diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2026-11-02 05:59:11 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-11-02 17:53:14 +0000 |
| commit | 27f0738d348c386e59c7ed147abdc9b91711f97d (patch) | |
| tree | 5a98d94e79a5edad4fe8acaa749fd12fe4606faa /scripts/basic/split-include.c | |
| parent | 6185d4fc6e64439cad415d9bf527f8ffb3fa3db4 (diff) | |
| download | linux-27f0738d348c386e59c7ed147abdc9b91711f97d.tar.gz linux-27f0738d348c386e59c7ed147abdc9b91711f97d.zip | |
selftests/bpf: Test the join of fp+0 with a value that is not a pointer to stack
A register is r10 on one path and a pointer to a map value on the other
path. A store through it is not a certain write to the stack.
join_of_r10_and_map_value is a valid prog. It reads the slots after the
stores. The join has one branch for "pointer to stack joins other value"
and one branch for the reverse order. The prog has one register for each
order, and it checks in the log that it takes both branches. Without the
fix the slots are dead in front of the stores, and the verifier rejects
the read:
reading from stack off -8+0 size 8, slot poisoned by dead code elimination
In join_of_r10_and_map_value_hidden_store the slot holds a pointer to the
counter of a loop. Without the fix the pointer is lost, and scalar
evolution does not see the store through it. The prog loads, and it
accesses a map value out of bounds.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261102055913.3598414-3-alexei.starovoitov@gmail.com
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions
