Re: [PATCH v5 bpf-next 2/4] bpf: test the proper verification of tail calls

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2025-11-18 at 14:39 +0100, Martin Teichmann wrote:
> Three tests are added:
> 
> - invalidate_pkt_pointers_by_tail_call checks that one can use the
>   packet pointer after a tail call. This was originally possible
>   and also poses not problems, but was made impossible by 1a4607ffba35.
> 
> - invalidate_pkt_pointers_by_static_tail_call tests a corner case
>   found by Eduard Zingerman during the discussion of the original fix,
>   which was broken in that fix.
> 
> - subprog_result_tail_call tests that precision propagation works
>   correctly across tail calls. This did not work before.
> 
> Signed-off-by: Martin Teichmann <martin.teichmann@xfel.eu>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> index ac3e418c2a96..de5ef3152567 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> @@ -793,4 +793,51 @@ __naked int stack_slot_aliases_precision(void)
>  	);
>  }

[...]

> +SEC("?raw_tp")
> +__failure __log_level(2)
> +__msg("6: (0f) r1 += r0")
> +__msg("mark_precise: frame0: regs=r0 stack= before 5: (bf) r1 = r6")
> +__msg("mark_precise: frame0: regs=r0 stack= before 4: (27) r0 *= 4")
> +__msg("mark_precise: frame0: parent state regs=r0 stack=:  R0=Pscalar() R6=map_value(map=.data.vals,ks=4,vs=16) R10=fp0")

Nit: I'd add a couple more lines to this __msg sequence to check that
     backtrack_insn correctly moved one frame down.

> +__msg("math between map_value pointer and register with unbounded min value is not allowed")
> +__naked int subprog_result_tail_call(void)
> +{
> +	asm volatile (
> +		"r2 = 3;"
> +		"call identity_tail_call;"
> +		"r0 *= 4;"
> +		"r1 = %[vals];"
> +		"r1 += r0;"
> +		"r0 = *(u32 *)(r1 + 0);"
> +		"exit;"
> +		:
> +		: __imm_ptr(vals)
> +		: __clobber_common
> +	);
> +}
> +
>  char _license[] SEC("license") = "GPL";