mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 22:26:55 +00:00
Code Issues Releases Wiki Activity

selftests/bpf: validate STACK_ZERO is preserved on subreg spill

Browse source 
Add tests validating that STACK_ZERO slots are preserved when slot is
partially overwritten with subregister spill.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231205184248.1502704-6-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Andrii Nakryiko 2023-12-05 10:42:43 -08:00 committed by Alexei Starovoitov
parent eaf18febd6
commit b33ceb6a3d
1 changed files with 40 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
tools/testing/selftests/bpf/progs/verifier_spill_fill.c
View file

@ -4,6 +4,7 @@
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
#include <../../../tools/include/linux/filter.h>
struct {
__uint(type, BPF_MAP_TYPE_RINGBUF);
@ -450,4 +451,43 @@ l0_%=: r1 >>= 16; \
: __clobber_all);
}
SEC("raw_tp")
__log_level(2)
__success
__msg("fp-8=0m??mmmm")
__msg("fp-16=00mm??mm")
__msg("fp-24=00mm???m")
__naked void spill_subregs_preserve_stack_zero(void)
{
asm volatile (
"call %[bpf_get_prandom_u32];"
/* 32-bit subreg spill with ZERO, MISC, and INVALID */
".8byte %[fp1_u8_st_zero];" /* ZERO, LLVM-18+: *(u8 *)(r10 -1) = 0; */
"*(u8 *)(r10 -2) = r0;" /* MISC */
/* fp-3 and fp-4 stay INVALID */
"*(u32 *)(r10 -8) = r0;"
/* 16-bit subreg spill with ZERO, MISC, and INVALID */
".8byte %[fp10_u16_st_zero];" /* ZERO, LLVM-18+: *(u16 *)(r10 -10) = 0; */
"*(u16 *)(r10 -12) = r0;" /* MISC */
/* fp-13 and fp-14 stay INVALID */
"*(u16 *)(r10 -16) = r0;"
/* 8-bit subreg spill with ZERO, MISC, and INVALID */
".8byte %[fp18_u16_st_zero];" /* ZERO, LLVM-18+: *(u16 *)(r18 -10) = 0; */
"*(u16 *)(r10 -20) = r0;" /* MISC */
/* fp-21, fp-22, and fp-23 stay INVALID */
"*(u8 *)(r10 -24) = r0;"
"r0 = 0;"
"exit;"
:
: __imm(bpf_get_prandom_u32),
__imm_insn(fp1_u8_st_zero, BPF_ST_MEM(BPF_B, BPF_REG_FP, -1, 0)),
__imm_insn(fp10_u16_st_zero, BPF_ST_MEM(BPF_H, BPF_REG_FP, -10, 0)),
__imm_insn(fp18_u16_st_zero, BPF_ST_MEM(BPF_H, BPF_REG_FP, -18, 0))
: __clobber_all);
}
char _license[] SEC("license") = "GPL";