FYI, we noticed the following commit (built with gcc-7): commit: 6c409a3aee945e50c6dd4109689f523dc0dc6fed ("[PATCH bpf-next] bpf: relax tracking of variable offset in packet pointers") url: https://github.com/0day-ci/linux/commits/Alexei-Starovoitov/bpf-relax-tracking-of-variable-offset-in-packet-pointers/20190620-002512 base: https://git.kernel.org/cgit/linux/kernel/git/bpf/bpf-next.git master in testcase: kernel_selftests with following parameters: group: kselftests-00 test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel. test-url: https://www.kernel.org/doc/Documentation/kselftest.txt on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 4G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): If you fix the issue, kindly add following tag Reported-by: kernel test robot # selftests: bpf: test_verifier # #0/u invalid and of negative number OK # #0/p invalid and of negative number OK # #1/u invalid range check OK # #1/p invalid range check OK # #2/u valid map access into an array with a constant OK # #2/p valid map access into an array with a constant OK # #3/u valid map access into an array with a register OK # #3/p valid map access into an array with a register OK # #4/u valid map access into an array with a variable OK # #4/p valid map access into an array with a variable OK # #5/u valid map access into an array with a signed variable OK # #5/p valid map access into an array with a signed variable OK # #6/u invalid map access into an array with a constant OK # #6/p invalid map access into an array with a constant OK # #7/u invalid map access into an array with a register OK # #7/p invalid map access into an array with a register OK # #8/u invalid map access into an array with a variable OK # #8/p invalid map access into an array with a variable OK # #9/u invalid map access into an array with no floor check OK # #9/p invalid map access into an array with no floor check OK # #10/u invalid map access into an array with a invalid max check OK # #10/p invalid map access into an array with a invalid max check OK # #11/u invalid map access into an array with a invalid max check OK # #11/p invalid map access into an array with a invalid max check OK # #12/u valid read map access into a read-only array 1 OK # #12/p valid read map access into a read-only array 1 OK # #13/p valid read map access into a read-only array 2 OK # #14/u invalid write map access into a read-only array 1 OK # #14/p invalid write map access into a read-only array 1 OK # #15/p invalid write map access into a read-only array 2 OK # #16/u valid write map access into a write-only array 1 OK # #16/p valid write map access into a write-only array 1 OK # #17/p valid write map access into a write-only array 2 OK # #18/u invalid read map access into a write-only array 1 OK # #18/p invalid read map access into a write-only array 1 OK # #19/p invalid read map access into a write-only array 2 OK # #20/u empty prog OK # #20/p empty prog OK # #21/u only exit insn OK # #21/p only exit insn OK # #22/u no bpf_exit OK # #22/p no bpf_exit OK # #23/u invalid call insn1 OK # #23/p invalid call insn1 OK # #24/u invalid call insn2 OK # #24/p invalid call insn2 OK # #25/u invalid function call OK # #25/p invalid function call OK # #26/p invalid argument register OK # #27/p non-invalid argument register OK # #28/u add+sub+mul OK # #28/p add+sub+mul OK # #29/p xor32 zero extend check OK # #30/u arsh32 on imm OK # #30/p arsh32 on imm OK # #31/u arsh32 on imm 2 OK # #31/p arsh32 on imm 2 OK # #32/u arsh32 on reg OK # #32/p arsh32 on reg OK # #33/u arsh32 on reg 2 OK # #33/p arsh32 on reg 2 OK # #34/u arsh64 on imm OK # #34/p arsh64 on imm OK # #35/u arsh64 on reg OK # #35/p arsh64 on reg OK # #36/u invalid 64-bit BPF_END OK # #36/p invalid 64-bit BPF_END OK # #37/p mov64 src == dst OK # #38/p mov64 src != dst OK # #39/u stack out of bounds OK # #39/p stack out of bounds OK # #40/u uninitialized stack1 OK # #40/p uninitialized stack1 OK # #41/u uninitialized stack2 OK # #41/p uninitialized stack2 OK # #42/u invalid fp arithmetic OK # #42/p invalid fp arithmetic OK # #43/u non-invalid fp arithmetic OK # #43/p non-invalid fp arithmetic OK # #44/u misaligned read from stack OK # #44/p misaligned read from stack OK # #45/u invalid src register in STX OK # #45/p invalid src register in STX OK # #46/u invalid dst register in STX OK # #46/p invalid dst register in STX OK # #47/u invalid dst register in ST OK # #47/p invalid dst register in ST OK # #48/u invalid src register in LDX OK # #48/p invalid src register in LDX OK # #49/u invalid dst register in LDX OK # #49/p invalid dst register in LDX OK # #50/u subtraction bounds (map value) variant 1 OK # #50/p subtraction bounds (map value) variant 1 OK # #51/u subtraction bounds (map value) variant 2 OK # #51/p subtraction bounds (map value) variant 2 OK # #52/u check subtraction on pointers for unpriv OK # #52/p check subtraction on pointers for unpriv OK # #53/u bounds check based on zero-extended MOV OK # #53/p bounds check based on zero-extended MOV OK # #54/u bounds check based on sign-extended MOV. test1 OK # #54/p bounds check based on sign-extended MOV. test1 OK # #55/u bounds check based on sign-extended MOV. test2 OK # #55/p bounds check based on sign-extended MOV. test2 OK # #56/p bounds check based on reg_off + var_off + insn_off. test1 OK # #57/p bounds check based on reg_off + var_off + insn_off. test2 OK # #58/u bounds check after truncation of non-boundary-crossing range OK # #58/p bounds check after truncation of non-boundary-crossing range OK # #59/u bounds check after truncation of boundary-crossing range (1) OK # #59/p bounds check after truncation of boundary-crossing range (1) OK # #60/u bounds check after truncation of boundary-crossing range (2) OK # #60/p bounds check after truncation of boundary-crossing range (2) OK # #61/u bounds check after wrapping 32-bit addition OK # #61/p bounds check after wrapping 32-bit addition OK # #62/u bounds check after shift with oversized count operand OK # #62/p bounds check after shift with oversized count operand OK # #63/u bounds check after right shift of maybe-negative number OK # #63/p bounds check after right shift of maybe-negative number OK # #64/u bounds check after 32-bit right shift with 64-bit input OK # #64/p bounds check after 32-bit right shift with 64-bit input OK # #65/u bounds check map access with off+size signed 32bit overflow. test1 OK # #65/p bounds check map access with off+size signed 32bit overflow. test1 OK # #66/u bounds check map access with off+size signed 32bit overflow. test2 OK # #66/p bounds check map access with off+size signed 32bit overflow. test2 OK # #67/u bounds check map access with off+size signed 32bit overflow. test3 OK # #67/p bounds check map access with off+size signed 32bit overflow. test3 OK # #68/u bounds check map access with off+size signed 32bit overflow. test4 OK # #68/p bounds check map access with off+size signed 32bit overflow. test4 OK # #69/u check deducing bounds from const, 1 OK # #69/p check deducing bounds from const, 1 OK # #70/u check deducing bounds from const, 2 OK # #70/p check deducing bounds from const, 2 OK # #71/u check deducing bounds from const, 3 OK # #71/p check deducing bounds from const, 3 OK # #72/u check deducing bounds from const, 4 OK # #72/p check deducing bounds from const, 4 OK # #73/u check deducing bounds from const, 5 OK # #73/p check deducing bounds from const, 5 OK # #74/u check deducing bounds from const, 6 OK # #74/p check deducing bounds from const, 6 OK # #75/u check deducing bounds from const, 7 OK # #75/p check deducing bounds from const, 7 OK # #76/u check deducing bounds from const, 8 OK # #76/p check deducing bounds from const, 8 OK # #77/u check deducing bounds from const, 9 OK # #77/p check deducing bounds from const, 9 OK # #78/u check deducing bounds from const, 10 OK # #78/p check deducing bounds from const, 10 OK # #79/u bounds checks mixing signed and unsigned, positive bounds OK # #79/p bounds checks mixing signed and unsigned, positive bounds OK # #80/u bounds checks mixing signed and unsigned OK # #80/p bounds checks mixing signed and unsigned OK # #81/u bounds checks mixing signed and unsigned, variant 2 OK # #81/p bounds checks mixing signed and unsigned, variant 2 OK # #82/u bounds checks mixing signed and unsigned, variant 3 OK # #82/p bounds checks mixing signed and unsigned, variant 3 OK # #83/u bounds checks mixing signed and unsigned, variant 4 OK # #83/p bounds checks mixing signed and unsigned, variant 4 OK # #84/u bounds checks mixing signed and unsigned, variant 5 OK # #84/p bounds checks mixing signed and unsigned, variant 5 OK # #85/u bounds checks mixing signed and unsigned, variant 6 OK # #85/p bounds checks mixing signed and unsigned, variant 6 OK # #86/u bounds checks mixing signed and unsigned, variant 7 OK # #86/p bounds checks mixing signed and unsigned, variant 7 OK # #87/u bounds checks mixing signed and unsigned, variant 8 OK # #87/p bounds checks mixing signed and unsigned, variant 8 OK # #88/u bounds checks mixing signed and unsigned, variant 9 OK # #88/p bounds checks mixing signed and unsigned, variant 9 OK # #89/u bounds checks mixing signed and unsigned, variant 10 OK # #89/p bounds checks mixing signed and