Re: [PATCH bpf-next v3 04/14] selftests/bpf: Test addr_space_cast of pointers that are not in arena

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests/bpf: wrong stack offset in r10_stored_to_arena()
--

commit 54fbcf6815ff6f19ca4963d449d29e574fbc1941
Author: Alexei Starovoitov <ast@kernel.org>

selftests/bpf: Test addr_space_cast of pointers that are not in arena

This commit adds BPF verifier selftests in verifier_arena_cast.c to test
addr_space_cast behavior on non-arena pointers, numbers, and stack slot
liveness tracking across casts.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_cast.c b/tools/testing/selftests/bpf/progs/verifier_arena_cast.c
> new file mode 100644
> index 0000000000000..14a199318d0d5
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_arena_cast.c
> @@ -0,0 +1,800 @@

[ ... ]

> +SEC("syscall")
> +__description("arena cast: r10 is stored to arena, a pointer to map value is in the stack")
> +__failure __msg("invalid access to map value, value_size=8 off=4096 size=1")
> +__naked void r10_stored_to_arena(void)
> +{
> +	asm volatile (
> +	"r1 = %[arena] ll;"
> +	UPDATE_AND_LOOKUP
> +	"if r0 == 0 goto 2f;"
> +	"r9 = r0;"
> +	STALE_SPILL_R7(-8)
> +	".8byte %[cast_r7_r7];"
> +	"r1 = r9;"
> +	"r1 += 8;"
> +	"*(u64 *)(r10 - 32) = r1;"
> +	/* to arena, not to fp-32 */
> +	"*(u64 *)(r7 + 0) = r10;"
> +	"r7 = *(u64 *)(r10 - 32);"

[Severity: Medium]
In r10_stored_to_arena() in
tools/testing/selftests/bpf/progs/verifier_arena_cast.c, should
STALE_SPILL_R7(-8) be STALE_SPILL_R7(-32) instead?

As written, STALE_SPILL_R7(-8) gives r7 a stale stack offset of fp-8 rather
than fp-32. When *(u64 *)(r7 + 0) = r10 executes, static stack analysis
tracks the store against slot fp-8 (which is immediately overwritten by
SPILL_FP24_TO_FP8) and never touches slot fp-32, so the test does not
exercise joining the map value pointer in fp-32 (ARG_NONE) with r10 (fp+0).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104012401.1354861-1-alexei.starovoitov@gmail.com?part=4