Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== bpf 2021-12-08 We've added 12 non-merge commits during the last 22 day(s) which contain a total of 29 files changed, 659 insertions(+), 80 deletions(-). The main changes are: 1) Fix an off-by-two error in packet range markings and also add a batch of new tests for coverage of these corner cases, from Maxim Mikityanskiy. 2) Fix a compilation issue on MIPS JIT for R10000 CPUs, from Johan Almbladh. 3) Fix two functional regressions and a build warning related to BTF kfunc for modules, from Kumar Kartikeya Dwivedi. 4) Fix outdated code and docs regarding BPF's migrate_disable() use on non- PREEMPT_RT kernels, from Sebastian Andrzej Siewior. 5) Add missing includes in order to be able to detangle cgroup vs bpf header dependencies, from Jakub Kicinski. 6) Fix regression in BPF sockmap tests caused by missing detachment of progs from sockets when they are removed from the map, from John Fastabend. 7) Fix a missing "no previous prototype" warning in x86 JIT caused by BPF dispatcher, from Björn Töpel. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Add selftests to cover packet access corner cases bpf: Fix the off-by-two error in range markings treewide: Add missing includes masked by cgroup -> bpf dependency tools/resolve_btfids: Skip unresolved symbol warning for empty BTF sets bpf: Fix bpf_check_mod_kfunc_call for built-in modules bpf: Make CONFIG_DEBUG_INFO_BTF depend upon CONFIG_BPF_SYSCALL mips, bpf: Fix reference to non-existing Kconfig symbol bpf: Make sure bpf_disable_instrumentation() is safe vs preemption. Documentation/locking/locktypes: Update migrate_disable() bits. bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Attach map progs to psock early for feature probes bpf, x86: Fix "no previous prototype" warning ====================

Jakub Kicinski committed 4 years ago

Commit 6efcdad2 parents 2b29cb9 b560b2129 files · +659 −80Browse files

Unified · Split

29 files

Documentation/locking/locktypes.rst +3 −6
arch/mips/net/bpf_jit_comp.h +1 −1
block/fops.c +1 −0
drivers/gpu/drm/drm_gem_shmem_helper.c +1 −0
drivers/gpu/drm/i915/gt/intel_gtt.c +1 −0
drivers/gpu/drm/i915/i915_request.c +1 −0
drivers/gpu/drm/lima/lima_device.c +1 −0
drivers/gpu/drm/msm/msm_gem_shrinker.c +1 −0
drivers/gpu/drm/ttm/ttm_tt.c +1 −0
drivers/net/ethernet/huawei/hinic/hinic_sriov.c +1 −0
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c +2 −0
drivers/pci/controller/dwc/pci-exynos.c +1 −0
drivers/pci/controller/dwc/pcie-qcom-ep.c +1 −0
drivers/usb/cdns3/host.c +1 −0
include/linux/bpf.h +3 −14
include/linux/btf.h +10 −4
include/linux/cacheinfo.h +0 −1
include/linux/device/driver.h +1 −0
include/linux/filter.h +1 −4
kernel/bpf/btf.c +2 −9
kernel/bpf/verifier.c +1 −1
lib/Kconfig.debug +1 −0
mm/damon/vaddr.c +1 −0
mm/memory_hotplug.c +1 −0
mm/swap_slots.c +1 −0
net/core/skmsg.c +5 −0
net/core/sock_map.c +10 −5
tools/bpf/resolve_btfids/main.c +5 −3
tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c +600 −32

Documentation/locking/locktypes.rst+3−6

@@ -439,11 +439,9 @@ preemption. The following substitution works on both kernels:: · 438 unmodified lines
439	439	spin_lock(&p->lock);
440	440	p->count += this_cpu_read(var2);
441	441
442		−On a non-PREEMPT_RT kernel migrate_disable() maps to preempt_disable()
443		−which makes the above code fully equivalent. On a PREEMPT_RT kernel
444	442	migrate_disable() ensures that the task is pinned on the current CPU which
445	443	in turn guarantees that the per-CPU access to var1 and var2 are staying on
446		−the same CPU.
	444	+the same CPU while the task remains preemptible.
447	445
448	446	The migrate_disable() substitution is not valid for the following
449	447	scenario::
@@ -456,9 +454,8 @@ scenario:: · 6 unmodified lines
456	454	p = this_cpu_ptr(&var1);
457	455	p->val = func2();
458	456
459		−While correct on a non-PREEMPT_RT kernel, this breaks on PREEMPT_RT because
460		−here migrate_disable() does not protect against reentrancy from a
461		−preempting task. A correct substitution for this case is::
	457	+This breaks because migrate_disable() does not protect against reentrancy from
	458	+a preempting task. A correct substitution for this case is::
462	459
463	460	func()
464	461	{

arch/mips/net/bpf_jit_comp.h+1−1

@@ -98,7 +98,7 @@ do { \ · 97 unmodified lines
98	98	#define emit(...) __emit(__VA_ARGS__)
99	99
100	100	/* Workaround for R10000 ll/sc errata */
101		−#ifdef CONFIG_WAR_R10000
	101	+#ifdef CONFIG_WAR_R10000_LLSC
102	102	#define LLSC_beqz beqzl
103	103	#else
104	104	#define LLSC_beqz beqz

block/fops.c+1−0

@@ -15,6 +15,7 @@ · 14 unmodified lines
15	15	#include <linux/falloc.h>
16	16	#include <linux/suspend.h>
17	17	#include <linux/fs.h>
	18	+#include <linux/module.h>
18	19	#include "blk.h"
19	20
20	21	static inline struct inode bdev_file_inode(struct file file)

drivers/gpu/drm/drm_gem_shmem_helper.c+1−0

@@ -9,6 +9,7 @@ · 8 unmodified lines
9	9	#include <linux/shmem_fs.h>
10	10	#include <linux/slab.h>
11	11	#include <linux/vmalloc.h>
	12	+#include <linux/module.h>
12	13
13	14	#ifdef CONFIG_X86
14	15	#include <asm/set_memory.h>

drivers/gpu/drm/i915/gt/intel_gtt.c+1−0

@@ -6,6 +6,7 @@ · 5 unmodified lines
6	6	#include <linux/slab.h> /* fault-inject.h is not standalone! */
7	7
8	8	#include <linux/fault-inject.h>
	9	+#include <linux/sched/mm.h>
9	10
10	11	#include "gem/i915_gem_lmem.h"
11	12	#include "i915_trace.h"