unsigned, variant 10 OK # #90/u bounds checks mixing signed and unsigned, variant 11 OK # #90/p bounds checks mixing signed and unsigned, variant 11 OK # #91/u bounds checks mixing signed and unsigned, variant 12 OK # #91/p bounds checks mixing signed and unsigned, variant 12 OK # #92/u bounds checks mixing signed and unsigned, variant 13 OK # #92/p bounds checks mixing signed and unsigned, variant 13 OK # #93/u bounds checks mixing signed and unsigned, variant 14 OK # #93/p bounds checks mixing signed and unsigned, variant 14 OK # #94/u bounds checks mixing signed and unsigned, variant 15 OK # #94/p bounds checks mixing signed and unsigned, variant 15 OK # #95/p bpf_get_stack return R0 within range OK # #96/p calls: basic sanity OK # #97/u calls: not on unpriviledged OK # #97/p calls: not on unpriviledged OK # #98/p calls: div by 0 in subprog OK # #99/p calls: multiple ret types in subprog 1 OK # #100/p calls: multiple ret types in subprog 2 OK # #101/p calls: overlapping caller/callee OK # #102/p calls: wrong recursive calls OK # #103/p calls: wrong src reg OK # #104/p calls: wrong off value OK # #105/p calls: jump back loop OK # #106/p calls: conditional call OK # #107/p calls: conditional call 2 OK # #108/u calls: conditional call 3 OK # #108/p calls: conditional call 3 OK # #109/p calls: conditional call 4 OK # #110/p calls: conditional call 5 OK # #111/p calls: conditional call 6 OK # #112/p calls: using r0 returned by callee OK # #113/p calls: using uninit r0 from callee OK # #114/p calls: callee is using r1 OK # #115/u calls: callee using args1 OK # #115/p calls: callee using args1 OK # #116/p calls: callee using wrong args2 OK # #117/u calls: callee using two args OK # #117/p calls: callee using two args OK # #118/p calls: callee changing pkt pointers OK # #119/u calls: ptr null check in subprog OK # #119/p calls: ptr null check in subprog OK # #120/p calls: two calls with args OK # #121/p calls: calls with stack arith OK # #122/p calls: calls with misaligned stack access OK # #123/p calls: calls control flow, jump test OK # #124/p calls: calls control flow, jump test 2 OK # #125/p calls: two calls with bad jump OK # #126/p calls: recursive call. test1 OK # #127/p calls: recursive call. test2 OK # #128/p calls: unreachable code OK # #129/p calls: invalid call OK # #130/p calls: invalid call 2 OK # #131/p calls: jumping across function bodies. test1 OK # #132/p calls: jumping across function bodies. test2 OK # #133/p calls: call without exit OK # #134/p calls: call into middle of ld_imm64 OK # #135/p calls: call into middle of other call OK # #136/p calls: ld_abs with changing ctx data in callee OK # #137/p calls: two calls with bad fallthrough OK # #138/p calls: two calls with stack read OK # #139/p calls: two calls with stack write OK # #140/p calls: stack overflow using two frames (pre-call access) OK # #141/p calls: stack overflow using two frames (post-call access) OK # #142/p calls: stack depth check using three frames. test1 OK # #143/p calls: stack depth check using three frames. test2 OK # #144/p calls: stack depth check using three frames. test3 OK # #145/p calls: stack depth check using three frames. test4 OK # #146/p calls: stack depth check using three frames. test5 OK # #147/p calls: stack depth check in dead code OK # #148/p calls: spill into caller stack frame OK # #149/p calls: write into caller stack frame OK # #150/p calls: write into callee stack frame OK # #151/p calls: two calls with stack write and void return OK # #152/u calls: ambiguous return value OK # #152/p calls: ambiguous return value OK # #153/p calls: two calls that return map_value OK # #154/p calls: two calls that return map_value with bool condition OK # #155/p calls: two calls that return map_value with incorrect bool check OK # #156/p calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1 OK # #157/p calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2 OK # #158/p calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3 OK # #159/p calls: two calls that receive map_value_ptr_or_null via arg. test1 OK # #160/p calls: two calls that receive map_value_ptr_or_null via arg. test2 OK # #161/p calls: pkt_ptr spill into caller stack OK # #162/p calls: pkt_ptr spill into caller stack 2 OK # #163/p calls: pkt_ptr spill into caller stack 3 OK # #164/p calls: pkt_ptr spill into caller stack 4 OK # #165/p calls: pkt_ptr spill into caller stack 5 OK # #166/p calls: pkt_ptr spill into caller stack 6 OK # #167/p calls: pkt_ptr spill into caller stack 7 OK # #168/p calls: pkt_ptr spill into caller stack 8 OK # #169/p calls: pkt_ptr spill into caller stack 9 OK # #170/p calls: caller stack init to zero or map_value_or_null OK # #171/p calls: stack init to zero and pruning OK # #172/u calls: ctx read at start of subprog OK # #172/p calls: ctx read at start of subprog OK # #173/u calls: cross frame pruning OK # #173/p calls: cross frame pruning OK # #174/u calls: cross frame pruning - liveness propagation OK # #174/p calls: cross frame pruning - liveness propagation OK # #175/u unreachable OK # #175/p unreachable OK # #176/u unreachable2 OK # #176/p unreachable2 OK # #177/u out of range jump OK # #177/p out of range jump OK # #178/u out of range jump2 OK # #178/p out of range jump2 OK # #179/u loop (back-edge) OK # #179/p loop (back-edge) OK # #180/u loop2 (back-edge) OK # #180/p loop2 (back-edge) OK # #181/u conditional loop OK # #181/p conditional loop OK # #182/p bpf_exit with invalid return code. test1 OK # #183/p bpf_exit with invalid return code. test2 OK # #184/p bpf_exit with invalid return code. test3 OK # #185/p bpf_exit with invalid return code. test4 OK # #186/p bpf_exit with invalid return code. test5 OK # #187/p bpf_exit with invalid return code. test6 OK # #188/p bpf_exit with invalid return code. test7 OK # #189/u direct packet read test#1 for CGROUP_SKB OK # #189/p direct packet read test#1 for CGROUP_SKB OK # #190/u direct packet read test#2 for CGROUP_SKB OK # #190/p direct packet read test#2 for CGROUP_SKB OK # #191/u direct packet read test#3 for CGROUP_SKB OK # #191/p direct packet read test#3 for CGROUP_SKB OK # #192/u direct packet read test#4 for CGROUP_SKB OK # #192/p direct packet read test#4 for CGROUP_SKB OK # #193/u invalid access of tc_classid for CGROUP_SKB OK # #193/p invalid access of tc_classid for CGROUP_SKB OK # #194/u invalid access of data_meta for CGROUP_SKB OK # #194/p invalid access of data_meta for CGROUP_SKB OK # #195/u invalid access of flow_keys for CGROUP_SKB OK # #195/p invalid access of flow_keys for CGROUP_SKB OK # #196/u invalid write access to napi_id for CGROUP_SKB OK # #196/p invalid write access to napi_id for CGROUP_SKB OK # #197/u write tstamp from CGROUP_SKB OK # #197/p write tstamp from CGROUP_SKB OK # #198/u read tstamp from CGROUP_SKB OK # #198/p read tstamp from CGROUP_SKB OK # #199/u valid cgroup storage access OK # #199/p valid cgroup storage access OK # #200/u invalid cgroup storage access 1 OK # #200/p invalid cgroup storage access 1 OK # #201/u invalid cgroup storage access 2 OK # #201/p invalid cgroup storage access 2 OK # #202/u invalid cgroup storage access 3 OK # #202/p invalid cgroup storage access 3 OK # #203/u invalid cgroup storage access 4 OK # #203/p invalid cgroup storage access 4 OK # #204/u invalid cgroup storage access 5 OK # #204/p invalid cgroup storage access 5 OK # #205/u invalid cgroup storage access 6 OK # #205/p invalid cgroup storage access 6 OK # #206/u valid per-cpu cgroup storage access OK # #206/p valid per-cpu cgroup storage access OK # #207/u invalid per-cpu cgroup storage access 1 OK # #207/p invalid per-cpu cgroup storage access 1 OK # #208/u invalid per-cpu cgroup storage access 2 OK # #208/p invalid per-cpu cgroup storage access 2 OK # #209/u invalid per-cpu cgroup storage access 3 OK # #209/p invalid per-cpu cgroup storage access 3 OK # #210/u invalid per-cpu cgroup storage access 4 OK # #210/p invalid per-cpu cgroup storage access 4 OK # #211/u invalid per-cpu cgroup storage access 5 OK # #211/p invalid per-cpu cgroup storage access 5 OK # #212/u invalid per-cpu cgroup storage access 6 OK # #212/p invalid per-cpu cgroup storage access 6 OK # #213/p constant register |= constant should keep constant type OK # #214/p constant register |= constant should not bypass stack boundary checks OK # #215/p constant register |= constant register should keep constant type OK # #216/p constant register |= constant register should not bypass stack boundary checks OK # #217/p context stores via ST OK # #218/p context stores via XADD OK # #219/p arithmetic ops make PTR_TO_CTX unusable OK # #220/p pass unmodified ctx pointer to helper OK # #221/p pass modified ctx pointer to helper, 1 OK # #222/u pass modified ctx pointer to helper, 2 OK # #222/p pass modified ctx pointer to helper, 2 OK # #223/p pass modified ctx pointer to helper, 3 OK # #224/p valid access family in SK_MSG OK # #225/p valid access remote_ip4 in SK_MSG OK # #226/p valid access local_ip4 in SK_MSG OK # #227/p valid access remote_port in SK_MSG OK # #228/p valid access local_port in SK_MSG OK # #229/p valid access remote_ip6 in SK_MSG OK # #230/p valid access local_ip6 in SK_MSG OK # #231/p valid access size in SK_MSG OK # #232/p invalid 64B read of size in