Commit 554b36bf authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

Merge branch 'bpf-verifier-misc-improvements' 



Alexei Starovoitov says:

====================
Small set of verifier improvements and cleanups which is
necessary for bigger patch set of bpf-to-bpf calls coming later.
See individual patches for details.
Tested on x86 and arm64 hw.
====================

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents 51de0825 6a28b446

kernel/bpf/verifier.c

+42 −20
Original line number Diff line number Diff line
@@ -216,6 +216,17 @@ static const char * const reg_type_str[] = { 
	[PTR_TO_PACKET_END]	= "pkt_end",

};



static void print_liveness(struct bpf_verifier_env *env,

			   enum bpf_reg_liveness live)

{

	if (live & (REG_LIVE_READ | REG_LIVE_WRITTEN))

	    verbose(env, "_");

	if (live & REG_LIVE_READ)

		verbose(env, "r");

	if (live & REG_LIVE_WRITTEN)

		verbose(env, "w");

}



static void print_verifier_state(struct bpf_verifier_env *env,

				 struct bpf_verifier_state *state)

{
@@ -228,7 +239,9 @@ static void print_verifier_state(struct bpf_verifier_env *env, 
		t = reg->type;

		if (t == NOT_INIT)

			continue;

		verbose(env, " R%d=%s", i, reg_type_str[t]);

		verbose(env, " R%d", i);

		print_liveness(env, reg->live);

		verbose(env, "=%s", reg_type_str[t]);

		if ((t == SCALAR_VALUE || t == PTR_TO_STACK) &&

		    tnum_is_const(reg->var_off)) {

			/* reg->off should be 0 for SCALAR_VALUE */
@@ -277,11 +290,14 @@ static void print_verifier_state(struct bpf_verifier_env *env, 
		}

	}

	for (i = 0; i < state->allocated_stack / BPF_REG_SIZE; i++) {

		if (state->stack[i].slot_type[0] == STACK_SPILL)

			verbose(env, " fp%d=%s",

				-MAX_BPF_STACK + i * BPF_REG_SIZE,

		if (state->stack[i].slot_type[0] == STACK_SPILL) {

			verbose(env, " fp%d",

				(-i - 1) * BPF_REG_SIZE);

			print_liveness(env, state->stack[i].spilled_ptr.live);

			verbose(env, "=%s",

				reg_type_str[state->stack[i].spilled_ptr.type]);

		}

	}

	verbose(env, "\n");

}
@@ -568,8 +584,8 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, 
{

	if (WARN_ON(regno >= MAX_BPF_REG)) {

		verbose(env, "mark_reg_unknown(regs, %u)\n", regno);

		/* Something bad happened, let's kill all regs */

		for (regno = 0; regno < MAX_BPF_REG; regno++)

		/* Something bad happened, let's kill all regs except FP */

		for (regno = 0; regno < BPF_REG_FP; regno++)

			__mark_reg_not_init(regs + regno);

		return;

	}
@@ -587,8 +603,8 @@ static void mark_reg_not_init(struct bpf_verifier_env *env, 
{

	if (WARN_ON(regno >= MAX_BPF_REG)) {

		verbose(env, "mark_reg_not_init(regs, %u)\n", regno);

		/* Something bad happened, let's kill all regs */

		for (regno = 0; regno < MAX_BPF_REG; regno++)

		/* Something bad happened, let's kill all regs except FP */

		for (regno = 0; regno < BPF_REG_FP; regno++)

			__mark_reg_not_init(regs + regno);

		return;

	}
@@ -779,6 +795,11 @@ static int check_stack_read(struct bpf_verifier_env *env, 
		if (value_regno >= 0) {

			/* restore register state from stack */

			state->regs[value_regno] = state->stack[spi].spilled_ptr;

			/* mark reg as written since spilled pointer state likely

			 * has its liveness marks cleared by is_state_visited()

			 * which resets stack/reg liveness for state transitions

			 */

			state->regs[value_regno].live |= REG_LIVE_WRITTEN;

			mark_stack_slot_read(state, spi);

		}

		return 0;
@@ -1244,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins 
}



/* Does this register contain a constant zero? */

static bool register_is_null(struct bpf_reg_state reg)

static bool register_is_null(struct bpf_reg_state *reg)

