linux-toradex.git/tools/testing/selftests/bpf/progs/verifier_zext.c, branch master Linux kernel for Apalis and Colibri modules selftests/bpf: check zero extension of an arena 32-bit cmpxchg 2026-09-04T01:54:45+00:00 Eduard Zingerman eddyz87@gmail.com 2026-09-03T17:15:41+00:00 54ed91950363c116bec9be1b7015ff2bfa989950 Add a test to verify that destination register of a 32-bit cmpxchg operating on an arena pointer is explicitly zero extended. W/o patch #1 this did not happen. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260903171542.1438050-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> 
Add a test to verify that destination register of a 32-bit cmpxchg
operating on an arena pointer is explicitly zero extended.
W/o patch #1 this did not happen.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260903171542.1438050-3-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
selftests/bpf: Verify zext_dst annotations for various instructions 2026-08-08T09:06:24+00:00 Eduard Zingerman eddyz87@gmail.com 2026-08-07T20:59:36+00:00 8b365b3c68b474a1053ec0755dacdc751578afb0 Includes the following test cases: - a test showing that zero extension flags do not propagate through state pruning in the unpatched kernel. - a 32-bit subregister consumed by MOV32 and ALU32 operations (never zext'ed); - a 64-bit MOV (never zext'ed); - a narrow (32-bit) BPF_LDX load whose result is read as 64-bit; - 32-bit atomic fetch_add and cmpxchg whose result is read as 64-bit; - a CFG case where a 32-bit definition's upper half is used only on one of two branches; - no zext for dead registers; - LD_ABS defines only lower 32 bits, hence needs zext when the result is used as 64-bits; - helper, kfunc and subprogram parameters are considered to use full 64 bits; - a 32-bit subregister consumed by JMP32 (X/K) operations; - a 32-bit subregister consumed by JMP (X/K) operations; - a 64-bit register consumed by both JMP and JMP32 operations (never zext'ed); - ALU64 and address space cast operations on arena pointers; - memory loads using BPF_PROBE_MEM instructions. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-7-b6c270013c77@gmail.com 
Includes the following test cases:

- a test showing that zero extension flags do not propagate through
  state pruning in the unpatched kernel.
- a 32-bit subregister consumed by MOV32 and ALU32 operations
  (never zext'ed);
- a 64-bit MOV (never zext'ed);
- a narrow (32-bit) BPF_LDX load whose result is read as 64-bit;
- 32-bit atomic fetch_add and cmpxchg whose result is read as 64-bit;
- a CFG case where a 32-bit definition's upper half is used only on one
  of two branches;
- no zext for dead registers;
- LD_ABS defines only lower 32 bits, hence needs zext when the result
  is used as 64-bits;
- helper, kfunc and subprogram parameters are considered to use full
  64 bits;
- a 32-bit subregister consumed by JMP32 (X/K) operations;
- a 32-bit subregister consumed by JMP (X/K) operations;
- a 64-bit register consumed by both JMP and JMP32 operations
  (never zext'ed);
- ALU64 and address space cast operations on arena pointers;
- memory loads using BPF_PROBE_MEM instructions.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-7-b6c270013c77@gmail.com