Two programs: - zext_narrowing_spill_keeps_link: a 32-bit spill of a wide register, filled back out, still follows a later narrowing of the source - zext_narrowing_spill_byte_no_link: a 1-byte spill forms no link, since the relation is not expressible
Signed-off-by: Vineet Gupta <[email protected]> --- v2: new, with 12/13. .../bpf/progs/verifier_linked_scalars.c | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/tools/testing/selftests/bpf/progs/verifier_linked_scalars.c b/tools/testing/selftests/bpf/progs/verifier_linked_scalars.c index e8a44e7579c8..ca7471f0293d 100644 --- a/tools/testing/selftests/bpf/progs/verifier_linked_scalars.c +++ b/tools/testing/selftests/bpf/progs/verifier_linked_scalars.c @@ -1048,6 +1048,60 @@ __naked void zext_fill_byte_forms_no_link(void) : __clobber_all); } +/* + * A narrowing spill stores only the source's low 32 bits, so the slot is their + * zero-extension. A later narrowing of the source must still reach anything + * filled back out of that slot. + */ +SEC("socket") +__success +__naked void zext_narrowing_spill_keeps_link(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + r6 = r0; \ + call %[bpf_get_prandom_u32]; \ + r0 <<= 32; \ + r6 |= r0; /* r6 = full 64-bit unknown */ \ + *(u32 *)(r10 - 8) = r6; /* narrowing spill, forms the link */ \ + r2 = *(u32 *)(r10 - 8); /* fill it back */ \ + if w6 != 0 goto 1f; /* narrows r6, propagates to r2 */ \ + if r2 == 0 goto 1f; \ + r0 /= 0; \ +1: \ + r0 = 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +/* + * A sub-word spill is below the low-32 model, so no link is formed there. + */ +SEC("socket") +__failure __msg("div by zero") +__naked void zext_narrowing_spill_byte_no_link(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + r6 = r0; \ + call %[bpf_get_prandom_u32]; \ + r0 <<= 32; \ + r6 |= r0; \ + *(u8 *)(r10 - 8) = r6; /* 1-byte spill: no link */ \ + r2 = *(u8 *)(r10 - 8); \ + if w6 != 0 goto 1f; \ + if r2 == 0 goto 1f; /* not deduced */ \ + r0 /= 0; \ +1: \ + r0 = 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32) + : __clobber_all); +} + #ifdef CAN_USE_MOVSX /* -- 2.53.0-Meta
