errstr = "R0 32-bit pointer arithmetic prohibited",
0033 .result = REJECT,
0034 },
0035 {
0036 "map element value illegal alu op, 3",
0037 .insns = {
0038 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0039 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0040 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0041 BPF_LD_MAP_FD(BPF_REG_1, 0),
0042 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0043 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0044 BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
0045 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
0046 BPF_EXIT_INSN(),
0047 },
0048 .fixup_map_hash_48b = { 3 },
0049 .errstr = "R0 pointer arithmetic with /= operator",
0050 .result = REJECT,
0051 },
0052 {
0053 "map element value illegal alu op, 4",
0054 .insns = {
0055 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0056 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0057 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0058 BPF_LD_MAP_FD(BPF_REG_1, 0),
0059 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0060 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
0061 BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
0062 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
0063 BPF_EXIT_INSN(),
0064 },
0065 .fixup_map_hash_48b = { 3 },
0066 .errstr_unpriv = "R0 pointer arithmetic prohibited",
0067 .errstr = "invalid mem access 'scalar'",
0068 .result = REJECT,
0069 .result_unpriv = REJECT,
0070 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0071 },
0072 {
0073 "map element value illegal alu op, 5",
0074 .insns = {
0075 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0076 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0077 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
0078 BPF_LD_MAP_FD(BPF_REG_1, 0),
0079 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
0080 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
0081 BPF_MOV64_IMM(BPF_REG_3, 4096),
0082 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0083 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0084 BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
0085 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_2, BPF_REG_3, 0),
0086 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
0087 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
0088 BPF_EXIT_INSN(),
0089 },
0090 .fixup_map_hash_48b = { 3 },
0091 .errstr_unpriv = "leaking pointer from stack off -8",
0092 .errstr = "R0 invalid mem access 'scalar'",
0093 .result = REJECT,
0094 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0095 },
