Lines Matching refs:off
136 * When type PTR_TO_MAP_VALUE_OR_NULL passes through 'if (reg != 0) goto +off'
582 /* reg->off should be 0 for SCALAR_VALUE */
583 verbose(env, "%lld", reg->var_off.value + reg->off);
593 verbose(env, ",off=%d", reg->off);
603 * for reg->off
666 verbose(env, "%lld", reg->var_off.value + reg->off);
1027 /* Clear id, off, and union(map_ptr, range) */
1085 return reg->type == which && reg->id == 0 && reg->off == 0 && tnum_equals_const(reg->var_off, 0);
1321 * Clear type, id, off, and union(map_ptr, range) and
1416 static int find_subprog(struct bpf_verifier_env *env, int off)
1420 p = bsearch(&off, env->subprog_info, env->subprog_cnt, sizeof(env->subprog_info[0]), cmp_subprogs);
1427 static int add_subprog(struct bpf_verifier_env *env, int off)
1432 if (off >= insn_cnt || off < 0) {
1436 ret = find_subprog(env, off);
1444 env->subprog_info[env->subprog_cnt++].start = off;
1451 int i, ret, subprog_start, subprog_end, off, cur_subprog = 0;
1509 off = i + insn[i].off + 1;
1510 if (off < subprog_start || off >= subprog_end) {
1511 verbose(env, "jump out of range from insn %d to %d\n", i, off);
1549 verbose(env, "verifier BUG type %s var_off %lld off %d\n", reg_type_str(env, parent->type),
1550 parent->var_off.value, parent->off);
1870 /* dreg = *(u64 *)[fp - off] was a fill from the stack.
1871 * that [fp - off] slot contains scalar that needs to be
1874 spi = (-insn->off - 1) / BPF_REG_SIZE;
1896 spi = (-insn->off - 1) / BPF_REG_SIZE;
1971 * R8=map_value(id=0,off=0,ks=4,vs=1952,imm=0) R9_w=map_value(id=0,off=40,ks=4,vs=1952,imm=0)
2288 struct bpf_func_state *state, int off, int size, int value_regno, int insn_idx)
2291 int i, slot = -off - 1, spi = slot / BPF_REG_SIZE, err;
2299 /* caller checked that off % size == 0 and -MAX_BPF_STACK <= off < 0,
2300 * so it's aligned access and [off, off + size) are within stack limits
2394 /* Write the stack: 'stack[ptr_regno + off] = value_regno'. 'ptr_regno' is
2400 * 'off' includes 'regno->off'.
2415 struct bpf_func_state *state, int ptr_regno, int off, int size, int value_regno,
2430 min_off = ptr_reg->smin_value + off;
2431 max_off = ptr_reg->smax_value + off + size;
2460 verbose(env, "spilled ptr in range of var-offset stack write; insn %d, ptr off: %d", insn_idx, i);
2482 verbose(env, "uninit stack in range of var-offset write prohibited for !root; insn %d, off: %d", insn_idx,
2548 /* Read the stack at 'off' and put the results into the register indicated by
2559 struct bpf_func_state *reg_state, int off, int size, int dst_regno)
2563 int i, slot = -off - 1, spi = slot / BPF_REG_SIZE;
2606 verbose(env, "leaking pointer from stack off %d\n", off);
2621 verbose(env, "invalid read from stack off %d+%d size %d\n", off, i, size);
2626 mark_reg_stack_read(env, reg_state, off, off + size, dst_regno);
2637 static int check_stack_range_initialized(struct bpf_verifier_env *env, int regno, int off, int access_size,
2646 /* Read the stack at 'ptr_regno + off' and put the result into the register
2648 * 'off' includes the pointer register's fixed offset(i.e. 'ptr_regno.off'),
2659 static int check_stack_read_var_off(struct bpf_verifier_env *env, int ptr_regno, int off, int size, int dst_regno)
2669 err = check_stack_range_initialized(env, ptr_regno, off, size, false, ACCESS_DIRECT, NULL);
2674 min_off = reg->smin_value + off;
2675 max_off = reg->smax_value + off;
2689 static int check_stack_read(struct bpf_verifier_env *env, int ptr_regno, int off, int size, int dst_regno)
2704 verbose(env, "variable offset stack pointer cannot be passed into helper function; var_off=%s off=%d size=%d\n",
2705 tn_buf, off, size);
2721 off += reg->var_off.value;
2722 err = check_stack_read_fixed_off(env, state, off, size, dst_regno);
2728 err = check_stack_read_var_off(env, ptr_regno, off, size, dst_regno);
2737 * 'off' includes 'ptr_regno->off', but not its variable offset (if any).
