2 "map access: known scalar += value_ptr from different maps",
4 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5 offsetof(struct __sk_buff, len)),
6 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
10 BPF_LD_MAP_FD(BPF_REG_1, 0),
11 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
12 BPF_LD_MAP_FD(BPF_REG_1, 0),
13 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
14 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
15 BPF_MOV64_IMM(BPF_REG_1, 4),
16 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
17 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
18 BPF_MOV64_IMM(BPF_REG_0, 1),
21 .fixup_map_hash_16b = { 5 },
22 .fixup_map_array_48b = { 8 },
27 "map access: value_ptr -= known scalar from different maps",
29 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
30 offsetof(struct __sk_buff, len)),
31 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
32 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
33 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
34 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
35 BPF_LD_MAP_FD(BPF_REG_1, 0),
36 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
37 BPF_LD_MAP_FD(BPF_REG_1, 0),
38 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
39 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
40 BPF_MOV64_IMM(BPF_REG_1, 4),
41 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
42 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
43 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
44 BPF_MOV64_IMM(BPF_REG_0, 1),
47 .fixup_map_hash_16b = { 5 },
48 .fixup_map_array_48b = { 8 },
50 .result_unpriv = REJECT,
51 .errstr_unpriv = "R0 min value is outside of the allowed memory range",
55 "map access: known scalar += value_ptr from different maps, but same value properties",
57 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
58 offsetof(struct __sk_buff, len)),
59 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
60 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
62 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
63 BPF_LD_MAP_FD(BPF_REG_1, 0),
64 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
65 BPF_LD_MAP_FD(BPF_REG_1, 0),
66 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
67 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
68 BPF_MOV64_IMM(BPF_REG_1, 4),
69 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
70 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
71 BPF_MOV64_IMM(BPF_REG_0, 1),
74 .fixup_map_hash_48b = { 5 },
75 .fixup_map_array_48b = { 8 },
80 "map access: mixing value pointer and scalar, 1",
82 // load map value pointer into r0 and r2
83 BPF_MOV64_IMM(BPF_REG_0, 1),
84 BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
85 BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
86 BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
87 BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
88 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
89 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
91 // load some number from the map into r1
92 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
93 // depending on r1, branch:
94 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 3),
96 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
97 BPF_MOV64_IMM(BPF_REG_3, 0),
100 BPF_MOV64_IMM(BPF_REG_2, 0),
101 BPF_MOV64_IMM(BPF_REG_3, 0x100000),
102 // common instruction
103 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
104 // depending on r1, branch:
105 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
109 BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
110 // verifier follows fall-through
111 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
112 BPF_MOV64_IMM(BPF_REG_0, 0),
114 // fake-dead code; targeted from branch A to
115 // prevent dead code sanitization
116 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
117 BPF_MOV64_IMM(BPF_REG_0, 0),
120 .fixup_map_array_48b = { 1 },
122 .result_unpriv = REJECT,
123 .errstr_unpriv = "R2 tried to add from different maps, paths or scalars",
127 "map access: mixing value pointer and scalar, 2",
129 // load map value pointer into r0 and r2
130 BPF_MOV64_IMM(BPF_REG_0, 1),
131 BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
132 BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
133 BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
134 BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
135 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
136 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
138 // load some number from the map into r1
139 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
140 // depending on r1, branch:
141 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
143 BPF_MOV64_IMM(BPF_REG_2, 0),
144 BPF_MOV64_IMM(BPF_REG_3, 0x100000),
147 BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
148 BPF_MOV64_IMM(BPF_REG_3, 0),
149 // common instruction
150 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
151 // depending on r1, branch:
152 BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
156 BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
157 // verifier follows fall-through
158 BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
159 BPF_MOV64_IMM(BPF_REG_0, 0),
161 // fake-dead code; targeted from branch A to
162 // prevent dead code sanitization
163 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
164 BPF_MOV64_IMM(BPF_REG_0, 0),
167 .fixup_map_array_48b = { 1 },
169 .result_unpriv = REJECT,
170 .errstr_unpriv = "R2 tried to add from different maps, paths or scalars",
174 "sanitation: alu with different scalars 1",
176 BPF_MOV64_IMM(BPF_REG_0, 1),
177 BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
178 BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
179 BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
180 BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
181 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
182 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
184 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
185 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
