1{ 2 "invalid direct packet write for LWT_IN", 3 .insns = { 4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 5 offsetof(struct __sk_buff, data)), 6 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 7 offsetof(struct __sk_buff, data_end)), 8 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 9 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 10 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 11 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0), 12 BPF_MOV64_IMM(BPF_REG_0, 0), 13 BPF_EXIT_INSN(), 14 }, 15 .errstr = "cannot write into packet", 16 .result = REJECT, 17 .prog_type = BPF_PROG_TYPE_LWT_IN, 18}, 19{ 20 "invalid direct packet write for LWT_OUT", 21 .insns = { 22 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 23 offsetof(struct __sk_buff, data)), 24 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 25 offsetof(struct __sk_buff, data_end)), 26 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 27 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 28 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 29 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0), 30 BPF_MOV64_IMM(BPF_REG_0, 0), 31 BPF_EXIT_INSN(), 32 }, 33 .errstr = "cannot write into packet", 34 .result = REJECT, 35 .prog_type = BPF_PROG_TYPE_LWT_OUT, 36}, 37{ 38 "direct packet write for LWT_XMIT", 39 .insns = { 40 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 41 offsetof(struct __sk_buff, data)), 42 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 43 offsetof(struct __sk_buff, data_end)), 44 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 45 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 46 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 47 BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0), 48 BPF_MOV64_IMM(BPF_REG_0, 0), 49 BPF_EXIT_INSN(), 50 }, 51 .result = ACCEPT, 52 .prog_type = BPF_PROG_TYPE_LWT_XMIT, 53}, 54{ 55 "direct packet read for LWT_IN", 56 .insns = { 57 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 58 offsetof(struct __sk_buff, data)), 59 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 60 offsetof(struct __sk_buff, data_end)), 61 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 62 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 63 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 64 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0), 65 BPF_MOV64_IMM(BPF_REG_0, 0), 66 BPF_EXIT_INSN(), 67 }, 68 .result = ACCEPT, 69 .prog_type = BPF_PROG_TYPE_LWT_IN, 70}, 71{ 72 "direct packet read for LWT_OUT", 73 .insns = { 74 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 75 offsetof(struct __sk_buff, data)), 76 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 77 offsetof(struct __sk_buff, data_end)), 78 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 79 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 80 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 81 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0), 82 BPF_MOV64_IMM(BPF_REG_0, 0), 83 BPF_EXIT_INSN(), 84 }, 85 .result = ACCEPT, 86 .prog_type = BPF_PROG_TYPE_LWT_OUT, 87}, 88{ 89 "direct packet read for LWT_XMIT", 90 .insns = { 91 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 92 offsetof(struct __sk_buff, data)), 93 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 94 offsetof(struct __sk_buff, data_end)), 95 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 96 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 97 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1), 98 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0), 99 BPF_MOV64_IMM(BPF_REG_0, 0), 100 BPF_EXIT_INSN(), 101 }, 102 .result = ACCEPT, 103 .prog_type = BPF_PROG_TYPE_LWT_XMIT, 104}, 105{ 106 "overlapping checks for direct packet access", 107 .insns = { 108 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 109 offsetof(struct __sk_buff, data)), 110 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 111 offsetof(struct __sk_buff, data_end)), 112 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), 113 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), 114 BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4), 115 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 116 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), 117 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1), 118 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6), 119 BPF_MOV64_IMM(BPF_REG_0, 0), 120 BPF_EXIT_INSN(), 121 }, 122 .result = ACCEPT, 123 .prog_type = BPF_PROG_TYPE_LWT_XMIT, 124}, 125{ 126 "make headroom for LWT_XMIT", 127 .insns = { 128 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 129 BPF_MOV64_IMM(BPF_REG_2, 34), 130 BPF_MOV64_IMM(BPF_REG_3, 0), 131 BPF_EMIT_CALL(BPF_FUNC_skb_change_head), 132 /* split for s390 to succeed */ 133 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 134 BPF_MOV64_IMM(BPF_REG_2, 42), 135 BPF_MOV64_IMM(BPF_REG_3, 0), 136 BPF_EMIT_CALL(BPF_FUNC_skb_change_head), 137 BPF_MOV64_IMM(BPF_REG_0, 0), 138 BPF_EXIT_INSN(), 139 }, 140 .result = ACCEPT, 141 .prog_type = BPF_PROG_TYPE_LWT_XMIT, 142}, 143{ 144 "invalid access of tc_classid for LWT_IN", 145 .insns = { 146 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 147 offsetof(struct __sk_buff, tc_classid)), 148 BPF_EXIT_INSN(), 149 }, 150 .result = REJECT, 151 .errstr = "invalid bpf_context access", 152}, 153{ 154 "invalid access of tc_classid for LWT_OUT", 155 .insns = { 156 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 157 offsetof(struct __sk_buff, tc_classid)), 158 BPF_EXIT_INSN(), 159 }, 160 .result = REJECT, 161 .errstr = "invalid bpf_context access", 162}, 163{ 164 "invalid access of tc_classid for LWT_XMIT", 165 .insns = { 166 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 167 offsetof(struct __sk_buff, tc_classid)), 168 BPF_EXIT_INSN(), 169 }, 170 .result = REJECT, 171 .errstr = "invalid bpf_context access", 172}, 173{ 174 "check skb->tc_classid half load not permitted for lwt prog", 175 .insns = { 176 BPF_MOV64_IMM(BPF_REG_0, 0), 177#if __BYTE_ORDER == __LITTLE_ENDIAN 178 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 179 offsetof(struct __sk_buff, tc_classid)), 180#else 181 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 182 offsetof(struct __sk_buff, tc_classid) + 2), 183#endif 184 BPF_EXIT_INSN(), 185 }, 186 .result = REJECT, 187 .errstr = "invalid bpf_context access", 188 .prog_type = BPF_PROG_TYPE_LWT_IN, 189}, 190