github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Cover half-slot cleanup of pointer spills

Browse Source 
Add a verifier regression test for a pointer spill whose high half is
cleaned dead while the low half remains live. Force checkpoint creation
with BPF_F_TEST_STATE_FREQ and assert the verifier log reaches the
checkpoint and the subsequent 32-bit fill before rejecting the partial fill
from a non-scalar spill.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260617-f01-06-half-slot-pointer-spill-v2-2-42b9cdc3cf64@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Nuoqi Gui 2026-06-17 23:20:21 +08:00 committed by Alexei Starovoitov
parent 3a354149bc
commit 8816d94303
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
tools/testing/selftests/bpf/progs/verifier_spill_fill.c
View File

@ -1359,4 +1359,22 @@ __naked void var_off_write_over_scalar_spill(void)
: __clobber_all);
}
SEC("socket")
__description("partial fill from cleaned pointer spill")
__failure
__log_level(2)
__msg("1: (05) goto pc+0")
__msg("2: (61) r0 = *(u32 *)(r10 -4)")
__msg("invalid size of register fill")
__flag(BPF_F_TEST_STATE_FREQ)
__naked void partial_fill_from_cleaned_pointer_spill(void)
{
/* Spill R1(ctx), then force a checkpoint and half-slot cleanup. */
asm volatile ("*(u64 *)(r10 - 8) = r1;"
"goto +0;"
"r0 = *(u32 *)(r10 - 4);"
"exit;"
::: __clobber_all);
}
char _license[] SEC("license") = "GPL";