drivers/gpu/drm/i915/i915_request.c+1−0

@@ -29,6 +29,7 @@ · 28 unmodified lines
29	29	#include <linux/sched.h>
30	30	#include <linux/sched/clock.h>
31	31	#include <linux/sched/signal.h>
	32	+#include <linux/sched/mm.h>
32	33
33	34	#include "gem/i915_gem_context.h"
34	35	#include "gt/intel_breadcrumbs.h"

drivers/gpu/drm/lima/lima_device.c+1−0

@@ -4,6 +4,7 @@ · 3 unmodified lines
4	4	#include <linux/regulator/consumer.h>
5	5	#include <linux/reset.h>
6	6	#include <linux/clk.h>
	7	+#include <linux/slab.h>
7	8	#include <linux/dma-mapping.h>
8	9	#include <linux/platform_device.h>
9	10

drivers/gpu/drm/msm/msm_gem_shrinker.c+1−0

@@ -5,6 +5,7 @@ · 4 unmodified lines
5	5	*/
6	6
7	7	#include <linux/vmalloc.h>
	8	+#include <linux/sched/mm.h>
8	9
9	10	#include "msm_drv.h"
10	11	#include "msm_gem.h"

drivers/gpu/drm/ttm/ttm_tt.c+1−0

@@ -34,6 +34,7 @@ · 33 unmodified lines
34	34	#include <linux/sched.h>
35	35	#include <linux/shmem_fs.h>
36	36	#include <linux/file.h>
	37	+#include <linux/module.h>
37	38	#include <drm/drm_cache.h>
38	39	#include <drm/ttm/ttm_bo_driver.h>
39	40

drivers/net/ethernet/huawei/hinic/hinic_sriov.c+1−0

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	8	#include <linux/interrupt.h>
9	9	#include <linux/etherdevice.h>
10	10	#include <linux/netdevice.h>
	11	+#include <linux/module.h>
11	12
12	13	#include "hinic_hw_dev.h"
13	14	#include "hinic_dev.h"

drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c+2−0

@@ -5,6 +5,8 @@ · 4 unmodified lines
5	5	*
6	6	*/
7	7
	8	+#include <linux/module.h>
	9	+
8	10	#include "otx2_common.h"
9	11	#include "otx2_ptp.h"
10	12

drivers/pci/controller/dwc/pci-exynos.c+1−0

@@ -19,6 +19,7 @@ · 18 unmodified lines
19	19	#include <linux/platform_device.h>
20	20	#include <linux/phy/phy.h>
21	21	#include <linux/regulator/consumer.h>
	22	+#include <linux/module.h>
22	23
23	24	#include "pcie-designware.h"
24	25

drivers/pci/controller/dwc/pcie-qcom-ep.c+1−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	18	#include <linux/pm_domain.h>
19	19	#include <linux/regmap.h>
20	20	#include <linux/reset.h>
	21	+#include <linux/module.h>
21	22
22	23	#include "pcie-designware.h"
23	24

drivers/usb/cdns3/host.c+1−0

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	10	*/
11	11
12	12	#include <linux/platform_device.h>
	13	+#include <linux/slab.h>
13	14	#include "core.h"
14	15	#include "drd.h"
15	16	#include "host-export.h"

include/linux/bpf.h+3−14

@@ -732,6 +732,7 @@ int bpf_trampoline_unlink_prog(struct bpf_prog prog, struct bpf_trampoline tr) · 731 unmodified lines
732	732	struct bpf_trampoline *bpf_trampoline_get(u64 key,
733	733	struct bpf_attach_target_info *tgt_info);
734	734	void bpf_trampoline_put(struct bpf_trampoline *tr);
	735	+int arch_prepare_bpf_dispatcher(void image, s64 funcs, int num_funcs);
735	736	#define BPF_DISPATCHER_INIT(_name) { \
736	737	.mutex = __MUTEX_INITIALIZER(_name.mutex), \
737	738	.func = &_name##_func, \
@@ -1352,28 +1353,16 @@ extern struct mutex bpf_stats_enabled_mutex; · 614 unmodified lines
1352	1353	* kprobes, tracepoints) to prevent deadlocks on map operations as any of
1353	1354	* these events can happen inside a region which holds a map bucket lock
1354	1355	* and can deadlock on it.
1355		− *
1356		− * Use the preemption safe inc/dec variants on RT because migrate disable
1357		− * is preemptible on RT and preemption in the middle of the RMW operation
1358		− * might lead to inconsistent state. Use the raw variants for non RT
1359		− * kernels as migrate_disable() maps to preempt_disable() so the slightly
1360		− * more expensive save operation can be avoided.
1361	1356	*/
1362	1357	static inline void bpf_disable_instrumentation(void)
1363	1358	{
1364	1359	migrate_disable();
1365		− if (IS_ENABLED(CONFIG_PREEMPT_RT))
1366		− this_cpu_inc(bpf_prog_active);
1367		− else
1368		− __this_cpu_inc(bpf_prog_active);
	1360	+ this_cpu_inc(bpf_prog_active);
1369	1361	}
1370	1362
1371	1363	static inline void bpf_enable_instrumentation(void)
1372	1364	{
1373		− if (IS_ENABLED(CONFIG_PREEMPT_RT))
1374		− this_cpu_dec(bpf_prog_active);
1375		− else
1376		− __this_cpu_dec(bpf_prog_active);
	1365	+ this_cpu_dec(bpf_prog_active);
1377	1366	migrate_enable();
1378	1367	}
1379	1368

