Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says: ==================== bpf 2021-12-08 We've added 12 non-merge commits during the last 22 day(s) which contain a total of 29 files changed, 659 insertions(+), 80 deletions(-). The main changes are: 1) Fix an off-by-two error in packet range markings and also add a batch of new tests for coverage of these corner cases, from Maxim Mikityanskiy. 2) Fix a compilation issue on MIPS JIT for R10000 CPUs, from Johan Almbladh. 3) Fix two functional regressions and a build warning related to BTF kfunc for modules, from Kumar Kartikeya Dwivedi. 4) Fix outdated code and docs regarding BPF's migrate_disable() use on non- PREEMPT_RT kernels, from Sebastian Andrzej Siewior. 5) Add missing includes in order to be able to detangle cgroup vs bpf header dependencies, from Jakub Kicinski. 6) Fix regression in BPF sockmap tests caused by missing detachment of progs from sockets when they are removed from the map, from John Fastabend. 7) Fix a missing "no previous prototype" warning in x86 JIT caused by BPF dispatcher, from Björn Töpel. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Add selftests to cover packet access corner cases bpf: Fix the off-by-two error in range markings treewide: Add missing includes masked by cgroup -> bpf dependency tools/resolve_btfids: Skip unresolved symbol warning for empty BTF sets bpf: Fix bpf_check_mod_kfunc_call for built-in modules bpf: Make CONFIG_DEBUG_INFO_BTF depend upon CONFIG_BPF_SYSCALL mips, bpf: Fix reference to non-existing Kconfig symbol bpf: Make sure bpf_disable_instrumentation() is safe vs preemption. Documentation/locking/locktypes: Update migrate_disable() bits. bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Attach map progs to psock early for feature probes bpf, x86: Fix "no previous prototype" warning ====================

Jakub Kicinski committed 4 years ago

Commit 6efcdad2 parents 2b29cb9 b560b2129 files · +659 −80Browse files

Unified · Split

29 files

Documentation/locking/locktypes.rst +3 −6
arch/mips/net/bpf_jit_comp.h +1 −1
block/fops.c +1 −0
drivers/gpu/drm/drm_gem_shmem_helper.c +1 −0
drivers/gpu/drm/i915/gt/intel_gtt.c +1 −0
drivers/gpu/drm/i915/i915_request.c +1 −0
drivers/gpu/drm/lima/lima_device.c +1 −0
drivers/gpu/drm/msm/msm_gem_shrinker.c +1 −0
drivers/gpu/drm/ttm/ttm_tt.c +1 −0
drivers/net/ethernet/huawei/hinic/hinic_sriov.c +1 −0
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c +2 −0
drivers/pci/controller/dwc/pci-exynos.c +1 −0
drivers/pci/controller/dwc/pcie-qcom-ep.c +1 −0
drivers/usb/cdns3/host.c +1 −0
include/linux/bpf.h +3 −14
include/linux/btf.h +10 −4
include/linux/cacheinfo.h +0 −1
include/linux/device/driver.h +1 −0
include/linux/filter.h +1 −4
kernel/bpf/btf.c +2 −9
kernel/bpf/verifier.c +1 −1
lib/Kconfig.debug +1 −0
mm/damon/vaddr.c +1 −0
mm/memory_hotplug.c +1 −0
mm/swap_slots.c +1 −0
net/core/skmsg.c +5 −0
net/core/sock_map.c +10 −5
tools/bpf/resolve_btfids/main.c +5 −3
tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c +600 −32

Documentation/locking/locktypes.rst+3−6

   spin_lock(&p->lock);
   p->count += this_cpu_read(var2);
-On a non-PREEMPT_RT kernel migrate_disable() maps to preempt_disable()
-which makes the above code fully equivalent. On a PREEMPT_RT kernel
 migrate_disable() ensures that the task is pinned on the current CPU which
 in turn guarantees that the per-CPU access to var1 and var2 are staying on
-the same CPU.
+the same CPU while the task remains preemptible.
 The migrate_disable() substitution is not valid for the following
 scenario::
     p = this_cpu_ptr(&var1);
     p->val = func2();
-While correct on a non-PREEMPT_RT kernel, this breaks on PREEMPT_RT because
+This breaks because migrate_disable() does not protect against reentrancy from
-here migrate_disable() does not protect against reentrancy from a
+a preempting task. A correct substitution for this case is::
-preempting task. A correct substitution for this case is::
   func()
   {

arch/mips/net/bpf_jit_comp.h+1−1

@@ -98,7 +98,7 @@ do { \ · 97 unmodified lines
98	#define emit(...) __emit(__VA_ARGS__)	98	#define emit(...) __emit(__VA_ARGS__)
99		99
100	/* Workaround for R10000 ll/sc errata */	100	/* Workaround for R10000 ll/sc errata */
101	#ifdef CONFIG_WAR_R10000	101	#ifdef CONFIG_WAR_R10000_LLSC
102	#define LLSC_beqz beqzl	102	#define LLSC_beqz beqzl
103	#else	103	#else
104	#define LLSC_beqz beqz	104	#define LLSC_beqz beqz

block/fops.c+1−0

@@ -15,6 +15,7 @@ · 14 unmodified lines
15	#include <linux/falloc.h>	15	#include <linux/falloc.h>
16	#include <linux/suspend.h>	16	#include <linux/suspend.h>
17	#include <linux/fs.h>	17	#include <linux/fs.h>
		18	#include <linux/module.h>
18	#include "blk.h"	19	#include "blk.h"
19		20
20	static inline struct inode bdev_file_inode(struct file file)	21	static inline struct inode bdev_file_inode(struct file file)

drivers/gpu/drm/drm_gem_shmem_helper.c+1−0

@@ -9,6 +9,7 @@ · 8 unmodified lines
9	#include <linux/shmem_fs.h>	9	#include <linux/shmem_fs.h>
10	#include <linux/slab.h>	10	#include <linux/slab.h>
11	#include <linux/vmalloc.h>	11	#include <linux/vmalloc.h>
		12	#include <linux/module.h>
12		13
13	#ifdef CONFIG_X86	14	#ifdef CONFIG_X86
14	#include <asm/set_memory.h>	15	#include <asm/set_memory.h>

drivers/gpu/drm/i915/gt/intel_gtt.c+1−0

@@ -6,6 +6,7 @@ · 5 unmodified lines
6	#include <linux/slab.h> /* fault-inject.h is not standalone! */	6	#include <linux/slab.h> /* fault-inject.h is not standalone! */
7		7
8	#include <linux/fault-inject.h>	8	#include <linux/fault-inject.h>
		9	#include <linux/sched/mm.h>
9		10
10	#include "gem/i915_gem_lmem.h"	11	#include "gem/i915_gem_lmem.h"
11	#include "i915_trace.h"	12	#include "i915_trace.h"

