Greeting, FYI, we noticed the following commit (built with gcc-9): commit: e4a473394751cf660a92485c10acc881852afaf0 ("[PATCH] bpf: Add env_type_is_resolved() in front of env_stack_push() in btf_resolve()") url: https://github.com/0day-ci/linux/commits/jiasheng/bpf-Add-env_type_is_resolved-in-front-of-env_stack_push-in-btf_resolve/20210902-144556 base: https://git.kernel.org/cgit/linux/kernel/git/bpf/bpf.git master in testcase: kernel-selftests version: kernel-selftests-x86_64-fb843668-1_20210905 with following parameters: group: bpf ucode: 0xde test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel. test-url: https://www.kernel.org/doc/Documentation/kselftest.txt on test machine: 4 threads 1 sockets Intel(R) Core(TM) i7-7567U CPU @ 3.50GHz with 32G memory caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): If you fix the issue, kindly add following tag Reported-by: kernel test robot TAP version 13 1..39 # selftests: bpf: test_verifier # #0/u invalid and of negative number OK # #0/p invalid and of negative number OK # #1/u invalid range check OK # #1/p invalid range check OK # #2/u check known subreg with unknown reg OK # #2/p check known subreg with unknown reg OK # #3/u valid map access into an array with a constant OK # #3/p valid map access into an array with a constant OK # #4/u valid map access into an array with a register OK # #4/p valid map access into an array with a register OK # #5/u valid map access into an array with a variable OK # #5/p valid map access into an array with a variable OK # #6/u valid map access into an array with a signed variable OK # #6/p valid map access into an array with a signed variable OK # #7/u invalid map access into an array with a constant OK # #7/p invalid map access into an array with a constant OK # #8/u invalid map access into an array with a register OK # #8/p invalid map access into an array with a register OK # #9/u invalid map access into an array with a variable OK # #9/p invalid map access into an array with a variable OK # #10/u invalid map access into an array with no floor check OK # #10/p invalid map access into an array with no floor check OK # #11/u invalid map access into an array with a invalid max check OK # #11/p invalid map access into an array with a invalid max check OK # #12/u invalid map access into an array with a invalid max check OK # #12/p invalid map access into an array with a invalid max check OK # #13/u valid read map access into a read-only array 1 OK # #13/p valid read map access into a read-only array 1 OK # #14/p valid read map access into a read-only array 2 OK # #15/u invalid write map access into a read-only array 1 OK # #15/p invalid write map access into a read-only array 1 OK # #16/p invalid write map access into a read-only array 2 OK # #17/u valid write map access into a write-only array 1 OK # #17/p valid write map access into a write-only array 1 OK # #18/p valid write map access into a write-only array 2 OK # #19/u invalid read map access into a write-only array 1 OK # #19/p invalid read map access into a write-only array 1 OK # #20/p invalid read map access into a write-only array 2 OK # #21/u BPF_ATOMIC_AND without fetch OK # #21/p BPF_ATOMIC_AND without fetch OK # #22/u BPF_ATOMIC_AND with fetch OK # #22/p BPF_ATOMIC_AND with fetch OK # #23/u BPF_ATOMIC_AND with fetch 32bit OK # #23/p BPF_ATOMIC_AND with fetch 32bit OK # #24/u BPF_ATOMIC_AND with fetch - r0 as source reg OK # #24/p BPF_ATOMIC_AND with fetch - r0 as source reg OK # #25/u BPF_ATOMIC bounds propagation, mem->reg OK # #25/p BPF_ATOMIC bounds propagation, mem->reg OK # #26/u atomic compare-and-exchange smoketest - 64bit OK # #26/p atomic compare-and-exchange smoketest - 64bit OK # #27/u atomic compare-and-exchange smoketest - 32bit OK # #27/p atomic compare-and-exchange smoketest - 32bit OK # #28/u Can't use cmpxchg on uninit src reg OK # #28/p Can't use cmpxchg on uninit src reg OK # #29/u Can't use cmpxchg on uninit memory OK # #29/p Can't use cmpxchg on uninit memory OK # #30/u BPF_W cmpxchg should zero top 32 bits OK # #30/p BPF_W cmpxchg should zero top 32 bits OK # #31/u BPF_ATOMIC_FETCH_ADD smoketest - 64bit OK # #31/p BPF_ATOMIC_FETCH_ADD smoketest - 64bit OK # #32/u BPF_ATOMIC_FETCH_ADD smoketest - 32bit OK # #32/p BPF_ATOMIC_FETCH_ADD smoketest - 32bit OK # #33/u Can't use ATM_FETCH_ADD on frame pointer OK # #33/p Can't use ATM_FETCH_ADD on frame pointer OK # #34/u Can't use ATM_FETCH_ADD on uninit src reg OK # #34/p Can't use ATM_FETCH_ADD on uninit src reg OK # #35/u Can't use ATM_FETCH_ADD on uninit dst reg OK # #35/p Can't use ATM_FETCH_ADD on uninit dst reg OK # #36/p Can't use ATM_FETCH_ADD on kernel memory OK # #37/u BPF_ATOMIC OR without fetch OK # #37/p BPF_ATOMIC OR without fetch OK # #38/u BPF_ATOMIC OR with fetch OK # #38/p BPF_ATOMIC OR with fetch OK # #39/u BPF_ATOMIC OR with fetch 32bit OK # #39/p BPF_ATOMIC OR with fetch 32bit OK # #40/u BPF_W atomic_fetch_or should zero top 32 bits OK # #40/p BPF_W atomic_fetch_or should zero top 32 bits OK # #41/u atomic exchange smoketest - 64bit OK # #41/p atomic exchange smoketest - 64bit OK # #42/u atomic exchange smoketest - 32bit OK # #42/p atomic exchange smoketest - 32bit OK # #43/u BPF_ATOMIC XOR without fetch OK # #43/p BPF_ATOMIC XOR without fetch OK # #44/u BPF_ATOMIC XOR with fetch OK # #44/p BPF_ATOMIC XOR with fetch OK # #45/u BPF_ATOMIC XOR with fetch 32bit OK # #45/p BPF_ATOMIC XOR with fetch 32bit OK # #46/u empty prog OK # #46/p empty prog OK # #47/u only exit insn OK # #47/p only exit insn OK # #48/u no bpf_exit OK # #48/p no bpf_exit OK # #49/u invalid call insn1 OK # #49/p invalid call insn1 OK # #50/u invalid call insn2 OK # #50/p invalid call insn2 OK # #51/u invalid function call OK # #51/p invalid function call OK # #52/p invalid argument register OK # #53/p non-invalid argument register OK # #54/u add+sub+mul OK # #54/p add+sub+mul OK # #55/p xor32 zero extend check OK # #56/u arsh32 on imm OK # #56/p arsh32 on imm OK # #57/u arsh32 on imm 2 OK # #57/p arsh32 on imm 2 OK # #58/u arsh32 on reg OK # #58/p arsh32 on reg OK # #59/u arsh32 on reg 2 OK # #59/p arsh32 on reg 2 OK # #60/u arsh64 on imm OK # #60/p arsh64 on imm OK # #61/u arsh64 on reg OK # #61/p arsh64 on reg OK # #62/u lsh64 by 0 imm OK # #62/p lsh64 by 0 imm OK # #63/u rsh64 by 0 imm OK # #63/p rsh64 by 0 imm OK # #64/u arsh64 by 0 imm OK # #64/p arsh64 by 0 imm OK # #65/u lsh64 by 0 reg OK # #65/p lsh64 by 0 reg OK # #66/u rsh64 by 0 reg OK # #66/p rsh64 by 0 reg OK # #67/u arsh64 by 0 reg OK # #67/p arsh64 by 0 reg OK # #68/u invalid 64-bit BPF_END OK # #68/p invalid 64-bit BPF_END OK # #69/p mov64 src == dst OK # #70/p mov64 src != dst OK # #71/u stack out of bounds OK # #71/p stack out of bounds OK # #72/u uninitialized stack1 OK # #72/p uninitialized stack1 OK # #73/u uninitialized stack2 OK # #73/p uninitialized stack2 OK # #74/u invalid fp arithmetic OK # #74/p invalid fp arithmetic OK # #75/u non-invalid fp arithmetic OK # #75/p non-invalid fp arithmetic OK # #76/u misaligned read from stack OK # #76/p misaligned read from stack OK # #77/u invalid src register in STX OK # #77/p invalid src register in STX OK # #78/u invalid dst register in STX OK # #78/p invalid dst register in STX OK # #79/u invalid dst register in ST OK # #79/p invalid dst register in ST OK # #80/u invalid src register in LDX OK # #80/p invalid src register in LDX OK # #81/u invalid dst register in LDX OK # #81/p invalid dst register in LDX OK # #82/u subtraction bounds (map value) variant 1 OK # #82/p subtraction bounds (map value) variant 1 OK # #83/u subtraction bounds (map value) variant 2 OK # #83/p subtraction bounds (map value) variant 2 OK # #84/u check subtraction on pointers for unpriv OK # #84/p check subtraction on pointers for unpriv OK # #85/u bounds check based on zero-extended MOV OK # #85/p bounds check based on zero-extended MOV OK # #86/u bounds check based on sign-extended MOV. test1 OK # #86/p bounds check based on sign-extended MOV. test1 OK # #87/u bounds check based on sign-extended MOV. test2 OK # #87/p bounds check based on sign-extended MOV. test2 OK # #88/p bounds check based on reg_off + var_off + insn_off. test1 OK # #89/p bounds check based on reg_off + var_off + insn_off. test2 OK # #90/u bounds check after truncation of non-boundary-crossing range OK # #90/p bounds check after truncation of non-boundary-crossing range OK # #91/u bounds check after truncation of boundary-crossing range (1) OK # #91/p bounds check after truncation of boundary-crossing range (1) OK # #92/u bounds check after truncation of boundary-crossing range (2) OK # #92/p bounds check after truncation of boundary-crossing range (2) OK # #93/u bounds check after wrapping 32-bit addition OK # #93/p bounds check after wrapping 32-bit addition OK # #94/u bounds check after shift with oversized count operand OK # #94/p bounds check after shift with oversized count operand OK # #95/u bounds check after right shift of maybe-negative number OK # #95/p bounds check after right shift of maybe-negative number OK # #96/u bounds check after 32-bit right shift with 64-bit input OK # #96/p bounds check after 32-bit right shift with 64-bit input OK # #97/u bounds check map access with off+size signed 32bit overflow. test1 OK # #97/p bounds check map access with off+size signed 32bit overflow. test1 OK # #98/u bounds check map access with off+size signed 32bit overflow. test2 OK # #98/p bounds check map access with off+size signed 32bit overflow. test2 OK # #99/u bounds check map access with off+size signed 32bit overflow. test3 OK # #99/p bounds check map access with off+size signed 32bit overflow. test3 OK # #100/u bounds check map access with off+size signed 32bit overflow. test4 OK # #100/p bounds check map access with off+size signed 32bit overflow. test4 OK # #101/u bounds check mixed 32bit and 64bit arithmetic. test1 OK # #101/p bounds check mixed 32bit and 64bit arithmetic. test1 OK # #102/u bounds check mixed 32bit and 64bit arithmetic. test2 OK # #102/p bounds check mixed 32bit and 64bit arithmetic. test2 OK # #103/p assigning 32bit bounds to 64bit for wA = 0, wB = wA OK # #104/u bounds check for reg = 0, reg xor 1 OK # #104/p bounds check for reg = 0, reg xor 1 OK # #105/u bounds check for reg32 = 0, reg32 xor 1 OK # #105/p bounds check for reg32 = 0, reg32 xor 1 OK # #106/u bounds check for reg = 2, reg xor 3 OK # #106/p bounds check for reg = 2, reg xor 3 OK # #107/u bounds check for reg = any, reg xor 3 OK # #107/p bounds check for reg = any, reg xor 3 OK # #108/u bounds check for reg32 = any, reg32 xor 3 OK # #108/p bounds check for reg32 = any, reg32 xor 3 OK # #109/u bounds check for reg > 0, reg xor 3 OK # #109/p bounds check for reg > 0, reg xor 3 OK # #110/u bounds check for reg32 > 0, reg32 xor 3 OK # #110/p bounds check for reg32 > 0, reg32 xor 3 OK # #111/u bounds checks after 32-bit truncation. test 1 OK # #111/p bounds checks after 32-bit truncation. test 1 OK # #112/u bounds checks after 32-bit truncation. test 2 OK # #112/p bounds checks after 32-bit truncation. test 2 OK # #113/u check deducing bounds from const, 1 OK # #113/p check deducing bounds from const, 1 OK # #114/u check deducing bounds from const, 2 OK # #114/p check deducing bounds from const, 2 OK # #115/u check deducing bounds from const, 3 OK # #115/p check deducing bounds from const, 3 OK # #116/u check deducing bounds from const, 4 OK # #116/p check deducing bounds from const, 4 OK # #117/u check deducing bounds from const, 5 OK # #117/p check deducing bounds from const, 5 OK # #118/u check deducing bounds from const, 6 OK # #118/p check deducing bounds from const, 6 OK # #119/u check deducing bounds from const, 7 OK # #119/p check deducing bounds from const, 7 OK # #120/u check deducing bounds from const, 8 OK # #120/p check deducing bounds from const, 8 OK # #121/u check deducing bounds from const, 9 OK # #121/p check deducing bounds from const, 9 OK # #122/u check deducing bounds from const, 10 OK # #122/p check deducing bounds from const, 10 OK # #123/u bounds checks mixing signed and unsigned, positive bounds OK # #123/p bounds checks