1{
  2	/* This is equivalent to the following program:
  3	 *
  4	 *   r6 = skb->sk;
  5	 *   r7 = sk_fullsock(r6);
  6	 *   r0 = sk_fullsock(r6);
  7	 *   if (r0 == 0) return 0;    (a)
  8	 *   if (r0 != r7) return 0;   (b)
  9	 *   *r7->type;                (c)
 10	 *   return 0;
 11	 *
 12	 * It is safe to dereference r7 at point (c), because of (a) and (b).
 13	 * The test verifies that relation r0 == r7 is propagated from (b) to (c).
 14	 */
 15	"jne/jeq infer not null, PTR_TO_SOCKET_OR_NULL -> PTR_TO_SOCKET for JNE false branch",
 16	.insns = {
 17	/* r6 = skb->sk; */
 18	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, offsetof(struct __sk_buff, sk)),
 19	/* if (r6 == 0) return 0; */
 20	BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 8),
 21	/* r7 = sk_fullsock(skb); */
 22	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 23	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 24	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 25	/* r0 = sk_fullsock(skb); */
 26	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 27	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 28	/* if (r0 == null) return 0; */
 29	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
 30	/* if (r0 == r7) r0 = *(r7->type); */
 31	BPF_JMP_REG(BPF_JNE, BPF_REG_0, BPF_REG_7, 1), /* Use ! JNE ! */
 32	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
 33	/* return 0 */
 34	BPF_MOV64_IMM(BPF_REG_0, 0),
 35	BPF_EXIT_INSN(),
 36	},
 37	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 38	.result = ACCEPT,
 39	.result_unpriv = REJECT,
 40	.errstr_unpriv = "R7 pointer comparison",
 41},
 42{
 43	/* Same as above, but verify that another branch of JNE still
 44	 * prohibits access to PTR_MAYBE_NULL.
 45	 */
 46	"jne/jeq infer not null, PTR_TO_SOCKET_OR_NULL unchanged for JNE true branch",
 47	.insns = {
 48	/* r6 = skb->sk */
 49	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, offsetof(struct __sk_buff, sk)),
 50	/* if (r6 == 0) return 0; */
 51	BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 9),
 52	/* r7 = sk_fullsock(skb); */
 53	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 54	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 55	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 56	/* r0 = sk_fullsock(skb); */
 57	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 58	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 59	/* if (r0 == null) return 0; */
 60	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
 61	/* if (r0 == r7) return 0; */
 62	BPF_JMP_REG(BPF_JNE, BPF_REG_0, BPF_REG_7, 1), /* Use ! JNE ! */
 63	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 64	/* r0 = *(r7->type); */
 65	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
 66	/* return 0 */
 67	BPF_MOV64_IMM(BPF_REG_0, 0),
 68	BPF_EXIT_INSN(),
 69	},
 70	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 71	.result = REJECT,
 72	.errstr = "R7 invalid mem access 'sock_or_null'",
 73	.result_unpriv = REJECT,
 74	.errstr_unpriv = "R7 pointer comparison",
 75},
 76{
 77	/* Same as a first test, but not null should be inferred for JEQ branch */
 78	"jne/jeq infer not null, PTR_TO_SOCKET_OR_NULL -> PTR_TO_SOCKET for JEQ true branch",
 79	.insns = {
 80	/* r6 = skb->sk; */
 81	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, offsetof(struct __sk_buff, sk)),
 82	/* if (r6 == null) return 0; */
 83	BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 9),
 84	/* r7 = sk_fullsock(skb); */
 85	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 86	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 87	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 88	/* r0 = sk_fullsock(skb); */
 89	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 90	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
 91	/* if (r0 == null) return 0; */
 92	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 93	/* if (r0 != r7) return 0; */
 94	BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_7, 1), /* Use ! JEQ ! */
 95	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 96	/* r0 = *(r7->type); */
 97	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
 98	/* return 0; */
 99	BPF_MOV64_IMM(BPF_REG_0, 0),
100	BPF_EXIT_INSN(),
101	},
102	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
103	.result = ACCEPT,
104	.result_unpriv = REJECT,
105	.errstr_unpriv = "R7 pointer comparison",
106},
107{
108	/* Same as above, but verify that another branch of JNE still
109	 * prohibits access to PTR_MAYBE_NULL.
110	 */
111	"jne/jeq infer not null, PTR_TO_SOCKET_OR_NULL unchanged for JEQ false branch",
112	.insns = {
113	/* r6 = skb->sk; */
114	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, offsetof(struct __sk_buff, sk)),
115	/* if (r6 == null) return 0; */
116	BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 8),
117	/* r7 = sk_fullsock(skb); */
118	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
119	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
120	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
121	/* r0 = sk_fullsock(skb); */
122	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
123	BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
124	/* if (r0 == null) return 0; */
125	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
126	/* if (r0 != r7) r0 = *(r7->type); */
127	BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_7, 1), /* Use ! JEQ ! */
128	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
129	/* return 0; */
130	BPF_MOV64_IMM(BPF_REG_0, 0),
131	BPF_EXIT_INSN(),
132	},
133	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
134	.result = REJECT,
135	.errstr = "R7 invalid mem access 'sock_or_null'",
136	.result_unpriv = REJECT,
137	.errstr_unpriv = "R7 pointer comparison",
138},
139{
140	/* Maps are treated in a different branch of `mark_ptr_not_null_reg`,
141	 * so separate test for maps case.
142	 */
143	"jne/jeq infer not null, PTR_TO_MAP_VALUE_OR_NULL -> PTR_TO_MAP_VALUE",
144	.insns = {
145	/* r9 = &some stack to use as key */
146	BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
147	BPF_MOV64_REG(BPF_REG_9, BPF_REG_10),
148	BPF_ALU64_IMM(BPF_ADD, BPF_REG_9, -8),
149	/* r8 = process local map */
150	BPF_LD_MAP_FD(BPF_REG_8, 0),
151	/* r6 = map_lookup_elem(r8, r9); */
152	BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
153	BPF_MOV64_REG(BPF_REG_2, BPF_REG_9),
154	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
155	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
156	/* r7 = map_lookup_elem(r8, r9); */
157	BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
158	BPF_MOV64_REG(BPF_REG_2, BPF_REG_9),
159	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
160	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
161	/* if (r6 == 0) return 0; */
162	BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2),
163	/* if (r6 != r7) return 0; */
164	BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_7, 1),
165	/* read *r7; */
166	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_xdp_sock, queue_id)),
167	/* return 0; */
168	BPF_MOV64_IMM(BPF_REG_0, 0),
169	BPF_EXIT_INSN(),
170	},
171	.fixup_map_xskmap = { 3 },
172	.prog_type = BPF_PROG_TYPE_XDP,
173	.result = ACCEPT,
174},