186 BPF_MOV64_IMM(BPF_REG_2, 0),
187 BPF_MOV64_IMM(BPF_REG_3, 0x100000),
189 BPF_MOV64_IMM(BPF_REG_2, 42),
190 BPF_MOV64_IMM(BPF_REG_3, 0x100001),
191 BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
192 BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
195 .fixup_map_array_48b = { 1 },
200 "sanitation: alu with different scalars 2",
202 BPF_MOV64_IMM(BPF_REG_0, 1),
203 BPF_LD_MAP_FD(BPF_REG_1, 0),
204 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
205 BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
206 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
207 BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
208 BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
209 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
210 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
211 BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
212 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
213 BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
214 BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
215 BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
216 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7),
217 BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
220 .fixup_map_array_48b = { 1 },
222 .retval = -EINVAL * 2,
225 "sanitation: alu with different scalars 3",
227 BPF_MOV64_IMM(BPF_REG_0, EINVAL),
228 BPF_ALU64_IMM(BPF_MUL, BPF_REG_0, -1),
229 BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
230 BPF_MOV64_IMM(BPF_REG_0, EINVAL),
231 BPF_ALU64_IMM(BPF_MUL, BPF_REG_0, -1),
232 BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
233 BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
234 BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7),
235 BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
239 .retval = -EINVAL * 2,
242 "map access: value_ptr += known scalar, upper oob arith, test 1",
244 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
245 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
246 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
247 BPF_LD_MAP_FD(BPF_REG_1, 0),
248 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
249 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
250 BPF_MOV64_IMM(BPF_REG_1, 48),
251 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
252 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
253 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
254 BPF_MOV64_IMM(BPF_REG_0, 1),
257 .fixup_map_array_48b = { 3 },
259 .result_unpriv = REJECT,
260 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
264 "map access: value_ptr += known scalar, upper oob arith, test 2",
266 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
267 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
268 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
269 BPF_LD_MAP_FD(BPF_REG_1, 0),
270 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
271 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
272 BPF_MOV64_IMM(BPF_REG_1, 49),
273 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
274 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
275 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
276 BPF_MOV64_IMM(BPF_REG_0, 1),
279 .fixup_map_array_48b = { 3 },
281 .result_unpriv = REJECT,
282 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
286 "map access: value_ptr += known scalar, upper oob arith, test 3",
288 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
289 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
290 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
291 BPF_LD_MAP_FD(BPF_REG_1, 0),
292 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
293 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
294 BPF_MOV64_IMM(BPF_REG_1, 47),
295 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
296 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
297 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
298 BPF_MOV64_IMM(BPF_REG_0, 1),
301 .fixup_map_array_48b = { 3 },
306 "map access: value_ptr -= known scalar, lower oob arith, test 1",
308 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
309 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
310 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
311 BPF_LD_MAP_FD(BPF_REG_1, 0),
312 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
313 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
314 BPF_MOV64_IMM(BPF_REG_1, 47),
315 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
316 BPF_MOV64_IMM(BPF_REG_1, 48),
317 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
318 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
319 BPF_MOV64_IMM(BPF_REG_0, 1),
322 .fixup_map_array_48b = { 3 },
324 .errstr = "R0 min value is outside of the allowed memory range",
325 .result_unpriv = REJECT,
326 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
329 "map access: value_ptr -= known scalar, lower oob arith, test 2",
331 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
332 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
333 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
334 BPF_LD_MAP_FD(BPF_REG_1, 0),
335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
336 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
337 BPF_MOV64_IMM(BPF_REG_1, 47),
338 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
339 BPF_MOV64_IMM(BPF_REG_1, 48),
340 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
341 BPF_MOV64_IMM(BPF_REG_1, 1),
342 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
343 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
344 BPF_MOV64_IMM(BPF_REG_0, 1),
347 .fixup_map_array_48b = { 3 },
349 .result_unpriv = REJECT,
350 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
354 "map access: value_ptr -= known scalar, lower oob arith, test 3",
356 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
357 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
358 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
359 BPF_LD_MAP_FD(BPF_REG_1, 0),
360 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