mixing signed and unsigned, positive bounds OK # #124/u bounds checks mixing signed and unsigned OK # #124/p bounds checks mixing signed and unsigned OK # #125/u bounds checks mixing signed and unsigned, variant 2 OK # #125/p bounds checks mixing signed and unsigned, variant 2 OK # #126/u bounds checks mixing signed and unsigned, variant 3 OK # #126/p bounds checks mixing signed and unsigned, variant 3 OK # #127/u bounds checks mixing signed and unsigned, variant 4 OK # #127/p bounds checks mixing signed and unsigned, variant 4 OK # #128/u bounds checks mixing signed and unsigned, variant 5 OK # #128/p bounds checks mixing signed and unsigned, variant 5 OK # #129/u bounds checks mixing signed and unsigned, variant 6 OK # #129/p bounds checks mixing signed and unsigned, variant 6 OK # #130/u bounds checks mixing signed and unsigned, variant 7 OK # #130/p bounds checks mixing signed and unsigned, variant 7 OK # #131/u bounds checks mixing signed and unsigned, variant 8 OK # #131/p bounds checks mixing signed and unsigned, variant 8 OK # #132/u bounds checks mixing signed and unsigned, variant 9 OK # #132/p bounds checks mixing signed and unsigned, variant 9 OK # #133/u bounds checks mixing signed and unsigned, variant 10 OK # #133/p bounds checks mixing signed and unsigned, variant 10 OK # #134/u bounds checks mixing signed and unsigned, variant 11 OK # #134/p bounds checks mixing signed and unsigned, variant 11 OK # #135/u bounds checks mixing signed and unsigned, variant 12 OK # #135/p bounds checks mixing signed and unsigned, variant 12 OK # #136/u bounds checks mixing signed and unsigned, variant 13 OK # #136/p bounds checks mixing signed and unsigned, variant 13 OK # #137/u bounds checks mixing signed and unsigned, variant 14 OK # #137/p bounds checks mixing signed and unsigned, variant 14 OK # #138/u bounds checks mixing signed and unsigned, variant 15 OK # #138/p bounds checks mixing signed and unsigned, variant 15 OK # #139/p bpf_get_stack return R0 within range Did not run the program (not supported) OK # #140/p bpf_get_task_stack return R0 range is refined OK # #141/p calls: basic sanity Did not run the program (not supported) OK # #142/u calls: not on unpriviledged OK # #142/p calls: not on unpriviledged OK # #143/p calls: div by 0 in subprog OK # #144/p calls: multiple ret types in subprog 1 OK # #145/p calls: multiple ret types in subprog 2 OK # #146/p calls: overlapping caller/callee OK # #147/p calls: wrong recursive calls OK # #148/p calls: wrong src reg OK # #149/p calls: wrong off value OK # #150/p calls: jump back loop OK # #151/p calls: conditional call OK # #152/p calls: conditional call 2 Did not run the program (not supported) OK # #153/u calls: conditional call 3 OK # #153/p calls: conditional call 3 OK # #154/p calls: conditional call 4 Did not run the program (not supported) OK # #155/p calls: conditional call 5 OK # #156/p calls: conditional call 6 OK # #157/p calls: using r0 returned by callee Did not run the program (not supported) OK # #158/p calls: using uninit r0 from callee OK # #159/p calls: callee is using r1 OK # #160/u calls: callee using args1 OK # #160/p calls: callee using args1 OK # #161/p calls: callee using wrong args2 OK # #162/u calls: callee using two args OK # #162/p calls: callee using two args OK # #163/p calls: callee changing pkt pointers OK # #164/u calls: ptr null check in subprog OK # #164/p calls: ptr null check in subprog OK # #165/p calls: two calls with args OK # #166/p calls: calls with stack arith OK # #167/p calls: calls with misaligned stack access OK # #168/p calls: calls control flow, jump test OK # #169/p calls: calls control flow, jump test 2 OK # #170/p calls: two calls with bad jump OK # #171/p calls: recursive call. test1 OK # #172/p calls: recursive call. test2 OK # #173/p calls: unreachable code OK # #174/p calls: invalid call OK # #175/p calls: invalid call 2 OK # #176/p calls: jumping across function bodies. test1 OK # #177/p calls: jumping across function bodies. test2 OK # #178/p calls: call without exit OK # #179/p calls: call into middle of ld_imm64 OK # #180/p calls: call into middle of other call OK # #181/p calls: subprog call with ld_abs in main prog OK # #182/p calls: two calls with bad fallthrough OK # #183/p calls: two calls with stack read OK # #184/p calls: two calls with stack write OK # #185/p calls: stack overflow using two frames (pre-call access) OK # #186/p calls: stack overflow using two frames (post-call access) OK # #187/p calls: stack depth check using three frames. test1 OK # #188/p calls: stack depth check using three frames. test2 OK # #189/p calls: stack depth check using three frames. test3 OK # #190/p calls: stack depth check using three frames. test4 OK # #191/p calls: stack depth check using three frames. test5 OK # #192/p calls: stack depth check in dead code OK # #193/p calls: spill into caller stack frame OK # #194/p calls: write into caller stack frame OK # #195/p calls: write into callee stack frame OK # #196/p calls: two calls with stack write and void return OK # #197/u calls: ambiguous return value OK # #197/p calls: ambiguous return value OK # #198/p calls: two calls that return map_value OK # #199/p calls: two calls that return map_value with bool condition OK # #200/p calls: two calls that return map_value with incorrect bool check OK # #201/p calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1 OK # #202/p calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2 OK # #203/p calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3 OK # #204/p calls: two calls that receive map_value_ptr_or_null via arg. test1 OK # #205/p calls: two calls that receive map_value_ptr_or_null via arg. test2 OK # #206/p calls: pkt_ptr spill into caller stack OK # #207/p calls: pkt_ptr spill into caller stack 2 OK # #208/p calls: pkt_ptr spill into caller stack 3 OK # #209/p calls: pkt_ptr spill into caller stack 4 OK # #210/p calls: pkt_ptr spill into caller stack 5 OK # #211/p calls: pkt_ptr spill into caller stack 6 OK # #212/p calls: pkt_ptr spill into caller stack 7 OK # #213/p calls: pkt_ptr spill into caller stack 8 OK # #214/p calls: pkt_ptr spill into caller stack 9 OK # #215/p calls: caller stack init to zero or map_value_or_null OK # #216/p calls: stack init to zero and pruning OK # #217/u calls: ctx read at start of subprog OK # #217/p calls: ctx read at start of subprog OK # #218/u calls: cross frame pruning OK # #218/p calls: cross frame pruning OK # #219/u calls: cross frame pruning - liveness propagation OK # #219/p calls: cross frame pruning - liveness propagation OK # #220/u unreachable OK # #220/p unreachable OK # #221/u unreachable2 OK # #221/p unreachable2 OK # #222/u out of range jump OK # #222/p out of range jump OK # #223/u out of range jump2 OK # #223/p out of range jump2 OK # #224/u loop (back-edge) OK # #224/p loop (back-edge) OK # #225/u loop2 (back-edge) OK # #225/p loop2 (back-edge) OK # #226/u conditional loop OK # #226/p conditional loop OK # #227/p bpf_exit with invalid return code. test1 OK # #228/p bpf_exit with invalid return code. test2 Did not run the program (not supported) OK # #229/p bpf_exit with invalid return code. test3 OK # #230/p bpf_exit with invalid return code. test4 Did not run the program (not supported) OK # #231/p bpf_exit with invalid return code. test5 OK # #232/p bpf_exit with invalid return code. test6 OK # #233/p bpf_exit with invalid return code. test7 OK # #234/u direct packet read test#1 for CGROUP_SKB OK # #234/p direct packet read test#1 for CGROUP_SKB OK # #235/u direct packet read test#2 for CGROUP_SKB OK # #235/p direct packet read test#2 for CGROUP_SKB OK # #236/u direct packet read test#3 for CGROUP_SKB OK # #236/p direct packet read test#3 for CGROUP_SKB OK # #237/u direct packet read test#4 for CGROUP_SKB OK # #237/p direct packet read test#4 for CGROUP_SKB OK # #238/u invalid access of tc_classid for CGROUP_SKB OK # #238/p invalid access of tc_classid for CGROUP_SKB OK # #239/u invalid access of data_meta for CGROUP_SKB OK # #239/p invalid access of data_meta for CGROUP_SKB OK # #240/u invalid access of flow_keys for CGROUP_SKB OK # #240/p invalid access of flow_keys for CGROUP_SKB OK # #241/u invalid write access to napi_id for CGROUP_SKB OK # #241/p invalid write access to napi_id for CGROUP_SKB OK # #242/u write tstamp from CGROUP_SKB OK # #242/p write tstamp from CGROUP_SKB OK # #243/u read tstamp from CGROUP_SKB OK # #243/p read tstamp from CGROUP_SKB OK # #244/u valid cgroup storage access OK # #244/p valid cgroup storage access OK # #245/u invalid cgroup storage access 1 OK # #245/p invalid cgroup storage access 1 OK # #246/u invalid cgroup storage access 2 OK # #246/p invalid cgroup storage access 2 OK # #247/u invalid cgroup storage access 3 OK # #247/p invalid cgroup storage access 3 OK # #248/u invalid cgroup storage access 4 OK # #248/p invalid cgroup storage access 4 OK # #249/u invalid cgroup storage access 5 OK # #249/p invalid cgroup storage access 5 OK # #250/u invalid cgroup storage access 6 OK # #250/p invalid cgroup storage access 6 OK # #251/u valid per-cpu cgroup storage access OK # #251/p valid per-cpu cgroup storage access OK # #252/u invalid per-cpu cgroup storage access 1 OK # #252/p invalid per-cpu cgroup storage access 1 OK # #253/u invalid per-cpu cgroup storage access 2 OK # #253/p invalid per-cpu cgroup storage access 2 OK # #254/u invalid per-cpu cgroup storage access 3 OK # #254/p invalid per-cpu cgroup storage access 3 OK # #255/u invalid per-cpu cgroup storage access 4 OK # #255/p invalid per-cpu cgroup storage access 4 OK # #256/u invalid per-cpu cgroup storage access 5 OK # #256/p invalid per-cpu cgroup storage access 5 OK # #257/u invalid per-cpu cgroup storage access 6 OK # #257/p invalid per-cpu cgroup storage access 6 OK # #258/p constant register |= constant should keep constant type Did not run the program (not supported) OK # #259/p constant register |= constant should not bypass stack boundary checks OK # #260/p constant register |= constant register should keep constant type Did not run the program (not supported) OK # #261/p constant register |= constant register should not bypass stack boundary checks OK # #262/p context stores via ST OK # #263/p context stores via BPF_ATOMIC OK # #264/p arithmetic ops make PTR_TO_CTX unusable OK # #265/p pass unmodified ctx pointer to helper OK # #266/p pass modified ctx pointer to helper, 1 OK # #267/u pass modified ctx pointer to helper, 2 OK # #267/p pass modified ctx pointer to helper, 2 OK # #268/p pass modified ctx pointer to helper, 3 OK # #269/p pass ctx or null check, 1: ctx Did not run the program (not supported) OK # #270/p pass ctx or null check, 2: null Did not run the program (not supported) OK # #271/p pass ctx or null check, 3: 1 OK # #272/p pass ctx or null check, 4: ctx - const OK # #273/p pass ctx or null check, 5: null (connect) Did not run the program (not supported) OK # #274/p pass ctx or null check, 6: null (bind) Did not run the program (not supported) OK # #275/p pass ctx or null check, 7: ctx (bind) Did not run the program (not supported) OK # #276/p pass ctx or null check, 8: null (bind) OK # #277/p valid 1,2,4,8-byte reads from bpf_sk_lookup OK # #278/p invalid 8-byte read from bpf_sk_lookup family field OK # #279/p invalid 8-byte read from bpf_sk_lookup protocol field OK # #280/p invalid 8-byte read from bpf_sk_lookup remote_ip4 field OK # #281/p invalid 8-byte read from bpf_sk_lookup remote_ip6 field OK # #282/p invalid 8-byte read from bpf_sk_lookup remote_port field OK # #283/p invalid 8-byte read from bpf_sk_lookup local_ip4 field OK # #284/p invalid 8-byte read from bpf_sk_lookup local_ip6 field OK # #285/p invalid 8-byte read from bpf_sk_lookup local_port field OK # #286/p invalid 4-byte read from bpf_sk_lookup sk field OK # #287/p invalid 2-byte read from bpf_sk_lookup sk field OK # #288/p invalid 1-byte read from bpf_sk_lookup sk field OK # #289/p invalid 4-byte read past end of bpf_sk_lookup OK # #290/p invalid 4-byte unaligned read from bpf_sk_lookup at odd offset OK # #291/p invalid 4-byte unaligned read from bpf_sk_lookup