include/linux/btf.h+10−4

@@ -245,7 +245,10 @@ struct kfunc_btf_id_set { · 244 unmodified lines
245	245	struct module *owner;
246	246	};
247	247
248		−struct kfunc_btf_id_list;
	248	+struct kfunc_btf_id_list {
	249	+ struct list_head list;
	250	+ struct mutex mutex;
	251	+};
249	252
250	253	#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
251	254	void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
@@ -254,6 +257,9 @@ void unregister_kfunc_btf_id_set(struct kfunc_btf_id_list *l, · 2 unmodified lines
254	257	struct kfunc_btf_id_set *s);
255	258	bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, u32 kfunc_id,
256	259	struct module *owner);
	260	+
	261	+extern struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list;
	262	+extern struct kfunc_btf_id_list prog_test_kfunc_list;
257	263	#else
258	264	static inline void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
259	265	struct kfunc_btf_id_set *s)
@@ -268,13 +274,13 @@ static inline bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, · 8 unmodified lines
268	274	{
269	275	return false;
270	276	}
	277	+
	278	+static struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list __maybe_unused;
	279	+static struct kfunc_btf_id_list prog_test_kfunc_list __maybe_unused;
271	280	#endif
272	281
273	282	#define DEFINE_KFUNC_BTF_ID_SET(set, name) \
274	283	struct kfunc_btf_id_set name = { LIST_HEAD_INIT(name.list), (set), \
275	284	THIS_MODULE }
276	285
277		−extern struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list;
278		−extern struct kfunc_btf_id_list prog_test_kfunc_list;
279		−
280	286	#endif

include/linux/cacheinfo.h+0−1

@@ -3,7 +3,6 @@ · 2 unmodified lines
3	3	#define _LINUX_CACHEINFO_H
4	4
5	5	#include <linux/bitops.h>
6		−#include <linux/cpu.h>
7	6	#include <linux/cpumask.h>
8	7	#include <linux/smp.h>
9	8

include/linux/device/driver.h+1−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	18	#include <linux/klist.h>
19	19	#include <linux/pm.h>
20	20	#include <linux/device/bus.h>
	21	+#include <linux/module.h>
21	22
22	23	/**
23	24	* enum probe_type - device driver probe type to try

include/linux/filter.h+1−4

@@ -6,6 +6,7 @@ · 5 unmodified lines
6	6	#define __LINUX_FILTER_H__
7	7
8	8	#include <linux/atomic.h>
	9	+#include <linux/bpf.h>
9	10	#include <linux/refcount.h>
10	11	#include <linux/compat.h>
11	12	#include <linux/skbuff.h>
@@ -26,7 +27,6 @@ · 14 unmodified lines
26	27
27	28	#include <asm/byteorder.h>
28	29	#include <uapi/linux/filter.h>
29		−#include <uapi/linux/bpf.h>
30	30
31	31	struct sk_buff;
32	32	struct sock;
@@ -640,9 +640,6 @@ static __always_inline u32 bpf_prog_run(const struct bpf_prog *prog, const void · 607 unmodified lines
640	640	* This uses migrate_disable/enable() explicitly to document that the
641	641	* invocation of a BPF program does not require reentrancy protection
642	642	* against a BPF program which is invoked from a preempting task.
643		− *
644		− * For non RT enabled kernels migrate_disable/enable() maps to
645		− * preempt_disable/enable(), i.e. it disables also preemption.
646	643	*/
647	644	static inline u32 bpf_prog_run_pin_on_cpu(const struct bpf_prog *prog,
648	645	const void *ctx)

kernel/bpf/btf.c+2−9

@@ -6346,11 +6346,6 @@ BTF_ID_LIST_GLOBAL_SINGLE(btf_task_struct_ids, struct, task_struct) · 6345 unmodified lines
6346	6346
6347	6347	/* BTF ID set registration API for modules */
6348	6348
6349		−struct kfunc_btf_id_list {
6350		− struct list_head list;
6351		− struct mutex mutex;
6352		−};
6353		−
6354	6349	#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
6355	6350
6356	6351	void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
@@ -6376,8 +6371,6 @@ bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, u32 kfunc_id, · 19 unmodified lines
6376	6371	{
6377	6372	struct kfunc_btf_id_set *s;
6378	6373
6379		− if (!owner)
6380		− return false;
6381	6374	mutex_lock(&klist->mutex);
6382	6375	list_for_each_entry(s, &klist->list, list) {
6383	6376	if (s->owner == owner && btf_id_set_contains(s->set, kfunc_id)) {
@@ -6389,8 +6382,6 @@ bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, u32 kfunc_id, · 5 unmodified lines
6389	6382	return false;
6390	6383	}
6391	6384
6392		−#endif
6393		−
6394	6385	#define DEFINE_KFUNC_BTF_ID_LIST(name) \
6395	6386	struct kfunc_btf_id_list name = { LIST_HEAD_INIT(name.list), \
6396	6387	__MUTEX_INITIALIZER(name.mutex) }; \
@@ -6398,3 +6389,5 @@ bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, u32 kfunc_id, · 1 unmodified line
6398	6389
6399	6390	DEFINE_KFUNC_BTF_ID_LIST(bpf_tcp_ca_kfunc_list);
6400	6391	DEFINE_KFUNC_BTF_ID_LIST(prog_test_kfunc_list);
	6392	+
	6393	+#endif

kernel/bpf/verifier.c+1−1

@@ -8422,7 +8422,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate, · 8421 unmodified lines
8422	8422
8423	8423	new_range = dst_reg->off;
8424	8424	if (range_right_open)
8425		− new_range--;
	8425	+ new_range++;
8426	8426
8427	8427	/* Examples for register markings:
8428	8428	*

lib/Kconfig.debug+1−0

@@ -316,6 +316,7 @@ config DEBUG_INFO_BTF · 315 unmodified lines
316	316	bool "Generate BTF typeinfo"
317	317	depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED
318	318	depends on !GCC_PLUGIN_RANDSTRUCT \|\| COMPILE_TEST
	319	+ depends on BPF_SYSCALL
319	320	help
320	321	Generate deduplicated BTF type information from DWARF debug info.
321	322	Turning this on expects presence of pahole tool, which will convert

mm/damon/vaddr.c+1−0

@@ -13,6 +13,7 @@ · 12 unmodified lines
13	13	#include <linux/mmu_notifier.h>
14	14	#include <linux/page_idle.h>
15	15	#include <linux/pagewalk.h>
	16	+#include <linux/sched/mm.h>
16	17
17	18	#include "prmtv-common.h"
18	19

mm/memory_hotplug.c+1−0

@@ -35,6 +35,7 @@ · 34 unmodified lines
35	35	#include <linux/memblock.h>
36	36	#include <linux/compaction.h>
37	37	#include <linux/rmap.h>
	38	+#include <linux/module.h>
38	39
39	40	#include <asm/tlbflush.h>
40	41

mm/swap_slots.c+1−0

@@ -30,6 +30,7 @@ · 29 unmodified lines
30	30	#include <linux/swap_slots.h>
31	31	#include <linux/cpu.h>
32	32	#include <linux/cpumask.h>
	33	+#include <linux/slab.h>
33	34	#include <linux/vmalloc.h>
34	35	#include <linux/mutex.h>
35	36	#include <linux/mm.h>

net/core/skmsg.c+5−0

@@ -1124,6 +1124,8 @@ void sk_psock_start_strp(struct sock sk, struct sk_psock psock) · 1123 unmodified lines
1124	1124
1125	1125	void sk_psock_stop_strp(struct sock sk, struct sk_psock psock)
1126	1126	{
	1127	+ psock_set_prog(&psock->progs.stream_parser, NULL);
	1128	+
1127	1129	if (!psock->saved_data_ready)
1128	1130	return;
1129	1131
@@ -1212,6 +1214,9 @@ void sk_psock_start_verdict(struct sock sk, struct sk_psock psock) · 82 unmodified lines
1212	1214
1213	1215	void sk_psock_stop_verdict(struct sock sk, struct sk_psock psock)
1214	1216	{
	1217	+ psock_set_prog(&psock->progs.stream_verdict, NULL);
	1218	+ psock_set_prog(&psock->progs.skb_verdict, NULL);
	1219	+
1215	1220	if (!psock->saved_data_ready)
1216	1221	return;
1217	1222

net/core/sock_map.c+10−5

@@ -167,8 +167,11 @@ static void sock_map_del_link(struct sock *sk, · 166 unmodified lines
167	167	write_lock_bh(&sk->sk_callback_lock);
168	168	if (strp_stop)
169	169	sk_psock_stop_strp(sk, psock);
170		− else
	170	+ if (verdict_stop)
171	171	sk_psock_stop_verdict(sk, psock);
	172	+
	173	+ if (psock->psock_update_sk_prot)
	174	+ psock->psock_update_sk_prot(sk, psock, false);
172	175	write_unlock_bh(&sk->sk_callback_lock);
173	176	}
174	177	}
@@ -282,6 +285,12 @@ static int sock_map_link(struct bpf_map map, struct sock sk) · 107 unmodified lines
282	285
283	286	if (msg_parser)
284	287	psock_set_prog(&psock->progs.msg_parser, msg_parser);
	288	+ if (stream_parser)
	289	+ psock_set_prog(&psock->progs.stream_parser, stream_parser);
	290	+ if (stream_verdict)
	291	+ psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
	292	+ if (skb_verdict)
	293	+ psock_set_prog(&psock->progs.skb_verdict, skb_verdict);
285	294
286	295	ret = sock_map_init_proto(sk, psock);
287	296	if (ret < 0)
@@ -292,14 +301,10 @@ static int sock_map_link(struct bpf_map map, struct sock sk) · 4 unmodified lines
292	301	ret = sk_psock_init_strp(sk, psock);
293	302	if (ret)
294	303	goto out_unlock_drop;
295		− psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
296		− psock_set_prog(&psock->progs.stream_parser, stream_parser);
297	304	sk_psock_start_strp(sk, psock);
298	305	} else if (!stream_parser && stream_verdict && !psock->saved_data_ready) {
299		− psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
300	306	sk_psock_start_verdict(sk,psock);
301	307	} else if (!stream_verdict && skb_verdict && !psock->saved_data_ready) {
302		− psock_set_prog(&psock->progs.skb_verdict, skb_verdict);
303	308	sk_psock_start_verdict(sk, psock);
304	309	}
305	310	write_unlock_bh(&sk->sk_callback_lock);

tools/bpf/resolve_btfids/main.c+5−3

@@ -83,6 +83,7 @@ struct btf_id { · 82 unmodified lines
83	83	int cnt;
84	84	};
85	85	int addr_cnt;
	86	+ bool is_set;
86	87	Elf64_Addr addr[ADDR_CNT];
87	88	};
88	89
@@ -451,8 +452,10 @@ static int symbols_collect(struct object *obj) · 362 unmodified lines
451	452	* in symbol's size, together with 'cnt' field hence
452	453	* that - 1.
453	454	*/
454		− if (id)
	455	+ if (id) {
455	456	id->cnt = sym.st_size / sizeof(int) - 1;
	457	+ id->is_set = true;
	458	+ }
456	459	} else {
457	460	pr_err("FAILED unsupported prefix %s\n", prefix);
458	461	return -1;
@@ -568,9 +571,8 @@ static int id_patch(struct object obj, struct btf_id id) · 109 unmodified lines
568	571	int *ptr = data->d_buf;
569	572	int i;
570	573
571		− if (!id->id) {
	574	+ if (!id->id && !id->is_set)
572	575	pr_err("WARN: resolve_btfids: unresolved symbol %s\n", id->name);
573		− }
574	576
575	577	for (i = 0; i < id->addr_cnt; i++) {
576	578	unsigned long addr = id->addr[i];

tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c+600−32

@@ -35,7 +35,7 @@ · 34 unmodified lines
35	35	.prog_type = BPF_PROG_TYPE_XDP,
36	36	},
37	37	{
38		− "XDP pkt read, pkt_data' > pkt_end, good access",
	38	+ "XDP pkt read, pkt_data' > pkt_end, corner case, good access",
39	39	.insns = {
40	40	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
41	41	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -87,6 +87,41 @@ · 45 unmodified lines
87	87	.prog_type = BPF_PROG_TYPE_XDP,
88	88	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
89	89	},
	90	+{
	91	+ "XDP pkt read, pkt_data' > pkt_end, corner case +1, good access",
	92	+ .insns = {
	93	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	94	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	95	+ offsetof(struct xdp_md, data_end)),
	96	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	97	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	98	+ BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
	99	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	100	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	101	+ BPF_EXIT_INSN(),
	102	+ },
	103	+ .result = ACCEPT,
	104	+ .prog_type = BPF_PROG_TYPE_XDP,
	105	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	106	+},
	107	+{
	108	+ "XDP pkt read, pkt_data' > pkt_end, corner case -1, bad access",
	109	+ .insns = {
	110	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	111	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	112	+ offsetof(struct xdp_md, data_end)),
	113	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	114	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	115	+ BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
	116	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	117	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	118	+ BPF_EXIT_INSN(),
	119	+ },
	120	+ .errstr = "R1 offset is outside of the packet",
	121	+ .result = REJECT,
	122	+ .prog_type = BPF_PROG_TYPE_XDP,
	123	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	124	+},
90	125	{
91	126	"XDP pkt read, pkt_end > pkt_data', good access",
92	127	.insns = {
@@ -106,16 +141,16 @@ · 13 unmodified lines
106	141	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
107	142	},
108	143	{
109		− "XDP pkt read, pkt_end > pkt_data', bad access 1",
	144	+ "XDP pkt read, pkt_end > pkt_data', corner case -1, bad access",
110	145	.insns = {
111	146	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
112	147	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
113	148	offsetof(struct xdp_md, data_end)),
114	149	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
115		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	150	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
116	151	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
117	152	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
118		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	153	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
119	154	BPF_MOV64_IMM(BPF_REG_0, 0),
120	155	BPF_EXIT_INSN(),
121	156	},
@@ -142,6 +177,42 @@ · 20 unmodified lines
142	177	.prog_type = BPF_PROG_TYPE_XDP,
143	178	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
144	179	},
	180	+{
	181	+ "XDP pkt read, pkt_end > pkt_data', corner case, good access",
	182	+ .insns = {
	183	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	184	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	185	+ offsetof(struct xdp_md, data_end)),
	186	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	187	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	188	+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
	189	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	190	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	191	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	192	+ BPF_EXIT_INSN(),
	193	+ },
	194	+ .result = ACCEPT,
	195	+ .prog_type = BPF_PROG_TYPE_XDP,
	196	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	197	+},
	198	+{
	199	+ "XDP pkt read, pkt_end > pkt_data', corner case +1, good access",
	200	+ .insns = {
	201	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	202	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	203	+ offsetof(struct xdp_md, data_end)),
	204	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	205	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	206	+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
	207	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	208	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	209	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	210	+ BPF_EXIT_INSN(),
	211	+ },
	212	+ .result = ACCEPT,
	213	+ .prog_type = BPF_PROG_TYPE_XDP,
	214	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	215	+},
145	216	{
146	217	"XDP pkt read, pkt_data' < pkt_end, good access",
147	218	.insns = {
@@ -161,16 +232,16 @@ · 13 unmodified lines
161	232	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
162	233	},
163	234	{
164		− "XDP pkt read, pkt_data' < pkt_end, bad access 1",
	235	+ "XDP pkt read, pkt_data' < pkt_end, corner case -1, bad access",
165	236	.insns = {
166	237	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
167	238	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
168	239	offsetof(struct xdp_md, data_end)),
169	240	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
170		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	241	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
171	242	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
172	243	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
173		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	244	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
174	245	BPF_MOV64_IMM(BPF_REG_0, 0),
175	246	BPF_EXIT_INSN(),
176	247	},
@@ -198,7 +269,43 @@ · 21 unmodified lines
198	269	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
199	270	},
200	271	{
201		− "XDP pkt read, pkt_end < pkt_data', good access",
	272	+ "XDP pkt read, pkt_data' < pkt_end, corner case, good access",
	273	+ .insns = {
	274	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	275	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	276	+ offsetof(struct xdp_md, data_end)),
	277	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	278	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	279	+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
	280	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	281	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	282	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	283	+ BPF_EXIT_INSN(),
	284	+ },
	285	+ .result = ACCEPT,
	286	+ .prog_type = BPF_PROG_TYPE_XDP,
	287	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	288	+},
	289	+{
	290	+ "XDP pkt read, pkt_data' < pkt_end, corner case +1, good access",
	291	+ .insns = {
	292	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	293	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	294	+ offsetof(struct xdp_md, data_end)),
	295	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	296	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	297	+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
	298	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	299	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	300	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	301	+ BPF_EXIT_INSN(),
	302	+ },
	303	+ .result = ACCEPT,
	304	+ .prog_type = BPF_PROG_TYPE_XDP,
	305	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	306	+},
	307	+{
	308	+ "XDP pkt read, pkt_end < pkt_data', corner case, good access",
202	309	.insns = {
203	310	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
204	311	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -250,6 +357,41 @@ · 45 unmodified lines
250	357	.prog_type = BPF_PROG_TYPE_XDP,
251	358	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
252	359	},
	360	+{
	361	+ "XDP pkt read, pkt_end < pkt_data', corner case +1, good access",
	362	+ .insns = {
	363	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	364	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	365	+ offsetof(struct xdp_md, data_end)),
	366	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	367	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	368	+ BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
	369	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	370	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	371	+ BPF_EXIT_INSN(),
	372	+ },
	373	+ .result = ACCEPT,
	374	+ .prog_type = BPF_PROG_TYPE_XDP,
	375	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	376	+},
	377	+{
	378	+ "XDP pkt read, pkt_end < pkt_data', corner case -1, bad access",
	379	+ .insns = {
	380	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	381	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	382	+ offsetof(struct xdp_md, data_end)),
	383	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	384	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	385	+ BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
	386	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	387	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	388	+ BPF_EXIT_INSN(),
	389	+ },
	390	+ .errstr = "R1 offset is outside of the packet",
	391	+ .result = REJECT,