2743 static int check_stack_write(struct bpf_verifier_env *env, int ptr_regno, int off, int size, int value_regno,
2751 off += reg->var_off.value;
2752 err = check_stack_write_fixed_off(env, state, off, size, value_regno, insn_idx);
2757 err = check_stack_write_var_off(env, state, ptr_regno, off, size, value_regno, insn_idx);
2762 static int check_map_access_type(struct bpf_verifier_env *env, u32 regno, int off, int size, enum bpf_access_type type)
2768 verbose(env, "write into map forbidden, value_size=%d off=%d size=%d\n", map->value_size, off, size);
2772 verbose(env, "read from map forbidden, value_size=%d off=%d size=%d\n", map->value_size, off, size);
2780 static int __check_mem_access(struct bpf_verifier_env *env, int regno, int off, int size, u32 mem_size,
2786 if (off >= 0 && size_ok && (u64)off + size <= mem_size) {
2793 verbose(env, "invalid access to map value, value_size=%d off=%d size=%d\n", mem_size, off, size);
2798 verbose(env, "invalid access to packet, off=%d size=%d, R%d(id=%d,off=%d,r=%d)\n", off, size, regno,
2799 reg->id, off, mem_size);
2803 verbose(env, "invalid access to memory, mem_size=%u off=%d size=%d\n", mem_size, off, size);
2810 static int check_mem_region_access(struct bpf_verifier_env *env, u32 regno, int off, int size, u32 mem_size,
2819 * need to try adding each of min_value and max_value to off
2833 (reg->smin_value == S64_MIN || (off + reg->smin_value != (s64)(s32)(off + reg->smin_value)) ||
2834 reg->smin_value + off < 0)) {
2838 err = __check_mem_access(env, regno, reg->smin_value + off, size, mem_size, zero_size_allowed);
2846 * If reg->umax_value + off could overflow, treat that as unbounded too.
2852 err = __check_mem_access(env, regno, reg->umax_value + off, size, mem_size, zero_size_allowed);
2862 static int check_map_access(struct bpf_verifier_env *env, u32 regno, int off, int size, bool zero_size_allowed)
2870 err = check_mem_region_access(env, regno, off, size, map->value_size, zero_size_allowed);
2883 if (reg->smin_value + off < lock + sizeof(struct bpf_spin_lock) && lock < reg->umax_value + off + size) {
2942 static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, int size, bool zero_size_allowed)
2960 err = __check_mem_access(env, regno, off, size, reg->range, zero_size_allowed);
2966 /* __check_mem_access has made sure "off + size - 1" is within u16.
2970 * Therefore, "off + reg->umax_value + size - 1" won't overflow u32.
