github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 02:48:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Test pointer bpf_loop iteration count rejection

Browse Source 
Add a verifier test that leaves the raw tracepoint context pointer in R1
when calling bpf_loop(). This is the smallest trigger for the incorrect
precision backtracking: it reuses an existing callback and needs no maps or
userspace setup.

Expect an ordinary scalar-type rejection. Without the verifier fix, the
test instead reaches precision backtracking and reports an internal
"backtracking misuse" error.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260905014735.1452988-3-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
This commit is contained in:
Kumar Kartikeya Dwivedi 2026-09-05 03:47:34 +02:00 committed by Eduard Zingerman
parent c3fd8e5fd1
commit bde8901ea1
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
View File

@ -168,6 +168,23 @@ static int iter_limit_cb(__u32 idx, struct num_context *ctx)
return 0;
}
SEC("?raw_tp")
__failure __msg("R1 type=ctx expected=scalar")
__naked void bpf_loop_reject_pointer(void)
{
asm volatile (
"r2 = %[iter_limit_cb];"
"r3 = 0;"
"r4 = 0;"
"call %[bpf_loop];"
"exit;"
:
: __imm_ptr(iter_limit_cb),
__imm(bpf_loop)
: __clobber_common
);
}
SEC("?raw_tp")
__success
int bpf_loop_iter_limit_ok(void *unused)