From: Eduard Zingerman <eddyz87@gmail.com>
To: Jiayuan Chen <jiayuan.chen@linux.dev>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
Shuah Khan <shuah@kernel.org>,
Paul Chaignon <paul.chaignon@gmail.com>,
Amery Hung <ameryhung@gmail.com>,
Shung-Hsi Yu <shung-hsi.yu@suse.com>,
Daniel Wade <danjwade95@gmail.com>,
KaFai Wan <kafai.wan@linux.dev>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org
Subject: Re: [PATCH bpf 2/2] selftests/bpf: Add reg-invariants test for speculative pointer arithmetic
Date: Thu, 20 Aug 2026 11:26:07 -0700 [thread overview]
Message-ID: <502518ed7ac143e2d9e4f588ab33c5c7c1566b84.camel@gmail.com> (raw)
In-Reply-To: <20260819125840.286434-2-jiayuan.chen@linux.dev>
On Wed, 2026-08-19 at 20:58 +0800, Jiayuan Chen wrote:
> An unprivileged socket filter does variable pointer arithmetic on a
> PTR_TO_MAP_VALUE whose offset collapses to a constant. The Spectre-v1
> speculative path used to snapshot the pointer with a const offset and an
> unbounded r32, which tripped reg_bounds_sanity_check() on the following
> register move.
>
> Mark the test __success_unpriv (the speculative path only runs
> unprivileged) and flag it BPF_F_TEST_REG_INVARIANTS so the invariant
> violation becomes a hard load failure. The unprivileged run fails without
> the verifier fix and passes with it:
>
> verifier_bounds/spec_ptr_alu_const_offset @unpriv:FAIL # without fix
> verifier_bounds/spec_ptr_alu_const_offset @unpriv:OK # with fix
>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
...
next prev parent reply other threads:[~2026-08-20 18:26 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 12:58 [PATCH bpf 1/2] bpf: fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Jiayuan Chen
2026-08-19 12:58 ` [PATCH bpf 2/2] selftests/bpf: Add reg-invariants test for " Jiayuan Chen
2026-08-19 13:49 ` bot+bpf-ci
2026-08-20 18:26 ` Eduard Zingerman [this message]
2026-08-19 13:06 ` [PATCH bpf 1/2] bpf: fix REG INVARIANTS VIOLATION on " sashiko-bot
2026-08-20 18:25 ` Eduard Zingerman
2026-08-20 18:45 ` Kumar Kartikeya Dwivedi
2026-08-20 18:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=502518ed7ac143e2d9e4f588ab33c5c7c1566b84.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=danjwade95@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kafai.wan@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=paul.chaignon@gmail.com \
--cc=shuah@kernel.org \
--cc=shung-hsi.yu@suse.com \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.