Re: [PATCH bpf-next 13/18] selftests/bpf: Add verifier tests for stack argument validation

[Yonghong Song <yonghong.song@linux.dev>]

On 4/24/26 10:48 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> new file mode 100644
>> index 000000000000..6b596ad63774
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> @@ -0,0 +1,456 @@
> [ ... ]
>
>> +SEC("tc")
>> +__description("stack_arg: pruning with different stack arg types")
>> +__failure
>> +__flag(BPF_F_TEST_STATE_FREQ)
>> +__msg("invalid mem access 'scalar'")
>> +__naked void stack_arg_pruning_type_mismatch(void)
>> +{
>> +	asm volatile (
>> +		"call %[bpf_get_prandom_u32];"
>> +		"r6 = r0;"
>> +		/* local = 0 on program stack */
>> +		"r7 = 0;"
>> +		"*(u64 *)(r10 - 8) = r7;"
>> +		/* Branch based on random value */
>> +		"if r6 s> 3 goto l0_%=;"
>> +		/* Path 1: store stack pointer to outgoing arg6 */
>> +		"r1 = r10;"
>> +		"r1 += -8;"
>> +		"*(u64 *)(r11 - 8) = r1;"
>> +		"goto l1_%=;"
>> +	"l0_%=:"
>> +		/* Path 2: store scalar to outgoing arg6 */
>> +		"*(u64 *)(r11 - 8) = 42;"
>> +	"l1_%=:"
>> +		/* Call subprog that dereferences arg6 */
>> +		"r1 = r6;"
>> +		"r2 = 0;"
>> +		"r3 = 0;"
>> +		"r4 = 0;"
>> +		"r5 = 0;"
>> +		"call subprog_deref_arg6;"
>> +		"exit;"
>> +		:: __imm(bpf_get_prandom_u32)
>> +		: __clobber_all
>> +	);
>> +}
> Does the error message string match the expected register output?
>
> During v6 review, sashiko-bot raised a concern about test fragility:
> since subprog_deref_arg6 is standard C (not __naked), LLVM determines
> which register is used to dereference f. If a future LLVM version
> chooses a different register, the verifier error will mention that
> register instead of R1, causing the test to fail.
>
> You acknowledged the issue and said you would use a regex like
> __msg("R{{[0-9]}} invalid mem access 'scalar'") to match the register
> dynamically. However, the current code uses __msg("invalid mem access
> 'scalar'") without any register prefix.
>
> The same pattern appears in stack_arg_release_ref,
> stack_arg_stale_pkt_ptr, and stack_arg_null_propagation_fail. Should
> these tests use the regex pattern to avoid compiler-dependent failures,
> or be rewritten to make subprog_deref_arg6 a __naked function?

Yes, I removed the "R{{[0-9]}}' stuff since I thought "R{{[0-9]}}"
will be equivalent to ignore it since we do not have a definite register
any more.

There is an option to use __naked function for subprog_deref_arg6
(see patch "selftests/bpf: Add precision backtracking test for stack arguments").
It becomes more complicated so I prefer the current result.

>
> Reference:
> https://lore.kernel.org/bpf/20260419172100.A89FEC2BCAF@smtp.kernel.org/
>
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24902767240