at even offset OK # #292/p invalid 8-byte write to bpf_sk_lookup OK # #293/p invalid 4-byte write to bpf_sk_lookup OK # #294/p invalid 2-byte write to bpf_sk_lookup OK # #295/p invalid 1-byte write to bpf_sk_lookup OK # #296/p invalid 4-byte write past end of bpf_sk_lookup OK # #297/p valid access family in SK_MSG Did not run the program (not supported) OK # #298/p valid access remote_ip4 in SK_MSG Did not run the program (not supported) OK # #299/p valid access local_ip4 in SK_MSG Did not run the program (not supported) OK # #300/p valid access remote_port in SK_MSG Did not run the program (not supported) OK # #301/p valid access local_port in SK_MSG Did not run the program (not supported) OK # #302/p valid access remote_ip6 in SK_MSG Did not run the program (not supported) OK # #303/p valid access local_ip6 in SK_MSG Did not run the program (not supported) OK # #304/p valid access size in SK_MSG Did not run the program (not supported) OK # #305/p invalid 64B read of size in SK_MSG OK # #306/p invalid read past end of SK_MSG OK # #307/p invalid read offset in SK_MSG OK # #308/p direct packet read for SK_MSG Did not run the program (not supported) OK # #309/p direct packet write for SK_MSG Did not run the program (not supported) OK # #310/p overlapping checks for direct packet access SK_MSG Did not run the program (not supported) OK # #311/u access skb fields ok OK # #311/p access skb fields ok OK # #312/u access skb fields bad1 OK # #312/p access skb fields bad1 OK # #313/u access skb fields bad2 OK # #313/p access skb fields bad2 OK # #314/u access skb fields bad3 OK # #314/p access skb fields bad3 OK # #315/u access skb fields bad4 OK # #315/p access skb fields bad4 OK # #316/u invalid access __sk_buff family OK # #316/p invalid access __sk_buff family OK # #317/u invalid access __sk_buff remote_ip4 OK # #317/p invalid access __sk_buff remote_ip4 OK # #318/u invalid access __sk_buff local_ip4 OK # #318/p invalid access __sk_buff local_ip4 OK # #319/u invalid access __sk_buff remote_ip6 OK # #319/p invalid access __sk_buff remote_ip6 OK # #320/u invalid access __sk_buff local_ip6 OK # #320/p invalid access __sk_buff local_ip6 OK # #321/u invalid access __sk_buff remote_port OK # #321/p invalid access __sk_buff remote_port OK # #322/u invalid access __sk_buff remote_port OK # #322/p invalid access __sk_buff remote_port OK # #323/p valid access __sk_buff family Did not run the program (not supported) OK # #324/p valid access __sk_buff remote_ip4 Did not run the program (not supported) OK # #325/p valid access __sk_buff local_ip4 Did not run the program (not supported) OK # #326/p valid access __sk_buff remote_ip6 Did not run the program (not supported) OK # #327/p valid access __sk_buff local_ip6 Did not run the program (not supported) OK # #328/p valid access __sk_buff remote_port Did not run the program (not supported) OK # #329/p valid access __sk_buff remote_port Did not run the program (not supported) OK # #330/p invalid access of tc_classid for SK_SKB OK # #331/p invalid access of skb->mark for SK_SKB OK # #332/p check skb->mark is not writeable by SK_SKB OK # #333/p check skb->tc_index is writeable by SK_SKB Did not run the program (not supported) OK # #334/p check skb->priority is writeable by SK_SKB Did not run the program (not supported) OK # #335/p direct packet read for SK_SKB Did not run the program (not supported) OK # #336/p direct packet write for SK_SKB Did not run the program (not supported) OK # #337/p overlapping checks for direct packet access SK_SKB Did not run the program (not supported) OK # #338/u check skb->mark is not writeable by sockets OK # #338/p check skb->mark is not writeable by sockets OK # #339/u check skb->tc_index is not writeable by sockets OK # #339/p check skb->tc_index is not writeable by sockets OK # #340/u check cb access: byte OK # #340/p check cb access: byte OK # #341/u __sk_buff->hash, offset 0, byte store not permitted OK # #341/p __sk_buff->hash, offset 0, byte store not permitted OK # #342/u __sk_buff->tc_index, offset 3, byte store not permitted OK # #342/p __sk_buff->tc_index, offset 3, byte store not permitted OK # #343/u check skb->hash byte load permitted OK # #343/p check skb->hash byte load permitted OK # #344/u check skb->hash byte load permitted 1 OK # #344/p check skb->hash byte load permitted 1 OK # #345/u check skb->hash byte load permitted 2 OK # #345/p check skb->hash byte load permitted 2 OK # #346/u check skb->hash byte load permitted 3 OK # #346/p check skb->hash byte load permitted 3 OK # #347/p check cb access: byte, wrong type OK # #348/u check cb access: half OK # #348/p check cb access: half OK # #349/u check cb access: half, unaligned OK # #349/p check cb access: half, unaligned OK # #350/u check __sk_buff->hash, offset 0, half store not permitted OK # #350/p check __sk_buff->hash, offset 0, half store not permitted OK # #351/u check __sk_buff->tc_index, offset 2, half store not permitted OK # #351/p check __sk_buff->tc_index, offset 2, half store not permitted OK # #352/u check skb->hash half load permitted OK # #352/p check skb->hash half load permitted OK # #353/u check skb->hash half load permitted 2 OK # #353/p check skb->hash half load permitted 2 OK # #354/u check skb->hash half load not permitted, unaligned 1 OK # #354/p check skb->hash half load not permitted, unaligned 1 OK # #355/u check skb->hash half load not permitted, unaligned 3 OK # #355/p check skb->hash half load not permitted, unaligned 3 OK # #356/p check cb access: half, wrong type OK # #357/u check cb access: word OK # #357/p check cb access: word OK # #358/u check cb access: word, unaligned 1 OK # #358/p check cb access: word, unaligned 1 OK # #359/u check cb access: word, unaligned 2 OK # #359/p check cb access: word, unaligned 2 OK # #360/u check cb access: word, unaligned 3 OK # #360/p check cb access: word, unaligned 3 OK # #361/u check cb access: word, unaligned 4 OK # #361/p check cb access: word, unaligned 4 OK # #362/u check cb access: double OK # #362/p check cb access: double OK # #363/u check cb access: double, unaligned 1 OK # #363/p check cb access: double, unaligned 1 OK # #364/u check cb access: double, unaligned 2 OK # #364/p check cb access: double, unaligned 2 OK # #365/u check cb access: double, oob 1 OK # #365/p check cb access: double, oob 1 OK # #366/u check cb access: double, oob 2 OK # #366/p check cb access: double, oob 2 OK # #367/u check __sk_buff->ifindex dw store not permitted OK # #367/p check __sk_buff->ifindex dw store not permitted OK # #368/u check __sk_buff->ifindex dw load not permitted OK # #368/p check __sk_buff->ifindex dw load not permitted OK # #369/p check cb access: double, wrong type OK # #370/p check out of range skb->cb access OK # #371/u write skb fields from socket prog OK # #371/p write skb fields from socket prog OK # #372/p write skb fields from tc_cls_act prog OK # #373/u check skb->data half load not permitted OK # #373/p check skb->data half load not permitted OK # #374/u read gso_segs from CGROUP_SKB OK # #374/p read gso_segs from CGROUP_SKB OK # #375/u read gso_segs from CGROUP_SKB OK # #375/p read gso_segs from CGROUP_SKB OK # #376/u write gso_segs from CGROUP_SKB OK # #376/p write gso_segs from CGROUP_SKB OK # #377/p read gso_segs from CLS OK # #378/u read gso_size from CGROUP_SKB OK # #378/p read gso_size from CGROUP_SKB OK # #379/u read gso_size from CGROUP_SKB OK # #379/p read gso_size from CGROUP_SKB OK # #380/u write gso_size from CGROUP_SKB OK # #380/p write gso_size from CGROUP_SKB OK # #381/p read gso_size from CLS OK # #382/u check wire_len is not readable by sockets OK # #382/p check wire_len is not readable by sockets OK # #383/p check wire_len is readable by tc classifier OK # #384/p check wire_len is not writable by tc classifier OK # #385/p pkt > pkt_end taken check Did not run the program (not supported) OK # #386/p pkt_end < pkt taken check Did not run the program (not supported) OK # #387/p d_path accept OK # #388/p d_path reject OK # #389/u dead code: start OK # #389/p dead code: start OK # #390/u dead code: mid 1 OK # #390/p dead code: mid 1 OK # #391/u dead code: mid 2 OK # #391/p dead code: mid 2 OK # #392/u dead code: end 1 OK # #392/p dead code: end 1 OK # #393/u dead code: end 2 OK # #393/p dead code: end 2 OK # #394/u dead code: end 3 OK # #394/p dead code: end 3 OK # #395/u dead code: tail of main + func OK # #395/p dead code: tail of main + func OK # #396/u dead code: tail of main + two functions OK # #396/p dead code: tail of main + two functions OK # #397/u dead code: function in the middle and mid of another func OK # #397/p dead code: function in the middle and mid of another func OK # #398/u dead code: middle of main before call OK # #398/p dead code: middle of main before call OK # #399/u dead code: start of a function OK # #399/p dead code: start of a function OK # #400/u dead code: zero extension OK # #400/p dead code: zero extension OK # #401/p pkt_end - pkt_start is allowed OK # #402/p direct packet access: test1 OK # #403/p direct packet access: test2 OK # #404/u direct packet access: test3 OK # #404/p direct packet access: test3 OK # #405/p direct packet access: test4 (write) OK # #406/p direct packet access: test5 (pkt_end >= reg, good access) OK # #407/p direct packet access: test6 (pkt_end >= reg, bad access) OK # #408/p direct packet access: test7 (pkt_end >= reg, both accesses) OK # #409/p direct packet access: test8 (double test, variant 1) OK # #410/p direct packet access: test9 (double test, variant 2) OK # #411/p direct packet access: test10 (write invalid) OK # #412/p direct packet access: test11 (shift, good access) OK # #413/p direct packet access: test12 (and, good access) OK # #414/p direct packet access: test13 (branches, good access) OK # #415/p direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access) OK # #416/p direct packet access: test15 (spill with xadd) OK # #417/p direct packet access: test16 (arith on data_end) OK # #418/p direct packet access: test17 (pruning, alignment) OK # #419/p direct packet access: test18 (imm += pkt_ptr, 1) OK # #420/p direct packet access: test19 (imm += pkt_ptr, 2) OK # #421/p direct packet access: test20 (x += pkt_ptr, 1) OK # #422/p direct packet access: test21 (x += pkt_ptr, 2) OK # #423/p direct packet access: test22 (x += pkt_ptr, 3) OK # #424/p direct packet access: test23 (x += pkt_ptr, 4) OK # #425/p direct packet access: test24 (x += pkt_ptr, 5) OK # #426/p direct packet access: test25 (marking on <, good access) OK # #427/p direct packet access: test26 (marking on <, bad access) OK # #428/p direct packet access: test27 (marking on <=, good access) OK # #429/p direct packet access: test28 (marking on <=, bad access) OK # #430/p direct packet access: test29 (reg > pkt_end in subprog) OK # #431/u direct stack access with 32-bit wraparound. test1 OK # #431/p direct stack access with 32-bit wraparound. test1 OK # #432/u direct stack access with 32-bit wraparound. test2 OK # #432/p direct stack access with 32-bit wraparound. test2 OK # #433/u direct stack access with 32-bit wraparound. test3 OK # #433/p direct stack access with 32-bit wraparound. test3 OK # #434/u direct map access, write test 1 OK # #434/p direct map access, write test 1 OK # #435/u direct map access, write test 2 OK # #435/p direct map access, write test 2 OK # #436/u direct map access, write test 3 OK # #436/p direct map access, write test 3 OK # #437/u direct map access, write test 4 OK # #437/p direct map access, write test 4 OK # #438/u direct map access, write test 5 OK # #438/p direct map access, write test 5 OK # #439/u direct map access, write test 6 OK # #439/p direct map access, write test 6 OK # #440/u direct map access, write test 7 OK # #440/p direct map access, write test 7 OK # #441/u direct map access, write test 8 OK # #441/p direct map access, write test 8 OK # #442/u direct map access, write test 9 OK # #442/p direct map access, write test 9 OK # #443/u direct map access, write test 10 OK # #443/p direct map access, write test 10 OK # #444/u direct map access, write test 11 OK # #444/p direct map access, write