Commit b0226542 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 



Daniel Borkmann says:

====================
pull-request: bpf 2021-04-17

The following pull-request contains BPF updates for your *net* tree.

We've added 10 non-merge commits during the last 9 day(s) which contain
a total of 8 files changed, 175 insertions(+), 111 deletions(-).

The main changes are:

1) Fix a potential NULL pointer dereference in libbpf's xsk
   umem handling, from Ciara Loftus.

2) Mitigate a speculative oob read of up to map value size by
   tightening the masking window, from Daniel Borkmann.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6b389c16 d7a50913

kernel/bpf/verifier.c

+156 −74
Original line number Diff line number Diff line
@@ -5856,40 +5856,51 @@ static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env) 
	return &env->insn_aux_data[env->insn_idx];

}



enum {

	REASON_BOUNDS	= -1,

	REASON_TYPE	= -2,

	REASON_PATHS	= -3,

	REASON_LIMIT	= -4,

	REASON_STACK	= -5,

};



static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,

			      u32 *ptr_limit, u8 opcode, bool off_is_neg)

			      const struct bpf_reg_state *off_reg,

			      u32 *alu_limit, u8 opcode)

{

	bool off_is_neg = off_reg->smin_value < 0;

	bool mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||

			    (opcode == BPF_SUB && !off_is_neg);

	u32 off, max;

	u32 max = 0, ptr_limit = 0;



	if (!tnum_is_const(off_reg->var_off) &&

	    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))

		return REASON_BOUNDS;



	switch (ptr_reg->type) {

	case PTR_TO_STACK:

		/* Offset 0 is out-of-bounds, but acceptable start for the

		 * left direction, see BPF_REG_FP.

		 * left direction, see BPF_REG_FP. Also, unknown scalar

		 * offset where we would need to deal with min/max bounds is

		 * currently prohibited for unprivileged.

		 */

		max = MAX_BPF_STACK + mask_to_left;

		/* Indirect variable offset stack access is prohibited in

		 * unprivileged mode so it's not handled here.

		 */

		off = ptr_reg->off + ptr_reg->var_off.value;

		if (mask_to_left)

			*ptr_limit = MAX_BPF_STACK + off;

		else

			*ptr_limit = -off - 1;

		return *ptr_limit >= max ? -ERANGE : 0;

		ptr_limit = -(ptr_reg->var_off.value + ptr_reg->off);

		break;

	case PTR_TO_MAP_VALUE:

		max = ptr_reg->map_ptr->value_size;

		if (mask_to_left) {

			*ptr_limit = ptr_reg->umax_value + ptr_reg->off;

		} else {

			off = ptr_reg->smin_value + ptr_reg->off;

			*ptr_limit = ptr_reg->map_ptr->value_size - off - 1;

		}

		return *ptr_limit >= max ? -ERANGE : 0;

		ptr_limit = (mask_to_left ?

			     ptr_reg->smin_value :

			     ptr_reg->umax_value) + ptr_reg->off;

		break;

	default:

		return -EINVAL;

		return REASON_TYPE;

	}



	if (ptr_limit >= max)

		return REASON_LIMIT;

	*alu_limit = ptr_limit;

	return 0;

}



static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
@@ -5907,7 +5918,7 @@ static int update_alu_sanitation_state(struct bpf_insn_aux_data *aux, 
	if (aux->alu_state &&

	    (aux->alu_state != alu_state ||

	     aux->alu_limit != alu_limit))

		return -EACCES;

		return REASON_PATHS;



	/* Corresponding fixup done in fixup_bpf_calls(). */

	aux->alu_state = alu_state;
@@ -5926,14 +5937,22 @@ static int sanitize_val_alu(struct bpf_verifier_env *env, 
	return update_alu_sanitation_state(aux, BPF_ALU_NON_POINTER, 0);

}



static bool sanitize_needed(u8 opcode)

{

	return opcode == BPF_ADD || opcode == BPF_SUB;

}



static int sanitize_ptr_alu(struct bpf_verifier_env *env,

			    struct bpf_insn *insn,

			    const struct bpf_reg_state *ptr_reg,

			    const struct bpf_reg_state *off_reg,

			    struct bpf_reg_state *dst_reg,

			    bool off_is_neg)

			    struct bpf_insn_aux_data *tmp_aux,

			    const bool commit_window)

