On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote: > Add verifier coverage for the three cases affected by preserving the full > pointer state across scalar += pointer: stack frame number inheritance, > readonly-untrusted memory access, and dynptr data-slice invalidation. > > Signed-off-by: Yiyang Chen <[email protected]> > ---
Acked-by: Eduard Zingerman <[email protected]> > .../testing/selftests/bpf/progs/dynptr_fail.c | 31 ++++++++++++++ > .../bpf/progs/mem_rdonly_untrusted.c | 17 ++++++++ > .../bpf/progs/verifier_basic_stack.c | 41 +++++++++++++++++++ > 3 files changed, 89 insertions(+) > > diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c > b/tools/testing/selftests/bpf/progs/dynptr_fail.c > index 94489ac64da8e..7da4266bae09b 100644 > --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c > +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c > @@ -1635,6 +1635,37 @@ static int callback(__u32 index, void *data) > return 0; > } > > +/* A commuted add should preserve the parent id of a dynptr data slice. > + */ Nit: comments style is: /* foo */ or /* * foo * bar */ > +SEC("?raw_tp") > +__failure __msg("invalid mem access 'scalar'") > +int dynptr_slice_commuted_invalidate(void *ctx) > +{ > + struct bpf_dynptr ptr; > + __u32 *slice, *derived; > + > + bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(__u32), 0, &ptr); > + > + slice = bpf_dynptr_data(&ptr, 0, sizeof(__u32)); > + if (!slice) > + goto done; > + > + asm volatile ("%[dst] = 0;" > + "%[dst] += %[src];" > + "%[src] = 0;" Nit: no need to zero out 'src'? > + : [dst]"=&r"(derived), [src]"+r"(slice) > + : > + : "memory"); > + > + bpf_ringbuf_discard_dynptr(&ptr, 0); > + val = *derived; > + return 0; > + > +done: > + bpf_ringbuf_discard_dynptr(&ptr, 0); > + return 0; > +} > + ...
