{ "bounded loop, count to 4", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, .retval = 4, }, { "bounded loop, count to 20", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "bounded loop, count from positive unknown to 4", .insns = { BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, .retval = 4, }, { "bounded loop, count from totally unknown to 4", .insns = { BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "bounded loop, count to 4 with equality", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "bounded loop, start in the middle", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_JMP_A(1), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = REJECT, .errstr = "back-edge", .prog_type = BPF_PROG_TYPE_TRACEPOINT, .retval = 4, }, { "bounded loop containing a forward jump", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, .retval = 4, }, { "bounded loop that jumps out rather than in", .insns = { BPF_MOV64_IMM(BPF_REG_6, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), BPF_JMP_A(-4), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "infinite loop after a conditional jump", .insns = { BPF_MOV64_IMM(BPF_REG_0, 5), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_JMP_A(-2), BPF_EXIT_INSN(), }, .result = REJECT, .errstr = "program is too large", .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "bounded recursion", .insns = { BPF_MOV64_IMM(BPF_REG_1, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), BPF_EXIT_INSN(), BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1), BPF_MOV64_REG(BPF_REG_0, BPF_REG_1), BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1), BPF_EXIT_INSN(), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5), BPF_EXIT_INSN(), }, .result = REJECT, .errstr = "back-edge", .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "infinite loop in two jumps", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_JMP_A(0), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = REJECT, .errstr = "loop detected", .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "infinite loop: three-jump trick", .insns = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1), BPF_EXIT_INSN(), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1), BPF_EXIT_INSN(), BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1), BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1), BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11), BPF_EXIT_INSN(), }, .result = REJECT, .errstr = "loop detected", .prog_type = BPF_PROG_TYPE_TRACEPOINT, }, { "not-taken loop with back jump to 1st insn", .insns = { BPF_MOV64_IMM(BPF_REG_0, 123), BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 4, -2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_XDP, .retval = 123, }, { "taken loop with back jump to 1st insn", .insns = { BPF_MOV64_IMM(BPF_REG_1, 10), BPF_MOV64_IMM(BPF_REG_2, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1), BPF_EXIT_INSN(), BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1), BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1), BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -3), BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), BPF_EXIT_INSN(), }, .result = ACCEPT, .prog_type = BPF_PROG_TYPE_XDP, .retval = 55, },