2972 env->prog->aux->max_pkt_offset = max_t(u32, env->prog->aux->max_pkt_offset, off + reg->umax_value + size - 1);
2978 static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t,
2986 if (env->ops->is_valid_access && env->ops->is_valid_access(off, size, t, env->prog, &info)) {
3002 if (env->prog->aux->max_ctx_offset < off + size) {
3003 env->prog->aux->max_ctx_offset = off + size;
3008 verbose(env, "invalid bpf_context access off=%d size=%d\n", off, size);
3012 static int check_flow_keys_access(struct bpf_verifier_env *env, int off, int size)
3014 if (size < 0 || off < 0 || (u64)off + size > sizeof(struct bpf_flow_keys)) {
3015 verbose(env, "invalid access to flow keys off=%d size=%d\n", off, size);
3021 static int check_sock_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, int off, int size,
3036 valid = bpf_sock_common_is_valid_access(off, size, t, &info);
3039 valid = bpf_sock_is_valid_access(off, size, t, &info);
3042 valid = bpf_tcp_sock_is_valid_access(off, size, t, &info);
3045 valid = bpf_xdp_sock_is_valid_access(off, size, t, &info);
3056 verbose(env, "R%d invalid %s access off=%d size=%d\n", regno, reg_type_str(env, reg->type), off, size);
3095 static int check_pkt_ptr_alignment(struct bpf_verifier_env *env, const struct bpf_reg_state *reg, int off, int size,
3116 reg_off = tnum_add(reg->var_off, tnum_const(ip_align + reg->off + off));
3121 verbose(env, "misaligned packet access off %d+%s+%d+%d size %d\n", ip_align, tn_buf, reg->off, off, size);
3129 const char *pointer_desc, int off, int size, bool strict)
3138 reg_off = tnum_add(reg->var_off, tnum_const(reg->off + off));
3143 verbose(env, "misaligned %saccess off %s+%d+%d size %d\n", pointer_desc, tn_buf, reg->off, off, size);
3150 static int check_ptr_alignment(struct bpf_verifier_env *env, const struct bpf_reg_state *reg, int off, int size,
3162 return check_pkt_ptr_alignment(env, reg, off, size, strict);
3195 return check_generic_ptr_alignment(env, reg, pointer_desc, off, size, strict);
3198 static int update_stack_depth(struct bpf_verifier_env *env, const struct bpf_func_state *func, int off)
3202 if (stack >= -off) {
3207 env->subprog_info[func->subprogno].stack_depth = -off;
3356 if (!fixed_off_ok && reg->off) {
3357 verbose(env, "dereference of modified %s ptr R%d off=%d disallowed\n", reg_type_str(env, reg->type), regno,
3358 reg->off);
3379 int regno, int off, int size)
3381 if (off < 0) {
3382 verbose(env, "R%d invalid %s buffer access: off=%d, size=%d\n", regno, buf_info, off, size);
3389 verbose(env, "R%d invalid variable buffer offset: off=%d, var_off=%s\n", regno, off, tn_buf);
3396 static int check_tp_buffer_access(struct bpf_verifier_env *env, const struct bpf_reg_state *reg, int regno, int off,
3401 err = __check_buffer_access(env, "tracepoint", reg, regno, off, size);
3406 if (off + size > env->prog->aux->max_tp_access) {
3407 env->prog->aux->max_tp_access = off + size;
3413 static int check_buffer_access(struct bpf_verifier_env *env, const struct bpf_reg_state *reg, int regno, int off,
3418 err = __check_buffer_access(env, buf_info, reg, regno, off, size);
3423 if (off + size > *max_access) {
3424 *max_access = off + size;
3474 static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val)
3480 err = map->ops->map_direct_value_addr(map, &addr, off);
3484 ptr = (void *)(long)addr + off;
3505 static int check_ptr_to_btf_access(struct bpf_verifier_env *env, struct bpf_reg_state *regs, int regno, int off,
3514 if (off < 0) {
3515 verbose(env, "R%d is ptr_%s invalid negative access: off=%d\n", regno, tname, off);
3522 verbose(env, "R%d is ptr_%s invalid variable offset: off=%d, var_off=%s\n", regno, tname, off, tn_buf);
3527 ret = env->ops->btf_struct_access(&env->log, t, off, size, atype, &btf_id);
3534 ret = btf_struct_access(&env->log, t, off, size, atype, &btf_id);
3548 static int check_ptr_to_map_access(struct bpf_verifier_env *env, struct bpf_reg_state *regs, int regno, int off,
3576 if (off < 0) {
3577 verbose(env, "R%d is %s invalid negative access: off=%d\n", regno, tname, off);
3586 ret = btf_struct_access(&env->log, t, off, size, atype, &btf_id);
3604 static int check_stack_slot_within_bounds(int off, struct bpf_func_state *state, enum bpf_access_type t)
3614 if (off < min_valid_off || off > -1) {
3620 /* Check that the stack access at 'regno + off' falls within the maximum stack
3623 * 'off' includes `regno->offset`, but not its dynamic part (if any).