SK_MSG OK # #233/p invalid read past end of SK_MSG OK # #234/p invalid read offset in SK_MSG OK # #235/p direct packet read for SK_MSG OK # #236/p direct packet write for SK_MSG OK # #237/p overlapping checks for direct packet access SK_MSG OK # #238/u access skb fields ok OK # #238/p access skb fields ok OK # #239/u access skb fields bad1 OK # #239/p access skb fields bad1 OK # #240/u access skb fields bad2 OK # #240/p access skb fields bad2 OK # #241/u access skb fields bad3 OK # #241/p access skb fields bad3 OK # #242/u access skb fields bad4 OK # #242/p access skb fields bad4 OK # #243/u invalid access __sk_buff family OK # #243/p invalid access __sk_buff family OK # #244/u invalid access __sk_buff remote_ip4 OK # #244/p invalid access __sk_buff remote_ip4 OK # #245/u invalid access __sk_buff local_ip4 OK # #245/p invalid access __sk_buff local_ip4 OK # #246/u invalid access __sk_buff remote_ip6 OK # #246/p invalid access __sk_buff remote_ip6 OK # #247/u invalid access __sk_buff local_ip6 OK # #247/p invalid access __sk_buff local_ip6 OK # #248/u invalid access __sk_buff remote_port OK # #248/p invalid access __sk_buff remote_port OK # #249/u invalid access __sk_buff remote_port OK # #249/p invalid access __sk_buff remote_port OK # #250/p valid access __sk_buff family OK # #251/p valid access __sk_buff remote_ip4 OK # #252/p valid access __sk_buff local_ip4 OK # #253/p valid access __sk_buff remote_ip6 OK # #254/p valid access __sk_buff local_ip6 OK # #255/p valid access __sk_buff remote_port OK # #256/p valid access __sk_buff remote_port OK # #257/p invalid access of tc_classid for SK_SKB OK # #258/p invalid access of skb->mark for SK_SKB OK # #259/p check skb->mark is not writeable by SK_SKB OK # #260/p check skb->tc_index is writeable by SK_SKB OK # #261/p check skb->priority is writeable by SK_SKB OK # #262/p direct packet read for SK_SKB OK # #263/p direct packet write for SK_SKB OK # #264/p overlapping checks for direct packet access SK_SKB OK # #265/u check skb->mark is not writeable by sockets OK # #265/p check skb->mark is not writeable by sockets OK # #266/u check skb->tc_index is not writeable by sockets OK # #266/p check skb->tc_index is not writeable by sockets OK # #267/u check cb access: byte OK # #267/p check cb access: byte OK # #268/u __sk_buff->hash, offset 0, byte store not permitted OK # #268/p __sk_buff->hash, offset 0, byte store not permitted OK # #269/u __sk_buff->tc_index, offset 3, byte store not permitted OK # #269/p __sk_buff->tc_index, offset 3, byte store not permitted OK # #270/u check skb->hash byte load permitted OK # #270/p check skb->hash byte load permitted OK # #271/u check skb->hash byte load permitted 1 OK # #271/p check skb->hash byte load permitted 1 OK # #272/u check skb->hash byte load permitted 2 OK # #272/p check skb->hash byte load permitted 2 OK # #273/u check skb->hash byte load permitted 3 OK # #273/p check skb->hash byte load permitted 3 OK # #274/p check cb access: byte, wrong type OK # #275/u check cb access: half OK # #275/p check cb access: half OK # #276/u check cb access: half, unaligned OK # #276/p check cb access: half, unaligned OK # #277/u check __sk_buff->hash, offset 0, half store not permitted OK # #277/p check __sk_buff->hash, offset 0, half store not permitted OK # #278/u check __sk_buff->tc_index, offset 2, half store not permitted OK # #278/p check __sk_buff->tc_index, offset 2, half store not permitted OK # #279/u check skb->hash half load permitted OK # #279/p check skb->hash half load permitted OK # #280/u check skb->hash half load permitted 2 OK # #280/p check skb->hash half load permitted 2 OK # #281/u check skb->hash half load not permitted, unaligned 1 OK # #281/p check skb->hash half load not permitted, unaligned 1 OK # #282/u check skb->hash half load not permitted, unaligned 3 OK # #282/p check skb->hash half load not permitted, unaligned 3 OK # #283/p check cb access: half, wrong type OK # #284/u check cb access: word OK # #284/p check cb access: word OK # #285/u check cb access: word, unaligned 1 OK # #285/p check cb access: word, unaligned 1 OK # #286/u check cb access: word, unaligned 2 OK # #286/p check cb access: word, unaligned 2 OK # #287/u check cb access: word, unaligned 3 OK # #287/p check cb access: word, unaligned 3 OK # #288/u check cb access: word, unaligned 4 OK # #288/p check cb access: word, unaligned 4 OK # #289/u check cb access: double OK # #289/p check cb access: double OK # #290/u check cb access: double, unaligned 1 OK # #290/p check cb access: double, unaligned 1 OK # #291/u check cb access: double, unaligned 2 OK # #291/p check cb access: double, unaligned 2 OK # #292/u check cb access: double, oob 1 OK # #292/p check cb access: double, oob 1 OK # #293/u check cb access: double, oob 2 OK # #293/p check cb access: double, oob 2 OK # #294/u check __sk_buff->ifindex dw store not permitted OK # #294/p check __sk_buff->ifindex dw store not permitted OK # #295/u check __sk_buff->ifindex dw load not permitted OK # #295/p check __sk_buff->ifindex dw load not permitted OK # #296/p check cb access: double, wrong type OK # #297/p check out of range skb->cb access OK # #298/u write skb fields from socket prog OK # #298/p write skb fields from socket prog OK # #299/p write skb fields from tc_cls_act prog OK # #300/u check skb->data half load not permitted OK # #300/p check skb->data half load not permitted OK # #301/u read gso_segs from CGROUP_SKB OK # #301/p read gso_segs from CGROUP_SKB OK # #302/u write gso_segs from CGROUP_SKB OK # #302/p write gso_segs from CGROUP_SKB OK # #303/p read gso_segs from CLS OK # #304/u check wire_len is not readable by sockets OK # #304/p check wire_len is not readable by sockets OK # #305/p check wire_len is readable by tc classifier OK # #306/p check wire_len is not writable by tc classifier OK # #307/u dead code: start OK # #307/p dead code: start OK # #308/u dead code: mid 1 OK # #308/p dead code: mid 1 OK # #309/u dead code: mid 2 OK # #309/p dead code: mid 2 OK # #310/u dead code: end 1 OK # #310/p dead code: end 1 OK # #311/u dead code: end 2 OK # #311/p dead code: end 2 OK # #312/u dead code: end 3 OK # #312/p dead code: end 3 OK # #313/u dead code: tail of main + func OK # #313/p dead code: tail of main + func OK # #314/u dead code: tail of main + two functions OK # #314/p dead code: tail of main + two functions OK # #315/u dead code: function in the middle and mid of another func OK # #315/p dead code: function in the middle and mid of another func OK # #316/u dead code: middle of main before call OK # #316/p dead code: middle of main before call OK # #317/u dead code: start of a function OK # #317/p dead code: start of a function OK # #318/p pkt_end - pkt_start is allowed OK # #319/p direct packet access: test1 OK # #320/p direct packet access: test2 OK # #321/u direct packet access: test3 OK # #321/p direct packet access: test3 OK # #322/p direct packet access: test4 (write) OK # #323/p direct packet access: test5 (pkt_end >= reg, good access) OK # #324/p direct packet access: test6 (pkt_end >= reg, bad access) OK # #325/p direct packet access: test7 (pkt_end >= reg, both accesses) OK # #326/p direct packet access: test8 (double test, variant 1) OK # #327/p direct packet access: test9 (double test, variant 2) OK # #328/p direct packet access: test10 (write invalid) OK # #329/p direct packet access: test11 (shift, good access) OK # #330/p direct packet access: test12 (and, good access) OK # #331/p direct packet access: test13 (branches, good access) OK # #332/p direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access) OK # #333/p direct packet access: test15 (spill with xadd) OK # #334/p direct packet access: test16 (arith on data_end) OK # #335/p direct packet access: test17 (pruning, alignment) OK # #336/p direct packet access: test18 (imm += pkt_ptr, 1) OK # #337/p direct packet access: test19 (imm += pkt_ptr, 2) OK # #338/p direct packet access: test20 (x += pkt_ptr, 1) OK # #339/p direct packet access: test21 (x += pkt_ptr, 2) OK # #340/p direct packet access: test22 (x += pkt_ptr, 3) OK # #341/p direct packet access: test23 (x += pkt_ptr, 4) FAIL # Unexpected success to load! # verification time 17 usec # stack depth 8 # processed 18 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0 # #342/p direct packet access: test24 (x += pkt_ptr, 5) OK # #343/p direct packet access: test25 (marking on <, good access) OK # #344/p direct packet access: test26 (marking on <, bad access) OK # #345/p direct packet access: test27 (marking on <=, good access) OK # #346/p direct packet access: test28 (marking on <=, bad access) OK # #347/p direct packet access: test29 (reg > pkt_end in subprog) OK # #348/u direct stack access with 32-bit wraparound. test1 OK # #348/p direct stack access with 32-bit wraparound. test1 OK # #349/u direct stack access with 32-bit wraparound. test2 OK # #349/p direct stack access with 32-bit wraparound. test2 OK # #350/u direct stack access with 32-bit wraparound. test3 OK # #350/p direct stack access with 32-bit wraparound. test3 OK # #351/u direct map access, write test 1 OK # #351/p direct map access, write test 1 OK # #352/u direct map access, write test 2 OK # #352/p direct map access, write test 2 OK # #353/u direct map