drivers/gpu/drm/i915/i915_request.c+1−0

@@ -29,6 +29,7 @@ · 28 unmodified lines
29	#include <linux/sched.h>	29	#include <linux/sched.h>
30	#include <linux/sched/clock.h>	30	#include <linux/sched/clock.h>
31	#include <linux/sched/signal.h>	31	#include <linux/sched/signal.h>
		32	#include <linux/sched/mm.h>
32		33
33	#include "gem/i915_gem_context.h"	34	#include "gem/i915_gem_context.h"
34	#include "gt/intel_breadcrumbs.h"	35	#include "gt/intel_breadcrumbs.h"

drivers/gpu/drm/lima/lima_device.c+1−0

@@ -4,6 +4,7 @@ · 3 unmodified lines
4	#include <linux/regulator/consumer.h>	4	#include <linux/regulator/consumer.h>
5	#include <linux/reset.h>	5	#include <linux/reset.h>
6	#include <linux/clk.h>	6	#include <linux/clk.h>
		7	#include <linux/slab.h>
7	#include <linux/dma-mapping.h>	8	#include <linux/dma-mapping.h>
8	#include <linux/platform_device.h>	9	#include <linux/platform_device.h>
9		10

drivers/gpu/drm/msm/msm_gem_shrinker.c+1−0

@@ -5,6 +5,7 @@ · 4 unmodified lines
5	*/	5	*/
6		6
7	#include <linux/vmalloc.h>	7	#include <linux/vmalloc.h>
		8	#include <linux/sched/mm.h>
8		9
9	#include "msm_drv.h"	10	#include "msm_drv.h"
10	#include "msm_gem.h"	11	#include "msm_gem.h"

drivers/gpu/drm/ttm/ttm_tt.c+1−0

@@ -34,6 +34,7 @@ · 33 unmodified lines
34	#include <linux/sched.h>	34	#include <linux/sched.h>
35	#include <linux/shmem_fs.h>	35	#include <linux/shmem_fs.h>
36	#include <linux/file.h>	36	#include <linux/file.h>
		37	#include <linux/module.h>
37	#include <drm/drm_cache.h>	38	#include <drm/drm_cache.h>
38	#include <drm/ttm/ttm_bo_driver.h>	39	#include <drm/ttm/ttm_bo_driver.h>
39		40

drivers/net/ethernet/huawei/hinic/hinic_sriov.c+1−0

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	#include <linux/interrupt.h>	8	#include <linux/interrupt.h>
9	#include <linux/etherdevice.h>	9	#include <linux/etherdevice.h>
10	#include <linux/netdevice.h>	10	#include <linux/netdevice.h>
		11	#include <linux/module.h>
11		12
12	#include "hinic_hw_dev.h"	13	#include "hinic_hw_dev.h"
13	#include "hinic_dev.h"	14	#include "hinic_dev.h"

drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c+2−0

@@ -5,6 +5,8 @@ · 4 unmodified lines
5	*	5	*
6	*/	6	*/
7		7
		8	#include <linux/module.h>
		9
8	#include "otx2_common.h"	10	#include "otx2_common.h"
9	#include "otx2_ptp.h"	11	#include "otx2_ptp.h"
10		12

drivers/pci/controller/dwc/pci-exynos.c+1−0

@@ -19,6 +19,7 @@ · 18 unmodified lines
19	#include <linux/platform_device.h>	19	#include <linux/platform_device.h>
20	#include <linux/phy/phy.h>	20	#include <linux/phy/phy.h>
21	#include <linux/regulator/consumer.h>	21	#include <linux/regulator/consumer.h>
		22	#include <linux/module.h>
22		23
23	#include "pcie-designware.h"	24	#include "pcie-designware.h"
24		25

drivers/pci/controller/dwc/pcie-qcom-ep.c+1−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	#include <linux/pm_domain.h>	18	#include <linux/pm_domain.h>
19	#include <linux/regmap.h>	19	#include <linux/regmap.h>
20	#include <linux/reset.h>	20	#include <linux/reset.h>
		21	#include <linux/module.h>
21		22
22	#include "pcie-designware.h"	23	#include "pcie-designware.h"
23		24

drivers/usb/cdns3/host.c+1−0

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	*/	10	*/
11		11
12	#include <linux/platform_device.h>	12	#include <linux/platform_device.h>
		13	#include <linux/slab.h>
13	#include "core.h"	14	#include "core.h"
14	#include "drd.h"	15	#include "drd.h"
15	#include "host-export.h"	16	#include "host-export.h"

include/linux/bpf.h+3−14

 struct bpf_trampoline *bpf_trampoline_get(u64 key,
 					  struct bpf_attach_target_info *tgt_info);
 void bpf_trampoline_put(struct bpf_trampoline *tr);
+int arch_prepare_bpf_dispatcher(void *image, s64 *funcs, int num_funcs);
 #define BPF_DISPATCHER_INIT(_name) {				\
 	.mutex = __MUTEX_INITIALIZER(_name.mutex),		\
 	.func = &_name##_func,					\
  * kprobes, tracepoints) to prevent deadlocks on map operations as any of
  * these events can happen inside a region which holds a map bucket lock
  * and can deadlock on it.
- *
- * Use the preemption safe inc/dec variants on RT because migrate disable
- * is preemptible on RT and preemption in the middle of the RMW operation
- * might lead to inconsistent state. Use the raw variants for non RT
- * kernels as migrate_disable() maps to preempt_disable() so the slightly
- * more expensive save operation can be avoided.
  */
 static inline void bpf_disable_instrumentation(void)
 {
 	migrate_disable();
-	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+	this_cpu_inc(bpf_prog_active);
-		this_cpu_inc(bpf_prog_active);
-	else
-		__this_cpu_inc(bpf_prog_active);
 }
 static inline void bpf_enable_instrumentation(void)
 {
-	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+	this_cpu_dec(bpf_prog_active);
-		this_cpu_dec(bpf_prog_active);
-	else
-		__this_cpu_dec(bpf_prog_active);
 	migrate_enable();
 }

