Re: [PATCH bpf v2 2/2] selftests/bpf: Cover stack nospec slot indexing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `__xlated_unpriv` expectation strings contain an extra space in the frame pointer offsets (`r10 - 4` and `r10 - 8`), which will cause the strict substring match against the verifier disassembly to fail.
--

commit 14e5b2945bb48da1c1729feb483806b25ccac3aa
Author: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>

selftests/bpf: Cover stack nospec slot indexing

This commit adds a verifier test for fixed-offset stack writes where two
4-byte stores initialize opposite halves of the same stack slot. The test
runs through the unprivileged loader and expects both writes to emit
nospec instructions.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_unpriv.c b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
> index c16f8382cf17d..d54e5b59e62e5 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_unpriv.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
[ ... ]
> @@ -976,4 +976,26 @@ l0_%=:	exit;						\
>  	: __clobber_all);
>  }
>  
> +SEC("socket")
> +__description("unpriv: Spectre v4 stack write slot index")
> +__success __success_unpriv
> +__retval(0)
> +#ifdef SPEC_V4
> +__xlated_unpriv("r0 = 0")
> +__xlated_unpriv("*(u32 *)(r10 - 4) = r0")

[Severity: Medium]
Will this test fail due to the extra space in the offset? The BPF
disassembler typically formats negative offsets without a space after the
minus sign, like *(u32 *)(r10 -4) = r0. Since the selftest framework uses
exact substring matching for the __xlated_unpriv assertions, expecting
(r10 - 4) and (r10 - 8) might cause a spurious test failure.

> +__xlated_unpriv("nospec")
> +__xlated_unpriv("*(u32 *)(r10 - 8) = r0")
> +__xlated_unpriv("nospec")
> +__xlated_unpriv("exit")
> +#endif
> +__naked void stack_write_nospec_slot_index(void)
> +{
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618-f01-11-stack-nospec-slot-index-v2-0-ede9495359b6@mails.tsinghua.edu.cn?part=2