test 11 OK # #445/u direct map access, write test 12 OK # #445/p direct map access, write test 12 OK # #446/u direct map access, write test 13 OK # #446/p direct map access, write test 13 OK # #447/u direct map access, write test 14 OK # #447/p direct map access, write test 14 OK # #448/u direct map access, write test 15 OK # #448/p direct map access, write test 15 OK # #449/u direct map access, write test 16 OK # #449/p direct map access, write test 16 OK # #450/u direct map access, write test 17 OK # #450/p direct map access, write test 17 OK # #451/u direct map access, write test 18 OK # #451/p direct map access, write test 18 OK # #452/u direct map access, write test 19 OK # #452/p direct map access, write test 19 OK # #453/u direct map access, write test 20 OK # #453/p direct map access, write test 20 OK # #454/u direct map access, invalid insn test 1 OK # #454/p direct map access, invalid insn test 1 OK # #455/u direct map access, invalid insn test 2 OK # #455/p direct map access, invalid insn test 2 OK # #456/u direct map access, invalid insn test 3 OK # #456/p direct map access, invalid insn test 3 OK # #457/u direct map access, invalid insn test 4 OK # #457/p direct map access, invalid insn test 4 OK # #458/u direct map access, invalid insn test 5 OK # #458/p direct map access, invalid insn test 5 OK # #459/u direct map access, invalid insn test 6 OK # #459/p direct map access, invalid insn test 6 OK # #460/u direct map access, invalid insn test 7 OK # #460/p direct map access, invalid insn test 7 OK # #461/u direct map access, invalid insn test 8 OK # #461/p direct map access, invalid insn test 8 OK # #462/u direct map access, invalid insn test 9 OK # #462/p direct map access, invalid insn test 9 OK # #463/u DIV32 by 0, zero check 1 OK # #463/p DIV32 by 0, zero check 1 OK # #464/u DIV32 by 0, zero check 2 OK # #464/p DIV32 by 0, zero check 2 OK # #465/u DIV64 by 0, zero check OK # #465/p DIV64 by 0, zero check OK # #466/u MOD32 by 0, zero check 1 OK # #466/p MOD32 by 0, zero check 1 OK # #467/u MOD32 by 0, zero check 2 OK # #467/p MOD32 by 0, zero check 2 OK # #468/u MOD64 by 0, zero check OK # #468/p MOD64 by 0, zero check OK # #469/p DIV32 by 0, zero check ok, cls OK # #470/p DIV32 by 0, zero check 1, cls OK # #471/p DIV32 by 0, zero check 2, cls OK # #472/p DIV64 by 0, zero check, cls OK # #473/p MOD32 by 0, zero check ok, cls OK # #474/p MOD32 by 0, zero check 1, cls OK # #475/p MOD32 by 0, zero check 2, cls OK # #476/p MOD64 by 0, zero check 1, cls OK # #477/p MOD64 by 0, zero check 2, cls OK # #478/p DIV32 overflow, check 1 OK # #479/p DIV32 overflow, check 2 OK # #480/p DIV64 overflow, check 1 OK # #481/p DIV64 overflow, check 2 OK # #482/p MOD32 overflow, check 1 OK # #483/p MOD32 overflow, check 2 OK # #484/p MOD64 overflow, check 1 OK # #485/p MOD64 overflow, check 2 OK # #486/p perfevent for sockops Did not run the program (not supported) OK # #487/p perfevent for tc OK # #488/p perfevent for lwt out OK # #489/p perfevent for xdp OK # #490/u perfevent for socket filter OK # #490/p perfevent for socket filter OK # #491/p perfevent for sk_skb Did not run the program (not supported) OK # #492/u perfevent for cgroup skb OK # #492/p perfevent for cgroup skb OK # #493/p perfevent for cgroup dev Did not run the program (not supported) OK # #494/p perfevent for cgroup sysctl Did not run the program (not supported) OK # #495/p perfevent for cgroup sockopt Did not run the program (not supported) OK # #496/p helper access to variable memory: stack, bitwise AND + JMP, correct bounds Did not run the program (not supported) OK # #497/p helper access to variable memory: stack, bitwise AND, zero included OK # #498/p helper access to variable memory: stack, bitwise AND + JMP, wrong max OK # #499/p helper access to variable memory: stack, JMP, correct bounds Did not run the program (not supported) OK # #500/p helper access to variable memory: stack, JMP (signed), correct bounds Did not run the program (not supported) OK # #501/p helper access to variable memory: stack, JMP, bounds + offset OK # #502/p helper access to variable memory: stack, JMP, wrong max OK # #503/p helper access to variable memory: stack, JMP, no max check OK # #504/p helper access to variable memory: stack, JMP, no min check OK # #505/p helper access to variable memory: stack, JMP (signed), no min check OK # #506/p helper access to variable memory: map, JMP, correct bounds Did not run the program (not supported) OK # #507/p helper access to variable memory: map, JMP, wrong max OK # #508/p helper access to variable memory: map adjusted, JMP, correct bounds Did not run the program (not supported) OK # #509/p helper access to variable memory: map adjusted, JMP, wrong max OK # #510/p helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL) OK # #511/p helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL) OK # #512/p helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #513/p helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #514/p helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #515/p helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #516/p helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #517/p helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL) OK # #518/p helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL) OK # #519/p helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL) Did not run the program (not supported) OK # #520/p helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL) Did not run the program (not supported) OK # #521/p helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL) Did not run the program (not supported) OK # #522/p helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL) Did not run the program (not supported) OK # #523/p helper access to variable memory: 8 bytes leak OK # #524/p helper access to variable memory: 8 bytes no leak (init memory) Did not run the program (not supported) OK # #525/p helper access to packet: test1, valid packet_ptr range OK # #526/p helper access to packet: test2, unchecked packet_ptr OK # #527/p helper access to packet: test3, variable add OK # #528/p helper access to packet: test4, packet_ptr with bad range OK # #529/p helper access to packet: test5, packet_ptr with too short range OK # #530/p helper access to packet: test6, cls valid packet_ptr range OK # #531/p helper access to packet: test7, cls unchecked packet_ptr OK # #532/p helper access to packet: test8, cls variable add OK # #533/p helper access to packet: test9, cls packet_ptr with bad range OK # #534/p helper access to packet: test10, cls packet_ptr with too short range OK # #535/p helper access to packet: test11, cls unsuitable helper 1 OK # #536/p helper access to packet: test12, cls unsuitable helper 2 OK # #537/p helper access to packet: test13, cls helper ok OK # #538/p helper access to packet: test14, cls helper ok sub OK # #539/p helper access to packet: test15, cls helper fail sub OK # #540/p helper access to packet: test16, cls helper fail range 1 OK # #541/p helper access to packet: test17, cls helper fail range 2 OK # #542/p helper access to packet: test18, cls helper fail range 3 OK # #543/p helper access to packet: test19, cls helper range zero OK # #544/p helper access to packet: test20, pkt end as input OK # #545/p helper access to packet: test21, wrong reg OK # #546/p helper access to map: full range Did not run the program (not supported) OK # #547/p helper access to map: partial range Did not run the program (not supported) OK # #548/p helper access to map: empty range OK # #549/p helper access to map: out-of-bound range OK # #550/p helper access to map: negative range OK # #551/p helper access to adjusted map (via const imm): full range Did not run the program (not supported) OK # #552/p helper access to adjusted map (via const imm): partial range Did not run the program (not supported) OK # #553/p helper access to adjusted map (via const imm): empty range OK # #554/p helper access to adjusted map (via const imm): out-of-bound range OK # #555/p helper access to adjusted map (via const imm): negative range (> adjustment) OK # #556/p helper access to adjusted map (via const imm): negative range (< adjustment) OK # #557/p helper access to adjusted map (via const reg): full range Did not run the program (not supported) OK # #558/p helper access to adjusted map (via const reg): partial range Did not run the program (not supported) OK # #559/p helper access to adjusted map (via const reg): empty range OK # #560/p helper access to adjusted map (via const reg): out-of-bound range OK # #561/p helper access to adjusted map (via const reg): negative range (> adjustment) OK # #562/p helper access to adjusted map (via const reg): negative range (< adjustment) OK # #563/p helper access to adjusted map (via variable): full range Did not run the program (not supported) OK # #564/p helper access to adjusted map (via variable): partial range Did not run the program (not supported) OK # #565/p helper access to adjusted map (via variable): empty range OK # #566/p helper access to adjusted map (via variable): no max check OK # #567/p helper access to adjusted map (via variable): wrong max check OK # #568/p helper access to map: bounds check using <, good access Did not run the program (not supported) OK # #569/p helper access to map: bounds check using <, bad access OK # #570/p helper access to map: bounds check using <=, good access Did not run the program (not supported) OK # #571/p helper access to map: bounds check using <=, bad access OK # #572/p helper access to map: bounds check using s<, good access Did not run the program (not supported) OK # #573/p helper access to map: bounds check using s<, good access 2 Did not run the program (not supported) OK # #574/p helper access to map: bounds check using s<, bad access OK # #575/p helper access to map: bounds check using s<=, good access Did not run the program (not supported) OK # #576/p helper access to map: bounds check using s<=, good access 2 Did not run the program (not supported) OK # #577/p helper access to map: bounds check using s<=, bad access OK # #578/p map lookup helper access to map Did not run the program (not supported) OK # #579/p map update helper access to map Did not run the program (not supported) OK # #580/p map update helper access to map: wrong size OK # #581/p map helper access to adjusted map (via const imm) Did not run the program (not supported) OK # #582/p map helper access to adjusted map (via const imm): out-of-bound 1 OK # #583/p map helper access to adjusted map (via const imm): out-of-bound 2 OK # #584/p map helper access to adjusted map (via const reg) Did not run the program (not supported) OK # #585/p map helper access to adjusted map (via const reg): out-of-bound 1 OK # #586/p map helper access to adjusted map (via const reg): out-of-bound 2 OK # #587/p map helper access to adjusted map (via variable) Did not run the program (not supported) OK # #588/p map helper access to adjusted map (via variable): no max check OK # #589/p map helper access to adjusted map (via variable): wrong max check OK # #590/p ARG_PTR_TO_LONG uninitialized OK # #591/p ARG_PTR_TO_LONG half-uninitialized OK # #592/p ARG_PTR_TO_LONG misaligned OK # #593/p ARG_PTR_TO_LONG size < sizeof(long) OK # #594/p ARG_PTR_TO_LONG initialized Did not run the program (not supported) OK # #595/u jit: lsh, rsh, arsh by 1 OK # #595/p jit: lsh, rsh, arsh by 1 OK # #596/u jit: mov32 for ldimm64, 1 OK # #596/p jit: mov32 for ldimm64, 1 OK # #597/u jit: mov32 for ldimm64, 2 OK # #597/p jit: mov32 for ldimm64, 2 OK # #598/u jit: various mul tests OK # #598/p jit: various mul tests OK # #599/u jit: jsgt, jslt OK # #599/p jit: jsgt, jslt OK # #600/p jit: torturous jumps, imm8 nop jmp and pure jump padding OK # #601/p jit: torturous jumps, imm32 nop jmp and jmp_cond padding OK # #602/p jit: torturous jumps in subprog OK # #603/p jset32: BPF_K 3 cases OK # #604/p jset32: BPF_X 3 cases OK # #605/u jset32: ignores upper bits OK # #605/p jset32: ignores upper bits OK # #606/u jset32: min/max deduction OK # #606/p jset32: min/max deduction OK # #607/p jeq32: BPF_K 2 cases OK # #608/p jeq32: BPF_X 3 cases OK # #609/u jeq32: min/max deduction OK # #609/p jeq32: min/max deduction OK # #610/p jne32: BPF_K 2 cases OK # #611/p jne32: BPF_X 3 cases OK # #612/u jne32: min/max deduction OK # #612/p jne32: min/max deduction OK # #613/p jge32: BPF_K 3 cases OK # #614/p jge32: BPF_X 3 cases OK # #615/u jge32: min/max deduction OK # #615/p jge32: min/max deduction OK # #616/p jgt32: BPF_K 3 cases OK # #617/p jgt32: BPF_X 3 cases OK # #618/u jgt32: min/max deduction OK # #618/p jgt32: min/max deduction OK # #619/p jle32: BPF_K 3 cases OK # #620/p jle32: BPF_X 3 cases OK # #621/u jle32: min/max deduction OK # #621/p jle32: min/max deduction OK # #622/p jlt32: BPF_K 3 cases OK # #623/p jlt32: BPF_X 3 cases OK # #624/u jlt32: min/max deduction OK # #624/p jlt32: min/max deduction OK # #625/p jsge32: BPF_K 3 cases OK # #626/p jsge32: BPF_X 3 cases OK # #627/u jsge32: min/max deduction OK # #627/p jsge32: min/max deduction OK # #628/p jsgt32: BPF_K 3 cases OK # #629/p jsgt32: BPF_X 3 cases OK # #630/u jsgt32: min/max deduction OK # #630/p jsgt32: min/max deduction OK # #631/p jsle32: BPF_K 3 cases OK # #632/p jsle32: BPF_X 3 cases OK # #633/u jsle32: min/max deduction OK # #633/p jsle32: min/max deduction OK # #634/p jslt32: BPF_K 3 cases OK # #635/p jslt32: BPF_X 3 cases OK # #636/u jslt32: min/max deduction OK # #636/p jslt32: min/max deduction OK # #637/p jgt32: range bound deduction, reg op imm OK # #638/p jgt32: range bound deduction, reg1 op reg2, reg1 unknown OK # #639/p jle32: range bound deduction, reg1 op reg2, reg2 unknown OK # #640/p jset: functional 7 cases OK # #641/p jset: sign-extend OK # #642/u jset: known const compare OK # #642/p jset: known const compare OK # #643/u jset: known const compare bad OK # #643/p jset: known const compare bad OK # #644/u jset: unknown const compare taken OK # #644/p jset: unknown const compare taken OK # #645/u jset: unknown const compare not taken OK # #645/p jset: unknown const compare not taken OK # #646/u jset: half-known const compare OK # #646/p jset: half-known const compare OK # #647/u jset: range OK # #647/p jset: range OK # #648/u jump test 1 OK # #648/p jump test 1 OK # #649/u jump test 2 OK # #649/p jump test 2 OK # #650/u jump test 3 OK # #650/p jump test 3 OK # #651/u jump test 4 OK # #651/p jump test 4 OK # #652/u jump test 5 OK # #652/p jump test 5 OK # #653/u jump test 6 OK # #653/p jump test 6 OK # #654/u jump test 7 OK # #654/p jump test 7 OK # #655/u jump test 8 OK # #655/p jump test 8 OK # #656/p jump/call test 9 OK # #657/p jump/call test 10 OK # #658/p jump/call test 11 OK # #659/u junk insn OK # #659/p junk insn OK # #660/u junk insn2 OK # #660/p junk insn2 OK # #661/u junk insn3 OK # #661/p junk insn3 OK # #662/u junk insn4 OK # #662/p junk insn4 OK # #663/u junk insn5 OK # #663/p junk insn5 OK # #664/u ld_abs: check calling conv, r1 OK # #664/p ld_abs: check calling conv, r1 OK # #665/u ld_abs: check calling conv, r2 OK # #665/p ld_abs: check calling conv, r2 OK # #666/u ld_abs: check calling conv, r3 OK # #666/p ld_abs: check calling conv, r3 OK # #667/u ld_abs: check calling conv, r4 OK # #667/p ld_abs: check calling conv, r4 OK # #668/u ld_abs: check calling conv, r5 OK # #668/p ld_abs: check calling conv, r5 OK # #669/u ld_abs: check calling conv, r7 OK # #669/p ld_abs: check calling conv, r7 OK # #670/p ld_abs: tests on r6 and skb data reload helper OK # #671/p ld_abs: invalid op 1 OK # #672/p ld_abs: invalid op 2 OK # #673/p ld_abs: nmap reduced OK # #674/p ld_abs: div + abs, test 1 OK # #675/p ld_abs: div + abs, test 2 OK # #676/p ld_abs: div + abs, test 3 OK # #677/p ld_abs: div + abs, test 4 OK # #678/p ld_abs: vlan + abs, test 1 OK # #679/p ld_abs: vlan + abs, test 2 OK # #680/p ld_abs: jump around ld_abs OK # #681/p ld_dw: xor semi-random 64 bit imms, test 1 OK # #682/p ld_dw: xor semi-random 64 bit imms, test 2 OK # #683/p ld_dw: xor semi-random 64 bit imms, test 3 OK # #684/p ld_dw: xor semi-random 64 bit imms, test 4 OK # #685/p ld_dw: xor semi-random 64 bit imms, test 5 OK # #686/u test1 ld_imm64 OK # #686/p test1 ld_imm64 OK # #687/u test2 ld_imm64 OK # #687/p test2 ld_imm64 OK # #688/u test3 ld_imm64 OK # #688/p test3 ld_imm64 OK # #689/u test4 ld_imm64 OK # #689/p test4 ld_imm64 OK # #690/u test6 ld_imm64 OK # #690/p test6 ld_imm64 OK # #691/u test7 ld_imm64 OK # #691/p test7 ld_imm64 OK # #692/u test8 ld_imm64 OK # #692/p test8 ld_imm64 OK # #693/u test9 ld_imm64 OK # #693/p test9 ld_imm64 OK # #694/u test10 ld_imm64 OK # #694/p test10 ld_imm64 OK # #695/u test11 ld_imm64 OK # #695/p test11 ld_imm64 OK # #696/u test12 ld_imm64 OK # #696/p test12 ld_imm64 OK # #697/u test13 ld_imm64 OK # #697/p test13 ld_imm64 OK # #698/u test14 ld_imm64: reject 2nd imm != 0 OK # #698/p test14 ld_imm64: reject 2nd imm != 0 OK # #699/u ld_ind: check calling conv, r1 OK # #699/p ld_ind: check calling conv, r1 OK # #700/u ld_ind: check calling conv, r2 OK # #700/p ld_ind: check calling conv, r2 OK # #701/u ld_ind: check calling conv, r3 OK # #701/p ld_ind: check calling conv, r3 OK # #702/u ld_ind: check calling conv, r4 OK # #702/p ld_ind: check calling conv, r4 OK # #703/u ld_ind: check calling conv, r5 OK # #703/p ld_ind: check calling conv, r5 OK # #704/u ld_ind: check calling conv, r7 OK # #704/p ld_ind: check calling conv, r7 OK # #705/u leak pointer into ctx 1 OK # #705/p leak pointer into ctx 1 OK # #706/u leak pointer into ctx 2 OK # #706/p leak pointer into ctx 2 OK # #707/u leak pointer into ctx 3 OK # #707/p leak pointer into ctx 3 OK # #708/u leak pointer into map val OK # #708/p leak pointer into map val OK # #709/p bounded loop, count to 4 Did not run the program (not supported) OK # #710/p bounded loop, count to 20 Did not run the program (not supported) OK # #711/p bounded loop, count from positive unknown to 4 Did not run the program (not supported) OK # #712/p bounded loop, count from totally unknown to 4 Did not run the program (not supported) OK # #713/p bounded loop, count to 4 with equality Did not run the program (not supported) OK # #714/p bounded loop, start in the middle OK # #715/p bounded loop containing a forward jump Did not run the program (not supported) OK # #716/p bounded loop that jumps out rather than in Did not run the program (not supported) OK # #717/p infinite loop after a conditional jump OK # #718/p bounded recursion OK # #719/p infinite loop in two jumps OK # #720/p infinite loop: three-jump trick OK # #721/p not-taken loop with back jump to 1st insn OK # #722/p taken loop with back jump to 1st insn OK # #723/p taken loop with back jump to 1st insn, 2 OK # #724/p invalid direct packet write for LWT_IN OK # #725/p invalid direct packet write for LWT_OUT OK # #726/p direct packet write for LWT_XMIT OK # #727/p direct packet read for LWT_IN OK # #728/p direct packet read for LWT_OUT OK # #729/p direct packet read for LWT_XMIT OK # #730/p overlapping checks for direct packet access OK # #731/p make headroom for LWT_XMIT OK # #732/u invalid access of tc_classid for LWT_IN OK # #732/p invalid access of tc_classid for LWT_IN OK # #733/u invalid access of tc_classid for LWT_OUT OK # #733/p invalid access of tc_classid for LWT_OUT OK # #734/u invalid access of tc_classid for LWT_XMIT OK # #734/p invalid access of tc_classid for LWT_XMIT OK # #735/p check skb->tc_classid half load not permitted for lwt prog OK # #736/u map in map access OK # #736/p map in map access OK # #737/u invalid inner map pointer OK # #737/p invalid inner map pointer OK # #738/u forgot null checking on the inner map pointer OK # #738/p forgot null checking on the inner map pointer OK # #739/u bpf_map_ptr: read with negative offset rejected OK # #739/p bpf_map_ptr: read with negative offset rejected OK # #740/u bpf_map_ptr: write rejected OK # #740/p bpf_map_ptr: write rejected OK # #741/u bpf_map_ptr: read non-existent field rejected OK # #741/p bpf_map_ptr: read non-existent field rejected OK # #742/u bpf_map_ptr: read ops field accepted OK # #742/p bpf_map_ptr: read ops field accepted OK # #743/u bpf_map_ptr: r = 0, map_ptr = map_ptr + r OK # #743/p bpf_map_ptr: r = 0, map_ptr = map_ptr + r OK # #744/u bpf_map_ptr: r = 0, r = r + map_ptr OK # #744/p bpf_map_ptr: r = 0, r = r + map_ptr OK # #745/p calls: two calls returning different map pointers for lookup (hash, array) OK # #746/p calls: two calls returning different map pointers for lookup (hash, map in map) OK # #747/u cond: two branches returning different map pointers for lookup (tail, tail) OK # #747/p cond: two branches returning different map pointers for lookup (tail, tail) OK # #748/u cond: two branches returning same map pointers for lookup (tail, tail) OK # #748/p cond: two branches returning same map pointers for lookup (tail, tail) OK # #749/u invalid map_fd for function call OK # #749/p invalid map_fd for function call OK # #750/u don't check return value before access OK # #750/p don't check return value before access OK # #751/u access memory with incorrect alignment OK # #751/p access memory with incorrect alignment OK # #752/u sometimes access memory with incorrect alignment OK # #752/p sometimes access memory with incorrect alignment OK # #753/u masking, test out of bounds 1 OK # #753/p masking, test out of bounds 1 OK # #754/u masking, test out of bounds 2 OK # #754/p masking, test out of bounds 2 OK # #755/u masking, test out of bounds 3 OK # #755/p masking, test out of bounds 3 OK # #756/u masking, test out of bounds 4 OK # #756/p masking, test out of bounds 4 OK # #757/u masking, test out of bounds 5 OK # #757/p masking, test out of bounds 5 OK # #758/u masking, test out of bounds 6 OK # #758/p masking, test out of bounds 6 OK # #759/u masking, test out of bounds 7 OK # #759/p masking, test out of bounds 7 OK # #760/u masking, test out of bounds 8 OK # #760/p masking, test out of bounds 8 OK # #761/u masking, test out of bounds 9 OK # #761/p masking, test out of bounds 9 OK # #762/u masking, test out of bounds 10 OK # #762/p masking, test out of bounds 10 OK # #763/u masking, test out of bounds 11 OK # #763/p masking, test out of bounds 11 OK # #764/u masking, test out of bounds 12 OK # #764/p masking, test out of bounds 12 OK # #765/u masking, test in bounds 1 OK # #765/p masking, test in bounds 1 OK # #766/u masking, test in bounds 2 OK # #766/p masking, test in bounds 2 OK # #767/u masking, test in bounds 3 OK # #767/p masking, test in bounds 3 OK # #768/u masking, test in bounds 4 OK # #768/p masking, test in bounds 4 OK # #769/u masking, test in bounds 5 OK # #769/p masking, test in bounds 5 OK # #770/u masking, test in bounds 6 OK # #770/p masking, test in bounds 6 OK # #771/u masking, test in bounds 7 OK # #771/p masking, test in bounds 7 OK # #772/u masking, test in bounds 8 OK # #772/p masking, test in bounds 8 OK # #773/p meta access, test1 OK # #774/p meta access, test2 OK # #775/p meta access, test3 OK # #776/p meta access, test4 OK # #777/p meta access, test5 OK # #778/p meta access, test6 OK # #779/p meta access, test7 OK # #780/p meta access, test8 OK # #781/p meta access, test9 OK # #782/p meta access, test10 OK # #783/p meta access, test11 OK # #784/p meta access, test12 OK # #785/p check bpf_perf_event_data->sample_period byte load permitted Did not run the program (not supported) OK # #786/p check bpf_perf_event_data->sample_period half load permitted Did not run the program (not supported) OK # #787/p check bpf_perf_event_data->sample_period word load permitted Did not run the program (not supported) OK # #788/p check bpf_perf_event_data->sample_period dword load permitted Did not run the program (not supported) OK # #789/p precise: test 1 Did not run the program (not supported) OK # #790/p precise: test 2 Did not run the program (not supported) OK # #791/p precise: cross frame pruning OK # #792/p precise: ST insn causing spi > allocated_stack OK # #793/p precise: STX insn causing spi > allocated_stack OK # #794/p prevent map lookup in stack trace OK # #795/u prevent map lookup in prog array OK # #795/p prevent map lookup in prog array OK # #796/p raw_stack: no skb_load_bytes