{

	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux;

	struct bpf_verifier_state *vstate = env->cur_state;

	struct bpf_insn_aux_data *aux = cur_aux(env);

	bool off_is_neg = off_reg->smin_value < 0;

	bool ptr_is_dst_reg = ptr_reg == dst_reg;

	u8 opcode = BPF_OP(insn->code);

	u32 alu_state, alu_limit;
@@ -5951,18 +5970,33 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	if (vstate->speculative)

		goto do_sim;



	err = retrieve_ptr_limit(ptr_reg, off_reg, &alu_limit, opcode);

	if (err < 0)

		return err;



	if (commit_window) {

		/* In commit phase we narrow the masking window based on

		 * the observed pointer move after the simulated operation.

		 */

		alu_state = tmp_aux->alu_state;

		alu_limit = abs(tmp_aux->alu_limit - alu_limit);

	} else {

		alu_state  = off_is_neg ? BPF_ALU_NEG_VALUE : 0;

		alu_state |= ptr_is_dst_reg ?

			     BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;



	err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);

	if (err < 0)

		return err;

	}



	err = update_alu_sanitation_state(aux, alu_state, alu_limit);

	if (err < 0)

		return err;

do_sim:

	/* If we're in commit phase, we're done here given we already

	 * pushed the truncated dst_reg into the speculative verification

	 * stack.

	 */

	if (commit_window)

		return 0;



	/* Simulate and find potential out-of-bounds access under

	 * speculative execution from truncation as a result of

	 * masking when off was not within expected range. If off
@@ -5979,7 +6013,46 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);

	if (!ptr_is_dst_reg && ret)

		*dst_reg = tmp;

	return !ret ? -EFAULT : 0;

	return !ret ? REASON_STACK : 0;

}



static int sanitize_err(struct bpf_verifier_env *env,

			const struct bpf_insn *insn, int reason,

			const struct bpf_reg_state *off_reg,

			const struct bpf_reg_state *dst_reg)

{

	static const char *err = "pointer arithmetic with it prohibited for !root";

	const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";

	u32 dst = insn->dst_reg, src = insn->src_reg;



	switch (reason) {

	case REASON_BOUNDS:

		verbose(env, "R%d has unknown scalar with mixed signed bounds, %s\n",

			off_reg == dst_reg ? dst : src, err);

		break;

	case REASON_TYPE:

		verbose(env, "R%d has pointer with unsupported alu operation, %s\n",

			off_reg == dst_reg ? src : dst, err);

		break;

	case REASON_PATHS:

		verbose(env, "R%d tried to %s from different maps, paths or scalars, %s\n",

			dst, op, err);

		break;

	case REASON_LIMIT:

		verbose(env, "R%d tried to %s beyond pointer bounds, %s\n",

			dst, op, err);

		break;

	case REASON_STACK:

		verbose(env, "R%d could not be pushed for speculative verification, %s\n",

			dst, err);

		break;

	default:

		verbose(env, "verifier internal error: unknown reason (%d)\n",

			reason);

		break;

	}



	return -EACCES;

}



/* check that stack access falls within stack limits and that 'reg' doesn't
@@ -6016,6 +6089,37 @@ static int check_stack_access_for_ptr_arithmetic( 
	return 0;

}



static int sanitize_check_bounds(struct bpf_verifier_env *env,

				 const struct bpf_insn *insn,

				 const struct bpf_reg_state *dst_reg)

{

	u32 dst = insn->dst_reg;



	/* For unprivileged we require that resulting offset must be in bounds

	 * in order to be able to sanitize access later on.

	 */

	if (env->bypass_spec_v1)

		return 0;



	switch (dst_reg->type) {

	case PTR_TO_STACK:

		if (check_stack_access_for_ptr_arithmetic(env, dst, dst_reg,

					dst_reg->off + dst_reg->var_off.value))

			return -EACCES;

		break;

	case PTR_TO_MAP_VALUE:

		if (check_map_access(env, dst, dst_reg->off, 1, false)) {

			verbose(env, "R%d pointer arithmetic of map value goes out of range, "

				"prohibited for !root\n", dst);

			return -EACCES;

		}

		break;

	default:

		break;

	}



	return 0;

}



/* Handles arithmetic on a pointer and a scalar: computes new min/max and var_off.