include/linux/btf.h+10−4

 	struct module *owner;
 };
-struct kfunc_btf_id_list;
+struct kfunc_btf_id_list {
+	struct list_head list;
+	struct mutex mutex;
+};
 #ifdef CONFIG_DEBUG_INFO_BTF_MODULES
 void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
 				 struct kfunc_btf_id_set *s);
 bool bpf_check_mod_kfunc_call(struct kfunc_btf_id_list *klist, u32 kfunc_id,
 			      struct module *owner);
+extern struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list;
+extern struct kfunc_btf_id_list prog_test_kfunc_list;
 #else
 static inline void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
 					     struct kfunc_btf_id_set *s)
 {
 	return false;
 }
+static struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list __maybe_unused;
+static struct kfunc_btf_id_list prog_test_kfunc_list __maybe_unused;
 #endif
 #define DEFINE_KFUNC_BTF_ID_SET(set, name)                                     \
 	struct kfunc_btf_id_set name = { LIST_HEAD_INIT(name.list), (set),     \
 					 THIS_MODULE }
-extern struct kfunc_btf_id_list bpf_tcp_ca_kfunc_list;
-extern struct kfunc_btf_id_list prog_test_kfunc_list;
 #endif

include/linux/cacheinfo.h+0−1

@@ -3,7 +3,6 @@ · 2 unmodified lines
3	#define _LINUX_CACHEINFO_H	3	#define _LINUX_CACHEINFO_H
4		4
5	#include <linux/bitops.h>	5	#include <linux/bitops.h>
6	#include <linux/cpu.h>
7	#include <linux/cpumask.h>	6	#include <linux/cpumask.h>
8	#include <linux/smp.h>	7	#include <linux/smp.h>
9		8

include/linux/device/driver.h+1−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	#include <linux/klist.h>	18	#include <linux/klist.h>
19	#include <linux/pm.h>	19	#include <linux/pm.h>
20	#include <linux/device/bus.h>	20	#include <linux/device/bus.h>
		21	#include <linux/module.h>
21		22
22	/**	23	/**
23	* enum probe_type - device driver probe type to try	24	* enum probe_type - device driver probe type to try

include/linux/filter.h+1−4

 #define __LINUX_FILTER_H__
 #include <linux/atomic.h>
+#include <linux/bpf.h>
 #include <linux/refcount.h>
 #include <linux/compat.h>
 #include <linux/skbuff.h>
 #include <asm/byteorder.h>
 #include <uapi/linux/filter.h>
-#include <uapi/linux/bpf.h>
 struct sk_buff;
 struct sock;
  * This uses migrate_disable/enable() explicitly to document that the
  * invocation of a BPF program does not require reentrancy protection
  * against a BPF program which is invoked from a preempting task.
- *
- * For non RT enabled kernels migrate_disable/enable() maps to
- * preempt_disable/enable(), i.e. it disables also preemption.
  */
 static inline u32 bpf_prog_run_pin_on_cpu(const struct bpf_prog *prog,
 					  const void *ctx)

kernel/bpf/btf.c+2−9

 /* BTF ID set registration API for modules */
-struct kfunc_btf_id_list {
-	struct list_head list;
-	struct mutex mutex;
-};
 #ifdef CONFIG_DEBUG_INFO_BTF_MODULES
 void register_kfunc_btf_id_set(struct kfunc_btf_id_list *l,
 {
 	struct kfunc_btf_id_set *s;
-	if (!owner)
-		return false;
 	mutex_lock(&klist->mutex);
 	list_for_each_entry(s, &klist->list, list) {
 		if (s->owner == owner && btf_id_set_contains(s->set, kfunc_id)) {
 	return false;
 }
-#endif
 #define DEFINE_KFUNC_BTF_ID_LIST(name)                                         \
 	struct kfunc_btf_id_list name = { LIST_HEAD_INIT(name.list),           \
 					  __MUTEX_INITIALIZER(name.mutex) };   \
 DEFINE_KFUNC_BTF_ID_LIST(bpf_tcp_ca_kfunc_list);
 DEFINE_KFUNC_BTF_ID_LIST(prog_test_kfunc_list);
+#endif

kernel/bpf/verifier.c+1−1

@@ -8422,7 +8422,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate, · 8421 unmodified lines
8422		8422
8423	new_range = dst_reg->off;	8423	new_range = dst_reg->off;
8424	if (range_right_open)	8424	if (range_right_open)
8425	new_range--;	8425	new_range++;
8426		8426
8427	/* Examples for register markings:	8427	/* Examples for register markings:
8428	*	8428	*

lib/Kconfig.debug+1−0

@@ -316,6 +316,7 @@ config DEBUG_INFO_BTF · 315 unmodified lines
316	bool "Generate BTF typeinfo"	316	bool "Generate BTF typeinfo"
317	depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED	317	depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED
318	depends on !GCC_PLUGIN_RANDSTRUCT \|\| COMPILE_TEST	318	depends on !GCC_PLUGIN_RANDSTRUCT \|\| COMPILE_TEST
		319	depends on BPF_SYSCALL
319	help	320	help
320	Generate deduplicated BTF type information from DWARF debug info.	321	Generate deduplicated BTF type information from DWARF debug info.
321	Turning this on expects presence of pahole tool, which will convert	322	Turning this on expects presence of pahole tool, which will convert

mm/damon/vaddr.c+1−0

@@ -13,6 +13,7 @@ · 12 unmodified lines
13	#include <linux/mmu_notifier.h>	13	#include <linux/mmu_notifier.h>
14	#include <linux/page_idle.h>	14	#include <linux/page_idle.h>
15	#include <linux/pagewalk.h>	15	#include <linux/pagewalk.h>
		16	#include <linux/sched/mm.h>
16		17
17	#include "prmtv-common.h"	18	#include "prmtv-common.h"
18		19

mm/memory_hotplug.c+1−0

@@ -35,6 +35,7 @@ · 34 unmodified lines
35	#include <linux/memblock.h>	35	#include <linux/memblock.h>
36	#include <linux/compaction.h>	36	#include <linux/compaction.h>
37	#include <linux/rmap.h>	37	#include <linux/rmap.h>
		38	#include <linux/module.h>
38		39
39	#include <asm/tlbflush.h>	40	#include <asm/tlbflush.h>
40		41

mm/swap_slots.c+1−0

@@ -30,6 +30,7 @@ · 29 unmodified lines
30	#include <linux/swap_slots.h>	30	#include <linux/swap_slots.h>
31	#include <linux/cpu.h>	31	#include <linux/cpu.h>
32	#include <linux/cpumask.h>	32	#include <linux/cpumask.h>
		33	#include <linux/slab.h>
33	#include <linux/vmalloc.h>	34	#include <linux/vmalloc.h>
34	#include <linux/mutex.h>	35	#include <linux/mutex.h>
35	#include <linux/mm.h>	36	#include <linux/mm.h>

net/core/skmsg.c+5−0

 void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
 {
+	psock_set_prog(&psock->progs.stream_parser, NULL);
 	if (!psock->saved_data_ready)
 		return;
 void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock)
 {
+	psock_set_prog(&psock->progs.stream_verdict, NULL);
+	psock_set_prog(&psock->progs.skb_verdict, NULL);
 	if (!psock->saved_data_ready)
 		return;

