mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-12 01:25:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: check zero extension of an arena 32-bit cmpxchg

Browse Source 
Add a test to verify that destination register of a 32-bit cmpxchg
operating on an arena pointer is explicitly zero extended.
W/o patch #1 this did not happen.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260903171542.1438050-3-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Eduard Zingerman
2026-09-03 10:15:41 -07:00
committed by Alexei Starovoitov
parent 1f3cd9719c
commit 54ed919503
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tools/testing/selftests/bpf/progs/verifier_zext.c
View File

@@ -356,6 +356,32 @@ __naked void arena_ptr(void)
: __clobber_all);
}
/*
* Result of a 32-bit cmpxchg is always explicitly zero extended.
* Check that this holds for arenas (BPF_PROBE_ATOMIC instruction flavor).
*/
SEC("socket")
__success
__xlated("probe r0 = atomic_cmpxchg((u32 *)(r1 +0), r0, r2)")
__xlated("w0 = w0")
__naked void zext_arena_cmpxchg32(void)
{
asm volatile (" \
r9 = %[arena] ll; /* associate the arena with the program */ \
r1 = 0; \
r1 = addr_space_cast(r1, 0, 1); \
r0 = 0; \
r2 = 0; \
.8byte %[cmpxchg32]; \
r0 >>= 32; /* make the upper half live */ \
exit; \
" :
: __imm_addr(arena),
__imm_insn(cmpxchg32,
BPF_ATOMIC_OP(BPF_W, BPF_CMPXCHG, BPF_REG_1, BPF_REG_2, 0))
: __clobber_all);
}
#endif
/* Check if probe mem loads keep their zero extension. */