	392	+ .prog_type = BPF_PROG_TYPE_XDP,
	393	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	394	+},
253	395	{
254	396	"XDP pkt read, pkt_data' >= pkt_end, good access",
255	397	.insns = {
@@ -268,15 +410,15 @@ · 12 unmodified lines
268	410	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
269	411	},
270	412	{
271		− "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
	413	+ "XDP pkt read, pkt_data' >= pkt_end, corner case -1, bad access",
272	414	.insns = {
273	415	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
274	416	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
275	417	offsetof(struct xdp_md, data_end)),
276	418	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
277		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	419	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
278	420	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
279		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	421	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
280	422	BPF_MOV64_IMM(BPF_REG_0, 0),
281	423	BPF_EXIT_INSN(),
282	424	},
@@ -304,7 +446,41 @@ · 21 unmodified lines
304	446	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
305	447	},
306	448	{
307		− "XDP pkt read, pkt_end >= pkt_data', good access",
	449	+ "XDP pkt read, pkt_data' >= pkt_end, corner case, good access",
	450	+ .insns = {
	451	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	452	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	453	+ offsetof(struct xdp_md, data_end)),
	454	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	455	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	456	+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
	457	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	458	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	459	+ BPF_EXIT_INSN(),
	460	+ },
	461	+ .result = ACCEPT,
	462	+ .prog_type = BPF_PROG_TYPE_XDP,
	463	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	464	+},
	465	+{
	466	+ "XDP pkt read, pkt_data' >= pkt_end, corner case +1, good access",
	467	+ .insns = {
	468	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	469	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	470	+ offsetof(struct xdp_md, data_end)),
	471	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	472	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	473	+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
	474	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	475	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	476	+ BPF_EXIT_INSN(),
	477	+ },
	478	+ .result = ACCEPT,
	479	+ .prog_type = BPF_PROG_TYPE_XDP,
	480	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	481	+},
	482	+{
	483	+ "XDP pkt read, pkt_end >= pkt_data', corner case, good access",
308	484	.insns = {
309	485	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
310	486	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -359,7 +535,44 @@ · 48 unmodified lines
359	535	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
360	536	},
361	537	{
362		− "XDP pkt read, pkt_data' <= pkt_end, good access",
	538	+ "XDP pkt read, pkt_end >= pkt_data', corner case +1, good access",
	539	+ .insns = {
	540	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	541	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	542	+ offsetof(struct xdp_md, data_end)),
	543	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	544	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	545	+ BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
	546	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	547	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	548	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	549	+ BPF_EXIT_INSN(),
	550	+ },
	551	+ .result = ACCEPT,
	552	+ .prog_type = BPF_PROG_TYPE_XDP,
	553	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	554	+},
	555	+{
	556	+ "XDP pkt read, pkt_end >= pkt_data', corner case -1, bad access",
	557	+ .insns = {
	558	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	559	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	560	+ offsetof(struct xdp_md, data_end)),
	561	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	562	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	563	+ BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
	564	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	565	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	566	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	567	+ BPF_EXIT_INSN(),
	568	+ },
	569	+ .errstr = "R1 offset is outside of the packet",
	570	+ .result = REJECT,
	571	+ .prog_type = BPF_PROG_TYPE_XDP,
	572	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	573	+},
	574	+{
	575	+ "XDP pkt read, pkt_data' <= pkt_end, corner case, good access",
363	576	.insns = {
364	577	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
365	578	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -413,6 +626,43 @@ · 47 unmodified lines
413	626	.prog_type = BPF_PROG_TYPE_XDP,
414	627	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
415	628	},
	629	+{
	630	+ "XDP pkt read, pkt_data' <= pkt_end, corner case +1, good access",
	631	+ .insns = {
	632	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	633	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	634	+ offsetof(struct xdp_md, data_end)),
	635	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	636	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	637	+ BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
	638	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	639	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	640	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	641	+ BPF_EXIT_INSN(),
	642	+ },
	643	+ .result = ACCEPT,
	644	+ .prog_type = BPF_PROG_TYPE_XDP,
	645	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	646	+},
	647	+{
	648	+ "XDP pkt read, pkt_data' <= pkt_end, corner case -1, bad access",
	649	+ .insns = {
	650	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	651	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	652	+ offsetof(struct xdp_md, data_end)),
	653	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	654	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	655	+ BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
	656	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	657	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	658	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	659	+ BPF_EXIT_INSN(),
	660	+ },
	661	+ .errstr = "R1 offset is outside of the packet",
	662	+ .result = REJECT,
	663	+ .prog_type = BPF_PROG_TYPE_XDP,
	664	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	665	+},
416	666	{
417	667	"XDP pkt read, pkt_end <= pkt_data', good access",
418	668	.insns = {
@@ -431,15 +681,15 @@ · 12 unmodified lines
431	681	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
432	682	},
433	683	{
434		− "XDP pkt read, pkt_end <= pkt_data', bad access 1",
	684	+ "XDP pkt read, pkt_end <= pkt_data', corner case -1, bad access",
435	685	.insns = {
436	686	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
437	687	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
438	688	offsetof(struct xdp_md, data_end)),
439	689	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
440		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	690	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
441	691	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
442		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	692	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
443	693	BPF_MOV64_IMM(BPF_REG_0, 0),
444	694	BPF_EXIT_INSN(),
445	695	},
@@ -467,7 +717,41 @@ · 21 unmodified lines
467	717	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
468	718	},
469	719	{
470		− "XDP pkt read, pkt_meta' > pkt_data, good access",
	720	+ "XDP pkt read, pkt_end <= pkt_data', corner case, good access",
	721	+ .insns = {
	722	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	723	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	724	+ offsetof(struct xdp_md, data_end)),
	725	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	726	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	727	+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
	728	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	729	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	730	+ BPF_EXIT_INSN(),
	731	+ },
	732	+ .result = ACCEPT,
	733	+ .prog_type = BPF_PROG_TYPE_XDP,
	734	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	735	+},
	736	+{
	737	+ "XDP pkt read, pkt_end <= pkt_data', corner case +1, good access",
	738	+ .insns = {
	739	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
	740	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
	741	+ offsetof(struct xdp_md, data_end)),
	742	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	743	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	744	+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
	745	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	746	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	747	+ BPF_EXIT_INSN(),
	748	+ },
	749	+ .result = ACCEPT,
	750	+ .prog_type = BPF_PROG_TYPE_XDP,
	751	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	752	+},
	753	+{