{

	return reg.type == SCALAR_VALUE && tnum_equals_const(reg.var_off, 0);

	return reg->type == SCALAR_VALUE && tnum_equals_const(reg->var_off, 0);

}



/* when register 'regno' is passed into function that will read 'access_size'
@@ -1259,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
				int access_size, bool zero_size_allowed,

				struct bpf_call_arg_meta *meta)

{

	struct bpf_reg_state *reg = cur_regs(env) + regno;

	struct bpf_verifier_state *state = env->cur_state;

	struct bpf_reg_state *regs = state->regs;

	int off, i, slot, spi;



	if (regs[regno].type != PTR_TO_STACK) {

	if (reg->type != PTR_TO_STACK) {

		/* Allow zero-byte read from NULL, regardless of pointer type */

		if (zero_size_allowed && access_size == 0 &&

		    register_is_null(regs[regno]))

		    register_is_null(reg))

			return 0;



		verbose(env, "R%d type=%s expected=%s\n", regno,

			reg_type_str[regs[regno].type],

			reg_type_str[reg->type],

			reg_type_str[PTR_TO_STACK]);

		return -EACCES;

	}



	/* Only allow fixed-offset stack reads */

	if (!tnum_is_const(regs[regno].var_off)) {

	if (!tnum_is_const(reg->var_off)) {

		char tn_buf[48];



		tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off);

		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

		verbose(env, "invalid variable stack read R%d var_off=%s\n",

			regno, tn_buf);

	}

	off = regs[regno].off + regs[regno].var_off.value;

	off = reg->off + reg->var_off.value;

	if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||

	    access_size < 0 || (access_size == 0 && !zero_size_allowed)) {

		verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
@@ -1391,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
		 * passed in as argument, it's a SCALAR_VALUE type. Final test

		 * happens during stack boundary checking.

		 */

		if (register_is_null(*reg) &&

		if (register_is_null(reg) &&

		    arg_type == ARG_PTR_TO_MEM_OR_NULL)

			/* final test in check_stack_boundary() */;

		else if (!type_is_pkt_pointer(type) &&
@@ -2934,8 +2955,9 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, 
	if (BPF_SRC(insn->code) == BPF_K &&

	    (opcode == BPF_JEQ || opcode == BPF_JNE) &&

	    dst_reg->type == SCALAR_VALUE &&

	    tnum_equals_const(dst_reg->var_off, insn->imm)) {

		if (opcode == BPF_JEQ) {

	    tnum_is_const(dst_reg->var_off)) {

		if ((opcode == BPF_JEQ && dst_reg->var_off.value == insn->imm) ||

		    (opcode == BPF_JNE && dst_reg->var_off.value != insn->imm)) {

			/* if (imm == imm) goto pc+off;

			 * only follow the goto, ignore fall-through

			 */

tools/testing/selftests/bpf/test_align.c

+78 −78
Original line number Diff line number Diff line
@@ -64,11 +64,11 @@ static struct bpf_align_test tests[] = { 
		.matches = {

