57 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2#include <stddef.h>3#include <linux/bpf.h>4#include <bpf/bpf_helpers.h>5#include "bpf_misc.h"6 7__noinline int foo(unsigned int *v)8{9 if (v)10 *v = bpf_get_prandom_u32();11 12 return 0;13}14 15SEC("cgroup_skb/ingress")16__failure __msg("At program exit the register R0 has ")17int global_func15(struct __sk_buff *skb)18{19 unsigned int v = 1;20 21 foo(&v);22 23 return v;24}25 26SEC("cgroup_skb/ingress")27__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)28__failure29/* check that fallthrough code path marks r0 as precise */30__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")31/* check that branch code path marks r0 as precise */32__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")33__msg("At program exit the register R0 has ")34__naked int global_func15_tricky_pruning(void)35{36 asm volatile (37 "call %[bpf_get_prandom_u32];"38 "if r0 s> 1000 goto 1f;"39 "r0 = 1;"40 "1:"41 "goto +0;" /* checkpoint */42 /* cgroup_skb/ingress program is expected to return [0, 1]43 * values, so branch above makes sure that in a fallthrough44 * case we have a valid 1 stored in R0 register, but in45 * a branch case we assign some random value to R0. So if46 * there is something wrong with precision tracking for R0 at47 * program exit, we might erroneously prune branch case,48 * because R0 in fallthrough case is imprecise (and thus any49 * value is valid from POV of verifier is_state_equal() logic)50 */51 "exit;"52 :53 : __imm(bpf_get_prandom_u32)54 : __clobber_common55 );56}57