net/core/sock_map.c+10−5

 		write_lock_bh(&sk->sk_callback_lock);
 		if (strp_stop)
 			sk_psock_stop_strp(sk, psock);
-		else
+		if (verdict_stop)
 			sk_psock_stop_verdict(sk, psock);
+		if (psock->psock_update_sk_prot)
+			psock->psock_update_sk_prot(sk, psock, false);
 		write_unlock_bh(&sk->sk_callback_lock);
 	}
 }
 	if (msg_parser)
 		psock_set_prog(&psock->progs.msg_parser, msg_parser);
+	if (stream_parser)
+		psock_set_prog(&psock->progs.stream_parser, stream_parser);
+	if (stream_verdict)
+		psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
+	if (skb_verdict)
+		psock_set_prog(&psock->progs.skb_verdict, skb_verdict);
 	ret = sock_map_init_proto(sk, psock);
 	if (ret < 0)
 		ret = sk_psock_init_strp(sk, psock);
 		if (ret)
 			goto out_unlock_drop;
-		psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
-		psock_set_prog(&psock->progs.stream_parser, stream_parser);
 		sk_psock_start_strp(sk, psock);
 	} else if (!stream_parser && stream_verdict && !psock->saved_data_ready) {
-		psock_set_prog(&psock->progs.stream_verdict, stream_verdict);
 		sk_psock_start_verdict(sk,psock);
 	} else if (!stream_verdict && skb_verdict && !psock->saved_data_ready) {
-		psock_set_prog(&psock->progs.skb_verdict, skb_verdict);
 		sk_psock_start_verdict(sk, psock);
 	}
 	write_unlock_bh(&sk->sk_callback_lock);

tools/bpf/resolve_btfids/main.c+5−3

 		int	 cnt;
 	};
 	int		 addr_cnt;
+	bool		 is_set;
 	Elf64_Addr	 addr[ADDR_CNT];
 };
 			 * in symbol's size, together with 'cnt' field hence
 			 * that - 1.
 			 */
-			if (id)
+			if (id) {
 				id->cnt = sym.st_size / sizeof(int) - 1;
+				id->is_set = true;
+			}
 		} else {
 			pr_err("FAILED unsupported prefix %s\n", prefix);
 			return -1;
 	int *ptr = data->d_buf;
 	int i;
-	if (!id->id) {
+	if (!id->id && !id->is_set)
 		pr_err("WARN: resolve_btfids: unresolved symbol %s\n", id->name);
-	}
 	for (i = 0; i < id->addr_cnt; i++) {
 		unsigned long addr = id->addr[i];

tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c+600−32

@@ -35,7 +35,7 @@ · 34 unmodified lines
35	.prog_type = BPF_PROG_TYPE_XDP,	35	.prog_type = BPF_PROG_TYPE_XDP,
36	},	36	},
37	{	37	{
38	"XDP pkt read, pkt_data' > pkt_end, good access",	38	"XDP pkt read, pkt_data' > pkt_end, corner case, good access",
39	.insns = {	39	.insns = {
40	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	40	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
41	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	41	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -87,6 +87,41 @@ · 45 unmodified lines
87	.prog_type = BPF_PROG_TYPE_XDP,	87	.prog_type = BPF_PROG_TYPE_XDP,
88	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	88	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
89	},	89	},
		90	{
		91	"XDP pkt read, pkt_data' > pkt_end, corner case +1, good access",
		92	.insns = {
		93	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		94	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		95	offsetof(struct xdp_md, data_end)),
		96	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		97	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		98	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
		99	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		100	BPF_MOV64_IMM(BPF_REG_0, 0),
		101	BPF_EXIT_INSN(),
		102	},
		103	.result = ACCEPT,
		104	.prog_type = BPF_PROG_TYPE_XDP,
		105	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		106	},
		107	{
		108	"XDP pkt read, pkt_data' > pkt_end, corner case -1, bad access",
		109	.insns = {
		110	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		111	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		112	offsetof(struct xdp_md, data_end)),
		113	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		114	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		115	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
		116	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		117	BPF_MOV64_IMM(BPF_REG_0, 0),
		118	BPF_EXIT_INSN(),
		119	},
		120	.errstr = "R1 offset is outside of the packet",
		121	.result = REJECT,
		122	.prog_type = BPF_PROG_TYPE_XDP,
		123	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		124	},
90	{	125	{
91	"XDP pkt read, pkt_end > pkt_data', good access",	126	"XDP pkt read, pkt_end > pkt_data', good access",
92	.insns = {	127	.insns = {
@@ -106,16 +141,16 @@ · 13 unmodified lines
106	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	141	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
107	},	142	},
108	{	143	{
109	"XDP pkt read, pkt_end > pkt_data', bad access 1",	144	"XDP pkt read, pkt_end > pkt_data', corner case -1, bad access",
110	.insns = {	145	.insns = {
111	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	146	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
112	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	147	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
113	offsetof(struct xdp_md, data_end)),	148	offsetof(struct xdp_md, data_end)),
114	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	149	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
115	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	150	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
116	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),	151	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
117	BPF_JMP_IMM(BPF_JA, 0, 0, 1),	152	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
118	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	153	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
119	BPF_MOV64_IMM(BPF_REG_0, 0),	154	BPF_MOV64_IMM(BPF_REG_0, 0),
120	BPF_EXIT_INSN(),	155	BPF_EXIT_INSN(),
121	},	156	},
@@ -142,6 +177,42 @@ · 20 unmodified lines
142	.prog_type = BPF_PROG_TYPE_XDP,	177	.prog_type = BPF_PROG_TYPE_XDP,
143	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	178	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
144	},	179	},
		180	{
		181	"XDP pkt read, pkt_end > pkt_data', corner case, good access",
		182	.insns = {
		183	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		184	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		185	offsetof(struct xdp_md, data_end)),
		186	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		187	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		188	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
		189	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		190	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		191	BPF_MOV64_IMM(BPF_REG_0, 0),
		192	BPF_EXIT_INSN(),
		193	},
		194	.result = ACCEPT,
		195	.prog_type = BPF_PROG_TYPE_XDP,
		196	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		197	},
		198	{
		199	"XDP pkt read, pkt_end > pkt_data', corner case +1, good access",
		200	.insns = {
		201	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		202	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		203	offsetof(struct xdp_md, data_end)),
		204	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		205	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		206	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
		207	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		208	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		209	BPF_MOV64_IMM(BPF_REG_0, 0),
		210	BPF_EXIT_INSN(),
		211	},
		212	.result = ACCEPT,
		213	.prog_type = BPF_PROG_TYPE_XDP,
		214	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		215	},
145	{	216	{
146	"XDP pkt read, pkt_data' < pkt_end, good access",	217	"XDP pkt read, pkt_data' < pkt_end, good access",
147	.insns = {	218	.insns = {
@@ -161,16 +232,16 @@ · 13 unmodified lines
161	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	232	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
162	},	233	},
163	{	234	{
164	"XDP pkt read, pkt_data' < pkt_end, bad access 1",	235	"XDP pkt read, pkt_data' < pkt_end, corner case -1, bad access",
165	.insns = {	236	.insns = {
166	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	237	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
167	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	238	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
168	offsetof(struct xdp_md, data_end)),	239	offsetof(struct xdp_md, data_end)),
169	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	240	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
170	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	241	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
171	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),	242	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
172	BPF_JMP_IMM(BPF_JA, 0, 0, 1),	243	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
173	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	244	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
174	BPF_MOV64_IMM(BPF_REG_0, 0),	245	BPF_MOV64_IMM(BPF_REG_0, 0),
175	BPF_EXIT_INSN(),	246	BPF_EXIT_INSN(),
176	},	247	},
@@ -198,7 +269,43 @@ · 21 unmodified lines
198	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	269	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
199	},	270	},
200	{	271	{
201	"XDP pkt read, pkt_end < pkt_data', good access",	272	"XDP pkt read, pkt_data' < pkt_end, corner case, good access",
		273	.insns = {
		274	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		275	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		276	offsetof(struct xdp_md, data_end)),
		277	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		278	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		279	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
		280	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		281	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		282	BPF_MOV64_IMM(BPF_REG_0, 0),
		283	BPF_EXIT_INSN(),
		284	},
		285	.result = ACCEPT,
		286	.prog_type = BPF_PROG_TYPE_XDP,
		287	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		288	},
		289	{
		290	"XDP pkt read, pkt_data' < pkt_end, corner case +1, good access",
		291	.insns = {
		292	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		293	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		294	offsetof(struct xdp_md, data_end)),
		295	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		296	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		297	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
		298	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		299	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		300	BPF_MOV64_IMM(BPF_REG_0, 0),
		301	BPF_EXIT_INSN(),
		302	},
		303	.result = ACCEPT,
		304	.prog_type = BPF_PROG_TYPE_XDP,
		305	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		306	},
		307	{
		308	"XDP pkt read, pkt_end < pkt_data', corner case, good access",
202	.insns = {	309	.insns = {
203	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	310	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
204	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	311	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -250,6 +357,41 @@ · 45 unmodified lines
250	.prog_type = BPF_PROG_TYPE_XDP,	357	.prog_type = BPF_PROG_TYPE_XDP,
251	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	358	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
252	},	359	},
		360	{
		361	"XDP pkt read, pkt_end < pkt_data', corner case +1, good access",
		362	.insns = {
		363	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		364	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		365	offsetof(struct xdp_md, data_end)),
		366	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		367	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		368	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
		369	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		370	BPF_MOV64_IMM(BPF_REG_0, 0),
		371	BPF_EXIT_INSN(),
		372	},
		373	.result = ACCEPT,
		374	.prog_type = BPF_PROG_TYPE_XDP,
		375	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		376	},
		377	{
		378	"XDP pkt read, pkt_end < pkt_data', corner case -1, bad access",
		379	.insns = {
		380	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		381	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		382	offsetof(struct xdp_md, data_end)),
		383	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		384	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		385	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
		386	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		387	BPF_MOV64_IMM(BPF_REG_0, 0),
		388	BPF_EXIT_INSN(),
		389	},
		390	.errstr = "R1 offset is outside of the packet",
		391	.result = REJECT,
		392	.prog_type = BPF_PROG_TYPE_XDP,
		393	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		394	},
253	{	395	{
254	"XDP pkt read, pkt_data' >= pkt_end, good access",	396	"XDP pkt read, pkt_data' >= pkt_end, good access",
255	.insns = {	397	.insns = {
@@ -268,15 +410,15 @@ · 12 unmodified lines
268	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	410	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
269	},	411	},
270	{	412	{
271	"XDP pkt read, pkt_data' >= pkt_end, bad access 1",	413	"XDP pkt read, pkt_data' >= pkt_end, corner case -1, bad access",
272	.insns = {	414	.insns = {
273	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	415	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
274	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	416	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
275	offsetof(struct xdp_md, data_end)),	417	offsetof(struct xdp_md, data_end)),
276	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	418	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
277	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	419	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
278	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),	420	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
279	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	421	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
280	BPF_MOV64_IMM(BPF_REG_0, 0),	422	BPF_MOV64_IMM(BPF_REG_0, 0),
281	BPF_EXIT_INSN(),	423	BPF_EXIT_INSN(),
282	},	424	},
@@ -304,7 +446,41 @@ · 21 unmodified lines
304	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	446	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
305	},	447	},
306	{	448	{
307	"XDP pkt read, pkt_end >= pkt_data', good access",	449	"XDP pkt read, pkt_data' >= pkt_end, corner case, good access",
		450	.insns = {
		451	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		452	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		453	offsetof(struct xdp_md, data_end)),
		454	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		455	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		456	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
		457	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		458	BPF_MOV64_IMM(BPF_REG_0, 0),
		459	BPF_EXIT_INSN(),
		460	},
		461	.result = ACCEPT,
		462	.prog_type = BPF_PROG_TYPE_XDP,
		463	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		464	},
		465	{
		466	"XDP pkt read, pkt_data' >= pkt_end, corner case +1, good access",
		467	.insns = {
		468	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		469	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		470	offsetof(struct xdp_md, data_end)),
		471	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		472	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		473	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
		474	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		475	BPF_MOV64_IMM(BPF_REG_0, 0),
		476	BPF_EXIT_INSN(),
		477	},
		478	.result = ACCEPT,
		479	.prog_type = BPF_PROG_TYPE_XDP,
		480	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		481	},
		482	{
		483	"XDP pkt read, pkt_end >= pkt_data', corner case, good access",
308	.insns = {	484	.insns = {
309	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	485	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
310	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	486	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -359,7 +535,44 @@ · 48 unmodified lines
359	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	535	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
360	},	536	},
361	{	537	{
362	"XDP pkt read, pkt_data' <= pkt_end, good access",	538	"XDP pkt read, pkt_end >= pkt_data', corner case +1, good access",
		539	.insns = {
		540	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		541	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		542	offsetof(struct xdp_md, data_end)),
		543	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		544	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		545	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
		546	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		547	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		548	BPF_MOV64_IMM(BPF_REG_0, 0),
		549	BPF_EXIT_INSN(),
		550	},
		551	.result = ACCEPT,
		552	.prog_type = BPF_PROG_TYPE_XDP,
		553	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		554	},
		555	{
		556	"XDP pkt read, pkt_end >= pkt_data', corner case -1, bad access",
		557	.insns = {
		558	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		559	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		560	offsetof(struct xdp_md, data_end)),
		561	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		562	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		563	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
		564	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		565	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		566	BPF_MOV64_IMM(BPF_REG_0, 0),
		567	BPF_EXIT_INSN(),
		568	},
		569	.errstr = "R1 offset is outside of the packet",
		570	.result = REJECT,
		571	.prog_type = BPF_PROG_TYPE_XDP,
		572	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		573	},
		574	{
		575	"XDP pkt read, pkt_data' <= pkt_end, corner case, good access",
363	.insns = {	576	.insns = {
364	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	577	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
365	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	578	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
@@ -413,6 +626,43 @@ · 47 unmodified lines
413	.prog_type = BPF_PROG_TYPE_XDP,	626	.prog_type = BPF_PROG_TYPE_XDP,
414	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	627	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
415	},	628	},
		629	{
		630	"XDP pkt read, pkt_data' <= pkt_end, corner case +1, good access",
		631	.insns = {
		632	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		633	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		634	offsetof(struct xdp_md, data_end)),
		635	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		636	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		637	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
		638	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		639	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		640	BPF_MOV64_IMM(BPF_REG_0, 0),
		641	BPF_EXIT_INSN(),
		642	},
		643	.result = ACCEPT,
		644	.prog_type = BPF_PROG_TYPE_XDP,
		645	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		646	},
		647	{
		648	"XDP pkt read, pkt_data' <= pkt_end, corner case -1, bad access",
		649	.insns = {
		650	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		651	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		652	offsetof(struct xdp_md, data_end)),
		653	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		654	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		655	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
		656	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		657	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		658	BPF_MOV64_IMM(BPF_REG_0, 0),
		659	BPF_EXIT_INSN(),
		660	},
		661	.errstr = "R1 offset is outside of the packet",
		662	.result = REJECT,
		663	.prog_type = BPF_PROG_TYPE_XDP,
		664	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		665	},
416	{	666	{
417	"XDP pkt read, pkt_end <= pkt_data', good access",	667	"XDP pkt read, pkt_end <= pkt_data', good access",
418	.insns = {	668	.insns = {
@@ -431,15 +681,15 @@ · 12 unmodified lines
431	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	681	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
432	},	682	},
433	{	683	{
434	"XDP pkt read, pkt_end <= pkt_data', bad access 1",	684	"XDP pkt read, pkt_end <= pkt_data', corner case -1, bad access",
435	.insns = {	685	.insns = {
436	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),	686	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
437	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,	687	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
438	offsetof(struct xdp_md, data_end)),	688	offsetof(struct xdp_md, data_end)),
439	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	689	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
440	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	690	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
441	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),	691	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
442	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	692	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
443	BPF_MOV64_IMM(BPF_REG_0, 0),	693	BPF_MOV64_IMM(BPF_REG_0, 0),
444	BPF_EXIT_INSN(),	694	BPF_EXIT_INSN(),
445	},	695	},
@@ -467,7 +717,41 @@ · 21 unmodified lines
467	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	717	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
468	},	718	},
469	{	719	{
470	"XDP pkt read, pkt_meta' > pkt_data, good access",	720	"XDP pkt read, pkt_end <= pkt_data', corner case, good access",
		721	.insns = {
		722	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		723	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		724	offsetof(struct xdp_md, data_end)),
		725	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		726	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		727	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
		728	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		729	BPF_MOV64_IMM(BPF_REG_0, 0),
		730	BPF_EXIT_INSN(),
		731	},
		732	.result = ACCEPT,
		733	.prog_type = BPF_PROG_TYPE_XDP,
		734	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		735	},
		736	{
		737	"XDP pkt read, pkt_end <= pkt_data', corner case +1, good access",
		738	.insns = {
		739	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
		740	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
		741	offsetof(struct xdp_md, data_end)),
		742	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		743	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		744	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
		745	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		746	BPF_MOV64_IMM(BPF_REG_0, 0),
		747	BPF_EXIT_INSN(),
		748	},
		749	.result = ACCEPT,
		750	.prog_type = BPF_PROG_TYPE_XDP,
		751	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		752	},
