diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-10-26 16:38:31 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-27 16:26:21 +0000 |
| commit | 8fd732e5a64b5c584b1c8701e6a8bb98da830205 (patch) | |
| tree | 005669bf71b0f6f6142aa68f6d99d830742ea86a /tools/testing | |
| parent | a0137c789774bdc2eff9b1b4525741ed118eeba0 (diff) | |
selftests/bpf: Restore stack pointer subrange pruning coverage
After the clamping changes, r7 returns to the header with [-72, -16]
instead of the narrower [-64, -16], so the test no longer checks subrange
pruning. Assign an invariant fp-16 pointer to r7 in the loop, giving r7 an
ANY SCEV that is not clamped and restoring strict-subrange coverage.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-11-f373aec9825f@gmail.com
Diffstat (limited to 'tools/testing')
| -rw-r--r-- | tools/testing/selftests/bpf/progs/verifier_stack_ptr.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_ptr.c b/tools/testing/selftests/bpf/progs/verifier_stack_ptr.c index dc176f407c36..e6a9021b197b 100644 --- a/tools/testing/selftests/bpf/progs/verifier_stack_ptr.c +++ b/tools/testing/selftests/bpf/progs/verifier_stack_ptr.c @@ -588,32 +588,37 @@ __naked void stack_check_size_512_with_may_goto(void) /* * Verify that old PTR_TO_STACK state is considered a super-set of - * new PTR_TO_STACK state when new variable range is a sub-range - * of the old range, e.g. old [-72, -16] vs new [-64, -16]. + * new PTR_TO_STACK state when the new offset is within the old range, + * e.g. old [-72, -16] vs new {-16}. */ SEC("socket") __success __log_level(2) __flag(BPF_F_TEST_STATE_FREQ) /* - * r7 is widened to [-72, -16] at the loop header (insn 3), - * the loop body sees [-64, -8] after 'r7 += 8' + * r7 is widened to [-72, -16] at the loop header (insn 5), + * the loop body sees [-64, -8] after 'r7 += 8'. */ -__msg("loop header at 3, widening r7 to -72..-16 step 8") +__msg("loop header at 5, widening r7 to -72..-16 step 1") __msg("R7=fp(smin=smin32=-64,smax=smax32=-8") -/* back-edge state is clamped to the widened range and pruned at the header */ -__msg("loop header at 3, clamping r7 to -72..-16 step 8") -__msg("from 5 to 3: safe") -__msg("processed 9 insns") +/* 'r7 = r8' sets r7 to fp-16; its ANY SCEV is not clamped. */ +__msg("R7=fp-16 R8=fp-16 loop_stack=5") +__not_msg("clamping r7") +/* back-edge state is pruned because {-16} is within [-72, -16]. */ +__msg("from 8 to 5: safe") +__msg("processed 12 insns") __naked void stack_ptr_subrange_in_loop(void) { asm volatile (" \ r7 = r10; \ r7 += -72; \ + r8 = r10; \ + r8 += -16; \ r6 = 0; \ - r7 += 8; \ +1: r7 += 8; \ + r7 = r8; \ r6 += 1; \ - if r6 < 8 goto -3; \ + if r6 < 8 goto 1b; \ r0 = 0; \ exit; \ " ::: __clobber_all); |