From patchwork Tue Dec 13 03:04:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 32611 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2604723wrr; Mon, 12 Dec 2022 19:14:03 -0800 (PST) X-Google-Smtp-Source: AA0mqf5+J/4xLyY2CGIjkxLNZbW24u8soMcXD6G0D+AxLOuz+tzyabJ9nm6As5M5MnI6qfI6e4Vk X-Received: by 2002:a05:6402:3906:b0:461:79d8:f51a with SMTP id fe6-20020a056402390600b0046179d8f51amr15841737edb.10.1670901243497; Mon, 12 Dec 2022 19:14:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670901243; cv=none; d=google.com; s=arc-20160816; b=CDCtOQgChTSpEtpzmyxcTguyT7z99eaSxdM8APfVn9WGFBg8Jvkd/b3V64sreOjEmJ JdCa4DoGQmocWJBlsELPIi+/V0SN4phtMieH/nDeAaeyvF+ObqzlyXyHLBPf+K0YIoXX qUvATjTlllSrgba5m7B/R0yc1MZFF23Ub0zvxcz5VeXIeygw2bzAzlxStA2SWv2Z1BzX T4GGza5lkI2ub4mTJ4krBFD4FbqvnJ1uJuNzMUa5B+uZOs1ZxXFwUpJkwb+aIFAlblWy BC1jlFEZ6wi35SXjWKWBWKDJzlAH3kAW1sdGCMqeou1nxaso8/ZGjVR57rxKDybxoft/ CL1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=KRz1ndE/MNsp7SX3z6xwVJjSnJS8PPptEfHAdy5xitk=; b=R5AWE9ssVH3BpK50oyYwB177aSySISCLqMyA5JeGo+cxz+EJa7xLtLGe8PptTy940i BlhHCeCfzTxyxGswEfRB4uN2XjiUmWOot+BJQbIZ8NskEHmqKgPkWeJQvpabkoT0GLDS HIeR/tdJN2x2jC+j5cm0qxhmBmzX8OQLFxkSV1CV8AYFhc6UJwoRki6W1lDwc6OcYLVH NThuFYz22ZB/aMxn8J5Sm0T+8A+R9iu2ugtwM0aSa3hkXIERlsLF4EMGYAWoUWe/VBRd w3GmM6KgJh+PRAs8jH3Q7rmS+4vZUHhSDy3gcbjAkZrICOqMVgoympUkvirhZA9fr+ZP 2FrQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b="q65PtU/O"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c6-20020a0564021f8600b00457ebe79577si7857752edc.623.2022.12.12.19.13.40; Mon, 12 Dec 2022 19:14:03 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b="q65PtU/O"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234376AbiLMDFb (ORCPT + 99 others); Mon, 12 Dec 2022 22:05:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234371AbiLMDF3 (ORCPT ); Mon, 12 Dec 2022 22:05:29 -0500 Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 15FA9193C4; Mon, 12 Dec 2022 19:05:28 -0800 (PST) Received: by mail-pf1-x42d.google.com with SMTP id c7so1271338pfc.12; Mon, 12 Dec 2022 19:05:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KRz1ndE/MNsp7SX3z6xwVJjSnJS8PPptEfHAdy5xitk=; b=q65PtU/OnLz+25mz/mVduCl7jZSDJoi13dQGQCSLvKN6GODR3uguXnhLQdv64ym6ug 2CiBmWcQvAVY61gDaXEcwOvcnIopxaMjVJf9bw/QNxSdwU9/vyOS94qbtedEnYwfSqUS Dgcxvo1fuzXWetK1aqanQvhe3ztc3ndXlB2iL5bij7uBGg5r11fmxarVmolhHJKtJzoC biQz7tgeNJ5Oh8MGB1hrvekudjKcLwP1/C7sIKiF2k6Wm6DAUZJGZz312gzayZeP5Day 0C6+SUQnX5eU1nLTyboJNGnmrfryy+2+NMIN7UDPPCYrynbbYH32qoAXA1uHmyD/bcqR M0tw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=KRz1ndE/MNsp7SX3z6xwVJjSnJS8PPptEfHAdy5xitk=; b=y92Vb/KTgXhS66HEAt6XpgkSJpcDFiw7BxbcKwJ9IBGLDSYlevHhFvuz9NNuB538SY x3JqQD5U7vc9Bd+xsrJjfWHk8uq0H2GvBOOH+fpObolNsKTjLtPWEzjh4QskMJFkIy92 +TB1XSr8lrE6+xj55f8DCCkDF3O4BVIq4P7DMpKiUu3z51/ls3SnuMxrRFm6wxr8VQtF x5MY2tvDRf1kUqemnE+y4/WtaRHHfKQ9VBo0SOVl1Rx0Z9y+wfzbwvFnz27D3Odlfbwg TYY457MjCN/3loPQSrMm8K90VFN+WzFE4aieMtuHEbGVJi00poG+nq+tQ3+rC91FMxEM