			{1, "R1=ctx(id=0,off=0,imm=0)"},

			{1, "R10=fp0"},

			{1, "R3=inv2"},

			{2, "R3=inv4"},

			{3, "R3=inv8"},

			{4, "R3=inv16"},

			{5, "R3=inv32"},

			{1, "R3_w=inv2"},

			{2, "R3_w=inv4"},

			{3, "R3_w=inv8"},

			{4, "R3_w=inv16"},

			{5, "R3_w=inv32"},

		},

	},

	{
@@ -92,17 +92,17 @@ static struct bpf_align_test tests[] = { 
		.matches = {

			{1, "R1=ctx(id=0,off=0,imm=0)"},

			{1, "R10=fp0"},

			{1, "R3=inv1"},

			{2, "R3=inv2"},

			{3, "R3=inv4"},

			{4, "R3=inv8"},

			{5, "R3=inv16"},

			{6, "R3=inv1"},

			{7, "R4=inv32"},

			{8, "R4=inv16"},

			{9, "R4=inv8"},

			{10, "R4=inv4"},

			{11, "R4=inv2"},

			{1, "R3_w=inv1"},

			{2, "R3_w=inv2"},

			{3, "R3_w=inv4"},

			{4, "R3_w=inv8"},

			{5, "R3_w=inv16"},

			{6, "R3_w=inv1"},

			{7, "R4_w=inv32"},

			{8, "R4_w=inv16"},

			{9, "R4_w=inv8"},

			{10, "R4_w=inv4"},

			{11, "R4_w=inv2"},

		},

	},

	{
@@ -121,12 +121,12 @@ static struct bpf_align_test tests[] = { 
		.matches = {

			{1, "R1=ctx(id=0,off=0,imm=0)"},

			{1, "R10=fp0"},

			{1, "R3=inv4"},

			{2, "R3=inv8"},

			{3, "R3=inv10"},

			{4, "R4=inv8"},

			{5, "R4=inv12"},

			{6, "R4=inv14"},

			{1, "R3_w=inv4"},

			{2, "R3_w=inv8"},

			{3, "R3_w=inv10"},

			{4, "R4_w=inv8"},

			{5, "R4_w=inv12"},

			{6, "R4_w=inv14"},

		},

	},

	{
@@ -143,10 +143,10 @@ static struct bpf_align_test tests[] = { 
		.matches = {

			{1, "R1=ctx(id=0,off=0,imm=0)"},

			{1, "R10=fp0"},

			{1, "R3=inv7"},

			{2, "R3=inv7"},

			{3, "R3=inv14"},

			{4, "R3=inv56"},

			{1, "R3_w=inv7"},

			{2, "R3_w=inv7"},

			{3, "R3_w=inv14"},

			{4, "R3_w=inv56"},

		},

	},
@@ -185,18 +185,18 @@ static struct bpf_align_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

		.matches = {

			{7, "R0=pkt(id=0,off=8,r=8,imm=0)"},

			{7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{8, "R3=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

			{9, "R3=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{10, "R3=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{11, "R3=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

			{7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{8, "R3_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

			{9, "R3_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{10, "R3_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{11, "R3_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

			{18, "R3=pkt_end(id=0,off=0,imm=0)"},

			{18, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{19, "R4=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"},

			{20, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

			{21, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{22, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{23, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

			{18, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{19, "R4_w=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"},

			{20, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

			{21, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{22, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{23, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

		},

	},

	{
@@ -217,16 +217,16 @@ static struct bpf_align_test tests[] = { 
		},

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

		.matches = {

			{7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{8, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{9, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{11, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

			{12, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{13, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{14, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{15, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{16, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

			{7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{8, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{9, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{11, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},

			{12, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{13, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{14, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{15, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},

			{16, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},

		},

	},

	{
@@ -257,14 +257,14 @@ static struct bpf_align_test tests[] = { 
		},

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

		.matches = {

			{4, "R5=pkt(id=0,off=0,r=0,imm=0)"},

			{5, "R5=pkt(id=0,off=14,r=0,imm=0)"},

			{6, "R4=pkt(id=0,off=14,r=0,imm=0)"},

			{4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"},

			{5, "R5_w=pkt(id=0,off=14,r=0,imm=0)"},

			{6, "R4_w=pkt(id=0,off=14,r=0,imm=0)"},

			{10, "R2=pkt(id=0,off=0,r=18,imm=0)"},

			{10, "R5=pkt(id=0,off=14,r=18,imm=0)"},

			{10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{14, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},

			{15, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},

			{10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},

			{14, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},

			{15, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},

		},

	},

	{
@@ -320,11 +320,11 @@ static struct bpf_align_test tests[] = { 
			 * alignment of 4.

			 */

			{8, "R2=pkt(id=0,off=0,r=8,imm=0)"},

			{8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Offset is added to packet pointer R5, resulting in

			 * known fixed offset, and variable offset from R6.

			 */

			{11, "R5=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{11, "R5_w=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* At the time the word size load is performed from R5,

			 * it's total offset is NET_IP_ALIGN + reg->off (0) +

			 * reg->aux_off (14) which is 16.  Then the variable
@@ -336,11 +336,11 @@ static struct bpf_align_test tests[] = { 
			/* Variable offset is added to R5 packet pointer,

			 * resulting in auxiliary alignment of 4.

			 */

			{18, "R5=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{18, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Constant offset is added to R5, resulting in

			 * reg->off of 14.

			 */

			{19, "R5=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{19, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* At the time the word size load is performed from R5,

			 * its total fixed offset is NET_IP_ALIGN + reg->off

			 * (14) which is 16.  Then the variable offset is 4-byte
@@ -352,18 +352,18 @@ static struct bpf_align_test tests[] = { 
			/* Constant offset is added to R5 packet pointer,

			 * resulting in reg->off value of 14.