	754	+ "XDP pkt read, pkt_meta' > pkt_data, corner case, good access",
471	755	.insns = {
472	756	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
473	757	offsetof(struct xdp_md, data_meta)),
@@ -519,6 +803,41 @@ · 45 unmodified lines
519	803	.prog_type = BPF_PROG_TYPE_XDP,
520	804	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
521	805	},
	806	+{
	807	+ "XDP pkt read, pkt_meta' > pkt_data, corner case +1, good access",
	808	+ .insns = {
	809	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	810	+ offsetof(struct xdp_md, data_meta)),
	811	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	812	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	813	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	814	+ BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
	815	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	816	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	817	+ BPF_EXIT_INSN(),
	818	+ },
	819	+ .result = ACCEPT,
	820	+ .prog_type = BPF_PROG_TYPE_XDP,
	821	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	822	+},
	823	+{
	824	+ "XDP pkt read, pkt_meta' > pkt_data, corner case -1, bad access",
	825	+ .insns = {
	826	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	827	+ offsetof(struct xdp_md, data_meta)),
	828	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	829	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	830	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	831	+ BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
	832	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	833	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	834	+ BPF_EXIT_INSN(),
	835	+ },
	836	+ .errstr = "R1 offset is outside of the packet",
	837	+ .result = REJECT,
	838	+ .prog_type = BPF_PROG_TYPE_XDP,
	839	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	840	+},
522	841	{
523	842	"XDP pkt read, pkt_data > pkt_meta', good access",
524	843	.insns = {
@@ -538,16 +857,16 @@ · 13 unmodified lines
538	857	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
539	858	},
540	859	{
541		− "XDP pkt read, pkt_data > pkt_meta', bad access 1",
	860	+ "XDP pkt read, pkt_data > pkt_meta', corner case -1, bad access",
542	861	.insns = {
543	862	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
544	863	offsetof(struct xdp_md, data_meta)),
545	864	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
546	865	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
547		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	866	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
548	867	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
549	868	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
550		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	869	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
551	870	BPF_MOV64_IMM(BPF_REG_0, 0),
552	871	BPF_EXIT_INSN(),
553	872	},
@@ -574,6 +893,42 @@ · 20 unmodified lines
574	893	.prog_type = BPF_PROG_TYPE_XDP,
575	894	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
576	895	},
	896	+{
	897	+ "XDP pkt read, pkt_data > pkt_meta', corner case, good access",
	898	+ .insns = {
	899	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	900	+ offsetof(struct xdp_md, data_meta)),
	901	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	902	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	903	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	904	+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
	905	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	906	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	907	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	908	+ BPF_EXIT_INSN(),
	909	+ },
	910	+ .result = ACCEPT,
	911	+ .prog_type = BPF_PROG_TYPE_XDP,
	912	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	913	+},
	914	+{
	915	+ "XDP pkt read, pkt_data > pkt_meta', corner case +1, good access",
	916	+ .insns = {
	917	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	918	+ offsetof(struct xdp_md, data_meta)),
	919	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	920	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	921	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	922	+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
	923	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	924	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	925	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	926	+ BPF_EXIT_INSN(),
	927	+ },
	928	+ .result = ACCEPT,
	929	+ .prog_type = BPF_PROG_TYPE_XDP,
	930	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	931	+},
577	932	{
578	933	"XDP pkt read, pkt_meta' < pkt_data, good access",
579	934	.insns = {
@@ -593,16 +948,16 @@ · 13 unmodified lines
593	948	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
594	949	},
595	950	{
596		− "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
	951	+ "XDP pkt read, pkt_meta' < pkt_data, corner case -1, bad access",
597	952	.insns = {
598	953	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
599	954	offsetof(struct xdp_md, data_meta)),
600	955	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
601	956	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
602		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	957	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
603	958	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
604	959	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
605		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	960	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
606	961	BPF_MOV64_IMM(BPF_REG_0, 0),
607	962	BPF_EXIT_INSN(),
608	963	},
@@ -630,7 +985,43 @@ · 21 unmodified lines
630	985	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
631	986	},
632	987	{
633		− "XDP pkt read, pkt_data < pkt_meta', good access",
	988	+ "XDP pkt read, pkt_meta' < pkt_data, corner case, good access",
	989	+ .insns = {
	990	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	991	+ offsetof(struct xdp_md, data_meta)),
	992	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	993	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	994	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	995	+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
	996	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	997	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	998	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	999	+ BPF_EXIT_INSN(),
	1000	+ },
	1001	+ .result = ACCEPT,
	1002	+ .prog_type = BPF_PROG_TYPE_XDP,
	1003	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1004	+},
	1005	+{
	1006	+ "XDP pkt read, pkt_meta' < pkt_data, corner case +1, good access",
	1007	+ .insns = {
	1008	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1009	+ offsetof(struct xdp_md, data_meta)),
	1010	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1011	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1012	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	1013	+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
	1014	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	1015	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	1016	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1017	+ BPF_EXIT_INSN(),
	1018	+ },
	1019	+ .result = ACCEPT,
	1020	+ .prog_type = BPF_PROG_TYPE_XDP,
	1021	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1022	+},
	1023	+{
	1024	+ "XDP pkt read, pkt_data < pkt_meta', corner case, good access",
634	1025	.insns = {
635	1026	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
636	1027	offsetof(struct xdp_md, data_meta)),
@@ -682,6 +1073,41 @@ · 45 unmodified lines
682	1073	.prog_type = BPF_PROG_TYPE_XDP,
683	1074	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
684	1075	},
	1076	+{
	1077	+ "XDP pkt read, pkt_data < pkt_meta', corner case +1, good access",
	1078	+ .insns = {
	1079	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1080	+ offsetof(struct xdp_md, data_meta)),
	1081	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1082	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1083	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	1084	+ BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
	1085	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	1086	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1087	+ BPF_EXIT_INSN(),
	1088	+ },
	1089	+ .result = ACCEPT,
	1090	+ .prog_type = BPF_PROG_TYPE_XDP,
	1091	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1092	+},
	1093	+{
	1094	+ "XDP pkt read, pkt_data < pkt_meta', corner case -1, bad access",
	1095	+ .insns = {
	1096	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1097	+ offsetof(struct xdp_md, data_meta)),
	1098	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1099	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1100	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	1101	+ BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
	1102	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	1103	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1104	+ BPF_EXIT_INSN(),
	1105	+ },
	1106	+ .errstr = "R1 offset is outside of the packet",
	1107	+ .result = REJECT,
	1108	+ .prog_type = BPF_PROG_TYPE_XDP,
	1109	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1110	+},
685	1111	{
