Re: [PATCH bpf-next v3 3/3] selftests/bpf: Cover commuted pointer state propagation

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote:
> Add verifier coverage for the three cases affected by preserving the full
> pointer state across scalar += pointer: stack frame number inheritance,
> readonly-untrusted memory access, and dynptr data-slice invalidation.
> 
> Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

>  .../testing/selftests/bpf/progs/dynptr_fail.c | 31 ++++++++++++++
>  .../bpf/progs/mem_rdonly_untrusted.c          | 17 ++++++++
>  .../bpf/progs/verifier_basic_stack.c          | 41 +++++++++++++++++++
>  3 files changed, 89 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> index 94489ac64da8e..7da4266bae09b 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> @@ -1635,6 +1635,37 @@ static int callback(__u32 index, void *data)
>          return 0;
>  }
>  
> +/* A commuted add should preserve the parent id of a dynptr data slice.
> + */

Nit: comments style is:

  /* foo */

or

  /*
   * foo
   * bar
   */

> +SEC("?raw_tp")
> +__failure __msg("invalid mem access 'scalar'")
> +int dynptr_slice_commuted_invalidate(void *ctx)
> +{
> +	struct bpf_dynptr ptr;
> +	__u32 *slice, *derived;
> +
> +	bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(__u32), 0, &ptr);
> +
> +	slice = bpf_dynptr_data(&ptr, 0, sizeof(__u32));
> +	if (!slice)
> +		goto done;
> +
> +	asm volatile ("%[dst] = 0;"
> +		"%[dst] += %[src];"
> +		"%[src] = 0;"

Nit: no need to zero out 'src'?

> +		: [dst]"=&r"(derived), [src]"+r"(slice)
> +		:
> +		: "memory");
> +
> +	bpf_ringbuf_discard_dynptr(&ptr, 0);
> +	val = *derived;
> +	return 0;
> +
> +done:
> +	bpf_ringbuf_discard_dynptr(&ptr, 0);
> +	return 0;
> +}
> +

...