			 */

			{26, "R5=pkt(id=0,off=14,r=8"},

			{26, "R5_w=pkt(id=0,off=14,r=8"},

			/* Variable offset is added to R5, resulting in a

			 * variable offset of (4n).

			 */

			{27, "R5=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{27, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Constant is added to R5 again, setting reg->off to 18. */

			{28, "R5=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{28, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* And once more we add a variable; resulting var_off

			 * is still (4n), fixed offset is not changed.

			 * Also, we create a new reg->id.

			 */

			{29, "R5=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"},

			{29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"},

			/* At the time the word size load is performed from R5,

			 * its total fixed offset is NET_IP_ALIGN + reg->off (18)

			 * which is 20.  Then the variable offset is (4n), so
@@ -410,11 +410,11 @@ static struct bpf_align_test tests[] = { 
			 * alignment of 4.

			 */

			{8, "R2=pkt(id=0,off=0,r=8,imm=0)"},

			{8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Adding 14 makes R6 be (4n+2) */

			{9, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			{9, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			/* Packet pointer has (4n+2) offset */

			{11, "R5=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			{11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			{13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			/* At the time the word size load is performed from R5,

			 * its total fixed offset is NET_IP_ALIGN + reg->off (0)
@@ -426,11 +426,11 @@ static struct bpf_align_test tests[] = { 
			/* Newly read value in R6 was shifted left by 2, so has

			 * known alignment of 4.

			 */

			{18, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{18, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Added (4n) to packet pointer's (4n+2) var_off, giving

			 * another (4n+2).

			 */

			{19, "R5=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},

			{19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},

			{21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},

			/* At the time the word size load is performed from R5,

			 * its total fixed offset is NET_IP_ALIGN + reg->off (0)
@@ -473,11 +473,11 @@ static struct bpf_align_test tests[] = { 
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

		.result = REJECT,

		.matches = {

			{4, "R5=pkt(id=0,off=0,r=0,imm=0)"},

			{4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"},

			/* ptr & 0x40 == either 0 or 0x40 */

			{5, "R5=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"},

			{5, "R5_w=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"},

			/* ptr << 2 == unknown, (4n) */

			{7, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},

			{7, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},

			/* (4n) + 14 == (4n+2).  We blow our bounds, because

			 * the add could overflow.

			 */
@@ -485,7 +485,7 @@ static struct bpf_align_test tests[] = { 
			/* Checked s>=0 */

			{10, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},

			/* packet pointer + nonnegative (4n+2) */

			{12, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},

			{12, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},

			{14, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},

			/* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine.

			 * We checked the bounds, but it might have been able
@@ -530,11 +530,11 @@ static struct bpf_align_test tests[] = { 
			 * alignment of 4.

			 */

			{7, "R2=pkt(id=0,off=0,r=8,imm=0)"},

			{9, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{9, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Adding 14 makes R6 be (4n+2) */

			{10, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			{10, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},

			/* New unknown value in R7 is (4n) */

			{11, "R7=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			{11, "R7_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},

			/* Subtracting it from R6 blows our unsigned bounds */

			{12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"},

			/* Checked s>= 0 */
@@ -583,15 +583,15 @@ static struct bpf_align_test tests[] = { 
			 * alignment of 4.

			 */

			{7, "R2=pkt(id=0,off=0,r=8,imm=0)"},

			{10, "R6=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"},

			{10, "R6_w=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"},

			/* Adding 14 makes R6 be (4n+2) */

			{11, "R6=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"},

			{11, "R6_w=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"},

			/* Subtracting from packet pointer overflows ubounds */

			{13, "R5=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"},

			{13, "R5_w=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"},

			/* New unknown value in R7 is (4n), >= 76 */

			{15, "R7=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"},

			{15, "R7_w=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"},

			/* Adding it to packet pointer gives nice bounds again */

			{16, "R5=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"},

			{16, "R5_w=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"},

			/* At the time the word size load is performed from R5,

			 * its total fixed offset is NET_IP_ALIGN + reg->off (0)

			 * which is 2.  Then the variable offset is (4n+2), so

CRA Git | Maintained and supported by SUSTech CRA and CCSE