1 // SPDX-License-Identifier: GPL-2.0-only 2 #include <stddef.h> 3 #include <linux/bpf.h> 4 #include <bpf/bpf_helpers.h> 5 #include "bpf_misc.h" 6 foo(unsigned int * v)7__noinline int foo(unsigned int *v) 8 { 9 if (v) 10 *v = bpf_get_prandom_u32(); 11 12 return 0; 13 } 14 15 SEC("cgroup_skb/ingress") 16 __failure __msg("At program exit the register R0 has ") global_func15(struct __sk_buff * skb)17int global_func15(struct __sk_buff *skb) 18 { 19 unsigned int v = 1; 20 21 foo(&v); 22 23 return v; 24 } 25 26 SEC("cgroup_skb/ingress") __flag(BPF_F_TEST_STATE_FREQ)27__log_level(2) __flag(BPF_F_TEST_STATE_FREQ) 28 __failure 29 /* check that fallthrough code path marks r0 as precise */ 30 __msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1") 31 /* check that branch code path marks r0 as precise */ 32 __msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7") 33 __msg("At program exit the register R0 has ") 34 __naked int global_func15_tricky_pruning(void) 35 { 36 asm volatile ( 37 "call %[bpf_get_prandom_u32];" 38 "if r0 s> 1000 goto 1f;" 39 "r0 = 1;" 40 "1:" 41 "goto +0;" /* checkpoint */ 42 /* cgroup_skb/ingress program is expected to return [0, 1] 43 * values, so branch above makes sure that in a fallthrough 44 * case we have a valid 1 stored in R0 register, but in 45 * a branch case we assign some random value to R0. So if 46 * there is something wrong with precision tracking for R0 at 47 * program exit, we might erroneously prune branch case, 48 * because R0 in fallthrough case is imprecise (and thus any 49 * value is valid from POV of verifier is_state_equal() logic) 50 */ 51 "exit;" 52 : 53 : __imm(bpf_get_prandom_u32) 54 : __clobber_common 55 ); 56 } 57