bpf: track accumulator state and reload it when necessary
bpf: track accumulator state and reload it when necessary

It turns out there are a few corner cases where we incorrectly
generate seccomp BPF due to poor accumulator state tracking for each
BPF instruction block.  This patch adds accumulator state tracking
such that we know what any given instruction block expects from the
accumulator and what value it leaves in the accumulator when it is
finished.  This allows us to veryify the accumulator state when
assembling the instruction blocks into the final BPF program and if
necessary we can insert accumulator load/mask instructions to
maintain the proper accumulator state.

Reported-by: Matthew Heon <b9ec3270cf4e91ac388bb1d81bcc7fb682087ac3@redhat.com>
Signed-off-by: Paul Moore <88a1d58bf22a647dce58dd91f9595600dceabba9@redhat.com>
seccomp/libseccomp,seccomp/libseccomp,seccomp/libseccomp