1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <stddef.h>
3 #include <linux/bpf.h>
4 #include <bpf/bpf_helpers.h>
5 #include "bpf_misc.h"
6
7 __noinline int foo(unsigned int *v)
8 {
9 if (v)
10 *v = bpf_get_prandom_u32();
11
12 return 0;
13 }
14
15 SEC("cgroup_skb/ingress")
16 __failure __msg("At program exit the register R0 has ")
17 int global_func15(struct __sk_buff *skb)
18 {
19 unsigned int v = 1;
20
21 foo(&v);
22
23 return v;
24 }
25
26 SEC("cgroup_skb/ingress")
27 __log_level(2) __flag(BPF_F_TEST_STATE_FREQ)
28 __failure
29 /* check that fallthrough code path marks r0 as precise */
30 __msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")
31 /* check that branch code path marks r0 as precise */
32 __msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")
33 __msg("At program exit the register R0 has ")
34 __naked int global_func15_tricky_pruning(void)
35 {
36 asm volatile (
37 "call %[bpf_get_prandom_u32];"
38 "if r0 s> 1000 goto 1f;"
39 "r0 = 1;"
40 "1:"
41 "goto +0;" /* checkpoint */
42 /* cgroup_skb/ingress program is expected to return [0, 1]
43 * values, so branch above makes sure that in a fallthrough
44 * case we have a valid 1 stored in R0 register, but in
45 * a branch case we assign some random value to R0. So if
46 * there is something wrong with precision tracking for R0 at
47 * program exit, we might erronenously prune branch case,
48 * because R0 in fallthrough case is imprecise (and thus any
49 * value is valid from POV of verifier is_state_equal() logic)
50 */
51 "exit;"
52 :
53 : __imm(bpf_get_prandom_u32)
54 : __clobber_common
55 );
56 }
57
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.