access, write test 3 OK # #353/p direct map access, write test 3 OK # #354/u direct map access, write test 4 OK # #354/p direct map access, write test 4 OK # #355/u direct map access, write test 5 OK # #355/p direct map access, write test 5 OK # #356/u direct map access, write test 6 OK # #356/p direct map access, write test 6 OK # #357/u direct map access, write test 7 OK # #357/p direct map access, write test 7 OK # #358/u direct map access, write test 8 OK # #358/p direct map access, write test 8 OK # #359/u direct map access, write test 9 OK # #359/p direct map access, write test 9 OK # #360/u direct map access, write test 10 OK # #360/p direct map access, write test 10 OK # #361/u direct map access, write test 11 OK # #361/p direct map access, write test 11 OK # #362/u direct map access, write test 12 OK # #362/p direct map access, write test 12 OK # #363/u direct map access, write test 13 OK # #363/p direct map access, write test 13 OK # #364/u direct map access, write test 14 OK # #364/p direct map access, write test 14 OK # #365/u direct map access, write test 15 OK # #365/p direct map access, write test 15 OK # #366/u direct map access, write test 16 OK # #366/p direct map access, write test 16 OK # #367/u direct map access, write test 17 OK # #367/p direct map access, write test 17 OK # #368/u direct map access, write test 18 OK # #368/p direct map access, write test 18 OK # #369/u direct map access, write test 19 OK # #369/p direct map access, write test 19 OK # #370/u direct map access, write test 20 OK # #370/p direct map access, write test 20 OK # #371/u direct map access, invalid insn test 1 OK # #371/p direct map access, invalid insn test 1 OK # #372/u direct map access, invalid insn test 2 OK # #372/p direct map access, invalid insn test 2 OK # #373/u direct map access, invalid insn test 3 OK # #373/p direct map access, invalid insn test 3 OK # #374/u direct map access, invalid insn test 4 OK # #374/p direct map access, invalid insn test 4 OK # #375/u direct map access, invalid insn test 5 OK # #375/p direct map access, invalid insn test 5 OK # #376/u direct map access, invalid insn test 6 OK # #376/p direct map access, invalid insn test 6 OK # #377/u direct map access, invalid insn test 7 OK # #377/p direct map access, invalid insn test 7 OK # #378/u direct map access, invalid insn test 8 OK # #378/p direct map access, invalid insn test 8 OK # #379/u direct map access, invalid insn test 9 OK # #379/p direct map access, invalid insn test 9 OK # #380/u DIV32 by 0, zero check 1 OK # #380/p DIV32 by 0, zero check 1 OK # #381/u DIV32 by 0, zero check 2 OK # #381/p DIV32 by 0, zero check 2 OK # #382/u DIV64 by 0, zero check OK # #382/p DIV64 by 0, zero check OK # #383/u MOD32 by 0, zero check 1 OK # #383/p MOD32 by 0, zero check 1 OK # #384/u MOD32 by 0, zero check 2 OK # #384/p MOD32 by 0, zero check 2 OK # #385/u MOD64 by 0, zero check OK # #385/p MOD64 by 0, zero check OK # #386/p DIV32 by 0, zero check ok, cls OK # #387/p DIV32 by 0, zero check 1, cls OK # #388/p DIV32 by 0, zero check 2, cls OK # #389/p DIV64 by 0, zero check, cls OK # #390/p MOD32 by 0, zero check ok, cls OK # #391/p MOD32 by 0, zero check 1, cls OK # #392/p MOD32 by 0, zero check 2, cls OK # #393/p MOD64 by 0, zero check 1, cls OK # #394/p MOD64 by 0, zero check 2, cls OK # #395/p DIV32 overflow, check 1 OK # #396/p DIV32 overflow, check 2 OK # #397/p DIV64 overflow, check 1 OK # #398/p DIV64 overflow, check 2 OK # #399/p MOD32 overflow, check 1 OK # #400/p MOD32 overflow, check 2 OK # #401/p MOD64 overflow, check 1 OK # #402/p MOD64 overflow, check 2 OK # #403/p helper access to variable memory: stack, bitwise AND + JMP, correct bounds OK # #404/p helper access to variable memory: stack, bitwise AND, zero included OK # #405/p helper access to variable memory: stack, bitwise AND + JMP, wrong max OK # #406/p helper access to variable memory: stack, JMP, correct bounds OK # #407/p helper access to variable memory: stack, JMP (signed), correct bounds OK # #408/p helper access to variable memory: stack, JMP, bounds + offset OK # #409/p helper access to variable memory: stack, JMP, wrong max OK # #410/p helper access to variable memory: stack, JMP, no max check OK # #411/p helper access to variable memory: stack, JMP, no min check OK # #412/p helper access to variable memory: stack, JMP (signed), no min check OK # #413/p helper access to variable memory: map, JMP, correct bounds OK # #414/p helper access to variable memory: map, JMP, wrong max OK # #415/p helper access to variable memory: map adjusted, JMP, correct bounds OK # #416/p helper access to variable memory: map adjusted, JMP, wrong max OK # #417/p helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL) OK # #418/p helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL) OK # #419/p helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #420/p helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #421/p helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #422/p helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #423/p helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL) OK # #424/p helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL) OK # #425/p helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL) OK # #426/p helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL) OK # #427/p helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL) OK # #428/p helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL) OK # #429/p helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL) OK # #430/p helper access to variable memory: 8 bytes leak OK # #431/p helper access to variable memory: 8 bytes no leak (init memory) OK # #432/p helper access to packet: test1, valid packet_ptr range OK # #433/p helper access to packet: test2, unchecked packet_ptr OK # #434/p helper access to packet: test3, variable add OK # #435/p helper access to packet: test4, packet_ptr with bad range OK # #436/p helper access to packet: test5, packet_ptr with too short range OK # #437/p helper access to packet: test6, cls valid packet_ptr range OK # #438/p helper access to packet: test7, cls unchecked packet_ptr OK # #439/p helper access to packet: test8, cls variable add OK # #440/p helper access to packet: test9, cls packet_ptr with bad range OK # #441/p helper access to packet: test10, cls packet_ptr with too short range OK # #442/p helper access to packet: test11, cls unsuitable helper 1 OK # #443/p helper access to packet: test12, cls unsuitable helper 2 OK # #444/p helper access to packet: test13, cls helper ok OK # #445/p helper access to packet: test14, cls helper ok sub OK # #446/p helper access to packet: test15, cls helper fail sub OK # #447/p helper access to packet: test16, cls helper fail range 1 OK # #448/p helper access to packet: test17, cls helper fail range 2 OK # #449/p helper access to packet: test18, cls helper fail range 3 OK # #450/p helper access to packet: test19, cls helper range zero OK # #451/p helper access to packet: test20, pkt end as input OK # #452/p helper access to packet: test21, wrong reg OK # #453/p helper access to map: full range OK # #454/p helper access to map: partial range OK # #455/p helper access to map: empty range OK # #456/p helper access to map: out-of-bound range OK # #457/p helper access to map: negative range OK # #458/p helper access to adjusted map (via const imm): full range OK # #459/p helper access to adjusted map (via const imm): partial range OK # #460/p helper access to adjusted map (via const imm): empty range OK # #461/p helper access to adjusted map (via const imm): out-of-bound range OK # #462/p helper access to adjusted map (via const imm): negative range (> adjustment) OK # #463/p helper access to adjusted map (via const imm): negative range (< adjustment) OK # #464/p helper access to adjusted map (via const reg): full range OK # #465/p helper access to adjusted map (via const reg): partial range OK # #466/p helper access to adjusted map (via const reg): empty range OK # #467/p helper access to adjusted map (via const reg): out-of-bound range OK # #468/p helper access to adjusted map (via const reg): negative range (> adjustment) OK # #469/p helper access to adjusted map (via const reg): negative range (< adjustment) OK # #470/p helper access to adjusted map (via variable): full range OK # #471/p helper access to adjusted map (via variable): partial range OK # #472/p helper access to adjusted map (via variable): empty range OK # #473/p helper access to adjusted map (via variable): no max check OK # #474/p helper access to adjusted map (via variable): wrong max check OK # #475/p helper access to map: bounds check using <, good access OK # #476/p helper access to map: bounds check using <, bad access OK # #477/p helper access to map: bounds check using <=, good access OK # #478/p helper access to map: bounds check using <=, bad access OK # #479/p helper access to map: bounds check using s<, good access OK # #480/p helper access to map: bounds check using s<, good access 2 OK # #481/p helper access to map: bounds check using s<, bad access OK # #482/p helper access to map: bounds check using s<=, good access OK # #483/p helper access to map: bounds check using s<=, good access 2 OK # #484/p helper