3625 static int check_stack_access_within_bounds(struct bpf_verifier_env *env, int regno, int off, int access_size,
3645 min_off = reg->var_off.value + off;
3656 min_off = reg->smin_value + off;
3658 max_off = reg->smax_value + off + access_size - 1;
3671 verbose(env, "invalid%s stack R%d off=%d size=%d\n", err_extra, regno, off, access_size);
3683 /* check whether memory at (regno + off) is accessible for t = (read | write)
3689 static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, int off, int bpf_size,
3702 /* alignment checks will add in reg->off themselves */
3703 err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
3708 /* for access checks, reg->off is just part of off */
3709 off += reg->off;
3716 err = check_map_access_type(env, regno, off, size, t);
3720 err = check_map_access(env, regno, off, size, false);
3726 int map_off = off + reg->var_off.value;
3758 err = check_mem_region_access(env, regno, off, size, reg->mem_size, false);
3776 err = check_ctx_access(env, insn_idx, off, size, t, ®_type, &btf_id);
3806 err = check_stack_access_within_bounds(env, regno, off, size, ACCESS_DIRECT, t);
3811 err = update_stack_depth(env, state, off);
3817 err = check_stack_read(env, regno, off, size, value_regno);
3819 err = check_stack_write(env, regno, off, size, value_regno, insn_idx);
3830 err = check_packet_access(env, regno, off, size, false);
3840 err = check_flow_keys_access(env, off, size);
3849 err = check_sock_access(env, insn_idx, regno, off, size, t);
3854 err = check_tp_buffer_access(env, reg, regno, off, size);
3859 err = check_ptr_to_btf_access(env, regs, regno, off, size, t, value_regno);
3861 err = check_ptr_to_map_access(env, regs, regno, off, size, t, value_regno);
3879 err = check_buffer_access(env, reg, regno, off, size, false, buf_info, max_access);
3929 err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, BPF_SIZE(insn->code), BPF_READ, -1, true);
3935 return check_mem_access(env, insn_idx, insn->dst_reg, insn->off, BPF_SIZE(insn->code), BPF_WRITE, -1, true);
3942 * 'off' includes 'regno->off', but not its dynamic part (if any).
3947 static int check_stack_range_initialized(struct bpf_verifier_env *env, int regno, int off, int access_size,
3976 err = check_stack_access_within_bounds(env, regno, off, access_size, type, bounds_check_type);
3982 min_off = max_off = reg->var_off.value + off;
4007 min_off = reg->smin_value + off;
4008 max_off = reg->smax_value + off;
4054 verbose(env, "invalid%s read from stack R%d off %d+%d size %d\n", err_extra, regno, min_off, i - min_off,
4083 return check_packet_access(env, regno, reg->off, access_size, zero_size_allowed);
4085 if (check_map_access_type(env, regno, reg->off, access_size,
4089 return check_map_access(env, regno, reg->off, access_size, zero_size_allowed);
4091 return check_mem_region_access(env, regno, reg->off, access_size, reg->mem_size, zero_size_allowed);
4104 return check_buffer_access(env, reg, regno, reg->off, access_size, zero_size_allowed, buf_info, max_access);
4106 return check_stack_range_initialized(env, regno, reg->off, access_size, zero_size_allowed, ACCESS_HELPER,
4165 if (map->spin_lock_off != val + reg->off) {
4166 verbose(env, "off %lld doesn't point to 'struct bpf_spin_lock'\n", val + reg->off);
4399 if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *arg_btf_id)) {
5609 if (reg->off >= BPF_MAX_VAR_OFF || reg->off <= -BPF_MAX_VAR_OFF) {
5610 verbose(env, "%s pointer offset %d is not allowed\n", reg_type_str(env, type), reg->off);
5653 ptr_limit = -(ptr_reg->var_off.value + ptr_reg->off);
5657 ptr_limit = (mask_to_left ? ptr_reg->smin_value : ptr_reg->umax_value) + ptr_reg->off;
5808 * masking when off was not within expected range. If off
5879 * 'off' includes 'reg->off'.