361 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
362 BPF_MOV64_IMM(BPF_REG_1, 47),
363 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
364 BPF_MOV64_IMM(BPF_REG_1, 47),
365 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
366 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
367 BPF_MOV64_IMM(BPF_REG_0, 1),
370 .fixup_map_array_48b = { 3 },
375 "map access: known scalar += value_ptr",
377 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
378 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
379 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
380 BPF_LD_MAP_FD(BPF_REG_1, 0),
381 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
382 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
383 BPF_MOV64_IMM(BPF_REG_1, 4),
384 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
385 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
386 BPF_MOV64_IMM(BPF_REG_0, 1),
389 .fixup_map_array_48b = { 3 },
394 "map access: value_ptr += known scalar, 1",
396 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
397 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
399 BPF_LD_MAP_FD(BPF_REG_1, 0),
400 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
401 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
402 BPF_MOV64_IMM(BPF_REG_1, 4),
403 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
404 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
405 BPF_MOV64_IMM(BPF_REG_0, 1),
408 .fixup_map_array_48b = { 3 },
413 "map access: value_ptr += known scalar, 2",
415 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
416 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
417 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
418 BPF_LD_MAP_FD(BPF_REG_1, 0),
419 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
420 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
421 BPF_MOV64_IMM(BPF_REG_1, 49),
422 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
423 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
424 BPF_MOV64_IMM(BPF_REG_0, 1),
427 .fixup_map_array_48b = { 3 },
429 .errstr = "invalid access to map value",
432 "map access: value_ptr += known scalar, 3",
434 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
435 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
436 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
437 BPF_LD_MAP_FD(BPF_REG_1, 0),
438 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
439 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
440 BPF_MOV64_IMM(BPF_REG_1, -1),
441 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
442 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
443 BPF_MOV64_IMM(BPF_REG_0, 1),
446 .fixup_map_array_48b = { 3 },
448 .errstr = "invalid access to map value",
451 "map access: value_ptr += known scalar, 4",
453 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
454 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
455 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
456 BPF_LD_MAP_FD(BPF_REG_1, 0),
457 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
458 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
459 BPF_MOV64_IMM(BPF_REG_1, 5),
460 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
461 BPF_MOV64_IMM(BPF_REG_1, -2),
462 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
463 BPF_MOV64_IMM(BPF_REG_1, -1),
464 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
465 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
466 BPF_MOV64_IMM(BPF_REG_0, 1),
469 .fixup_map_array_48b = { 3 },
474 "map access: value_ptr += known scalar, 5",
476 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
477 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
478 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
479 BPF_LD_MAP_FD(BPF_REG_1, 0),
480 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
481 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
482 BPF_MOV64_IMM(BPF_REG_1, (6 + 1) * sizeof(int)),
483 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
484 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
487 .fixup_map_array_48b = { 3 },
489 .retval = 0xabcdef12,
492 "map access: value_ptr += known scalar, 6",
494 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
495 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
496 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
497 BPF_LD_MAP_FD(BPF_REG_1, 0),
498 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
499 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
500 BPF_MOV64_IMM(BPF_REG_1, (3 + 1) * sizeof(int)),
501 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
502 BPF_MOV64_IMM(BPF_REG_1, 3 * sizeof(int)),
503 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
504 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
507 .fixup_map_array_48b = { 3 },
509 .retval = 0xabcdef12,
512 "map access: value_ptr += N, value_ptr -= N known scalar",
514 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
515 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
516 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
517 BPF_LD_MAP_FD(BPF_REG_1, 0),
518 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
519 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
520 BPF_MOV32_IMM(BPF_REG_1, 0x12345678),
521 BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
522 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
523 BPF_MOV64_IMM(BPF_REG_1, 2),
524 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
525 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
528 .fixup_map_array_48b = { 3 },
530 .retval = 0x12345678,
533 "map access: unknown scalar += value_ptr, 1",
535 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
536 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
537 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
538 BPF_LD_MAP_FD(BPF_REG_1, 0),
539 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
540 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
541 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
542 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
543 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
