Skip to content

Commit ea19897

Browse files
ADSWT518Alexei Starovoitov
authored andcommitted
selftests/bpf: Add test for BPF_END register ID reset
Add a test case to ensure that BPF_END operations correctly break register's scalar ID ties. The test creates a scenario where r1 is a copy of r0, r0 undergoes a byte swap, and then r0 is checked against a constant. - Without the fix in the verifier, the bounds learned from r0 are incorrectly propagated to r1, making the verifier believe r1 is bounded and wrongly allowing subsequent pointer arithmetic. - With the fix, r1 remains an unbounded scalar, and the verifier correctly rejects the arithmetic operation between the frame pointer and the unbounded register. Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304083228.142016-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
1 parent a3125bc commit ea19897

1 file changed

Lines changed: 22 additions & 0 deletions

File tree

tools/testing/selftests/bpf/progs/verifier_bswap.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,28 @@ BSWAP_RANGE_TEST(le32_range, "le32", 0x3f00, 0x3f0000)
9191
BSWAP_RANGE_TEST(le64_range, "le64", 0x3f00, 0x3f000000000000)
9292
#endif
9393

94+
SEC("socket")
95+
__description("BSWAP, reset reg id")
96+
__failure __msg("math between fp pointer and register with unbounded min value is not allowed")
97+
__naked void bswap_reset_reg_id(void)
98+
{
99+
asm volatile (" \
100+
call %[bpf_ktime_get_ns]; \
101+
r1 = r0; \
102+
r0 = be16 r0; \
103+
if r0 != 1 goto l0_%=; \
104+
r2 = r10; \
105+
r2 += -512; \
106+
r2 += r1; \
107+
*(u8 *)(r2 + 0) = 0; \
108+
l0_%=: \
109+
r0 = 0; \
110+
exit; \
111+
" :
112+
: __imm(bpf_ktime_get_ns)
113+
: __clobber_all);
114+
}
115+
94116
#else
95117

96118
SEC("socket")

0 commit comments

Comments
 (0)