Re: [PATCH bpf-next v6 17/17] selftests/bpf: Add verifier tests for stack argument validation

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Medium] Test fragility in `subprog_deref_arg6` error matching due to compiler register allocation
--

commit 3936b0a6dea45627278be80c25b20ff18f2821d4
Author: Yonghong Song <yonghong.song@linux.dev>

selftests/bpf: Add verifier tests for stack argument validation

This commit adds inline-asm based verifier tests to exercise BPF stack
argument validation logic directly, including both positive and negative
tests for tracking pointers, references, and null propagation.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> new file mode 100644
> index 0000000000000..66dd11840a63e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c

[ ... ]

> +__noinline __used
> +static long subprog_deref_arg6(long a, long b, long c, long d, long e, long *f)
> +{
> +	return *f;
> +}

[ ... ]

> +SEC("tc")
> +__description("stack_arg: pruning with different stack arg types")
> +__failure
> +__flag(BPF_F_TEST_STATE_FREQ)
> +__arch_x86_64
> +__msg("R1 invalid mem access 'scalar'")

Does this hardcode an assumption about Clang's register allocation?

Since subprog_deref_arg6 is standard C rather than a __naked inline
assembly function, the compiler determines which register is used to
dereference f. If a future LLVM version chooses a different register, the
tests will fail because the verifier error will mention the new register
instead of R1.

Could these tests use __regex to match the register dynamically, or be
rewritten so subprog_deref_arg6 is a __naked function to guarantee the
register choice?

> +__naked void stack_arg_pruning_type_mismatch(void)
> +{
> +	asm volatile (
> +		"call %[bpf_get_prandom_u32];"

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260419163316.731019-1-yonghong.song@linux.dev?part=17