5882 const struct bpf_reg_state *reg, int off)
5888 verbose(env, "R%d variable stack access prohibited for !root, var_off=%s off=%d\n", regno, tn_buf, off);
5892 if (off >= 0 || off < -MAX_BPF_STACK) {
5895 "prohibited for !root; off=%d\n",
5896 regno, off);
5917 if (check_stack_access_for_ptr_arithmetic(env, dst, dst_reg, dst_reg->off + dst_reg->var_off.value)) {
5922 if (check_map_access(env, dst, dst_reg->off, 1, false)) {
6030 * the s32 'off' field
6032 if (known && (ptr_reg->off + smin_val == (s64)(s32)(ptr_reg->off + smin_val))) {
6039 dst_reg->off = ptr_reg->off + smin_val;
6043 /* A new variable offset is created. Note that off_reg->off
6067 dst_reg->off = ptr_reg->off;
6089 if (known && (ptr_reg->off - smin_val == (s64)(s32)(ptr_reg->off - smin_val))) {
6097 dst_reg->off = ptr_reg->off - smin_val;
6122 dst_reg->off = ptr_reg->off;
6962 if (BPF_SRC(insn->code) != 0 || insn->src_reg != BPF_REG_0 || insn->off != 0 || insn->imm != 0) {
6967 if (insn->src_reg != BPF_REG_0 || insn->off != 0 ||
6993 if (insn->imm != 0 || insn->off != 0) {
7003 if (insn->src_reg != BPF_REG_0 || insn->off != 0) {
7072 if (insn->imm != 0 || insn->off != 0) {
7082 if (insn->src_reg != BPF_REG_0 || insn->off != 0) {
7148 if (dst_reg->off < 0 || (dst_reg->off == 0 && range_right_open)) {
7153 if (dst_reg->umax_value > MAX_PACKET_OFF || dst_reg->umax_value + dst_reg->off > MAX_PACKET_OFF) {
7160 new_range = dst_reg->off;
7181 * r2=pkt(id=n,off=8,r=0)
7182 * r3=pkt(id=n,off=0,r=0)
7198 * r2=pkt(id=n,off=8,r=0)
7199 * r3=pkt(id=n,off=0,r=0)
7201 * Find register r3 and mark its range as r3=pkt(id=n,off=0,r=8)
7202 * or r3=pkt(id=n,off=0,r=8-1), so that range of bytes [r3, r3 + 8)
7210 * dst_reg->off is known < MAX_PACKET_OFF, therefore it fits in a u16.
7634 !tnum_equals_const(reg->var_off, 0) || reg->off)) {
7903 *insn_idx += insn->off;
7910 if (!env->bypass_spec_v1 && !sanitize_speculative_path(env, insn, *insn_idx + insn->off + 1, *insn_idx)) {
7916 other_branch = push_stack(env, *insn_idx + insn->off + 1, *insn_idx, false);
7994 if (insn->off != 0) {
8041 dst_reg->off = aux->map_off;
8099 if (insn->dst_reg != BPF_REG_0 || insn->off != 0 || BPF_SIZE(insn->code) == BPF_DW ||
8458 ret = push_insn(t, t + insns[t].off + 1, FALLTHROUGH, env, true);
8468 init_explored_state(env, t + insns[t].off + 1);
8485 ret = push_insn(t, t + insns[t].off + 1, BRANCH, env, true);
9069 * still safe. This is true even if old range < old off,
9079 if (rold->off != rcur->off) {
9165 * (bpf_reg_state) {.type = PTR_TO_STACK, .off = -8}
9167 * (bpf_reg_state) {.type = PTR_TO_STACK, .off = -16}
9296 /* A write screens off any subsequent reads; but write marks come from the
9592 * our child did, so they don't screen off its reads from us.