544 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
545 BPF_MOV64_IMM(BPF_REG_0, 1),
548 .fixup_map_array_48b = { 3 },
553 "map access: unknown scalar += value_ptr, 2",
555 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
556 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
557 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
558 BPF_LD_MAP_FD(BPF_REG_1, 0),
559 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
560 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
561 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
562 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
563 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
564 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
567 .fixup_map_array_48b = { 3 },
569 .retval = 0xabcdef12,
570 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
573 "map access: unknown scalar += value_ptr, 3",
575 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
576 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
577 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
578 BPF_LD_MAP_FD(BPF_REG_1, 0),
579 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
580 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
581 BPF_MOV64_IMM(BPF_REG_1, -1),
582 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
583 BPF_MOV64_IMM(BPF_REG_1, 1),
584 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
585 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
586 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
587 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
588 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
591 .fixup_map_array_48b = { 3 },
593 .result_unpriv = REJECT,
594 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
595 .retval = 0xabcdef12,
596 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
599 "map access: unknown scalar += value_ptr, 4",
601 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
602 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
603 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
604 BPF_LD_MAP_FD(BPF_REG_1, 0),
605 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
606 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
607 BPF_MOV64_IMM(BPF_REG_1, 19),
608 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
609 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
610 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
611 BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
612 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
615 .fixup_map_array_48b = { 3 },
617 .errstr = "R1 max value is outside of the allowed memory range",
618 .errstr_unpriv = "R1 pointer arithmetic of map value goes out of range",
619 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
622 "map access: value_ptr += unknown scalar, 1",
624 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
625 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
626 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
627 BPF_LD_MAP_FD(BPF_REG_1, 0),
628 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
629 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
630 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
631 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
632 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
633 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
634 BPF_MOV64_IMM(BPF_REG_0, 1),
637 .fixup_map_array_48b = { 3 },
642 "map access: value_ptr += unknown scalar, 2",
644 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
645 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
646 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
647 BPF_LD_MAP_FD(BPF_REG_1, 0),
648 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
649 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
650 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
651 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
652 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
653 BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
656 .fixup_map_array_48b = { 3 },
658 .retval = 0xabcdef12,
659 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
662 "map access: value_ptr += unknown scalar, 3",
664 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
665 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
666 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
667 BPF_LD_MAP_FD(BPF_REG_1, 0),
668 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
669 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
670 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
671 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 8),
672 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 16),
673 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
674 BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 1),
675 BPF_ALU64_IMM(BPF_OR, BPF_REG_3, 1),
676 BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_3, 4),
677 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
678 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
679 BPF_MOV64_IMM(BPF_REG_0, 1),
681 BPF_MOV64_IMM(BPF_REG_0, 2),
682 BPF_JMP_IMM(BPF_JA, 0, 0, -3),
684 .fixup_map_array_48b = { 3 },
689 "map access: value_ptr += value_ptr",
691 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
692 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
693 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
694 BPF_LD_MAP_FD(BPF_REG_1, 0),
695 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
696 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
697 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),
698 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
699 BPF_MOV64_IMM(BPF_REG_0, 1),
702 .fixup_map_array_48b = { 3 },
704 .errstr = "R0 pointer += pointer prohibited",
707 "map access: known scalar -= value_ptr",
709 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
710 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
711 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
712 BPF_LD_MAP_FD(BPF_REG_1, 0),
713 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