OK # #797/p raw_stack: skb_load_bytes, negative len OK # #798/p raw_stack: skb_load_bytes, negative len 2 OK # #799/p raw_stack: skb_load_bytes, zero len OK # #800/p raw_stack: skb_load_bytes, no init OK # #801/p raw_stack: skb_load_bytes, init OK # #802/p raw_stack: skb_load_bytes, spilled regs around bounds OK # #803/p raw_stack: skb_load_bytes, spilled regs corruption OK # #804/p raw_stack: skb_load_bytes, spilled regs corruption 2 OK # #805/p raw_stack: skb_load_bytes, spilled regs + data OK # #806/p raw_stack: skb_load_bytes, invalid access 1 OK # #807/p raw_stack: skb_load_bytes, invalid access 2 OK # #808/p raw_stack: skb_load_bytes, invalid access 3 OK # #809/p raw_stack: skb_load_bytes, invalid access 4 OK # #810/p raw_stack: skb_load_bytes, invalid access 5 OK # #811/p raw_stack: skb_load_bytes, invalid access 6 OK # #812/p raw_stack: skb_load_bytes, large access OK # #813/p raw_tracepoint_writable: reject variable offset OK # #814/p reference tracking: leak potential reference OK # #815/p reference tracking: leak potential reference to sock_common OK # #816/p reference tracking: leak potential reference on stack OK # #817/p reference tracking: leak potential reference on stack 2 OK # #818/p reference tracking: zero potential reference OK # #819/p reference tracking: zero potential reference to sock_common OK # #820/p reference tracking: copy and zero potential references OK # #821/p reference tracking: release reference without check OK # #822/p reference tracking: release reference to sock_common without check OK # #823/p reference tracking: release reference OK # #824/p reference tracking: release reference to sock_common OK # #825/p reference tracking: release reference 2 OK # #826/p reference tracking: release reference twice OK # #827/p reference tracking: release reference twice inside branch OK # #828/p reference tracking: alloc, check, free in one subbranch OK # #829/p reference tracking: alloc, check, free in both subbranches OK # #830/p reference tracking in call: free reference in subprog OK # #831/p reference tracking in call: free reference in subprog and outside OK # #832/p reference tracking in call: alloc & leak reference in subprog OK # #833/p reference tracking in call: alloc in subprog, release outside OK # #834/p reference tracking in call: sk_ptr leak into caller stack OK # #835/p reference tracking in call: sk_ptr spill into caller stack OK # #836/p reference tracking: allow LD_ABS OK # #837/p reference tracking: forbid LD_ABS while holding reference OK # #838/p reference tracking: allow LD_IND OK # #839/p reference tracking: forbid LD_IND while holding reference OK # #840/p reference tracking: check reference or tail call OK # #841/p reference tracking: release reference then tail call OK # #842/p reference tracking: leak possible reference over tail call OK # #843/p reference tracking: leak checked reference over tail call OK # #844/p reference tracking: mangle and release sock_or_null OK # #845/p reference tracking: mangle and release sock OK # #846/p reference tracking: access member OK # #847/p reference tracking: write to member OK # #848/p reference tracking: invalid 64-bit access of member OK # #849/p reference tracking: access after release OK # #850/p reference tracking: direct access for lookup OK # #851/p reference tracking: use ptr from bpf_tcp_sock() after release OK # #852/p reference tracking: use ptr from bpf_sk_fullsock() after release OK # #853/p reference tracking: use ptr from bpf_sk_fullsock(tp) after release OK # #854/p reference tracking: use sk after bpf_sk_release(tp) OK # #855/p reference tracking: use ptr from bpf_get_listener_sock() after bpf_sk_release(sk) OK # #856/p reference tracking: bpf_sk_release(listen_sk) OK # #857/p reference tracking: tp->snd_cwnd after bpf_sk_fullsock(sk) and bpf_tcp_sock(sk) OK # #858/p reference tracking: branch tracking valid pointer null comparison OK # #859/p reference tracking: branch tracking valid pointer value comparison OK # #860/p reference tracking: bpf_sk_release(btf_tcp_sock) OK # #861/p reference tracking: use ptr from bpf_skc_to_tcp_sock() after release OK # #862/p regalloc basic Did not run the program (not supported) OK # #863/p regalloc negative OK # #864/p regalloc src_reg mark Did not run the program (not supported) OK # #865/p regalloc src_reg negative OK # #866/p regalloc and spill Did not run the program (not supported) OK # #867/p regalloc and spill negative OK # #868/p regalloc three regs Did not run the program (not supported) OK # #869/p regalloc after call Did not run the program (not supported) OK # #870/p regalloc in callee Did not run the program (not supported) OK # #871/p regalloc, spill, JEQ Did not run the program (not supported) OK # #872/u runtime/jit: tail_call within bounds, prog once OK # #872/p runtime/jit: tail_call within bounds, prog once OK # #873/u runtime/jit: tail_call within bounds, prog loop OK # #873/p runtime/jit: tail_call within bounds, prog loop OK # #874/u runtime/jit: tail_call within bounds, no prog OK # #874/p runtime/jit: tail_call within bounds, no prog OK # #875/u runtime/jit: tail_call within bounds, key 2 OK # #875/p runtime/jit: tail_call within bounds, key 2 OK # #876/u runtime/jit: tail_call within bounds, key 2 / key 2, first branch OK # #876/p runtime/jit: tail_call within bounds, key 2 / key 2, first branch OK # #877/u runtime/jit: tail_call within bounds, key 2 / key 2, second branch OK # #877/p runtime/jit: tail_call within bounds, key 2 / key 2, second branch OK # #878/u runtime/jit: tail_call within bounds, key 0 / key 2, first branch OK # #878/p runtime/jit: tail_call within bounds, key 0 / key 2, first branch OK # #879/u runtime/jit: tail_call within bounds, key 0 / key 2, second branch OK # #879/p runtime/jit: tail_call within bounds, key 0 / key 2, second branch OK # #880/u runtime/jit: tail_call within bounds, different maps, first branch OK # #880/p runtime/jit: tail_call within bounds, different maps, first branch OK # #881/u runtime/jit: tail_call within bounds, different maps, second branch OK # #881/p runtime/jit: tail_call within bounds, different maps, second branch OK # #882/u runtime/jit: tail_call out of bounds OK # #882/p runtime/jit: tail_call out of bounds OK # #883/u runtime/jit: pass negative index to tail_call OK # #883/p runtime/jit: pass negative index to tail_call OK # #884/u runtime/jit: pass > 32bit index to tail_call OK # #884/p runtime/jit: pass > 32bit index to tail_call OK # #885/p scale: scale test 1 OK # #886/p scale: scale test 2 OK # #887/u pointer/scalar confusion in state equality check (way 1) OK # #887/p pointer/scalar confusion in state equality check (way 1) OK # #888/u pointer/scalar confusion in state equality check (way 2) OK # #888/p pointer/scalar confusion in state equality check (way 2) OK # #889/p liveness pruning and write screening OK # #890/u varlen_map_value_access pruning OK # #890/p varlen_map_value_access pruning OK # #891/p search pruning: all branches should be verified (nop operation) OK # #892/p search pruning: all branches should be verified (invalid stack access) OK # #893/u allocated_stack OK # #893/p allocated_stack OK # #894/u skb->sk: no NULL check OK # #894/p skb->sk: no NULL check OK # #895/u skb->sk: sk->family [non fullsock field] OK # #895/p skb->sk: sk->family [non fullsock field] OK # #896/u skb->sk: sk->type [fullsock field] OK # #896/p skb->sk: sk->type [fullsock field] OK # #897/u bpf_sk_fullsock(skb->sk): no !skb->sk check OK # #897/p bpf_sk_fullsock(skb->sk): no !skb->sk check OK # #898/u sk_fullsock(skb->sk): no NULL check on ret OK # #898/p sk_fullsock(skb->sk): no NULL check on ret OK # #899/u sk_fullsock(skb->sk): sk->type [fullsock field] OK # #899/p sk_fullsock(skb->sk): sk->type [fullsock field] OK # #900/u sk_fullsock(skb->sk): sk->family [non fullsock field] OK # #900/p sk_fullsock(skb->sk): sk->family [non fullsock field] OK # #901/u sk_fullsock(skb->sk): sk->state [narrow load] OK # #901/p sk_fullsock(skb->sk): sk->state [narrow load] OK # #902/u sk_fullsock(skb->sk): sk->dst_port [narrow load] OK # #902/p sk_fullsock(skb->sk): sk->dst_port [narrow load] OK # #903/u sk_fullsock(skb->sk): sk->dst_port [load 2nd byte] OK # #903/p sk_fullsock(skb->sk): sk->dst_port [load 2nd byte] OK # #904/u sk_fullsock(skb->sk): sk->dst_ip6 [load 2nd byte] OK # #904/p sk_fullsock(skb->sk): sk->dst_ip6 [load 2nd byte] OK # #905/u sk_fullsock(skb->sk): sk->type [narrow load] OK # #905/p sk_fullsock(skb->sk): sk->type [narrow load] OK # #906/u sk_fullsock(skb->sk): sk->protocol [narrow load] OK # #906/p sk_fullsock(skb->sk): sk->protocol [narrow load] OK # #907/u sk_fullsock(skb->sk): beyond last field OK # #907/p sk_fullsock(skb->sk): beyond last field OK # #908/u bpf_tcp_sock(skb->sk): no !skb->sk check OK # #908/p bpf_tcp_sock(skb->sk): no !skb->sk check OK # #909/u bpf_tcp_sock(skb->sk): no NULL check on ret OK # #909/p bpf_tcp_sock(skb->sk): no NULL check on ret OK # #910/u bpf_tcp_sock(skb->sk): tp->snd_cwnd OK # #910/p bpf_tcp_sock(skb->sk): tp->snd_cwnd OK # #911/u bpf_tcp_sock(skb->sk): tp->bytes_acked OK # #911/p bpf_tcp_sock(skb->sk): tp->bytes_acked OK # #912/u bpf_tcp_sock(skb->sk): beyond last field OK # #912/p bpf_tcp_sock(skb->sk): beyond last field OK # #913/u bpf_tcp_sock(bpf_sk_fullsock(skb->sk)): tp->snd_cwnd OK # #913/p bpf_tcp_sock(bpf_sk_fullsock(skb->sk)): tp->snd_cwnd OK # #914/p bpf_sk_release(skb->sk) OK # #915/p bpf_sk_release(bpf_sk_fullsock(skb->sk)) OK # #916/p bpf_sk_release(bpf_tcp_sock(skb->sk)) OK # #917/p sk_storage_get(map, skb->sk, NULL, 0): value == NULL FAIL # Failed to load prog 'Bad file descriptor'! # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #918/p sk_storage_get(map, skb->sk, 1, 1): value == 1 FAIL # Unexpected verifier log! # EXP: R3 type=inv expected=fp # RES: # FAIL # Unexpected error message! # EXP: R3 type=inv expected=fp # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #919/p sk_storage_get(map, skb->sk, &stack_value, 1): stack_value FAIL # Failed to load prog 'Bad file descriptor'! # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #920/p sk_storage_get(map, skb->sk, &stack_value, 1): partially init stack_value FAIL # Unexpected verifier log! # EXP: invalid indirect read from stack # RES: # FAIL # Unexpected error message! # EXP: invalid indirect read from stack # RES: fd -1 is not pointing to valid bpf_map # verification time 19 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 19 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #921/p bpf_map_lookup_elem(smap, &key) FAIL # Unexpected verifier log! # EXP: cannot pass map_type 24 into func bpf_map_lookup_elem # RES: # FAIL # Unexpected error message! # EXP: cannot pass map_type 24 into func bpf_map_lookup_elem # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #922/p bpf_map_lookup_elem(xskmap, &key); xs->queue_id OK # #923/p bpf_map_lookup_elem(sockmap, &key) OK # #924/p bpf_map_lookup_elem(sockhash, &key) OK # #925/p bpf_map_lookup_elem(sockmap, &key); sk->type [fullsock field]; bpf_sk_release(sk) Did not run the program (not supported) OK # #926/p bpf_map_lookup_elem(sockhash, &key); sk->type [fullsock field]; bpf_sk_release(sk) Did not run the program (not supported) OK # #927/p bpf_sk_select_reuseport(ctx, reuseport_array, &key, flags) Did not run the program (not supported) OK # #928/p bpf_sk_select_reuseport(ctx, sockmap, &key, flags) Did not run the program (not supported) OK # #929/p bpf_sk_select_reuseport(ctx, sockhash, &key, flags) Did not run the program (not supported) OK # #930/p mark null check on return value of bpf_skc_to helpers OK # #931/u check valid spill/fill OK # #931/p check valid spill/fill OK # #932/u check valid spill/fill, skb mark OK # #932/p check valid spill/fill, skb mark OK # #933/u check valid spill/fill, ptr to mem OK # #933/p check valid spill/fill, ptr to mem OK # #934/u check corrupted spill/fill OK # #934/p check corrupted spill/fill OK # #935/u check corrupted spill/fill, LSB OK # #935/p check corrupted spill/fill, LSB OK # #936/u check corrupted spill/fill, MSB OK # #936/p check corrupted spill/fill, MSB