1 { 2 "BPF_ST_MEM stack imm non-zero", 3 .insns = { 4 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 42), 5 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), 6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -42), 7 /* if value is tracked correctly R0 is zero */ 8 BPF_EXIT_INSN(), 9 }, 10 .result = ACCEPT, 11 /* Use prog type that requires return value in range [0, 1] */ 12 .prog_type = BPF_PROG_TYPE_SK_LOOKUP, 13 .expected_attach_type = BPF_SK_LOOKUP, 14 .runs = -1, 15 }, 16 { 17 "BPF_ST_MEM stack imm zero", 18 .insns = { 19 /* mark stack 0000 0000 */ 20 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 21 /* read and sum a few bytes */ 22 BPF_MOV64_IMM(BPF_REG_0, 0), 23 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_10, -8), 24 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 25 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_10, -4), 26 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 27 BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_10, -1), 28 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 29 /* if value is tracked correctly R0 is zero */ 30 BPF_EXIT_INSN(), 31 }, 32 .result = ACCEPT, 33 /* Use prog type that requires return value in range [0, 1] */ 34 .prog_type = BPF_PROG_TYPE_SK_LOOKUP, 35 .expected_attach_type = BPF_SK_LOOKUP, 36 .runs = -1, 37 }, 38 { 39 "BPF_ST_MEM stack imm zero, variable offset", 40 .insns = { 41 /* set fp[-16], fp[-24] to zeros */ 42 BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0), 43 BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0), 44 /* r0 = random value in range [-32, -15] */ 45 BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32), 46 BPF_JMP_IMM(BPF_JLE, BPF_REG_0, 16, 2), 47 BPF_MOV64_IMM(BPF_REG_0, 0), 48 BPF_EXIT_INSN(), 49 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 32), 50 /* fp[r0] = 0, make a variable offset write of zero, 51 * this should preserve zero marks on stack. 52 */ 53 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_10), 54 BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0), 55 /* r0 = fp[-20], if variable offset write was tracked correctly 56 * r0 would be a known zero. 57 */ 58 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_10, -20), 59 /* Would fail return code verification if r0 range is not tracked correctly. */ 60 BPF_EXIT_INSN(), 61 }, 62 .result = ACCEPT, 63 /* Use prog type that requires return value in range [0, 1] */ 64 .prog_type = BPF_PROG_TYPE_SK_LOOKUP, 65 .expected_attach_type = BPF_SK_LOOKUP, 66 .runs = -1, 67 }, 68