Changes in verifier_stack_arg.c

d1dbe443a0abb4ea3ec35a16e36efe6d3bbf72f6 - bpf: Fix arg_track_join log to use sa prefix for stack arg slots

Sat, 16 May 2026 00:50:56 +0200

bpf: Fix arg_track_join log to use sa prefix for stack arg slotsarg_track_join() logs state transitions at CFG merge points. Forstack arg slots (r >= MAX_BPF_REG), it printed "r11:", "r12:", etc.,which is misleading since r11 is a special register (BPF_REG_PARAMS)not meaningful to the user.Fix it to print "sa0:", "sa1:", etc., matching the per-instructiontransition log in arg_track_log() which already uses the "sa" prefix.Update the existing stack_arg_pruning_type_mismatch selftest to expectthe corrected format.Fixes: 2af4e792773f ("bpf: Extend liveness analysis to track stack argument slots")Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260515225056.823086-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/verifier_stack_arg.c

0e2647792f60df746422d6089daf9d56945d5f91 - selftests/bpf: Log arg_track_join for stack arg slots in liveness analysis

Sat, 16 May 2026 00:50:51 +0200

selftests/bpf: Log arg_track_join for stack arg slots in liveness analysisCommit 2af4e792773f ("bpf: Extend liveness analysis to track stack argument slots")added stack arg supports. For selftest verifier_stack_arg/stack_arg: pruning with different stack arg typesthe following are two arg JOIN messages: arg JOIN insn 9 -> 10 r1: fp0-8 + _ => fp0-8|fp0+0 arg JOIN insn 9 -> 10 r11: fp0-8 + _ => fp0-8|fp0+0Here the "r11:" label for stack arg slot 0 is misleading since r11is a special register (BPF_REG_PARAMS). The next patch correctsthis to "sa0:", properly representing the 'stack arg slot 0'.Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260515225051.822739-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/verifier_stack_arg.c

ef1b54e0db671a161887475ef70cd570cbb2a6ab - selftests/bpf: Add test for stack arg read without caller write

Sat, 16 May 2026 00:50:45 +0200

selftests/bpf: Add test for stack arg read without caller writeAdd negative tests for the outgoing stack arg validation.A static subprog with a 'long *' arg causesbtf_prepare_func_args() to fail after setting arg_cnt. Thevalidation ensures check_outgoing_stack_args() still runs.Also update two existing tests (release_ref, stale_pkt_ptr) whoseexpected error messages changed: invalidated stack arg slots are nowcaught by check_outgoing_stack_args() at the call site instead ofat the callee's dereference.Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260515225045.822104-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/verifier_stack_arg.c

90e43f1b47535cc7aceef3add1a61ba3260b7aee - selftests/bpf: Enable stack argument tests for arm64

Wed, 13 May 2026 06:52:04 +0200

selftests/bpf: Enable stack argument tests for arm64Now that arm64 supports stack arguments, enable the existing stack_arg,stack_arg_kfunc and verifier_stack_arg tests for __TARGET_ARCH_arm64.Signed-off-by: Puranjay Mohan Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045204.2403441-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/verifier_stack_arg.c

00c3ac4292a6bc3039008cdb45bd423087acb98e - selftests/bpf: Add verifier tests for stack argument validation

Wed, 13 May 2026 06:51:43 +0200

selftests/bpf: Add verifier tests for stack argument validationAdd inline-asm based verifier tests that exercise stack argumentvalidation logic directly.Positive tests: - subprog call with 6 arg's - Two sequential calls to different subprogs (6-arg and 7-arg) - Share a r11 store for both branchesNegative tests — verifier rejection: - Read from uninitialized incoming stack arg slot - Gap in outgoing slots: only r11-16 written, r11-8 missing - Write at r11-80, exceeding max 7 stack args - Missing store on one branch with a shared store - First call has proper stack arguments and the second call intends to inherit stack arguments but not working - r11 load ordering issueNegative tests — pointer/ref tracking: - Pruning type mismatch: one branch stores PTR_TO_STACK, the other stores a scalar, callee dereferences — must not prune - Release invalidation: bpf_sk_release invalidates a socket pointer stored in a stack arg slot - Packet pointer invalidation: bpf_skb_pull_data invalidates a packet pointer stored in a stack arg slot - Null propagation: PTR_TO_MAP_VALUE_OR_NULL stored in stack arg slot, null branch attempts dereference via calleeSigned-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045143.2399278-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/verifier_stack_arg.c