Re: [PATCH v5 bpf-next 2/4] bpf: test the proper verification of tail calls

Eduard Zingerman
2025-11-18T22:47:14Z

On Tue, 2025-11-18 at 14:39 +0100, Martin Teichmann wrote:
> Three tests are added:
>
> - invalidate_pkt_pointers_by_tail_call checks that one can use the
> packet pointer after a tail call. This was originally possible
> and also poses not problems, but was made impossible by 1a4607ffba35.
>
> - invalidate_pkt_pointers_by_static_tail_call tests a corner case
> found by Eduard Zingerman during the discussion of the original fix,
> which was broken in that fix.
>
> - subprog_result_tail_call tests that precision propagation works
> correctly across tail calls. This did not work before.
>
> Signed-off-by: Martin Teichmann <martin.teichmann@xfel.eu>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> index ac3e418c2a96..de5ef3152567 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> @@ -793,4 +793,51 @@ __naked int stack_slot_aliases_precision(void)
> );
> }

[...]

> +SEC("?raw_tp")
> +__failure __log_level(2)
> +__msg("6: (0f) r1 += r0")
> +__msg("mark_precise: frame0: regs=r0 stack= before 5: (bf) r1 = r6")
> +__msg("mark_precise: frame0: regs=r0 stack= before 4: (27) r0 *= 4")
> +__msg("mark_precise: frame0: parent state regs=r0 stack=: R0=Pscalar() R6=map_value(map=.data.vals,ks=4,vs=16) R10=fp0")

Nit: I'd add a couple more lines to this __msg sequence to check that
backtrack_insn correctly moved one frame down.

> +__msg("math between map_value pointer and register with unbounded min value is not allowed")
> +__naked int subprog_result_tail_call(void)
> +{
> + asm volatile (
> + "r2 = 3;"
> + "call identity_tail_call;"
> + "r0 *= 4;"
> + "r1 = %[vals];"
> + "r1 += r0;"
> + "r0 = *(u32 *)(r1 + 0);"
> + "exit;"
> + :
> + : __imm_ptr(vals)
> + : __clobber_common
> + );
> +}
> +
> char _license[] SEC("license") = "GPL";