selftests/bpf: Test __szk precision with a NULL nullable buffer

When a nullable buffer is passed as NULL, check_mem_size_reg() is skipped,
so the __szk memory size must be marked precise through the scalar argument
path instead. Exercise this with bpf_dynptr_slice() and a NULL buffer.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20260801074633.1595644-12-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Amery Hung 2026-08-01 00:46:26 -07:00 committed by Kumar Kartikeya Dwivedi
parent f16e80c2c4
commit f88caee62e
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
2 changed files with 30 additions and 0 deletions

View File

@ -68,6 +68,7 @@
#include "verifier_masking.skel.h"
#include "verifier_may_goto_1.skel.h"
#include "verifier_may_goto_2.skel.h"
#include "verifier_mem_size_reg.skel.h"
#include "verifier_meta_access.skel.h"
#include "verifier_movsx.skel.h"
#include "verifier_mtu.skel.h"
@ -223,6 +224,7 @@ void test_verifier_map_ret_val(void) { RUN(verifier_map_ret_val); }
void test_verifier_masking(void) { RUN(verifier_masking); }
void test_verifier_may_goto_1(void) { RUN(verifier_may_goto_1); }
void test_verifier_may_goto_2(void) { RUN(verifier_may_goto_2); }
void test_verifier_mem_size_reg(void) { RUN(verifier_mem_size_reg); }
void test_verifier_meta_access(void) { RUN(verifier_meta_access); }
void test_verifier_movsx(void) { RUN(verifier_movsx); }
void test_verifier_mul(void) { RUN(verifier_mul); }

View File

@ -0,0 +1,28 @@
// SPDX-License-Identifier: GPL-2.0
#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
#include "bpf_kfuncs.h"
char _license[] SEC("license") = "GPL";
/*
* The __szk size of a kfunc memory/size pair must be marked precise even when
* the nullable buffer is passed as NULL.
*/
SEC("?tc")
__success __log_level(2)
__msg("mark_precise: frame0: regs=r4 stack= before")
int dynptr_slice_null_buf_size_precise(struct __sk_buff *skb)
{
struct bpf_dynptr dptr;
char *p;
bpf_dynptr_from_skb(skb, 0, &dptr);
p = bpf_dynptr_slice(&dptr, 0, NULL, 8);
if (p)
return p[0];
return 0;
}