From: David Windsor <dwindsor@gmail.com>
To: bpf@vger.kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com,
andrii@kernel.org, martin.lau@linux.dev, eddyz87@gmail.com,
song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org,
sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org,
shuah@kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org, yunwei356@gmail.com,
David Windsor <dwindsor@gmail.com>
Subject: [PATCH bpf 2/2] selftests/bpf: cover bpf_loop() state pruning regression
Date: Thu, 8 Oct 2026 19:36:23 -0400 [thread overview]
Message-ID: <20261008233623.4011127-2-dwindsor@gmail.com> (raw)
In-Reply-To: <20261008233623.4011127-1-dwindsor@gmail.com>
Exercise 18 independent conditional stores to dead callback stack slots,
reproducing the verifier state explosion fixed by the preceding commit.
Signed-off-by: David Windsor <dwindsor@gmail.com>
diff --git a/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c b/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
index 75dd922e4e9f87ebc947ee6e621a789cad10431e..c1c3099a6a20391c8b36b39eedd9cc6ce893d996 100644
--- a/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
+++ b/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
@@ -783,4 +783,62 @@ __naked void check_add_const_regsafe_off(void)
: __clobber_common);
}
+#define DEAD_STACK_SLOT(off) \
+ "call %[bpf_get_prandom_u32];" \
+ "if r0 == 0 goto 1f;" \
+ "*(u64 *)(r10 - " #off ") = 1;" /* dead stack store */ \
+ "goto 2f;" \
+ "1: *(u64 *)(r10 - " #off ") = 2;" /* dead stack store */ \
+ "2:;"
+
+__used __naked
+static void dead_stack_cb(void)
+{
+ asm volatile (
+ DEAD_STACK_SLOT(8)
+ DEAD_STACK_SLOT(16)
+ DEAD_STACK_SLOT(24)
+ DEAD_STACK_SLOT(32)
+ DEAD_STACK_SLOT(40)
+ DEAD_STACK_SLOT(48)
+ DEAD_STACK_SLOT(56)
+ DEAD_STACK_SLOT(64)
+ DEAD_STACK_SLOT(72)
+ DEAD_STACK_SLOT(80)
+ DEAD_STACK_SLOT(88)
+ DEAD_STACK_SLOT(96)
+ DEAD_STACK_SLOT(104)
+ DEAD_STACK_SLOT(112)
+ DEAD_STACK_SLOT(120)
+ DEAD_STACK_SLOT(128)
+ DEAD_STACK_SLOT(136)
+ DEAD_STACK_SLOT(144)
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_get_prandom_u32)
+ : __clobber_all
+ );
+}
+
+#undef DEAD_STACK_SLOT
+
+SEC("?raw_tp")
+__success __flag(BPF_F_TEST_STATE_FREQ) __log_level(4)
+__naked void callback_dead_stack(void)
+{
+ asm volatile (
+ "r1 = 100;"
+ "r2 = dead_stack_cb ll;"
+ "r3 = 0;"
+ "r4 = 0;"
+ "call %[bpf_loop];" /* trigger state pruning */
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_loop)
+ : __clobber_all
+ );
+}
+
char _license[] SEC("license") = "GPL";
--
2.53.0
next prev parent reply other threads:[~2026-10-08 23:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 23:36 [PATCH bpf 1/2] bpf: Fix state pruning regression in bpf_loop() callbacks David Windsor
2026-10-08 23:36 ` David Windsor [this message]
2026-10-14 1:06 ` Eduard Zingerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261008233623.4011127-2-dwindsor@gmail.com \
--to=dwindsor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
--cc=yunwei356@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.