 * Caller should also handle BPF_MOV case separately.
@@ -6035,8 +6139,9 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
	    smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;

	u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,

	    umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;

	u32 dst = insn->dst_reg, src = insn->src_reg;

	struct bpf_insn_aux_data tmp_aux = {};

	u8 opcode = BPF_OP(insn->code);

	u32 dst = insn->dst_reg;

	int ret;



	dst_reg = &regs[dst];
@@ -6084,13 +6189,6 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		verbose(env, "R%d pointer arithmetic on %s prohibited\n",

			dst, reg_type_str[ptr_reg->type]);

		return -EACCES;

	case PTR_TO_MAP_VALUE:

		if (!env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {

			verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",

				off_reg == dst_reg ? dst : src);

			return -EACCES;

		}

		fallthrough;

	default:

		break;

	}
@@ -6108,13 +6206,15 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
	/* pointer types do not carry 32-bit bounds at the moment. */

	__mark_reg32_unbounded(dst_reg);



	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,

				       &tmp_aux, false);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}



	switch (opcode) {

	case BPF_ADD:

		ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);

		if (ret < 0) {

			verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);

			return ret;

		}

		/* We can take a fixed offset as long as it doesn't overflow

		 * the s32 'off' field

		 */
@@ -6165,11 +6265,6 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		}

		break;

	case BPF_SUB:

		ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);

		if (ret < 0) {

			verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);

			return ret;

		}

		if (dst_reg == off_reg) {

			/* scalar -= pointer.  Creates an unknown scalar */

			verbose(env, "R%d tried to subtract pointer from scalar\n",
@@ -6250,21 +6345,13 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
	__reg_deduce_bounds(dst_reg);

	__reg_bound_offset(dst_reg);



	/* For unprivileged we require that resulting offset must be in bounds

	 * in order to be able to sanitize access later on.

	 */

	if (!env->bypass_spec_v1) {

		if (dst_reg->type == PTR_TO_MAP_VALUE &&

		    check_map_access(env, dst, dst_reg->off, 1, false)) {

			verbose(env, "R%d pointer arithmetic of map value goes out of range, "

				"prohibited for !root\n", dst);

	if (sanitize_check_bounds(env, insn, dst_reg) < 0)

		return -EACCES;

		} else if (dst_reg->type == PTR_TO_STACK &&

			   check_stack_access_for_ptr_arithmetic(

				   env, dst, dst_reg, dst_reg->off +

				   dst_reg->var_off.value)) {

			return -EACCES;

		}

	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,

				       &tmp_aux, true);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}



	return 0;
@@ -6858,9 +6945,8 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, 
	s32 s32_min_val, s32_max_val;

	u32 u32_min_val, u32_max_val;

	u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;

	u32 dst = insn->dst_reg;

	int ret;

	bool alu32 = (BPF_CLASS(insn->code) != BPF_ALU64);

	int ret;



	smin_val = src_reg.smin_value;

	smax_val = src_reg.smax_value;
@@ -6902,6 +6988,12 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, 
		return 0;

	}



	if (sanitize_needed(opcode)) {

		ret = sanitize_val_alu(env, insn);

		if (ret < 0)

			return sanitize_err(env, insn, ret, NULL, NULL);

	}



	/* Calculate sign/unsigned bounds and tnum for alu32 and alu64 bit ops.

	 * There are two classes of instructions: The first class we track both

	 * alu32 and alu64 sign/unsigned bounds independently this provides the
@@ -6918,21 +7010,11 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, 
	 */

	switch (opcode) {

	case BPF_ADD:

		ret = sanitize_val_alu(env, insn);

		if (ret < 0) {

			verbose(env, "R%d tried to add from different pointers or scalars\n", dst);

			return ret;

		}

		scalar32_min_max_add(dst_reg, &src_reg);

		scalar_min_max_add(dst_reg, &src_reg);

		dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);

		break;

	case BPF_SUB:

		ret = sanitize_val_alu(env, insn);

		if (ret < 0) {

			verbose(env, "R%d tried to sub from different pointers or scalars\n", dst);

			return ret;

		}

		scalar32_min_max_sub(dst_reg, &src_reg);

		scalar_min_max_sub(dst_reg, &src_reg);

		dst_reg->var_off = tnum_sub(dst_reg->var_off, src_reg.var_off);

tools/lib/bpf/xsk.c

+3 −2
Original line number Diff line number Diff line
@@ -852,18 +852,19 @@ int xsk_socket__create_shared(struct xsk_socket **xsk_ptr, 
			      struct xsk_ring_cons *comp,

			      const struct xsk_socket_config *usr_config)

{

	bool unmap, rx_setup_done = false, tx_setup_done = false;

	void *rx_map = NULL, *tx_map = NULL;

	struct sockaddr_xdp sxdp = {};

	struct xdp_mmap_offsets off;

	struct xsk_socket *xsk;

	struct xsk_ctx *ctx;

	int err, ifindex;

	bool unmap = umem->fill_save != fill;

	bool rx_setup_done = false, tx_setup_done = false;



	if (!umem || !xsk_ptr || !(rx || tx))

		return -EFAULT;



	unmap = umem->fill_save != fill;



	xsk = calloc(1, sizeof(*xsk));

	if (!xsk)

		return -ENOMEM;

tools/testing/selftests/bpf/verifier/bounds.c

+0 −5
Original line number Diff line number Diff line
@@ -261,8 +261,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	/* not actually fully unbounded, but the bound is very high */

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root",

	.result_unpriv = REJECT,

	.errstr = "value -4294967168 makes map_value pointer be out of bounds",

	.result = REJECT,

},
@@ -298,9 +296,6 @@ 
	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_8b = { 3 },

	/* not actually fully unbounded, but the bound is very high */

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root",

	.result_unpriv = REJECT,

	.errstr = "value -4294967168 makes map_value pointer be out of bounds",

	.result = REJECT,

},

tools/testing/selftests/bpf/verifier/bounds_deduction.c

+11 −10
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "R0 tried to subtract pointer from scalar",

	.result = REJECT,

},
@@ -21,7 +21,7 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 1,
@@ -34,22 +34,23 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "R0 tried to subtract pointer from scalar",

	.result = REJECT,

},

{

	"check deducing bounds from const, 4",

	.insns = {

		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),

		BPF_EXIT_INSN(),

		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),

		BPF_EXIT_INSN(),

		BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),

		BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R6 has pointer with unsupported alu operation",

	.result_unpriv = REJECT,

	.result = ACCEPT,

},
@@ -61,7 +62,7 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "R0 tried to subtract pointer from scalar",

	.result = REJECT,

},
@@ -74,7 +75,7 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "R0 tried to subtract pointer from scalar",

	.result = REJECT,

},
@@ -88,7 +89,7 @@ 
			    offsetof(struct __sk_buff, mark)),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "dereference of modified ctx ptr",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
@@ -103,7 +104,7 @@ 
			    offsetof(struct __sk_buff, mark)),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "dereference of modified ctx ptr",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
@@ -116,7 +117,7 @@ 
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

		BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types",

	.errstr_unpriv = "R1 has pointer with unsupported alu operation",

	.errstr = "R0 tried to subtract pointer from scalar",

	.result = REJECT,

},

tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c

+0 −13
Original line number Diff line number Diff line
@@ -19,7 +19,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -43,7 +42,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -69,7 +67,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -94,7 +91,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -141,7 +137,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -210,7 +205,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -260,7 +254,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -287,7 +280,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -313,7 +305,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -342,7 +333,6 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R7 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -372,7 +362,6 @@ 
	},

	.fixup_map_hash_8b = { 4 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

},

{
@@ -400,7 +389,5 @@ 
	},

	.fixup_map_hash_8b = { 3 },

	.errstr = "unbounded min value",

	.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",

	.result = REJECT,

	.result_unpriv = REJECT,

},