FycQ== X-Gm-Message-State: ANoB5pkDC60OjXwi3RRmuzhuRR5UhdAu+C/ylGhY8iy02HdzTSoVtb6w XoBIOES2ptM4c1R+FtOCBvKPrH69viID X-Received: by 2002:a62:3247:0:b0:574:7015:5501 with SMTP id y68-20020a623247000000b0057470155501mr19666643pfy.5.1670900727267; Mon, 12 Dec 2022 19:05:27 -0800 (PST) Received: from localhost.localdomain ([144.214.0.6]) by smtp.gmail.com with ESMTPSA id z21-20020aa79495000000b005746c3b2445sm6481716pfk.151.2022.12.12.19.05.24 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 12 Dec 2022 19:05:26 -0800 (PST) From: Hao Sun To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, Hao Sun Subject: [PATCH bpf-next v2 1/2] bpf: fix nullness propagation for reg to reg comparisons Date: Tue, 13 Dec 2022 11:04:35 +0800 Message-Id: <20221213030436.17907-1-sunhao.th@gmail.com> X-Mailer: git-send-email 2.37.1 (Apple Git-137.1) MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752066942373270858?= X-GMAIL-MSGID: =?utf-8?q?1752066942373270858?= After befae75856ab, the verifier would propagate null information after JEQ/JNE, e.g., if two pointers, one is maybe_null and the other is not, the former would be marked as non-null in eq path. However, as comment "PTR_TO_BTF_ID points to a kernel struct that does not need to be null checked by the BPF program ... The verifier must keep this in mind and can make no assumptions about null or non-null when doing branch ...". If one pointer is maybe_null and the other is PTR_TO_BTF, the former is incorrectly marked non-null. The following BPF prog can trigger a null-ptr-deref, also see this report for more details[1]: 0: (18) r1 = map_fd ; R1_w=map_ptr(ks=4, vs=4) 2: (79) r6 = *(u64 *)(r1 +8) ; R6_w=bpf_map->inner_map_data ; R6 is PTR_TO_BTF_ID ; equals to null at runtime 3: (bf) r2 = r10 4: (07) r2 += -4 5: (62) *(u32 *)(r2 +0) = 0 6: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null 7: (1d) if r6 == r0 goto pc+1 8: (95) exit ; from 7 to 9: R0=map_value R6=ptr_bpf_map 9: (61) r0 = *(u32 *)(r0 +0) ; null-ptr-deref 10: (95) exit So, make the verifier propagate nullness information for reg to reg comparisons only if neither reg is PTR_TO_BTF_ID. [1] https://lore.kernel.org/bpf/CACkBjsaFJwjC5oiw-1KXvcazywodwXo4zGYsRHwbr2gSG9WcSw@mail.gmail.com/T/#u Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg comparisons") Signed-off-by: Hao Sun Acked-by: Yonghong Song --- kernel/bpf/verifier.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) base-commit: ef3911a3e4d65d2db617366e79517b896045a6e2 diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a5255a0dcbb6..243d06ce6842 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11822,10 +11822,17 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, * register B - not null * for JNE A, B, ... - A is not null in the false branch; * for JEQ A, B, ... - A is not null in the true branch. + * + * Since PTR_TO_BTF_ID points to a kernel struct that does + * not need to be null checked by the BPF program, i.e., + * could