{ "context stores via ST", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0), BPF_EXIT_INSN(), }, .errstr = "BPF_ST stores into R1 ctx is not allowed", .result = REJECT, .prog_type = BPF_PROG_TYPE_SCHED_CLS, }, { "context stores via XADD", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1, BPF_REG_0, offsetof(struct __sk_buff, mark), 0), BPF_EXIT_INSN(), }, .errstr = "BPF_XADD stores into R1 ctx is not allowed", .result = REJECT, .prog_type = BPF_PROG_TYPE_SCHED_CLS, }, { "arithmetic ops make PTR_TO_CTX unusable", .insns = { BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct __sk_buff, data) - offsetof(struct __sk_buff, mark)), BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, offsetof(struct __sk_buff, mark)), BPF_EXIT_INSN(), }, .errstr = "dereference of modified ctx ptr", .result = REJECT, .prog_type = BPF_PROG_TYPE_SCHED_CLS, }, { "pass unmodified ctx pointer to helper", .insns = { BPF_MOV64_IMM(BPF_REG_2, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_update), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .result = ACCEPT, }, { "pass modified ctx pointer to helper, 1", .insns = { BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612), BPF_MOV64_IMM(BPF_REG_2, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_update), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .result = REJECT, .errstr = "dereference of modified ctx ptr", }, { "pass modified ctx pointer to helper, 2", .insns = { BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_socket_cookie), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, .result_unpriv = REJECT, .result = REJECT, .errstr_unpriv = "dereference of modified ctx ptr", .errstr = "dereference of modified ctx ptr", }, { "pass modified ctx pointer to helper, 3", .insns = { BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0), BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4), BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3), BPF_MOV64_IMM(BPF_REG_2, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_update), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .result = REJECT, .errstr = "variable ctx access var_off=(0x0; 0x4)", },