Check that mark_chain_precision() is called for a NULL pointer passed as a nullable pointer argument of a global subprogram. (Pointer arguments of the global subprograms are nullable by default).
Unified · Split
| @@ -676,4 +676,36 @@ __naked int null_mem_arg_zero_size(void) · 675 unmodified lines | ||
| 676 | 676 | : __clobber_all); |
| 677 | 677 | } |
| 678 | 678 | |
| 679 | +__weak int subprog_mem_arg(int *p) | |
| 680 | +{ | |
| 681 | + if (p) | |
| 682 | + return *p; | |
| 683 | + return 0; | |
| 684 | +} | |
| 685 | + | |
| 686 | +/* | |
| 687 | + * Verification takes two paths: with r1 being scalar zero on path (1) | |
| 688 | + * and with r1 being some other scalar on path (2). | |
| 689 | + * Check that the verifier does not use checkpoints created | |
| 690 | + * on path (1) to prune path (2). | |
| 691 | + */ | |
| 692 | +SEC("?raw_tp") | |
| 693 | +__flag(BPF_F_TEST_STATE_FREQ) | |
| 694 | +__failure __msg("R1 type=scalar expected=fp") | |
| 695 | +__naked int null_mem_arg_global_subprog(void) | |
| 696 | +{ | |
| 697 | + asm volatile ( | |
| 698 | + "call %[bpf_get_prandom_u32];" | |
| 699 | + "r1 = 42;" | |
| 700 | + "if r0 > 42 goto 1f;" | |
| 701 | + "r1 = 0;" | |
| 702 | + "1:" | |
| 703 | + "call subprog_mem_arg;" | |
| 704 | + "r0 = 0;" | |
| 705 | + "exit;" | |
| 706 | + : | |
| 707 | + : __imm(bpf_get_prandom_u32) | |
| 708 | + : __clobber_all); | |
| 709 | +} | |
| 710 | + | |
| 679 | 711 | char _license[] SEC("license") = "GPL"; |