be null even without PTR_MAYBE_NULL marking, so + * only propagate nullness when neither reg is that type. */ if (!is_jmp32 && BPF_SRC(insn->code) == BPF_X && __is_pointer_value(false, src_reg) && __is_pointer_value(false, dst_reg) && - type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type)) { + type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type) && + base_type(src_reg->type) != PTR_TO_BTF_ID && + base_type(dst_reg->type) != PTR_TO_BTF_ID) { eq_branch_regs = NULL; switch (opcode) { case BPF_JEQ: From patchwork Tue Dec 13 03:04:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 32610 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2604530wrr; Mon, 12 Dec 2022 19:13:30 -0800 (PST) X-Google-Smtp-Source: AA0mqf63NXuSTnLuQ92qji07zdltrCwbruAQJ5/LL7r22D92rmO4UIg7vlz003h9sujPlSuxwpTq X-Received: by 2002:a17:906:190e:b0:7c1:65ce:7f9f with SMTP id a14-20020a170906190e00b007c165ce7f9fmr7847486eje.65.1670901210320; Mon, 12 Dec 2022 19:13:30 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670901210; cv=none; d=google.com; s=arc-20160816; b=Pz2PqAEIjHmWWST6ik+oG5lqES3yogKgv8KiSGivt8QmrAu1qWhOH/WD6TIDoAhmmr VtUsdbd40zTXq3khjwb5Wo5TU6ZMCZtxZsVX0423bYiVE145NuLjjvp6BZBTpJ3lwASy Qz4LLOk7QaR6M/MtElMClra4+4Ed3wowhgavcIwmtcPl+zo+l2Q/egqByR6QxUGDuk8I YvY3KoXVlFkDr89TsVR48MO8m4lZ4Z8dvAgGellNDQwnMjsNhwTB01kOu0yzy0bTA5d8 /LsTj5ZHqZmk7rOhCXx+lYJ0MC6BYii2G90K5wlnqqKODQbDxVy2UTEHsN2eLJ0SmbJ5 aqzw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=n8wKW76JtFs2F5+hWCFZWeal4WDxfruIrmk6Ywx4Si4=; b=znBAcOJKYVRsGhL/UaE57WKLkd3vUDcBJsp2jqdadzlFp7unz0SnAqZHpXyruFBZrz 0PQYWxwP0RBtOKViak+GZReVndOAQOhvt8NQvYcGuNyTw1CVFFe5oTB7YlwY1oZ7RzqJ u7BAZJ1zgJnoUEnmz4MH/gxWMmGKcinDz1slm8HEUkzTX7knUNZ78AXKBZZ0MvwTM+mP wJA65PiaGJgFT/80mPDD7HZ+zSwjKAwMYkofpiHjrxbFJDkG4xy+L6If1MUrYhF540UH t8gWI0A6CAfIkw13tOzTYjHgTlUJE8XqINmqDWVwg71xhWxatr5aH2IfDU2eeRN23wrz ryQw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=nMyvyxUJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id j17-20020a05640211d100b00462848f0cdbsi11496299edw.299.2022.12.12.19.13.06; Mon, 12 Dec 2022 19:13:30 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=nMyvyxUJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234440AbiLMDFn (ORCPT + 99 others); Mon, 12 Dec 2022 22:05:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234387AbiLMDFc (ORCPT ); Mon, 12 Dec 2022 22:05:32 -0500 Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 173B81A209; Mon, 12 Dec 2022 19:05:31 -0800 (PST) Received: by mail-pj1-x1032.google.com with SMTP id u15-20020a17090a3fcf00b002191825cf02so2124552pjm.2; Mon, 12 Dec 2022 19:05:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=n8wKW76JtFs2F5+hWCFZWeal4WDxfruIrmk6Ywx4Si4=; b=nMyvyxUJTgQlDMX08Le+mw3awdPBeGMcnKlhZx4cReQRGaNqBtTgMabpUeS++olgHa gIrQubgHL+pXSdRjAQpL7sKpal0+oOfxKX2KhmxIWH01fKapkp6k+LWWH3lBk5/DhXyG /UcG06Gtd+CBtBM1Mrs2l2Ocm9muOTfhOMFZvmLv3WCPgNt8rhj29ABSSHMHrxN8vJE2 +o7O3ibuJOJmeQZpVo9ad9uTQ3EfkcSmcxU2OekPSJKcx9l1hUm5pLRlxHg1m5QwymDW 3VwVw+5+tOgbYfMbdoQnBfE4sYJA0ldZ08bh2yQIeDyU7qye/7sYLBzzkaMKSTDqfD3E PcYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n8wKW76JtFs2F5+hWCFZWeal4WDxfruIrmk6Ywx4Si4=; b=UPwAQEbdvsa5yhz6W+vZFSzXU6pp8/B1wF3NbrfYqfiSnBC5feshNdhXRb2m9U6oQM BcFuRKENGYz+Jv4WnuHoPriQcoK5J8wQpDIyCeDC4/0D1voC7Qd6uVgSX9O0pibMFSzD uG3dhrGtoh7ArMjfThEb7MeR0GRGEp+ML2uRSkYLOa58IrPzNFxAKp5pIH+IGPnQnfMm QHBIm7E2yWYQfVEl9JvJnNb5t10H1IDfGaCCg50lTqTGXJ6BX8FG6N04JtS22MCNOteT 9wj+xM0T8866GVZ89ahABU34DmVDprzO5OcO8sNCwazWZqtK05qydFnmb5SP8tZIakQQ aXXw== X-Gm-Message-State: ANoB5pm/OjaF9EagP++Uf9JDII+SsZsIa7h5RXRdC9OMy2r7sZwwE21t IY+ixh4xZFqaQZ/xY+jEMCPgVZ35Y22V X-Received: by 2002:a05:6a21:3397:b0:a5:70ed:bda9 with SMTP id yy23-20020a056a21339700b000a570edbda9mr32647414pzb.26.1670900730224; Mon, 12 Dec 2022 19:05:30 -0800 (PST) Received: from localhost.localdomain ([144.214.0.6]) by smtp.gmail.com with ESMTPSA id z21-20020aa79495000000b005746c3b2445sm6481716pfk.151.2022.12.12.19.05.27 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 12 Dec 2022 19:05:29 -0800 (PST) From: Hao Sun To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, Hao Sun Subject: [PATCH bpf-next v2 2/2] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Date: Tue, 13 Dec 2022 11:04:36 +0800 Message-Id: <20221213030436.17907-2-sunhao.th@gmail.com> X-Mailer: git-send-email 2.37.1 (Apple Git-137.1) In-Reply-To: <20221213030436.17907-1-sunhao.th@gmail.com> References: <20221213030436.17907-1-sunhao.th@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752066907612439483?= X-GMAIL-MSGID: =?utf-8?q?1752066907612439483?= Verify that nullness information is not porpagated in the branches of register to register JEQ and JNE operations if one of them is PTR_TO_BTF_ID. Signed-off-by: Hao Sun Acked-by: Yonghong Song --- .../bpf/verifier/jeq_infer_not_null.c | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/jeq_infer_not_null.c b/tools/testing/selftests/bpf/verifier/jeq_infer_not_null.c index 67a1c07ead34..b2b215227d97 100644 --- a/tools/testing/selftests/bpf/verifier/jeq_infer_not_null.c +++ b/tools/testing/selftests/bpf/verifier/jeq_infer_not_null.c @@ -172,3 +172,25 @@ .prog_type = BPF_PROG_TYPE_XDP, .result = ACCEPT, }, +{ + "jne/jeq infer not null, PTR_TO_MAP_OR_NULL unchanged with PTR_TO_BTF_ID reg", + .insns = { + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), + BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0), + BPF_LD_MAP_FD(BPF_REG_1, 0), + /* r6 = bpf_map->inner_map_meta; */ + BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8), + /* r0 = map_lookup_elem(r1, r2); */ + BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), + /* if (r0 == r6) read *r0; */ + BPF_JMP_REG(BPF_JEQ, BPF_REG_6, BPF_REG_0, 1), + BPF_EXIT_INSN(), + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 3 }, + .prog_type = BPF_PROG_TYPE_XDP, + .result = REJECT, + .errstr = "R0 invalid mem access 'map_value_or_null'", +},