		753	{
		754	"XDP pkt read, pkt_meta' > pkt_data, corner case, good access",
471	.insns = {	755	.insns = {
472	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	756	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
473	offsetof(struct xdp_md, data_meta)),	757	offsetof(struct xdp_md, data_meta)),
@@ -519,6 +803,41 @@ · 45 unmodified lines
519	.prog_type = BPF_PROG_TYPE_XDP,	803	.prog_type = BPF_PROG_TYPE_XDP,
520	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	804	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
521	},	805	},
		806	{
		807	"XDP pkt read, pkt_meta' > pkt_data, corner case +1, good access",
		808	.insns = {
		809	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		810	offsetof(struct xdp_md, data_meta)),
		811	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		812	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		813	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		814	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
		815	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		816	BPF_MOV64_IMM(BPF_REG_0, 0),
		817	BPF_EXIT_INSN(),
		818	},
		819	.result = ACCEPT,
		820	.prog_type = BPF_PROG_TYPE_XDP,
		821	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		822	},
		823	{
		824	"XDP pkt read, pkt_meta' > pkt_data, corner case -1, bad access",
		825	.insns = {
		826	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		827	offsetof(struct xdp_md, data_meta)),
		828	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		829	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		830	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		831	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
		832	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		833	BPF_MOV64_IMM(BPF_REG_0, 0),
		834	BPF_EXIT_INSN(),
		835	},
		836	.errstr = "R1 offset is outside of the packet",
		837	.result = REJECT,
		838	.prog_type = BPF_PROG_TYPE_XDP,
		839	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		840	},
522	{	841	{
523	"XDP pkt read, pkt_data > pkt_meta', good access",	842	"XDP pkt read, pkt_data > pkt_meta', good access",
524	.insns = {	843	.insns = {
@@ -538,16 +857,16 @@ · 13 unmodified lines
538	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	857	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
539	},	858	},
540	{	859	{
541	"XDP pkt read, pkt_data > pkt_meta', bad access 1",	860	"XDP pkt read, pkt_data > pkt_meta', corner case -1, bad access",
542	.insns = {	861	.insns = {
543	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	862	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
544	offsetof(struct xdp_md, data_meta)),	863	offsetof(struct xdp_md, data_meta)),
545	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),	864	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
546	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	865	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
547	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	866	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
548	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),	867	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
549	BPF_JMP_IMM(BPF_JA, 0, 0, 1),	868	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
550	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	869	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
551	BPF_MOV64_IMM(BPF_REG_0, 0),	870	BPF_MOV64_IMM(BPF_REG_0, 0),
552	BPF_EXIT_INSN(),	871	BPF_EXIT_INSN(),
553	},	872	},
@@ -574,6 +893,42 @@ · 20 unmodified lines
574	.prog_type = BPF_PROG_TYPE_XDP,	893	.prog_type = BPF_PROG_TYPE_XDP,
575	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	894	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
576	},	895	},
		896	{
		897	"XDP pkt read, pkt_data > pkt_meta', corner case, good access",
		898	.insns = {
		899	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		900	offsetof(struct xdp_md, data_meta)),
		901	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		902	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		903	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		904	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
		905	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		906	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		907	BPF_MOV64_IMM(BPF_REG_0, 0),
		908	BPF_EXIT_INSN(),
		909	},
		910	.result = ACCEPT,
		911	.prog_type = BPF_PROG_TYPE_XDP,
		912	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		913	},
		914	{
		915	"XDP pkt read, pkt_data > pkt_meta', corner case +1, good access",
		916	.insns = {
		917	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		918	offsetof(struct xdp_md, data_meta)),
		919	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		920	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		921	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		922	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
		923	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		924	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		925	BPF_MOV64_IMM(BPF_REG_0, 0),
		926	BPF_EXIT_INSN(),
		927	},
		928	.result = ACCEPT,
		929	.prog_type = BPF_PROG_TYPE_XDP,
		930	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		931	},
577	{	932	{
578	"XDP pkt read, pkt_meta' < pkt_data, good access",	933	"XDP pkt read, pkt_meta' < pkt_data, good access",
579	.insns = {	934	.insns = {
@@ -593,16 +948,16 @@ · 13 unmodified lines
593	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	948	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
594	},	949	},
595	{	950	{
596	"XDP pkt read, pkt_meta' < pkt_data, bad access 1",	951	"XDP pkt read, pkt_meta' < pkt_data, corner case -1, bad access",
597	.insns = {	952	.insns = {
598	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	953	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
599	offsetof(struct xdp_md, data_meta)),	954	offsetof(struct xdp_md, data_meta)),
600	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),	955	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
601	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	956	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
602	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	957	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
603	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),	958	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
604	BPF_JMP_IMM(BPF_JA, 0, 0, 1),	959	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
605	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	960	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
606	BPF_MOV64_IMM(BPF_REG_0, 0),	961	BPF_MOV64_IMM(BPF_REG_0, 0),
607	BPF_EXIT_INSN(),	962	BPF_EXIT_INSN(),
608	},	963	},
@@ -630,7 +985,43 @@ · 21 unmodified lines
630	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	985	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
631	},	986	},
632	{	987	{
633	"XDP pkt read, pkt_data < pkt_meta', good access",	988	"XDP pkt read, pkt_meta' < pkt_data, corner case, good access",
		989	.insns = {
		990	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		991	offsetof(struct xdp_md, data_meta)),
		992	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		993	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		994	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		995	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
		996	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		997	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		998	BPF_MOV64_IMM(BPF_REG_0, 0),
		999	BPF_EXIT_INSN(),
		1000	},
		1001	.result = ACCEPT,
		1002	.prog_type = BPF_PROG_TYPE_XDP,
		1003	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1004	},
		1005	{
		1006	"XDP pkt read, pkt_meta' < pkt_data, corner case +1, good access",
		1007	.insns = {
		1008	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1009	offsetof(struct xdp_md, data_meta)),
		1010	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1011	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1012	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		1013	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
		1014	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		1015	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		1016	BPF_MOV64_IMM(BPF_REG_0, 0),
		1017	BPF_EXIT_INSN(),
		1018	},
		1019	.result = ACCEPT,
		1020	.prog_type = BPF_PROG_TYPE_XDP,
		1021	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1022	},
		1023	{
		1024	"XDP pkt read, pkt_data < pkt_meta', corner case, good access",
634	.insns = {	1025	.insns = {
635	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	1026	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
636	offsetof(struct xdp_md, data_meta)),	1027	offsetof(struct xdp_md, data_meta)),
@@ -682,6 +1073,41 @@ · 45 unmodified lines
682	.prog_type = BPF_PROG_TYPE_XDP,	1073	.prog_type = BPF_PROG_TYPE_XDP,
683	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1074	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
684	},	1075	},
		1076	{
		1077	"XDP pkt read, pkt_data < pkt_meta', corner case +1, good access",
		1078	.insns = {
		1079	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1080	offsetof(struct xdp_md, data_meta)),
		1081	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1082	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1083	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		1084	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
		1085	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		1086	BPF_MOV64_IMM(BPF_REG_0, 0),
		1087	BPF_EXIT_INSN(),
		1088	},
		1089	.result = ACCEPT,
		1090	.prog_type = BPF_PROG_TYPE_XDP,
		1091	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1092	},
		1093	{
		1094	"XDP pkt read, pkt_data < pkt_meta', corner case -1, bad access",
		1095	.insns = {
		1096	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1097	offsetof(struct xdp_md, data_meta)),
		1098	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1099	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1100	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		1101	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
		1102	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		1103	BPF_MOV64_IMM(BPF_REG_0, 0),
		1104	BPF_EXIT_INSN(),
		1105	},
		1106	.errstr = "R1 offset is outside of the packet",
		1107	.result = REJECT,
		1108	.prog_type = BPF_PROG_TYPE_XDP,