access to map: bounds check using s<=, bad access OK # #485/p map lookup helper access to map OK # #486/p map update helper access to map OK # #487/p map update helper access to map: wrong size OK # #488/p map helper access to adjusted map (via const imm) OK # #489/p map helper access to adjusted map (via const imm): out-of-bound 1 OK # #490/p map helper access to adjusted map (via const imm): out-of-bound 2 OK # #491/p map helper access to adjusted map (via const reg) OK # #492/p map helper access to adjusted map (via const reg): out-of-bound 1 OK # #493/p map helper access to adjusted map (via const reg): out-of-bound 2 OK # #494/p map helper access to adjusted map (via variable) OK # #495/p map helper access to adjusted map (via variable): no max check OK # #496/p map helper access to adjusted map (via variable): wrong max check OK # #497/p ARG_PTR_TO_LONG uninitialized OK # #498/p ARG_PTR_TO_LONG half-uninitialized OK # #499/p ARG_PTR_TO_LONG misaligned OK # #500/p ARG_PTR_TO_LONG size < sizeof(long) OK # #501/p ARG_PTR_TO_LONG initialized OK # #502/u jit: lsh, rsh, arsh by 1 OK # #502/p jit: lsh, rsh, arsh by 1 OK # #503/u jit: mov32 for ldimm64, 1 OK # #503/p jit: mov32 for ldimm64, 1 OK # #504/u jit: mov32 for ldimm64, 2 OK # #504/p jit: mov32 for ldimm64, 2 OK # #505/u jit: various mul tests OK # #505/p jit: various mul tests OK # #506/u jit: jsgt, jslt OK # #506/p jit: jsgt, jslt OK # #507/p jset32: BPF_K 3 cases OK # #508/p jset32: BPF_X 3 cases OK # #509/u jset32: min/max deduction OK # #509/p jset32: min/max deduction OK # #510/p jeq32: BPF_K 2 cases OK # #511/p jeq32: BPF_X 3 cases OK # #512/u jeq32: min/max deduction OK # #512/p jeq32: min/max deduction OK # #513/p jne32: BPF_K 2 cases OK # #514/p jne32: BPF_X 3 cases OK # #515/u jne32: min/max deduction OK # #515/p jne32: min/max deduction OK # #516/p jge32: BPF_K 3 cases OK # #517/p jge32: BPF_X 3 cases OK # #518/u jge32: min/max deduction OK # #518/p jge32: min/max deduction OK # #519/p jgt32: BPF_K 3 cases OK # #520/p jgt32: BPF_X 3 cases OK # #521/u jgt32: min/max deduction OK # #521/p jgt32: min/max deduction OK # #522/p jle32: BPF_K 3 cases OK # #523/p jle32: BPF_X 3 cases OK # #524/u jle32: min/max deduction OK # #524/p jle32: min/max deduction OK # #525/p jlt32: BPF_K 3 cases OK # #526/p jlt32: BPF_X 3 cases OK # #527/u jlt32: min/max deduction OK # #527/p jlt32: min/max deduction OK # #528/p jsge32: BPF_K 3 cases OK # #529/p jsge32: BPF_X 3 cases OK # #530/u jsge32: min/max deduction OK # #530/p jsge32: min/max deduction OK # #531/p jsgt32: BPF_K 3 cases OK # #532/p jsgt32: BPF_X 3 cases OK # #533/u jsgt32: min/max deduction OK # #533/p jsgt32: min/max deduction OK # #534/p jsle32: BPF_K 3 cases OK # #535/p jsle32: BPF_X 3 cases OK # #536/u jsle32: min/max deduction OK # #536/p jsle32: min/max deduction OK # #537/p jslt32: BPF_K 3 cases OK # #538/p jslt32: BPF_X 3 cases OK # #539/u jslt32: min/max deduction OK # #539/p jslt32: min/max deduction OK # #540/p jset: functional 7 cases OK # #541/p jset: sign-extend OK # #542/u jset: known const compare OK # #542/p jset: known const compare OK # #543/u jset: known const compare bad OK # #543/p jset: known const compare bad OK # #544/u jset: unknown const compare taken OK # #544/p jset: unknown const compare taken OK # #545/u jset: unknown const compare not taken OK # #545/p jset: unknown const compare not taken OK # #546/u jset: half-known const compare OK # #546/p jset: half-known const compare OK # #547/u jset: range OK # #547/p jset: range OK # #548/u jump test 1 OK # #548/p jump test 1 OK # #549/u jump test 2 OK # #549/p jump test 2 OK # #550/u jump test 3 OK # #550/p jump test 3 OK # #551/u jump test 4 OK # #551/p jump test 4 OK # #552/u jump test 5 OK # #552/p jump test 5 OK # #553/u jump test 6 OK # #553/p jump test 6 OK # #554/u jump test 7 OK # #554/p jump test 7 OK # #555/u jump test 8 OK # #555/p jump test 8 OK # #556/p jump/call test 9 OK # #557/p jump/call test 10 OK # #558/p jump/call test 11 OK # #559/u junk insn OK # #559/p junk insn OK # #560/u junk insn2 OK # #560/p junk insn2 OK # #561/u junk insn3 OK # #561/p junk insn3 OK # #562/u junk insn4 OK # #562/p junk insn4 OK # #563/u junk insn5 OK # #563/p junk insn5 OK # #564/u ld_abs: check calling conv, r1 OK # #564/p ld_abs: check calling conv, r1 OK # #565/u ld_abs: check calling conv, r2 OK # #565/p ld_abs: check calling conv, r2 OK # #566/u ld_abs: check calling conv, r3 OK # #566/p ld_abs: check calling conv, r3 OK # #567/u ld_abs: check calling conv, r4 OK # #567/p ld_abs: check calling conv, r4 OK # #568/u ld_abs: check calling conv, r5 OK # #568/p ld_abs: check calling conv, r5 OK # #569/u ld_abs: check calling conv, r7 OK # #569/p ld_abs: check calling conv, r7 OK # #570/p ld_abs: tests on r6 and skb data reload helper OK # #571/p ld_abs: invalid op 1 OK # #572/p ld_abs: invalid op 2 OK # #573/p ld_abs: nmap reduced OK # #574/p ld_abs: div + abs, test 1 OK # #575/p ld_abs: div + abs, test 2 OK # #576/p ld_abs: div + abs, test 3 OK # #577/p ld_abs: div + abs, test 4 OK # #578/p ld_abs: vlan + abs, test 1 OK # #579/p ld_abs: vlan + abs, test 2 OK # #580/p ld_abs: jump around ld_abs OK # #581/p ld_dw: xor semi-random 64 bit imms, test 1 OK # #582/p ld_dw: xor semi-random 64 bit imms, test 2 OK # #583/p ld_dw: xor semi-random 64 bit imms, test 3 OK # #584/p ld_dw: xor semi-random 64 bit imms, test 4 OK # #585/p ld_dw: xor semi-random 64 bit imms, test 5 OK # #586/u test1 ld_imm64 OK # #586/p test1 ld_imm64 OK # #587/u test2 ld_imm64 OK # #587/p test2 ld_imm64 OK # #588/u test3 ld_imm64 OK # #588/p test3 ld_imm64 OK # #589/u test4 ld_imm64 OK # #589/p test4 ld_imm64 OK # #590/u test5 ld_imm64 OK # #590/p test5 ld_imm64 OK # #591/u test6 ld_imm64 OK # #591/p test6 ld_imm64 OK # #592/u test7 ld_imm64 OK # #592/p test7 ld_imm64 OK # #593/u test8 ld_imm64 OK # #593/p test8 ld_imm64 OK # #594/u test9 ld_imm64 OK # #594/p test9 ld_imm64 OK # #595/u test10 ld_imm64 OK # #595/p test10 ld_imm64 OK # #596/u test11 ld_imm64 OK # #596/p test11 ld_imm64 OK # #597/u test12 ld_imm64 OK # #597/p test12 ld_imm64 OK # #598/u test13 ld_imm64 OK # #598/p test13 ld_imm64 OK # #599/u test14 ld_imm64: reject 2nd imm != 0 OK # #599/p test14 ld_imm64: reject 2nd imm != 0 OK # #600/u ld_ind: check calling conv, r1 OK # #600/p ld_ind: check calling conv, r1 OK # #601/u ld_ind: check calling conv, r2 OK # #601/p ld_ind: check calling conv, r2 OK # #602/u ld_ind: check calling conv, r3 OK # #602/p ld_ind: check calling conv, r3 OK # #603/u ld_ind: check calling conv, r4 OK # #603/p ld_ind: check calling conv, r4 OK # #604/u ld_ind: check calling conv, r5 OK # #604/p ld_ind: check calling conv, r5 OK # #605/u ld_ind: check calling conv, r7 OK # #605/p ld_ind: check calling conv, r7 OK # #606/u leak pointer into ctx 1 OK # #606/p leak pointer into ctx 1 OK # #607/u leak pointer into ctx 2 OK # #607/p leak pointer into ctx 2 OK # #608/u leak pointer into ctx 3 OK # #608/p leak pointer into ctx 3 OK # #609/u leak pointer into map val OK # #609/p leak pointer into map val OK # #610/p bounded loop, count to 4 OK # #611/p bounded loop, count to 20 OK # #612/p bounded loop, count from positive unknown to 4 OK # #613/p bounded loop, count from totally unknown to 4 OK # #614/p bounded loop, count to 4 with equality OK # #615/p bounded loop, start in the middle OK # #616/p bounded loop containing a forward jump OK # #617/p bounded loop that jumps out rather than in OK # #618/p infinite loop after a conditional jump OK # #619/p bounded recursion OK # #620/p infinite loop in two jumps OK # #621/p infinite loop: three-jump trick OK # #622/p invalid direct packet write for LWT_IN OK # #623/p invalid direct packet write for LWT_OUT OK # #624/p direct packet write for LWT_XMIT OK # #625/p direct packet read for LWT_IN OK # #626/p direct packet read for LWT_OUT OK # #627/p direct packet read for LWT_XMIT OK # #628/p overlapping checks for direct packet access OK # #629/p make headroom for LWT_XMIT OK # #630/u invalid access of tc_classid for LWT_IN OK # #630/p invalid access of tc_classid for LWT_IN OK # #631/u invalid access of tc_classid for LWT_OUT OK # #631/p invalid access of tc_classid for LWT_OUT OK # #632/u invalid access of tc_classid for LWT_XMIT OK # #632/p invalid access of tc_classid for LWT_XMIT OK # #633/p check skb->tc_classid half load not permitted for lwt prog OK # #634/u map in map access OK # #634/p map in map access OK # #635/u invalid inner map pointer OK # #635/p invalid inner map pointer OK # #636/u forgot null checking on the inner map pointer OK # #636/p forgot null checking on the inner map pointer OK # #637/p calls: two calls returning different map pointers for lookup (hash, array) OK # #638/p calls: two calls returning different map pointers for lookup (hash, map in map) OK # #639/u cond: two branches returning different map pointers for lookup (tail, tail) OK # #639/p cond: two branches returning different map pointers for lookup (tail, tail) OK # #640/u cond: two branches returning same map pointers for lookup (tail, tail) OK # #640/p cond: two branches returning same map pointers for lookup (tail, tail) OK # #641/u invalid map_fd for function call OK # #641/p invalid map_fd for function call OK # #642/u don't check