686	1112	"XDP pkt read, pkt_meta' >= pkt_data, good access",
687	1113	.insns = {
@@ -700,15 +1126,15 @@ · 12 unmodified lines
700	1126	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
701	1127	},
702	1128	{
703		− "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
	1129	+ "XDP pkt read, pkt_meta' >= pkt_data, corner case -1, bad access",
704	1130	.insns = {
705	1131	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
706	1132	offsetof(struct xdp_md, data_meta)),
707	1133	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
708	1134	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
709		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	1135	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
710	1136	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
711		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	1137	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
712	1138	BPF_MOV64_IMM(BPF_REG_0, 0),
713	1139	BPF_EXIT_INSN(),
714	1140	},
@@ -736,7 +1162,41 @@ · 21 unmodified lines
736	1162	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
737	1163	},
738	1164	{
739		− "XDP pkt read, pkt_data >= pkt_meta', good access",
	1165	+ "XDP pkt read, pkt_meta' >= pkt_data, corner case, good access",
	1166	+ .insns = {
	1167	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1168	+ offsetof(struct xdp_md, data_meta)),
	1169	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1170	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1171	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	1172	+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
	1173	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	1174	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1175	+ BPF_EXIT_INSN(),
	1176	+ },
	1177	+ .result = ACCEPT,
	1178	+ .prog_type = BPF_PROG_TYPE_XDP,
	1179	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1180	+},
	1181	+{
	1182	+ "XDP pkt read, pkt_meta' >= pkt_data, corner case +1, good access",
	1183	+ .insns = {
	1184	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1185	+ offsetof(struct xdp_md, data_meta)),
	1186	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1187	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1188	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	1189	+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
	1190	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	1191	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1192	+ BPF_EXIT_INSN(),
	1193	+ },
	1194	+ .result = ACCEPT,
	1195	+ .prog_type = BPF_PROG_TYPE_XDP,
	1196	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1197	+},
	1198	+{
	1199	+ "XDP pkt read, pkt_data >= pkt_meta', corner case, good access",
740	1200	.insns = {
741	1201	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
742	1202	offsetof(struct xdp_md, data_meta)),
@@ -791,7 +1251,44 @@ · 48 unmodified lines
791	1251	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
792	1252	},
793	1253	{
794		− "XDP pkt read, pkt_meta' <= pkt_data, good access",
	1254	+ "XDP pkt read, pkt_data >= pkt_meta', corner case +1, good access",
	1255	+ .insns = {
	1256	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1257	+ offsetof(struct xdp_md, data_meta)),
	1258	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1259	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1260	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	1261	+ BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
	1262	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	1263	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	1264	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1265	+ BPF_EXIT_INSN(),
	1266	+ },
	1267	+ .result = ACCEPT,
	1268	+ .prog_type = BPF_PROG_TYPE_XDP,
	1269	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1270	+},
	1271	+{
	1272	+ "XDP pkt read, pkt_data >= pkt_meta', corner case -1, bad access",
	1273	+ .insns = {
	1274	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1275	+ offsetof(struct xdp_md, data_meta)),
	1276	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1277	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1278	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	1279	+ BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
	1280	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	1281	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	1282	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1283	+ BPF_EXIT_INSN(),
	1284	+ },
	1285	+ .errstr = "R1 offset is outside of the packet",
	1286	+ .result = REJECT,
	1287	+ .prog_type = BPF_PROG_TYPE_XDP,
	1288	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1289	+},
	1290	+{
	1291	+ "XDP pkt read, pkt_meta' <= pkt_data, corner case, good access",
795	1292	.insns = {
796	1293	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
797	1294	offsetof(struct xdp_md, data_meta)),
@@ -845,6 +1342,43 @@ · 47 unmodified lines
845	1342	.prog_type = BPF_PROG_TYPE_XDP,
846	1343	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
847	1344	},
	1345	+{
	1346	+ "XDP pkt read, pkt_meta' <= pkt_data, corner case +1, good access",
	1347	+ .insns = {
	1348	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1349	+ offsetof(struct xdp_md, data_meta)),
	1350	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1351	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1352	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
	1353	+ BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
	1354	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	1355	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
	1356	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1357	+ BPF_EXIT_INSN(),
	1358	+ },
	1359	+ .result = ACCEPT,
	1360	+ .prog_type = BPF_PROG_TYPE_XDP,
	1361	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1362	+},
	1363	+{
	1364	+ "XDP pkt read, pkt_meta' <= pkt_data, corner case -1, bad access",
	1365	+ .insns = {
	1366	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1367	+ offsetof(struct xdp_md, data_meta)),
	1368	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1369	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1370	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	1371	+ BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
	1372	+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
	1373	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	1374	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1375	+ BPF_EXIT_INSN(),
	1376	+ },
	1377	+ .errstr = "R1 offset is outside of the packet",
	1378	+ .result = REJECT,
	1379	+ .prog_type = BPF_PROG_TYPE_XDP,
	1380	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1381	+},
848	1382	{
849	1383	"XDP pkt read, pkt_data <= pkt_meta', good access",
850	1384	.insns = {
@@ -863,15 +1397,15 @@ · 12 unmodified lines
863	1397	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
864	1398	},
865	1399	{
866		− "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
	1400	+ "XDP pkt read, pkt_data <= pkt_meta', corner case -1, bad access",
867	1401	.insns = {
868	1402	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
869	1403	offsetof(struct xdp_md, data_meta)),
870	1404	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
871	1405	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
872		− BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	1406	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
873	1407	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
874		− BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	1408	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
875	1409	BPF_MOV64_IMM(BPF_REG_0, 0),
876	1410	BPF_EXIT_INSN(),
877	1411	},
@@ -898,3 +1432,37 @@ · 20 unmodified lines
898	1432	.prog_type = BPF_PROG_TYPE_XDP,
899	1433	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
900	1434	},
	1435	+{
	1436	+ "XDP pkt read, pkt_data <= pkt_meta', corner case, good access",
	1437	+ .insns = {
	1438	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1439	+ offsetof(struct xdp_md, data_meta)),
	1440	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1441	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1442	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
	1443	+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
	1444	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
	1445	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1446	+ BPF_EXIT_INSN(),
	1447	+ },
	1448	+ .result = ACCEPT,
	1449	+ .prog_type = BPF_PROG_TYPE_XDP,
	1450	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1451	+},
	1452	+{
	1453	+ "XDP pkt read, pkt_data <= pkt_meta', corner case +1, good access",
	1454	+ .insns = {
	1455	+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
	1456	+ offsetof(struct xdp_md, data_meta)),
	1457	+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
	1458	+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
	1459	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
	1460	+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
	1461	+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
	1462	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	1463	+ BPF_EXIT_INSN(),
	1464	+ },
	1465	+ .result = ACCEPT,
	1466	+ .prog_type = BPF_PROG_TYPE_XDP,
	1467	+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
	1468	+},