OK # #937/u spin_lock: test1 success OK # #937/p spin_lock: test1 success FAIL # Failed to load prog 'Bad file descriptor'! # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #938/u spin_lock: test2 direct ld/st OK # #938/p spin_lock: test2 direct ld/st FAIL # Unexpected verifier log! # EXP: cannot be accessed directly # RES: # FAIL # Unexpected error message! # EXP: cannot be accessed directly # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #939/u spin_lock: test3 direct ld/st OK # #939/p spin_lock: test3 direct ld/st FAIL # Unexpected verifier log! # EXP: cannot be accessed directly # RES: # FAIL # Unexpected error message! # EXP: cannot be accessed directly # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #940/u spin_lock: test4 direct ld/st OK # #940/p spin_lock: test4 direct ld/st FAIL # Unexpected verifier log! # EXP: cannot be accessed directly # RES: # FAIL # Unexpected error message! # EXP: cannot be accessed directly # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #941/u spin_lock: test5 call within a locked region OK # #941/p spin_lock: test5 call within a locked region FAIL # Unexpected verifier log! # EXP: calls are not allowed # RES: # FAIL # Unexpected error message! # EXP: calls are not allowed # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #942/u spin_lock: test6 missing unlock OK # #942/p spin_lock: test6 missing unlock FAIL # Unexpected verifier log! # EXP: unlock is missing # RES: # FAIL # Unexpected error message! # EXP: unlock is missing # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #943/u spin_lock: test7 unlock without lock OK # #943/p spin_lock: test7 unlock without lock FAIL # Unexpected verifier log! # EXP: without taking a lock # RES: # FAIL # Unexpected error message! # EXP: without taking a lock # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #944/u spin_lock: test8 double lock OK # #944/p spin_lock: test8 double lock FAIL # Unexpected verifier log! # EXP: calls are not allowed # RES: # FAIL # Unexpected error message! # EXP: calls are not allowed # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #945/u spin_lock: test9 different lock OK # #945/p spin_lock: test9 different lock FAIL # Unexpected verifier log! # EXP: unlock of different lock # RES: # FAIL # Unexpected error message! # EXP: unlock of different lock # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #946/u spin_lock: test10 lock in subprog without unlock OK # #946/p spin_lock: test10 lock in subprog without unlock FAIL # Unexpected verifier log! # EXP: unlock is missing # RES: # FAIL # Unexpected error message! # EXP: unlock is missing # RES: fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0+0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 17 usec # stack depth 0+0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #947/p spin_lock: test11 ld_abs under lock FAIL # Unexpected verifier log! # EXP: inside bpf_spin_lock # RES: # FAIL # Unexpected error message! # EXP: inside bpf_spin_lock # RES: fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # # fd -1 is not pointing to valid bpf_map # verification time 16 usec # stack depth 0 # processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 # #948/u PTR_TO_STACK store/load OK # #948/p PTR_TO_STACK store/load OK # #949/u PTR_TO_STACK store/load - bad alignment on off OK # #949/p PTR_TO_STACK store/load - bad alignment on off OK # #950/u PTR_TO_STACK store/load - bad alignment on reg OK # #950/p PTR_TO_STACK store/load - bad alignment on reg OK # #951/u PTR_TO_STACK store/load - out of bounds low OK # #951/p PTR_TO_STACK store/load - out of bounds low OK # #952/u PTR_TO_STACK store/load - out of bounds high OK # #952/p PTR_TO_STACK store/load - out of bounds high OK # #953/u PTR_TO_STACK check high 1 OK # #953/p PTR_TO_STACK check high 1 OK # #954/u PTR_TO_STACK check high 2 OK # #954/p PTR_TO_STACK check high 2 OK # #955/u PTR_TO_STACK check high 3 OK # #955/p PTR_TO_STACK check high 3 OK # #956/u PTR_TO_STACK check high 4 OK # #956/p PTR_TO_STACK check high 4 OK # #957/u PTR_TO_STACK check high 5 OK # #957/p PTR_TO_STACK check high 5 OK # #958/u PTR_TO_STACK check high 6 OK # #958/p PTR_TO_STACK check high 6 OK # #959/u PTR_TO_STACK check high 7 OK # #959/p PTR_TO_STACK check high 7 OK # #960/u PTR_TO_STACK check low 1 OK # #960/p PTR_TO_STACK check low 1 OK # #961/u PTR_TO_STACK check low 2 OK # #961/p PTR_TO_STACK check low 2 OK # #962/u PTR_TO_STACK check low 3 OK # #962/p PTR_TO_STACK check low 3 OK # #963/u PTR_TO_STACK check low 4 OK # #963/p PTR_TO_STACK check low 4 OK # #964/u PTR_TO_STACK check low 5 OK # #964/p PTR_TO_STACK check low 5 OK # #965/u PTR_TO_STACK check low 6 OK # #965/p PTR_TO_STACK check low 6 OK # #966/u PTR_TO_STACK check low 7 OK # #966/p PTR_TO_STACK check low 7 OK # #967/u PTR_TO_STACK mixed reg/k, 1 OK # #967/p PTR_TO_STACK mixed reg/k, 1 OK # #968/u PTR_TO_STACK mixed reg/k, 2 OK # #968/p PTR_TO_STACK mixed reg/k, 2 OK # #969/u PTR_TO_STACK mixed reg/k, 3 OK # #969/p PTR_TO_STACK mixed reg/k, 3 OK # #970/u PTR_TO_STACK reg OK # #970/p PTR_TO_STACK reg OK # #971/u stack pointer arithmetic OK # #971/p stack pointer arithmetic OK # #972/p store PTR_TO_STACK in R10 to array map using BPF_B OK # #973/u add32 reg zero extend check OK # #973/p add32 reg zero extend check OK # #974/u add32 imm zero extend check OK # #974/p add32 imm zero extend check OK # #975/u sub32 reg zero extend check OK # #975/p sub32 reg zero extend check OK # #976/u sub32 imm zero extend check OK # #976/p sub32 imm zero extend check OK # #977/u mul32 reg zero extend check OK # #977/p mul32 reg zero extend check OK # #978/u mul32 imm zero extend check OK # #978/p mul32 imm zero extend check OK # #979/u div32 reg zero extend check OK # #979/p div32 reg zero extend check OK # #980/u div32 imm zero extend check OK # #980/p div32 imm zero extend check OK # #981/u or32 reg zero extend check OK # #981/p or32 reg zero extend check OK # #982/u or32 imm zero extend check OK # #982/p or32 imm zero extend check OK # #983/u and32 reg zero extend check OK # #983/p and32 reg zero extend check OK # #984/u and32 imm zero extend check OK # #984/p and32 imm zero extend check OK # #985/u lsh32 reg zero extend check OK # #985/p lsh32 reg zero extend check OK # #986/u lsh32 imm zero extend check OK # #986/p lsh32 imm zero extend check OK # #987/u rsh32 reg zero extend check OK # #987/p rsh32 reg zero extend check OK # #988/u rsh32 imm zero extend check OK # #988/p rsh32 imm zero extend check OK # #989/u neg32 reg zero extend check OK # #989/p neg32 reg zero extend check OK # #990/u mod32 reg zero extend check OK # #990/p mod32 reg zero extend check OK # #991/u mod32 imm zero extend check OK # #991/p mod32 imm zero extend check OK # #992/u xor32 reg zero extend check OK # #992/p xor32 reg zero extend check OK # #993/u xor32 imm zero extend check OK # #993/p xor32 imm zero extend check OK # #994/u mov32 reg zero extend check OK # #994/p mov32 reg zero extend check OK # #995/u mov32 imm zero extend check OK # #995/p mov32 imm zero extend check OK # #996/u arsh32 reg zero extend check OK # #996/p arsh32 reg zero extend check OK # #997/u arsh32 imm zero extend check OK # #997/p arsh32 imm zero extend check OK # #998/u end16 (to_le) reg zero extend check OK # #998/p end16 (to_le) reg zero extend check OK # #999/u end32 (to_le) reg zero extend check OK # #999/p end32 (to_le) reg zero extend check OK # #1000/u end16 (to_be) reg zero extend check OK # #1000/p end16 (to_be) reg zero extend check OK # #1001/u end32 (to_be) reg zero extend check OK # #1001/p end32 (to_be) reg zero extend check OK # #1002/u ldx_b zero extend check OK # #1002/p ldx_b zero extend check OK # #1003/u ldx_h zero extend check OK # #1003/p ldx_h zero extend check OK # #1004/u ldx_w zero extend check OK # #1004/p ldx_w zero extend check OK # #1005/u read uninitialized register OK # #1005/p read uninitialized register OK # #1006/u read invalid register OK # #1006/p read invalid register OK # #1007/u program doesn't init R0 before exit OK # #1007/p program doesn't init R0 before exit OK # #1008/u program doesn't init R0 before exit in all branches OK # #1008/p program doesn't init R0 before exit in all branches OK # #1009/u unpriv: return pointer OK # #1009/p unpriv: return pointer OK # #1010/u unpriv: add const to pointer OK # #1010/p unpriv: add const to pointer OK # #1011/u unpriv: add pointer to pointer OK # #1011/p unpriv: add pointer to pointer OK # #1012/u unpriv: neg pointer OK # #1012/p unpriv: neg pointer OK # #1013/u unpriv: cmp pointer with const OK # #1013/p unpriv: cmp pointer with const OK # #1014/u unpriv: cmp pointer with pointer OK # #1014/p unpriv: cmp pointer with pointer OK # #1015/p unpriv: check that printk is disallowed Did not run the program (not supported) OK # #1016/u unpriv: pass pointer to helper function OK # #1016/p unpriv: pass pointer to helper function OK # #1017/u unpriv: indirectly pass pointer on stack to helper function OK # #1017/p unpriv: indirectly pass pointer on stack to helper function OK # #1018/u unpriv: mangle pointer on stack 1 OK # #1018/p unpriv: mangle pointer on stack 1 OK # #1019/u unpriv: mangle pointer on stack 2 OK # #1019/p unpriv: mangle pointer on stack 2 OK # #1020/u unpriv: read pointer from stack in small chunks OK # #1020/p unpriv: read pointer from stack in small chunks OK # #1021/u unpriv: write pointer into ctx OK # #1021/p unpriv: write pointer into ctx OK # #1022/u unpriv: spill/fill of ctx OK # #1022/p unpriv: spill/fill of ctx OK # #1023/p unpriv: spill/fill of ctx 2 OK # #1024/p unpriv: spill/fill of ctx 3 OK # #1025/p unpriv: spill/fill of ctx 4 OK # #1026/p unpriv: spill/fill of different pointers stx OK # #1027/p unpriv: spill/fill of different pointers stx - ctx and sock OK # #1028/p unpriv: spill/fill of different pointers stx - leak sock OK # #1029/p unpriv: spill/fill of different pointers stx - sock and ctx (read) OK # #1030/p unpriv: spill/fill of different pointers stx - sock and ctx (write) OK # #1031/p unpriv: spill/fill of different pointers ldx OK # #1032/u unpriv: write pointer into map elem value OK # #1032/p unpriv: write pointer into map elem value OK # #1033/u alu32: mov u32 const OK # #1033/p alu32: mov u32 const OK # #1034/u unpriv: partial copy of pointer OK # #1034/p unpriv: partial copy of pointer OK # #1035/u unpriv: pass pointer to tail_call OK # #1035/p unpriv: pass pointer to tail_call OK # #1036/u unpriv: cmp map pointer with zero OK # #1036/p unpriv: cmp map pointer with zero OK # #1037/u unpriv: write into frame pointer OK # #1037/p unpriv: write into frame pointer OK # #1038/u unpriv: spill/fill frame pointer OK # #1038/p unpriv: spill/fill frame pointer OK # #1039/u unpriv: cmp of frame pointer OK # #1039/p unpriv: cmp of frame pointer OK # #1040/u unpriv: adding of fp, reg OK # #1040/p unpriv: adding of fp, reg OK # #1041/u unpriv: adding of fp, imm OK # #1041/p unpriv: adding of fp, imm OK # #1042/u unpriv: cmp of stack pointer OK # #1042/p unpriv: cmp of stack pointer OK # #1043/u map element value store of cleared call register OK # #1043/p map element value store of cleared call register OK # #1044/u map element value with unaligned store OK # #1044/p map element value with unaligned store OK # #1045/u map element value with unaligned load OK # #1045/p map element value with unaligned load OK # #1046/u map element value is preserved across register spilling OK # #1046/p map element value is preserved across register spilling OK # #1047/u map element value is preserved across register spilling OK # #1047/p map element value is preserved across register spilling OK # #1048/u map element value or null is marked on register spilling OK # #1048/p map element value or null is marked on register spilling OK # #1049/u map element value illegal alu op, 1 OK # #1049/p map element value illegal alu op, 1 OK # #1050/u map element value illegal alu op, 2 OK # #1050/p map element value illegal alu op, 2 OK # #1051/u map element value illegal alu op, 3 OK # #1051/p map element value illegal alu op, 3 OK # #1052/u map element value illegal alu op, 4 OK # #1052/p map