return value before access OK # #642/p don't check return value before access OK # #643/u access memory with incorrect alignment OK # #643/p access memory with incorrect alignment OK # #644/u sometimes access memory with incorrect alignment OK # #644/p sometimes access memory with incorrect alignment OK # #645/u masking, test out of bounds 1 OK # #645/p masking, test out of bounds 1 OK # #646/u masking, test out of bounds 2 OK # #646/p masking, test out of bounds 2 OK # #647/u masking, test out of bounds 3 OK # #647/p masking, test out of bounds 3 OK # #648/u masking, test out of bounds 4 OK # #648/p masking, test out of bounds 4 OK # #649/u masking, test out of bounds 5 OK # #649/p masking, test out of bounds 5 OK # #650/u masking, test out of bounds 6 OK # #650/p masking, test out of bounds 6 OK # #651/u masking, test out of bounds 7 OK # #651/p masking, test out of bounds 7 OK # #652/u masking, test out of bounds 8 OK # #652/p masking, test out of bounds 8 OK # #653/u masking, test out of bounds 9 OK # #653/p masking, test out of bounds 9 OK # #654/u masking, test out of bounds 10 OK # #654/p masking, test out of bounds 10 OK # #655/u masking, test out of bounds 11 OK # #655/p masking, test out of bounds 11 OK # #656/u masking, test out of bounds 12 OK # #656/p masking, test out of bounds 12 OK # #657/u masking, test in bounds 1 OK # #657/p masking, test in bounds 1 OK # #658/u masking, test in bounds 2 OK # #658/p masking, test in bounds 2 OK # #659/u masking, test in bounds 3 OK # #659/p masking, test in bounds 3 OK # #660/u masking, test in bounds 4 OK # #660/p masking, test in bounds 4 OK # #661/u masking, test in bounds 5 OK # #661/p masking, test in bounds 5 OK # #662/u masking, test in bounds 6 OK # #662/p masking, test in bounds 6 OK # #663/u masking, test in bounds 7 OK # #663/p masking, test in bounds 7 OK # #664/u masking, test in bounds 8 OK # #664/p masking, test in bounds 8 OK # #665/p meta access, test1 OK # #666/p meta access, test2 OK # #667/p meta access, test3 OK # #668/p meta access, test4 OK # #669/p meta access, test5 OK # #670/p meta access, test6 OK # #671/p meta access, test7 OK # #672/p meta access, test8 OK # #673/p meta access, test9 OK # #674/p meta access, test10 FAIL # Unexpected success to load! # verification time 29 usec # stack depth 8 # processed 19 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0 # #675/p meta access, test11 OK # #676/p meta access, test12 OK # #677/p check bpf_perf_event_data->sample_period byte load permitted OK # #678/p check bpf_perf_event_data->sample_period half load permitted OK # #679/p check bpf_perf_event_data->sample_period word load permitted OK # #680/p check bpf_perf_event_data->sample_period dword load permitted OK # #681/p prevent map lookup in sockmap OK # #682/p prevent map lookup in sockhash OK # #683/p prevent map lookup in stack trace OK # #684/u prevent map lookup in prog array OK # #684/p prevent map lookup in prog array OK # #685/p raw_stack: no skb_load_bytes OK # #686/p raw_stack: skb_load_bytes, negative len OK # #687/p raw_stack: skb_load_bytes, negative len 2 OK # #688/p raw_stack: skb_load_bytes, zero len OK # #689/p raw_stack: skb_load_bytes, no init OK # #690/p raw_stack: skb_load_bytes, init OK # #691/p raw_stack: skb_load_bytes, spilled regs around bounds OK # #692/p raw_stack: skb_load_bytes, spilled regs corruption OK # #693/p raw_stack: skb_load_bytes, spilled regs corruption 2 OK # #694/p raw_stack: skb_load_bytes, spilled regs + data OK # #695/p raw_stack: skb_load_bytes, invalid access 1 OK # #696/p raw_stack: skb_load_bytes, invalid access 2 OK # #697/p raw_stack: skb_load_bytes, invalid access 3 OK # #698/p raw_stack: skb_load_bytes, invalid access 4 OK # #699/p raw_stack: skb_load_bytes, invalid access 5 OK # #700/p raw_stack: skb_load_bytes, invalid access 6 OK # #701/p raw_stack: skb_load_bytes, large access OK # #702/p raw_tracepoint_writable: reject variable offset OK # #703/p reference tracking: leak potential reference OK # #704/p reference tracking: leak potential reference to sock_common OK # #705/p reference tracking: leak potential reference on stack OK # #706/p reference tracking: leak potential reference on stack 2 OK # #707/p reference tracking: zero potential reference OK # #708/p reference tracking: zero potential reference to sock_common OK # #709/p reference tracking: copy and zero potential references OK # #710/p reference tracking: release reference without check OK # #711/p reference tracking: release reference to sock_common without check OK # #712/p reference tracking: release reference OK # #713/p reference tracking: release reference to sock_common OK # #714/p reference tracking: release reference 2 OK # #715/p reference tracking: release reference twice OK # #716/p reference tracking: release reference twice inside branch OK # #717/p reference tracking: alloc, check, free in one subbranch OK # #718/p reference tracking: alloc, check, free in both subbranches OK # #719/p reference tracking in call: free reference in subprog OK # #720/p reference tracking in call: free reference in subprog and outside OK # #721/p reference tracking in call: alloc & leak reference in subprog OK # #722/p reference tracking in call: alloc in subprog, release outside OK # #723/p reference tracking in call: sk_ptr leak into caller stack OK # #724/p reference tracking in call: sk_ptr spill into caller stack OK # #725/p reference tracking: allow LD_ABS OK # #726/p reference tracking: forbid LD_ABS while holding reference OK # #727/p reference tracking: allow LD_IND OK # #728/p reference tracking: forbid LD_IND while holding reference OK # #729/p reference tracking: check reference or tail call OK # #730/p reference tracking: release reference then tail call OK # #731/p reference tracking: leak possible reference over tail call OK # #732/p reference tracking: leak checked reference over tail call OK # #733/p reference tracking: mangle and release sock_or_null OK # #734/p reference tracking: mangle and release sock OK # #735/p reference tracking: access member OK # #736/p reference tracking: write to member OK # #737/p reference tracking: invalid 64-bit access of member OK # #738/p reference tracking: access after release OK # #739/p reference tracking: direct access for lookup OK # #740/p reference tracking: use ptr from bpf_tcp_sock() after release OK # #741/p reference tracking: use ptr from bpf_sk_fullsock() after release OK # #742/p reference tracking: use ptr from bpf_sk_fullsock(tp) after release OK # #743/p reference tracking: use sk after bpf_sk_release(tp) OK # #744/p reference tracking: use ptr from bpf_get_listener_sock() after bpf_sk_release(sk) OK # #745/p reference tracking: bpf_sk_release(listen_sk) OK # #746/p reference tracking: tp->snd_cwnd after bpf_sk_fullsock(sk) and bpf_tcp_sock(sk) OK # #747/u runtime/jit: tail_call within bounds, prog once OK # #747/p runtime/jit: tail_call within bounds, prog once OK # #748/u runtime/jit: tail_call within bounds, prog loop OK # #748/p runtime/jit: tail_call within bounds, prog loop OK # #749/u runtime/jit: tail_call within bounds, no prog OK # #749/p runtime/jit: tail_call within bounds, no prog OK # #750/u runtime/jit: tail_call out of bounds OK # #750/p runtime/jit: tail_call out of bounds OK # #751/u runtime/jit: pass negative index to tail_call OK # #751/p runtime/jit: pass negative index to tail_call OK # #752/u runtime/jit: pass > 32bit index to tail_call OK # #752/p runtime/jit: pass > 32bit index to tail_call OK # #753/p scale: scale test 1 OK # #754/p scale: scale test 2 OK # #755/u pointer/scalar confusion in state equality check (way 1) OK # #755/p pointer/scalar confusion in state equality check (way 1) OK # #756/u pointer/scalar confusion in state equality check (way 2) OK # #756/p pointer/scalar confusion in state equality check (way 2) OK # #757/p liveness pruning and write screening OK # #758/u varlen_map_value_access pruning OK # #758/p varlen_map_value_access pruning OK # #759/p search pruning: all branches should be verified (nop operation) OK # #760/p search pruning: all branches should be verified (invalid stack access) OK # #761/u allocated_stack OK # #761/p allocated_stack OK # #762/u skb->sk: no NULL check OK # #762/p skb->sk: no NULL check OK # #763/u skb->sk: sk->family [non fullsock field] OK # #763/p skb->sk: sk->family [non fullsock field] OK # #764/u skb->sk: sk->type [fullsock field] OK # #764/p skb->sk: sk->type [fullsock field] OK # #765/u bpf_sk_fullsock(skb->sk): no !skb->sk check OK # #765/p bpf_sk_fullsock(skb->sk): no !skb->sk check OK # #766/u sk_fullsock(skb->sk): no NULL check on ret OK # #766/p sk_fullsock(skb->sk): no NULL check on ret OK # #767/u sk_fullsock(skb->sk): sk->type [fullsock field] OK # #767/p sk_fullsock(skb->sk): sk->type [fullsock field] OK # #768/u sk_fullsock(skb->sk): sk->family [non fullsock field] OK # #768/p sk_fullsock(skb->sk): sk->family [non fullsock field] OK # #769/u sk_fullsock(skb->sk): sk->state [narrow load] OK # #769/p sk_fullsock(skb->sk): sk->state [narrow load] OK # #770/u sk_fullsock(skb->sk): sk->dst_port [narrow load] OK # #770/p sk_fullsock(skb->sk): sk->dst_port [narrow load] OK # #771/u sk_fullsock(skb->sk): sk->dst_port [load 2nd byte] OK # #771/p