9762 /* check that memory (src_reg + off) is readable,
9765 err = check_mem_access(env, env->insn_idx, insn->src_reg, insn->off, BPF_SIZE(insn->code), BPF_READ,
9775 * dst_reg = *(u32 *)(src_reg + off)
9781 * dst_reg = *(u32*) (src_reg + off)
9814 /* check that memory (dst_reg + off) is writeable */
9815 err = check_mem_access(env, env->insn_idx, insn->dst_reg, insn->off, BPF_SIZE(insn->code), BPF_WRITE,
9845 /* check that memory (dst_reg + off) is writeable */
9846 err = check_mem_access(env, env->insn_idx, insn->dst_reg, insn->off, BPF_SIZE(insn->code), BPF_WRITE, -1,
9855 if (BPF_SRC(insn->code) != BPF_K || insn->off != 0 ||
9881 env->insn_idx += insn->off + 1;
10183 insn[1].off != 0) {
10228 u32 off = insn[1].imm;
10230 if (off >= BPF_MAX_VAR_OFF) {
10231 verbose(env, "direct value offset of %u is not allowed\n", off);
10242 err = map->ops->map_direct_value_addr(map, &addr, off);
10244 verbose(env, "invalid access to map value pointer, value_size=%u off=%u\n", map->value_size, off);
10249 aux->map_off = off;
10250 addr += off;
10327 /* single env->prog->insni[off] instruction was replaced with the range
10328 * insni[off, off + cnt). Adjust corresponding insn_aux_data by copying
10329 * [0, off) and [off, end) to new locations, so the patched range stays zero
10332 struct bpf_prog *new_prog, u32 off, u32 cnt)
10336 u32 old_seen = old_data[off].seen;
10344 old_data[off].zext_dst = insn_has_def32(env, insn + off + cnt - 1);
10351 memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
10352 memcpy(new_data + off + cnt - 1, old_data + off, sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1));
10353 for (i = off; i < off + cnt - 1; i++) {
10354 /* Expand insni[off]'s seen count to the patched range. */
10362 static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len)
10371 if (env->subprog_info[i].start <= off) {
10378 static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len)
10386 if (desc->insn_idx <= off) {
10393 static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 off, const struct bpf_insn *patch,
10406 new_prog = bpf_patch_insn_single(env->prog, off, patch, len);
10409 verbose(env, "insn %d cannot be patched due to 16-bit range\n", env->insn_aux_data[off].orig_idx);
10414 adjust_insn_aux_data(env, new_data, new_prog, off, len);
10415 adjust_subprog_starts(env, off, len);
10416 adjust_poke_descs(new_prog, off, len);
10420 static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, u32 off, u32 cnt)
10424 /* find first prog starting at or after off (first to remove) */
10426 if (env->subprog_info[i].start >= off) {
10430 /* find first prog starting at or after off + cnt (first to stay) */
10432 if (env->subprog_info[j].start >= off + cnt) {
10436 /* if j doesn't start exactly at off + cnt, we are just removing
10439 if (env->subprog_info[j].start != off + cnt) {
10465 if (env->subprog_info[i].start == off) {
10478 static int bpf_adj_linfo_after_remove(struct bpf_verifier_env *env, u32 off, u32 cnt)
10493 if (linfo[i].insn_off >= off) {
10501 if (linfo[i].insn_off < off + cnt) {
10509 * last removed linfo. prog is already modified, so prog->len == off
10512 if (prog->len != off && l_cnt && (i == nr_linfo || linfo[i].insn_off != off + cnt)) {
10514 linfo[--i].insn_off = off + cnt;
10525 /* pull all linfo[i].insn_off >= off + cnt in by cnt */
10530 /* fix up all subprogs (incl. 'exit') which start >= off */
10547 static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt)
10554 bpf_prog_offload_remove_insns(env, off, cnt);
10557 err = bpf_remove_insns(env->prog, off, cnt);
10562 err = adjust_subprog_starts_after_remove(env, off, cnt);
10567 err = bpf_adj_linfo_after_remove(env, off, cnt);
10572 memmove(aux_data + off, aux_data + off + cnt, sizeof(*aux_data) * (orig_prog_len - off - cnt));
10635 ja.off = insn->off;
10636 } else if (!aux_data[i + 1 + insn->off].seen) {
10637 ja.off = 0;
10792 u32 target_size, size_default, off;
10903 off = insn->off;
10919 insn->off = off & ~(size_default - 1);
10931 u8 shift = bpf_ctx_narrow_access_offset(off, size, size_default) * VERIFIER_EIGHT;
10993 insn->off = subprog;
11087 subprog = insn->off;
11099 * by using its subprog id, available from the off field of
11132 insn->off = env->insn_aux_data[i].call_imm;
11133 subprog = find_subprog(env, i + insn->off + 1);
11171 insn->off = 0;
12300 /* program is valid, convert *(u32*)(ctx + off) accesses */