		1109	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1110	},
685	{	1111	{
686	"XDP pkt read, pkt_meta' >= pkt_data, good access",	1112	"XDP pkt read, pkt_meta' >= pkt_data, good access",
687	.insns = {	1113	.insns = {
@@ -700,15 +1126,15 @@ · 12 unmodified lines
700	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1126	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
701	},	1127	},
702	{	1128	{
703	"XDP pkt read, pkt_meta' >= pkt_data, bad access 1",	1129	"XDP pkt read, pkt_meta' >= pkt_data, corner case -1, bad access",
704	.insns = {	1130	.insns = {
705	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	1131	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
706	offsetof(struct xdp_md, data_meta)),	1132	offsetof(struct xdp_md, data_meta)),
707	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),	1133	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
708	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	1134	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
709	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	1135	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
710	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),	1136	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
711	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	1137	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
712	BPF_MOV64_IMM(BPF_REG_0, 0),	1138	BPF_MOV64_IMM(BPF_REG_0, 0),
713	BPF_EXIT_INSN(),	1139	BPF_EXIT_INSN(),
714	},	1140	},
@@ -736,7 +1162,41 @@ · 21 unmodified lines
736	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1162	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
737	},	1163	},
738	{	1164	{
739	"XDP pkt read, pkt_data >= pkt_meta', good access",	1165	"XDP pkt read, pkt_meta' >= pkt_data, corner case, good access",
		1166	.insns = {
		1167	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1168	offsetof(struct xdp_md, data_meta)),
		1169	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1170	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1171	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		1172	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
		1173	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		1174	BPF_MOV64_IMM(BPF_REG_0, 0),
		1175	BPF_EXIT_INSN(),
		1176	},
		1177	.result = ACCEPT,
		1178	.prog_type = BPF_PROG_TYPE_XDP,
		1179	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1180	},
		1181	{
		1182	"XDP pkt read, pkt_meta' >= pkt_data, corner case +1, good access",
		1183	.insns = {
		1184	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1185	offsetof(struct xdp_md, data_meta)),
		1186	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1187	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1188	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		1189	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
		1190	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		1191	BPF_MOV64_IMM(BPF_REG_0, 0),
		1192	BPF_EXIT_INSN(),
		1193	},
		1194	.result = ACCEPT,
		1195	.prog_type = BPF_PROG_TYPE_XDP,
		1196	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1197	},
		1198	{
		1199	"XDP pkt read, pkt_data >= pkt_meta', corner case, good access",
740	.insns = {	1200	.insns = {
741	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	1201	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
742	offsetof(struct xdp_md, data_meta)),	1202	offsetof(struct xdp_md, data_meta)),
@@ -791,7 +1251,44 @@ · 48 unmodified lines
791	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1251	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
792	},	1252	},
793	{	1253	{
794	"XDP pkt read, pkt_meta' <= pkt_data, good access",	1254	"XDP pkt read, pkt_data >= pkt_meta', corner case +1, good access",
		1255	.insns = {
		1256	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1257	offsetof(struct xdp_md, data_meta)),
		1258	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1259	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1260	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		1261	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
		1262	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		1263	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		1264	BPF_MOV64_IMM(BPF_REG_0, 0),
		1265	BPF_EXIT_INSN(),
		1266	},
		1267	.result = ACCEPT,
		1268	.prog_type = BPF_PROG_TYPE_XDP,
		1269	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1270	},
		1271	{
		1272	"XDP pkt read, pkt_data >= pkt_meta', corner case -1, bad access",
		1273	.insns = {
		1274	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1275	offsetof(struct xdp_md, data_meta)),
		1276	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1277	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1278	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		1279	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
		1280	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		1281	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		1282	BPF_MOV64_IMM(BPF_REG_0, 0),
		1283	BPF_EXIT_INSN(),
		1284	},
		1285	.errstr = "R1 offset is outside of the packet",
		1286	.result = REJECT,
		1287	.prog_type = BPF_PROG_TYPE_XDP,
		1288	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1289	},
		1290	{
		1291	"XDP pkt read, pkt_meta' <= pkt_data, corner case, good access",
795	.insns = {	1292	.insns = {
796	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	1293	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
797	offsetof(struct xdp_md, data_meta)),	1294	offsetof(struct xdp_md, data_meta)),
@@ -845,6 +1342,43 @@ · 47 unmodified lines
845	.prog_type = BPF_PROG_TYPE_XDP,	1342	.prog_type = BPF_PROG_TYPE_XDP,
846	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1343	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
847	},	1344	},
		1345	{
		1346	"XDP pkt read, pkt_meta' <= pkt_data, corner case +1, good access",
		1347	.insns = {
		1348	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1349	offsetof(struct xdp_md, data_meta)),
		1350	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1351	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1352	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
		1353	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
		1354	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		1355	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
		1356	BPF_MOV64_IMM(BPF_REG_0, 0),
		1357	BPF_EXIT_INSN(),
		1358	},
		1359	.result = ACCEPT,
		1360	.prog_type = BPF_PROG_TYPE_XDP,
		1361	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1362	},
		1363	{
		1364	"XDP pkt read, pkt_meta' <= pkt_data, corner case -1, bad access",
		1365	.insns = {
		1366	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1367	offsetof(struct xdp_md, data_meta)),
		1368	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1369	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1370	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		1371	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
		1372	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
		1373	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		1374	BPF_MOV64_IMM(BPF_REG_0, 0),
		1375	BPF_EXIT_INSN(),
		1376	},
		1377	.errstr = "R1 offset is outside of the packet",
		1378	.result = REJECT,
		1379	.prog_type = BPF_PROG_TYPE_XDP,
		1380	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1381	},
848	{	1382	{
849	"XDP pkt read, pkt_data <= pkt_meta', good access",	1383	"XDP pkt read, pkt_data <= pkt_meta', good access",
850	.insns = {	1384	.insns = {
@@ -863,15 +1397,15 @@ · 12 unmodified lines
863	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1397	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
864	},	1398	},
865	{	1399	{
866	"XDP pkt read, pkt_data <= pkt_meta', bad access 1",	1400	"XDP pkt read, pkt_data <= pkt_meta', corner case -1, bad access",
867	.insns = {	1401	.insns = {
868	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,	1402	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
869	offsetof(struct xdp_md, data_meta)),	1403	offsetof(struct xdp_md, data_meta)),
870	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),	1404	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
871	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),	1405	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
872	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),	1406	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
873	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),	1407	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
874	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),	1408	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
875	BPF_MOV64_IMM(BPF_REG_0, 0),	1409	BPF_MOV64_IMM(BPF_REG_0, 0),
876	BPF_EXIT_INSN(),	1410	BPF_EXIT_INSN(),
877	},	1411	},
@@ -898,3 +1432,37 @@ · 20 unmodified lines
898	.prog_type = BPF_PROG_TYPE_XDP,	1432	.prog_type = BPF_PROG_TYPE_XDP,
899	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,	1433	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
900	},	1434	},
		1435	{
		1436	"XDP pkt read, pkt_data <= pkt_meta', corner case, good access",
		1437	.insns = {
		1438	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1439	offsetof(struct xdp_md, data_meta)),
		1440	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1441	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1442	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
		1443	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
		1444	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
		1445	BPF_MOV64_IMM(BPF_REG_0, 0),
		1446	BPF_EXIT_INSN(),
		1447	},
		1448	.result = ACCEPT,
		1449	.prog_type = BPF_PROG_TYPE_XDP,
		1450	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1451	},
		1452	{
		1453	"XDP pkt read, pkt_data <= pkt_meta', corner case +1, good access",
		1454	.insns = {
		1455	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
		1456	offsetof(struct xdp_md, data_meta)),
		1457	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
		1458	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
		1459	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
		1460	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
		1461	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
		1462	BPF_MOV64_IMM(BPF_REG_0, 0),
		1463	BPF_EXIT_INSN(),
		1464	},
		1465	.result = ACCEPT,
		1466	.prog_type = BPF_PROG_TYPE_XDP,
		1467	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		1468	},