Re: [PATCH bpf-next v3 2/2] selftests/bpf: Add tests with stack ptr register in conditional jmp

[Eduard Zingerman <eddyz87@gmail.com>]

Yonghong Song <yonghong.song@linux.dev> writes:

[...]

> It does not interact with subprogram due the patch 1. Without patch 1,
> the error will happen (see commit message of patch 1):
>
>   0: (18) r3 = 0x0                      ; R3_w=0
>   2: (85) call pc+2
>   caller:
>    R10=fp0
>   callee:
>    frame1: R1=ctx() R3_w=0 R10=fp0
>   5: frame1: R1=ctx() R3_w=0 R10=fp0
>   ; asm volatile ("                                 \ @ verifier_precision.c:184
>   5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78
>   7: (05) goto pc+0
>   8: (bd) if r2 <= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0
>   9: (35) if r1 >= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()
>   10: (b5) if r2 <= 0x8 goto pc+0
>   mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1
>   mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0
>   mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3
>   mark_precise: frame1: regs=r2,r10 stack= before 7: (05) goto pc+0
>   mark_precise: frame1: regs=r2,r10 stack= before 5: (18) r2 = 0x20202000256c6c78
>   mark_precise: frame1: regs=r10 stack= before 2: (85) call pc+2
>   BUG regs 400

I see, in that case it is a useful test case, thank you.

[...]

>> - both src and dst registers are pointers to stack
>
> I actually thought about this as well, e.g.,
>    r2 = r10
>    r3 = r10
>    if r2 <= r3 goto +0
>    if r2 <= 8 goto +0
>
> But since r2 is actually a stack pointer, then r2 does not need
> backtracking. So r2 <= r3 won't be backtracked too.
>
> But if you feel such an example still valuable, I can add it too.

Makes sense, thank you for explaining.