mirror of
https://github.com/torvalds/linux.git
synced 2026-06-04 04:23:35 +02:00
a24a2dda70
This is a test case minimized from a syzbot reproducer from [1].
The test case triggers verifier.c:maybe_exit_scc() w/o
preceding call to verifier.c:maybe_enter_scc() on a speculative
symbolic execution path.
Here is verifier log for the test case:
Live regs before insn:
0: .......... (b7) r0 = 100
1 1: 0......... (7b) *(u64 *)(r10 -512) = r0
1 2: 0......... (b5) if r0 <= 0x0 goto pc-2
3: 0......... (95) exit
0: R1=ctx() R10=fp0
0: (b7) r0 = 100 ; R0_w=100
1: (7b) *(u64 *)(r10 -512) = r0 ; R0_w=100 R10=fp0 fp-512_w=100
2: (b5) if r0 <= 0x0 goto pc-2
mark_precise: ...
2: R0_w=100
3: (95) exit
from 2 to 1 (speculative execution): R0_w=scalar() R1=ctx() R10=fp0 fp-512_w=100
1: R0_w=scalar() R1=ctx() R10=fp0 fp-512_w=100
1: (7b) *(u64 *)(r10 -512) = r0
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
- Non-speculative execution path 0-3 does not allocate any checkpoints
(and hence does not call maybe_enter_scc()), and schedules a
speculative jump from 2 to 1.
- Speculative execution path stops immediately because of an infinite
loop detection and triggers verifier.c:update_branch_counts() ->
maybe_exit_scc() calls.
[1] https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250916212251.3490455-2-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
||
|---|---|---|
| .. | ||
| acct | ||
| alsa | ||
| amd-pstate | ||
| arm64 | ||
| bpf | ||
| breakpoints | ||
| cachestat | ||
| capabilities | ||
| cgroup | ||
| clone3 | ||
| connector | ||
| core | ||
| coredump | ||
| cpu-hotplug | ||
| cpufreq | ||
| damon | ||
| devices | ||
| dma | ||
| dmabuf-heaps | ||
| drivers | ||
| dt | ||
| efivarfs | ||
| exec | ||
| fchmodat2 | ||
| filelock | ||
| filesystems | ||
| firmware | ||
| fpu | ||
| ftrace | ||
| futex | ||
| gpio | ||
| hid | ||
| ia64 | ||
| intel_pstate | ||
| iommu | ||
| ipc | ||
| ir | ||
| kcmp | ||
| kexec | ||
| kho | ||
| kmod | ||
| kselftest | ||
| kselftest_harness | ||
| kvm | ||
| landlock | ||
| lib | ||
| livepatch | ||
| lkdtm | ||
| locking | ||
| lsm | ||
| media_tests | ||
| membarrier | ||
| memfd | ||
| memory-hotplug | ||
| mincore | ||
| mm | ||
| module | ||
| mount | ||
| mount_setattr | ||
| move_mount_set_group | ||
| mqueue | ||
| mseal_system_mappings | ||
| nci | ||
| net | ||
| nolibc | ||
| ntb | ||
| openat2 | ||
| pci_endpoint | ||
| pcie_bwctrl | ||
| perf_events | ||
| pid_namespace | ||
| pidfd | ||
| power_supply | ||
| powerpc | ||
| prctl | ||
| proc | ||
| pstore | ||
| ptp | ||
| ptrace | ||
| rcutorture | ||
| resctrl | ||
| ring-buffer | ||
| riscv | ||
| rlimits | ||
| rseq | ||
| rtc | ||
| rust | ||
| safesetid | ||
| sched | ||
| sched_ext | ||
| seccomp | ||
| sgx | ||
| signal | ||
| size | ||
| sparc64 | ||
| splice | ||
| static_keys | ||
| sync | ||
| syscall_user_dispatch | ||
| sysctl | ||
| tc-testing | ||
| tdx | ||
| thermal/intel | ||
| timens | ||
| timers | ||
| tmpfs | ||
| tpm2 | ||
| tty | ||
| turbostat | ||
| ublk | ||
| uevent | ||
| user_events | ||
| vDSO | ||
| vsock | ||
| watchdog | ||
| wireguard | ||
| x86 | ||
| zram | ||
| .gitignore | ||
| gen_kselftest_tar.sh | ||
| kselftest_deps.sh | ||
| kselftest_harness.h | ||
| kselftest_install.sh | ||
| kselftest_module.h | ||
| kselftest.h | ||
| lib.mk | ||
| Makefile | ||
| run_kselftest.sh | ||