714 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
715 BPF_MOV64_IMM(BPF_REG_1, 4),
716 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
717 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
718 BPF_MOV64_IMM(BPF_REG_0, 1),
721 .fixup_map_array_48b = { 3 },
723 .errstr = "R1 tried to subtract pointer from scalar",
726 "map access: value_ptr -= known scalar",
728 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
729 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
730 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
731 BPF_LD_MAP_FD(BPF_REG_1, 0),
732 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
733 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
734 BPF_MOV64_IMM(BPF_REG_1, 4),
735 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
736 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
737 BPF_MOV64_IMM(BPF_REG_0, 1),
740 .fixup_map_array_48b = { 3 },
742 .errstr = "R0 min value is outside of the allowed memory range",
745 "map access: value_ptr -= known scalar, 2",
747 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
748 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
749 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
750 BPF_LD_MAP_FD(BPF_REG_1, 0),
751 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
752 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
753 BPF_MOV64_IMM(BPF_REG_1, 6),
754 BPF_MOV64_IMM(BPF_REG_2, 4),
755 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
756 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
757 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
758 BPF_MOV64_IMM(BPF_REG_0, 1),
761 .fixup_map_array_48b = { 3 },
766 "map access: unknown scalar -= value_ptr",
768 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
769 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
770 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
771 BPF_LD_MAP_FD(BPF_REG_1, 0),
772 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
773 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
774 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
775 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
776 BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
777 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
778 BPF_MOV64_IMM(BPF_REG_0, 1),
781 .fixup_map_array_48b = { 3 },
783 .errstr = "R1 tried to subtract pointer from scalar",
786 "map access: value_ptr -= unknown scalar",
788 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
789 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
790 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
791 BPF_LD_MAP_FD(BPF_REG_1, 0),
792 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
793 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
794 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
795 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
796 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
797 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
798 BPF_MOV64_IMM(BPF_REG_0, 1),
801 .fixup_map_array_48b = { 3 },
803 .errstr = "R0 min value is negative",
806 "map access: value_ptr -= unknown scalar, 2",
808 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
809 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
810 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
811 BPF_LD_MAP_FD(BPF_REG_1, 0),
812 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
813 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
814 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
815 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
816 BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),
817 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
818 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
819 BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
820 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
821 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
822 BPF_MOV64_IMM(BPF_REG_0, 1),
825 .fixup_map_array_48b = { 3 },
827 .result_unpriv = REJECT,
828 .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
832 "map access: value_ptr -= value_ptr",
834 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
835 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
836 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
837 BPF_LD_MAP_FD(BPF_REG_1, 0),
838 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
839 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
840 BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),
841 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
842 BPF_MOV64_IMM(BPF_REG_0, 1),
845 .fixup_map_array_48b = { 3 },
847 .errstr = "R0 invalid mem access 'inv'",
848 .errstr_unpriv = "R0 pointer -= pointer prohibited",
851 "32bit pkt_ptr -= scalar",
853 BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
854 offsetof(struct __sk_buff, data_end)),
855 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
856 offsetof(struct __sk_buff, data)),
857 BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
858 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 40),
859 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_8, 2),
860 BPF_ALU32_REG(BPF_MOV, BPF_REG_4, BPF_REG_7),
861 BPF_ALU32_REG(BPF_SUB, BPF_REG_6, BPF_REG_4),
862 BPF_MOV64_IMM(BPF_REG_0, 0),
865 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
867 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
870 "32bit scalar -= pkt_ptr",
872 BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
873 offsetof(struct __sk_buff, data_end)),
874 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
875 offsetof(struct __sk_buff, data)),
876 BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
877 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 40),
878 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_8, 2),
879 BPF_ALU32_REG(BPF_MOV, BPF_REG_4, BPF_REG_6),
880 BPF_ALU32_REG(BPF_SUB, BPF_REG_4, BPF_REG_7),
881 BPF_MOV64_IMM(BPF_REG_0, 0),
884 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
886 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,