sk_fullsock(skb->sk): sk->dst_port [load 2nd byte] OK # #772/u sk_fullsock(skb->sk): sk->dst_ip6 [load 2nd byte] OK # #772/p sk_fullsock(skb->sk): sk->dst_ip6 [load 2nd byte] OK # #773/u sk_fullsock(skb->sk): sk->type [narrow load] OK # #773/p sk_fullsock(skb->sk): sk->type [narrow load] OK # #774/u sk_fullsock(skb->sk): sk->protocol [narrow load] OK # #774/p sk_fullsock(skb->sk): sk->protocol [narrow load] OK # #775/u sk_fullsock(skb->sk): beyond last field OK # #775/p sk_fullsock(skb->sk): beyond last field OK # #776/u bpf_tcp_sock(skb->sk): no !skb->sk check OK # #776/p bpf_tcp_sock(skb->sk): no !skb->sk check OK # #777/u bpf_tcp_sock(skb->sk): no NULL check on ret OK # #777/p bpf_tcp_sock(skb->sk): no NULL check on ret OK # #778/u bpf_tcp_sock(skb->sk): tp->snd_cwnd OK # #778/p bpf_tcp_sock(skb->sk): tp->snd_cwnd OK # #779/u bpf_tcp_sock(skb->sk): tp->bytes_acked OK # #779/p bpf_tcp_sock(skb->sk): tp->bytes_acked OK # #780/u bpf_tcp_sock(skb->sk): beyond last field OK # #780/p bpf_tcp_sock(skb->sk): beyond last field OK # #781/u bpf_tcp_sock(bpf_sk_fullsock(skb->sk)): tp->snd_cwnd OK # #781/p bpf_tcp_sock(bpf_sk_fullsock(skb->sk)): tp->snd_cwnd OK # #782/p bpf_sk_release(skb->sk) OK # #783/p bpf_sk_release(bpf_sk_fullsock(skb->sk)) OK # #784/p bpf_sk_release(bpf_tcp_sock(skb->sk)) OK # #785/p sk_storage_get(map, skb->sk, NULL, 0): value == NULL OK # #786/p sk_storage_get(map, skb->sk, 1, 1): value == 1 OK # #787/p sk_storage_get(map, skb->sk, &stack_value, 1): stack_value OK # #788/p sk_storage_get(map, skb->sk, &stack_value, 1): partially init stack_value OK # #789/p bpf_map_lookup_elem(smap, &key) OK # #790/p bpf_map_lookup_elem(xskmap, &key); xs->queue_id SKIP (unsupported map type 17) # #791/u check valid spill/fill OK # #791/p check valid spill/fill OK # #792/u check valid spill/fill, skb mark OK # #792/p check valid spill/fill, skb mark OK # #793/u check corrupted spill/fill OK # #793/p check corrupted spill/fill OK # #794/u check corrupted spill/fill, LSB OK # #794/p check corrupted spill/fill, LSB OK # #795/u check corrupted spill/fill, MSB OK # #795/p check corrupted spill/fill, MSB OK # #796/u spin_lock: test1 success OK # #796/p spin_lock: test1 success OK # #797/u spin_lock: test2 direct ld/st OK # #797/p spin_lock: test2 direct ld/st OK # #798/u spin_lock: test3 direct ld/st OK # #798/p spin_lock: test3 direct ld/st OK # #799/u spin_lock: test4 direct ld/st OK # #799/p spin_lock: test4 direct ld/st OK # #800/u spin_lock: test5 call within a locked region OK # #800/p spin_lock: test5 call within a locked region OK # #801/u spin_lock: test6 missing unlock OK # #801/p spin_lock: test6 missing unlock OK # #802/u spin_lock: test7 unlock without lock OK # #802/p spin_lock: test7 unlock without lock OK # #803/u spin_lock: test8 double lock OK # #803/p spin_lock: test8 double lock OK # #804/u spin_lock: test9 different lock OK # #804/p spin_lock: test9 different lock OK # #805/u spin_lock: test10 lock in subprog without unlock OK # #805/p spin_lock: test10 lock in subprog without unlock OK # #806/p spin_lock: test11 ld_abs under lock OK # #807/u PTR_TO_STACK store/load OK # #807/p PTR_TO_STACK store/load OK # #808/u PTR_TO_STACK store/load - bad alignment on off OK # #808/p PTR_TO_STACK store/load - bad alignment on off OK # #809/u PTR_TO_STACK store/load - bad alignment on reg OK # #809/p PTR_TO_STACK store/load - bad alignment on reg OK # #810/u PTR_TO_STACK store/load - out of bounds low OK # #810/p PTR_TO_STACK store/load - out of bounds low OK # #811/u PTR_TO_STACK store/load - out of bounds high OK # #811/p PTR_TO_STACK store/load - out of bounds high OK # #812/u PTR_TO_STACK check high 1 OK # #812/p PTR_TO_STACK check high 1 OK # #813/u PTR_TO_STACK check high 2 OK # #813/p PTR_TO_STACK check high 2 OK # #814/u PTR_TO_STACK check high 3 OK # #814/p PTR_TO_STACK check high 3 OK # #815/u PTR_TO_STACK check high 4 OK # #815/p PTR_TO_STACK check high 4 OK # #816/u PTR_TO_STACK check high 5 OK # #816/p PTR_TO_STACK check high 5 OK # #817/u PTR_TO_STACK check high 6 OK # #817/p PTR_TO_STACK check high 6 OK # #818/u PTR_TO_STACK check high 7 OK # #818/p PTR_TO_STACK check high 7 OK # #819/u PTR_TO_STACK check low 1 OK # #819/p PTR_TO_STACK check low 1 OK # #820/u PTR_TO_STACK check low 2 OK # #820/p PTR_TO_STACK check low 2 OK # #821/u PTR_TO_STACK check low 3 OK # #821/p PTR_TO_STACK check low 3 OK # #822/u PTR_TO_STACK check low 4 OK # #822/p PTR_TO_STACK check low 4 OK # #823/u PTR_TO_STACK check low 5 OK # #823/p PTR_TO_STACK check low 5 OK # #824/u PTR_TO_STACK check low 6 OK # #824/p PTR_TO_STACK check low 6 OK # #825/u PTR_TO_STACK check low 7 OK # #825/p PTR_TO_STACK check low 7 OK # #826/u PTR_TO_STACK mixed reg/k, 1 OK # #826/p PTR_TO_STACK mixed reg/k, 1 OK # #827/u PTR_TO_STACK mixed reg/k, 2 OK # #827/p PTR_TO_STACK mixed reg/k, 2 OK # #828/u PTR_TO_STACK mixed reg/k, 3 OK # #828/p PTR_TO_STACK mixed reg/k, 3 OK # #829/u PTR_TO_STACK reg OK # #829/p PTR_TO_STACK reg OK # #830/u stack pointer arithmetic OK # #830/p stack pointer arithmetic OK # #831/u read uninitialized register OK # #831/p read uninitialized register OK # #832/u read invalid register OK # #832/p read invalid register OK # #833/u program doesn't init R0 before exit OK # #833/p program doesn't init R0 before exit OK # #834/u program doesn't init R0 before exit in all branches OK # #834/p program doesn't init R0 before exit in all branches OK # #835/u unpriv: return pointer OK # #835/p unpriv: return pointer OK # #836/u unpriv: add const to pointer OK # #836/p unpriv: add const to pointer OK # #837/u unpriv: add pointer to pointer OK # #837/p unpriv: add pointer to pointer OK # #838/u unpriv: neg pointer OK # #838/p unpriv: neg pointer OK # #839/u unpriv: cmp pointer with const OK # #839/p unpriv: cmp pointer with const OK # #840/u unpriv: cmp pointer with pointer OK # #840/p unpriv: cmp pointer with pointer OK # #841/p unpriv: check that printk is disallowed OK # #842/u unpriv: pass pointer to helper function OK # #842/p unpriv: pass pointer to helper function OK # #843/u unpriv: indirectly pass pointer on stack to helper function OK # #843/p unpriv: indirectly pass pointer on stack to helper function OK # #844/u unpriv: mangle pointer on stack 1 OK # #844/p unpriv: mangle pointer on stack 1 OK # #845/u unpriv: mangle pointer on stack 2 OK # #845/p unpriv: mangle pointer on stack 2 OK # #846/u unpriv: read pointer from stack in small chunks OK # #846/p unpriv: read pointer from stack in small chunks OK # #847/u unpriv: write pointer into ctx OK # #847/p unpriv: write pointer into ctx OK # #848/u unpriv: spill/fill of ctx OK # #848/p unpriv: spill/fill of ctx OK # #849/p unpriv: spill/fill of ctx 2 OK # #850/p unpriv: spill/fill of ctx 3 OK # #851/p unpriv: spill/fill of ctx 4 OK # #852/p unpriv: spill/fill of different pointers stx OK # #853/p unpriv: spill/fill of different pointers stx - ctx and sock OK # #854/p unpriv: spill/fill of different pointers stx - leak sock OK # #855/p unpriv: spill/fill of different pointers stx - sock and ctx (read) OK # #856/p unpriv: spill/fill of different pointers stx - sock and ctx (write) OK # #857/p unpriv: spill/fill of different pointers ldx OK # #858/u unpriv: write pointer into map elem value OK # #858/p unpriv: write pointer into map elem value OK # #859/u alu32: mov u32 const OK # #859/p alu32: mov u32 const OK # #860/u unpriv: partial copy of pointer OK # #860/p unpriv: partial copy of pointer OK # #861/u unpriv: pass pointer to tail_call OK # #861/p unpriv: pass pointer to tail_call OK # #862/u unpriv: cmp map pointer with zero OK # #862/p unpriv: cmp map pointer with zero OK # #863/u unpriv: write into frame pointer OK # #863/p unpriv: write into frame pointer OK # #864/u unpriv: spill/fill frame pointer OK # #864/p unpriv: spill/fill frame pointer OK # #865/u unpriv: cmp of frame pointer OK # #865/p unpriv: cmp of frame pointer OK # #866/u unpriv: adding of fp OK # #866/p unpriv: adding of fp OK # #867/u unpriv: cmp of stack pointer OK # #867/p unpriv: cmp of stack pointer OK # #868/u map element value store of cleared call register OK # #868/p map element value store of cleared call register OK # #869/u map element value with unaligned store OK # #869/p map element value with unaligned store OK # #870/u map element value with unaligned load OK # #870/p map element value with unaligned load OK # #871/u map element value is preserved across register spilling OK # #871/p map element value is preserved across register spilling OK # #872/u map element value is preserved across register spilling OK # #872/p map element value is preserved across register spilling OK # #873/u map element value or null is marked on register spilling OK # #873/p map element value or null is marked on register spilling OK # #874/u map element value illegal alu op, 1 OK # #874/p map element value illegal alu op, 1 OK # #875/u map element value illegal alu op, 2 OK # #875/p map element value illegal alu op, 2 OK # #876/u map element value illegal alu op, 3 OK # #876/p map element value illegal alu op, 3 OK # #877/u map element value illegal alu op, 4 OK # #877/p map element value illegal alu op, 4 OK # #878/u map element value illegal alu op, 5 OK # #878/p map element value illegal alu op, 