element value illegal alu op, 4 OK # #1053/u map element value illegal alu op, 5 OK # #1053/p map element value illegal alu op, 5 OK # #1054/p multiple registers share map_lookup_elem result OK # #1055/p alu ops on ptr_to_map_value_or_null, 1 OK # #1056/p alu ops on ptr_to_map_value_or_null, 2 OK # #1057/p alu ops on ptr_to_map_value_or_null, 3 OK # #1058/p invalid memory access with multiple map_lookup_elem calls OK # #1059/p valid indirect map_lookup_elem access with 2nd lookup in branch OK # #1060/u invalid map access from else condition OK # #1060/p invalid map access from else condition OK # #1061/p map lookup and null branch prediction OK # #1062/u map access: known scalar += value_ptr unknown vs const OK # #1062/p map access: known scalar += value_ptr unknown vs const OK # #1063/u map access: known scalar += value_ptr const vs unknown OK # #1063/p map access: known scalar += value_ptr const vs unknown OK # #1064/u map access: known scalar += value_ptr const vs const (ne) OK # #1064/p map access: known scalar += value_ptr const vs const (ne) OK # #1065/u map access: known scalar += value_ptr const vs const (eq) OK # #1065/p map access: known scalar += value_ptr const vs const (eq) OK # #1066/u map access: known scalar += value_ptr unknown vs unknown (eq) OK # #1066/p map access: known scalar += value_ptr unknown vs unknown (eq) OK # #1067/u map access: known scalar += value_ptr unknown vs unknown (lt) OK # #1067/p map access: known scalar += value_ptr unknown vs unknown (lt) OK # #1068/u map access: known scalar += value_ptr unknown vs unknown (gt) OK # #1068/p map access: known scalar += value_ptr unknown vs unknown (gt) OK # #1069/u map access: known scalar += value_ptr from different maps OK # #1069/p map access: known scalar += value_ptr from different maps OK # #1070/u map access: value_ptr -= known scalar from different maps OK # #1070/p map access: value_ptr -= known scalar from different maps OK # #1071/u map access: known scalar += value_ptr from different maps, but same value properties OK # #1071/p map access: known scalar += value_ptr from different maps, but same value properties OK # #1072/u map access: mixing value pointer and scalar, 1 OK # #1072/p map access: mixing value pointer and scalar, 1 OK # #1073/u map access: mixing value pointer and scalar, 2 OK # #1073/p map access: mixing value pointer and scalar, 2 OK # #1074/u sanitation: alu with different scalars 1 OK # #1074/p sanitation: alu with different scalars 1 OK # #1075/u sanitation: alu with different scalars 2 OK # #1075/p sanitation: alu with different scalars 2 OK # #1076/u sanitation: alu with different scalars 3 OK # #1076/p sanitation: alu with different scalars 3 OK # #1077/u map access: value_ptr += known scalar, upper oob arith, test 1 OK # #1077/p map access: value_ptr += known scalar, upper oob arith, test 1 OK # #1078/u map access: value_ptr += known scalar, upper oob arith, test 2 OK # #1078/p map access: value_ptr += known scalar, upper oob arith, test 2 OK # #1079/u map access: value_ptr += known scalar, upper oob arith, test 3 OK # #1079/p map access: value_ptr += known scalar, upper oob arith, test 3 OK # #1080/u map access: value_ptr -= known scalar, lower oob arith, test 1 OK # #1080/p map access: value_ptr -= known scalar, lower oob arith, test 1 OK # #1081/u map access: value_ptr -= known scalar, lower oob arith, test 2 OK # #1081/p map access: value_ptr -= known scalar, lower oob arith, test 2 OK # #1082/u map access: value_ptr -= known scalar, lower oob arith, test 3 OK # #1082/p map access: value_ptr -= known scalar, lower oob arith, test 3 OK # #1083/u map access: known scalar += value_ptr OK # #1083/p map access: known scalar += value_ptr OK # #1084/u map access: value_ptr += known scalar, 1 OK # #1084/p map access: value_ptr += known scalar, 1 OK # #1085/u map access: value_ptr += known scalar, 2 OK # #1085/p map access: value_ptr += known scalar, 2 OK # #1086/u map access: value_ptr += known scalar, 3 OK # #1086/p map access: value_ptr += known scalar, 3 OK # #1087/u map access: value_ptr += known scalar, 4 OK # #1087/p map access: value_ptr += known scalar, 4 OK # #1088/u map access: value_ptr += known scalar, 5 OK # #1088/p map access: value_ptr += known scalar, 5 OK # #1089/u map access: value_ptr += known scalar, 6 OK # #1089/p map access: value_ptr += known scalar, 6 OK # #1090/u map access: value_ptr += N, value_ptr -= N known scalar OK # #1090/p map access: value_ptr += N, value_ptr -= N known scalar OK # #1091/u map access: unknown scalar += value_ptr, 1 OK # #1091/p map access: unknown scalar += value_ptr, 1 OK # #1092/u map access: unknown scalar += value_ptr, 2 OK # #1092/p map access: unknown scalar += value_ptr, 2 OK # #1093/u map access: unknown scalar += value_ptr, 3 OK # #1093/p map access: unknown scalar += value_ptr, 3 OK # #1094/u map access: unknown scalar += value_ptr, 4 OK # #1094/p map access: unknown scalar += value_ptr, 4 OK # #1095/u map access: value_ptr += unknown scalar, 1 OK # #1095/p map access: value_ptr += unknown scalar, 1 OK # #1096/u map access: value_ptr += unknown scalar, 2 OK # #1096/p map access: value_ptr += unknown scalar, 2 OK # #1097/u map access: value_ptr += unknown scalar, 3 OK # #1097/p map access: value_ptr += unknown scalar, 3 OK # #1098/u map access: value_ptr += value_ptr OK # #1098/p map access: value_ptr += value_ptr OK # #1099/u map access: known scalar -= value_ptr OK # #1099/p map access: known scalar -= value_ptr OK # #1100/u map access: value_ptr -= known scalar OK # #1100/p map access: value_ptr -= known scalar OK # #1101/u map access: value_ptr -= known scalar, 2 OK # #1101/p map access: value_ptr -= known scalar, 2 OK # #1102/u map access: unknown scalar -= value_ptr OK # #1102/p map access: unknown scalar -= value_ptr OK # #1103/u map access: value_ptr -= unknown scalar OK # #1103/p map access: value_ptr -= unknown scalar OK # #1104/u map access: value_ptr -= unknown scalar, 2 OK # #1104/p map access: value_ptr -= unknown scalar, 2 OK # #1105/u map access: value_ptr -= value_ptr OK # #1105/p map access: value_ptr -= value_ptr OK # #1106/p 32bit pkt_ptr -= scalar OK # #1107/p 32bit scalar -= pkt_ptr OK # #1108/p variable-offset ctx access OK # #1109/u variable-offset stack read, priv vs unpriv OK # #1109/p variable-offset stack read, priv vs unpriv OK # #1110/p variable-offset stack read, uninitialized OK # #1111/u variable-offset stack write, priv vs unpriv OK # #1111/p variable-offset stack write, priv vs unpriv OK # #1112/u variable-offset stack write clobbers spilled regs OK # #1112/p variable-offset stack write clobbers spilled regs OK # #1113/p indirect variable-offset stack access, unbounded OK # #1114/p indirect variable-offset stack access, max out of bound OK # #1115/p indirect variable-offset stack access, min out of bound OK # #1116/p indirect variable-offset stack access, max_off+size > max_initialized OK # #1117/p indirect variable-offset stack access, min_off < min_initialized OK # #1118/u indirect variable-offset stack access, priv vs unpriv OK # #1118/p indirect variable-offset stack access, priv vs unpriv OK # #1119/p indirect variable-offset stack access, uninitialized OK # #1120/p indirect variable-offset stack access, ok OK # #1121/p wide store to bpf_sock_addr.user_ip6[0] Did not run the program (not supported) OK # #1122/p wide store to bpf_sock_addr.user_ip6[1] OK # #1123/p wide store to bpf_sock_addr.user_ip6[2] Did not run the program (not supported) OK # #1124/p wide store to bpf_sock_addr.user_ip6[3] OK # #1125/p wide store to bpf_sock_addr.msg_src_ip6[0] OK # #1126/p wide store to bpf_sock_addr.msg_src_ip6[1] Did not run the program (not supported) OK # #1127/p wide store to bpf_sock_addr.msg_src_ip6[2] OK # #1128/p wide store to bpf_sock_addr.msg_src_ip6[3] OK # #1129/p wide load from bpf_sock_addr.user_ip6[0] Did not run the program (not supported) OK # #1130/p wide load from bpf_sock_addr.user_ip6[1] OK # #1131/p wide load from bpf_sock_addr.user_ip6[2] Did not run the program (not supported) OK # #1132/p wide load from bpf_sock_addr.user_ip6[3] OK # #1133/p wide load from bpf_sock_addr.msg_src_ip6[0] OK # #1134/p wide load from bpf_sock_addr.msg_src_ip6[1] Did not run the program (not supported) OK # #1135/p wide load from bpf_sock_addr.msg_src_ip6[2] OK # #1136/p wide load from bpf_sock_addr.msg_src_ip6[3] OK # #1137/p xadd/w check unaligned stack OK # #1138/p xadd/w check unaligned map OK # #1139/p xadd/w check unaligned pkt OK # #1140/p xadd/w check whether src/dst got mangled, 1 OK # #1141/p xadd/w check whether src/dst got mangled, 2 OK # #1142/p XDP, using ifindex from netdev OK # #1143/p XDP pkt read, pkt_end mangling, bad access 1 OK # #1144/p XDP pkt read, pkt_end mangling, bad access 2 OK # #1145/p XDP pkt read, pkt_data' > pkt_end, good access OK # #1146/p XDP pkt read, pkt_data' > pkt_end, bad access 1 OK # #1147/p XDP pkt read, pkt_data' > pkt_end, bad access 2 OK # #1148/p XDP pkt read, pkt_end > pkt_data', good access OK # #1149/p XDP pkt read, pkt_end > pkt_data', bad access 1 OK # #1150/p XDP pkt read, pkt_end > pkt_data', bad access 2 OK # #1151/p XDP pkt read, pkt_data' < pkt_end, good access OK # #1152/p XDP pkt read, pkt_data' < pkt_end, bad access 1 OK # #1153/p XDP pkt read, pkt_data' < pkt_end, bad access 2 OK # #1154/p XDP pkt read, pkt_end < pkt_data', good access OK # #1155/p XDP pkt read, pkt_end < pkt_data', bad access 1 OK # #1156/p XDP pkt read, pkt_end < pkt_data', bad access 2 OK # #1157/p XDP pkt read, pkt_data' >= pkt_end, good access OK # #1158/p XDP pkt read, pkt_data' >= pkt_end, bad access 1 OK # #1159/p XDP pkt read, pkt_data' >= pkt_end, bad access 2 OK # #1160/p XDP pkt read, pkt_end >= pkt_data', good access OK # #1161/p XDP pkt read, pkt_end >= pkt_data', bad access 1 OK # #1162/p XDP pkt read, pkt_end >= pkt_data', bad access 2 OK # #1163/p XDP pkt read, pkt_data' <= pkt_end, good access OK # #1164/p XDP pkt read, pkt_data' <= pkt_end, bad access 1 OK # #1165/p XDP pkt read, pkt_data' <= pkt_end, bad access 2 OK # #1166/p XDP pkt read, pkt_end <= pkt_data', good access OK # #1167/p XDP pkt read, pkt_end <= pkt_data', bad access 1 OK # #1168/p XDP pkt read, pkt_end <= pkt_data', bad access 2 OK # #1169/p XDP pkt read, pkt_meta' > pkt_data, good access OK # #1170/p XDP pkt read, pkt_meta' > pkt_data, bad access 1 OK # #1171/p XDP pkt read, pkt_meta' > pkt_data, bad access 2 OK # #1172/p XDP pkt read, pkt_data > pkt_meta', good access OK # #1173/p XDP pkt read, pkt_data > pkt_meta', bad access 1 OK # #1174/p XDP pkt read, pkt_data > pkt_meta', bad access 2 OK # #1175/p XDP pkt read, pkt_meta' < pkt_data, good access OK # #1176/p XDP pkt read, pkt_meta' < pkt_data, bad access 1 OK # #1177/p XDP pkt read, pkt_meta' < pkt_data, bad access 2 OK # #1178/p XDP pkt read, pkt_data < pkt_meta', good access OK # #1179/p XDP pkt read, pkt_data < pkt_meta', bad access 1 OK # #1180/p XDP pkt read, pkt_data < pkt_meta', bad access 2 OK # #1181/p XDP pkt read, pkt_meta' >= pkt_data, good access OK # #1182/p XDP pkt read, pkt_meta' >= pkt_data, bad access 1 OK # #1183/p XDP pkt read, pkt_meta' >= pkt_data, bad access 2 OK # #1184/p XDP pkt read, pkt_data >= pkt_meta', good access OK # #1185/p XDP pkt read, pkt_data >= pkt_meta', bad access 1 OK # #1186/p XDP pkt read, pkt_data >= pkt_meta', bad access 2 OK # #1187/p XDP pkt read, pkt_meta' <= pkt_data, good access OK # #1188/p XDP pkt read, pkt_meta' <= pkt_data, bad access 1 OK # #1189/p XDP pkt read, pkt_meta' <= pkt_data, bad access 2 OK # #1190/p XDP pkt read, pkt_data <= pkt_meta', good access OK # #1191/p XDP pkt read, pkt_data <= pkt_meta', bad access 1 OK # #1192/p XDP pkt read, pkt_data <= pkt_meta', bad access 2 OK # Summary: 1748 PASSED, 0 SKIPPED, 16 FAILED not ok 1 selftests: bpf: test_verifier # exit=1 To reproduce: git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp install job.yaml # job file is attached in this email bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run bin/lkp run generated-yaml-file --- 0DAY/LKP+ Test Infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation Thanks, Oliver Sang