summaryrefslogtreecommitdiff
path: root/scripts/basic/split-include.c
diff options
context:
space:
mode:
authorAlexei Starovoitov <ast@kernel.org>2026-11-02 05:59:11 +0000
committerAlexei Starovoitov <ast@kernel.org>2026-11-02 17:53:14 +0000
commit27f0738d348c386e59c7ed147abdc9b91711f97d (patch)
tree5a98d94e79a5edad4fe8acaa749fd12fe4606faa /scripts/basic/split-include.c
parent6185d4fc6e64439cad415d9bf527f8ffb3fa3db4 (diff)
downloadlinux-27f0738d348c386e59c7ed147abdc9b91711f97d.tar.gz
linux-27f0738d348c386e59c7ed147abdc9b91711f97d.zip
selftests/bpf: Test the join of fp+0 with a value that is not a pointer to stack
A register is r10 on one path and a pointer to a map value on the other path. A store through it is not a certain write to the stack. join_of_r10_and_map_value is a valid prog. It reads the slots after the stores. The join has one branch for "pointer to stack joins other value" and one branch for the reverse order. The prog has one register for each order, and it checks in the log that it takes both branches. Without the fix the slots are dead in front of the stores, and the verifier rejects the read: reading from stack off -8+0 size 8, slot poisoned by dead code elimination In join_of_r10_and_map_value_hidden_store the slot holds a pointer to the counter of a loop. Without the fix the pointer is lost, and scalar evolution does not see the store through it. The prog loads, and it accesses a map value out of bounds. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261102055913.3598414-3-alexei.starovoitov@gmail.com
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions