Re: [PATCH v4 bpf-next 2/2] bpf: test the proper verification of tail calls

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2025-11-10 at 16:18 +0100, Martin Teichmann wrote:

[...]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_live_stack.c b/tools/testing/selftests/bpf/progs/verifier_live_stack.c
> index c0e808509268..9cc53eb1a545 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_live_stack.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_live_stack.c
> @@ -292,3 +292,52 @@ __naked void syzbot_postorder_bug1(void)
>  	"exit;"
>  	::: __clobber_all);
>  }
> +
> +struct {
> +        __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
> +        __uint(max_entries, 1);
> +        __type(key, __u32);
> +        __type(value, __u32);
> +} map_array SEC(".maps");
> +
> +SEC("socket")
> +__failure __msg("invalid read from stack R2 off=-1024 size=8")

Please also add `__flag(BPF_F_TEST_STATE_FREQ)` here, so that it is
guaranteed that checkpoint is created at the `call write_tail_call`
instruction.  Otherwise the test case would depend on add_new_state
heuristic in is_state_visited() remaining unchanged.

> +__naked unsigned long caller_stack_write_tail_call(void)
> +{
> +        asm volatile (
> +	"r6 = r1;"
> +	"*(u64 *)(r10 - 8) = -8;"
> +        "call %[bpf_get_prandom_u32];"
> +        "if r0 != 42 goto 1f;"
> +        "goto 2f;"
> +  "1:"
> +        "*(u64 *)(r10 - 8) = -1024;"
> +  "2:"
> +        "r1 = r6;"
> +        "r2 = r10;"
> +        "r2 += -8;"
> +        "call write_tail_call;"
> +        "r1 = *(u64 *)(r10 - 8);"
> +        "r2 = r10;"
> +        "r2 += r1;"
> +        "r0 = *(u64 *)(r2 + 0);"
> +        "exit;"
> +        :: __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
> +static __used __naked unsigned long write_tail_call(void)
> +{
> +        asm volatile (
> +        "r6 = r2;"
> +        "r2 = %[map_array] ll;"
> +        "r3 = 0;"
> +        "call %[bpf_tail_call];"
> +        "*(u64 *)(r6 + 0) = -16;"
> +        "r0 = 0;"
> +        "exit;"
> +	:
> +	: __imm(bpf_tail_call),
> +          __imm_addr(map_array)
> +        : __clobber_all);
> +}

[...]