5 OK # #879/p multiple registers share map_lookup_elem result OK # #880/p alu ops on ptr_to_map_value_or_null, 1 OK # #881/p alu ops on ptr_to_map_value_or_null, 2 OK # #882/p alu ops on ptr_to_map_value_or_null, 3 OK # #883/p invalid memory access with multiple map_lookup_elem calls OK # #884/p valid indirect map_lookup_elem access with 2nd lookup in branch OK # #885/u invalid map access from else condition OK # #885/p invalid map access from else condition OK # #886/u map access: known scalar += value_ptr from different maps OK # #886/p map access: known scalar += value_ptr from different maps OK # #887/u map access: value_ptr -= known scalar from different maps OK # #887/p map access: value_ptr -= known scalar from different maps OK # #888/u map access: known scalar += value_ptr from different maps, but same value properties OK # #888/p map access: known scalar += value_ptr from different maps, but same value properties OK # #889/u map access: mixing value pointer and scalar, 1 OK # #889/p map access: mixing value pointer and scalar, 1 OK # #890/u map access: mixing value pointer and scalar, 2 OK # #890/p map access: mixing value pointer and scalar, 2 OK # #891/u sanitation: alu with different scalars 1 OK # #891/p sanitation: alu with different scalars 1 OK # #892/u sanitation: alu with different scalars 2 OK # #892/p sanitation: alu with different scalars 2 OK # #893/u sanitation: alu with different scalars 3 OK # #893/p sanitation: alu with different scalars 3 OK # #894/u map access: value_ptr += known scalar, upper oob arith, test 1 OK # #894/p map access: value_ptr += known scalar, upper oob arith, test 1 OK # #895/u map access: value_ptr += known scalar, upper oob arith, test 2 OK # #895/p map access: value_ptr += known scalar, upper oob arith, test 2 OK # #896/u map access: value_ptr += known scalar, upper oob arith, test 3 OK # #896/p map access: value_ptr += known scalar, upper oob arith, test 3 OK # #897/u map access: value_ptr -= known scalar, lower oob arith, test 1 OK # #897/p map access: value_ptr -= known scalar, lower oob arith, test 1 OK # #898/u map access: value_ptr -= known scalar, lower oob arith, test 2 OK # #898/p map access: value_ptr -= known scalar, lower oob arith, test 2 OK # #899/u map access: value_ptr -= known scalar, lower oob arith, test 3 OK # #899/p map access: value_ptr -= known scalar, lower oob arith, test 3 OK # #900/u map access: known scalar += value_ptr OK # #900/p map access: known scalar += value_ptr OK # #901/u map access: value_ptr += known scalar, 1 OK # #901/p map access: value_ptr += known scalar, 1 OK # #902/u map access: value_ptr += known scalar, 2 OK # #902/p map access: value_ptr += known scalar, 2 OK # #903/u map access: value_ptr += known scalar, 3 OK # #903/p map access: value_ptr += known scalar, 3 OK # #904/u map access: value_ptr += known scalar, 4 OK # #904/p map access: value_ptr += known scalar, 4 OK # #905/u map access: value_ptr += known scalar, 5 OK # #905/p map access: value_ptr += known scalar, 5 OK # #906/u map access: value_ptr += known scalar, 6 OK # #906/p map access: value_ptr += known scalar, 6 OK # #907/u map access: unknown scalar += value_ptr, 1 OK # #907/p map access: unknown scalar += value_ptr, 1 OK # #908/u map access: unknown scalar += value_ptr, 2 OK # #908/p map access: unknown scalar += value_ptr, 2 OK # #909/u map access: unknown scalar += value_ptr, 3 OK # #909/p map access: unknown scalar += value_ptr, 3 OK # #910/u map access: unknown scalar += value_ptr, 4 OK # #910/p map access: unknown scalar += value_ptr, 4 OK # #911/u map access: value_ptr += unknown scalar, 1 OK # #911/p map access: value_ptr += unknown scalar, 1 OK # #912/u map access: value_ptr += unknown scalar, 2 OK # #912/p map access: value_ptr += unknown scalar, 2 OK # #913/u map access: value_ptr += unknown scalar, 3 OK # #913/p map access: value_ptr += unknown scalar, 3 OK # #914/u map access: value_ptr += value_ptr OK # #914/p map access: value_ptr += value_ptr OK # #915/u map access: known scalar -= value_ptr OK # #915/p map access: known scalar -= value_ptr OK # #916/u map access: value_ptr -= known scalar OK # #916/p map access: value_ptr -= known scalar OK # #917/u map access: value_ptr -= known scalar, 2 OK # #917/p map access: value_ptr -= known scalar, 2 OK # #918/u map access: unknown scalar -= value_ptr OK # #918/p map access: unknown scalar -= value_ptr OK # #919/u map access: value_ptr -= unknown scalar OK # #919/p map access: value_ptr -= unknown scalar OK # #920/u map access: value_ptr -= unknown scalar, 2 OK # #920/p map access: value_ptr -= unknown scalar, 2 OK # #921/u map access: value_ptr -= value_ptr OK # #921/p map access: value_ptr -= value_ptr OK # #922/p variable-offset ctx access OK # #923/p variable-offset stack access OK # #924/p indirect variable-offset stack access, unbounded OK # #925/p indirect variable-offset stack access, max out of bound OK # #926/p indirect variable-offset stack access, min out of bound OK # #927/p indirect variable-offset stack access, max_off+size > max_initialized OK # #928/p indirect variable-offset stack access, min_off < min_initialized OK # #929/u indirect variable-offset stack access, priv vs unpriv OK # #929/p indirect variable-offset stack access, priv vs unpriv OK # #930/p indirect variable-offset stack access, uninitialized OK # #931/p indirect variable-offset stack access, ok OK # #932/p xadd/w check unaligned stack OK # #933/p xadd/w check unaligned map OK # #934/p xadd/w check unaligned pkt OK # #935/p xadd/w check whether src/dst got mangled, 1 OK # #936/p xadd/w check whether src/dst got mangled, 2 OK # #937/p XDP, using ifindex from netdev OK # #938/p XDP pkt read, pkt_end mangling, bad access 1 OK # #939/p XDP pkt read, pkt_end mangling, bad access 2 OK # #940/p XDP pkt read, pkt_data' > pkt_end, good access OK # #941/p XDP pkt read, pkt_data' > pkt_end, bad access 1 OK # #942/p XDP pkt read, pkt_data' > pkt_end, bad access 2 OK # #943/p XDP pkt read, pkt_end > pkt_data', good access OK # #944/p XDP pkt read, pkt_end > pkt_data', bad access 1 OK # #945/p XDP pkt read, pkt_end > pkt_data', bad access 2 OK # #946/p XDP pkt read, pkt_data' < pkt_end, good access OK # #947/p XDP pkt read, pkt_data' < pkt_end, bad access 1 OK # #948/p XDP pkt read, pkt_data' < pkt_end, bad access 2 OK # #949/p XDP pkt read, pkt_end < pkt_data', good access OK # #950/p XDP pkt read, pkt_end < pkt_data', bad access 1 OK # #951/p XDP pkt read, pkt_end < pkt_data', bad access 2 OK # #952/p XDP pkt read, pkt_data' >= pkt_end, good access OK # #953/p XDP pkt read, pkt_data' >= pkt_end, bad access 1 OK # #954/p XDP pkt read, pkt_data' >= pkt_end, bad access 2 OK # #955/p XDP pkt read, pkt_end >= pkt_data', good access OK # #956/p XDP pkt read, pkt_end >= pkt_data', bad access 1 OK # #957/p XDP pkt read, pkt_end >= pkt_data', bad access 2 OK # #958/p XDP pkt read, pkt_data' <= pkt_end, good access OK # #959/p XDP pkt read, pkt_data' <= pkt_end, bad access 1 OK # #960/p XDP pkt read, pkt_data' <= pkt_end, bad access 2 OK # #961/p XDP pkt read, pkt_end <= pkt_data', good access OK # #962/p XDP pkt read, pkt_end <= pkt_data', bad access 1 OK # #963/p XDP pkt read, pkt_end <= pkt_data', bad access 2 OK # #964/p XDP pkt read, pkt_meta' > pkt_data, good access OK # #965/p XDP pkt read, pkt_meta' > pkt_data, bad access 1 OK # #966/p XDP pkt read, pkt_meta' > pkt_data, bad access 2 OK # #967/p XDP pkt read, pkt_data > pkt_meta', good access OK # #968/p XDP pkt read, pkt_data > pkt_meta', bad access 1 OK # #969/p XDP pkt read, pkt_data > pkt_meta', bad access 2 OK # #970/p XDP pkt read, pkt_meta' < pkt_data, good access OK # #971/p XDP pkt read, pkt_meta' < pkt_data, bad access 1 OK # #972/p XDP pkt read, pkt_meta' < pkt_data, bad access 2 OK # #973/p XDP pkt read, pkt_data < pkt_meta', good access OK # #974/p XDP pkt read, pkt_data < pkt_meta', bad access 1 OK # #975/p XDP pkt read, pkt_data < pkt_meta', bad access 2 OK # #976/p XDP pkt read, pkt_meta' >= pkt_data, good access OK # #977/p XDP pkt read, pkt_meta' >= pkt_data, bad access 1 OK # #978/p XDP pkt read, pkt_meta' >= pkt_data, bad access 2 OK # #979/p XDP pkt read, pkt_data >= pkt_meta', good access OK # #980/p XDP pkt read, pkt_data >= pkt_meta', bad access 1 OK # #981/p XDP pkt read, pkt_data >= pkt_meta', bad access 2 OK # #982/p XDP pkt read, pkt_meta' <= pkt_data, good access OK # #983/p XDP pkt read, pkt_meta' <= pkt_data, bad access 1 OK # #984/p XDP pkt read, pkt_meta' <= pkt_data, bad access 2 OK # #985/p XDP pkt read, pkt_data <= pkt_meta', good access OK # #986/p XDP pkt read, pkt_data <= pkt_meta', bad access 1 OK # #987/p XDP pkt read, pkt_data <= pkt_meta', bad access 2 OK # Summary: 1449 PASSED, 1 SKIPPED, 2 FAILED not ok 1 selftests: bpf: test_verifier To reproduce: # build kernel cd linux cp config-5.2.0-rc2-00624-g6c409a3a .config make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 prepare make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 modules_prepare make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 SHELL=/bin/bash make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 bzImage git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k job-script # job-script is attached in this email Thanks, Rong Chen