Check that mark_chain_precision() is called for a NULL pointer passed as a nullable pointer argument of a global subprogram. (Pointer arguments of the global subprograms are nullable by default).
Unified · Split
| @@ -676,4 +676,36 @@ __naked int null_mem_arg_zero_size(void) · 675 unmodified lines | |||
| 676 | : __clobber_all); | 676 | : __clobber_all); |
| 677 | } | 677 | } |
| 678 | 678 | ||
| 679 | __weak int subprog_mem_arg(int *p) | ||
| 680 | { | ||
| 681 | if (p) | ||
| 682 | return *p; | ||
| 683 | return 0; | ||
| 684 | } | ||
| 685 | |||
| 686 | /* | ||
| 687 | * Verification takes two paths: with r1 being scalar zero on path (1) | ||
| 688 | * and with r1 being some other scalar on path (2). | ||
| 689 | * Check that the verifier does not use checkpoints created | ||
| 690 | * on path (1) to prune path (2). | ||
| 691 | */ | ||
| 692 | SEC("?raw_tp") | ||
| 693 | __flag(BPF_F_TEST_STATE_FREQ) | ||
| 694 | __failure __msg("R1 type=scalar expected=fp") | ||
| 695 | __naked int null_mem_arg_global_subprog(void) | ||
| 696 | { | ||
| 697 | asm volatile ( | ||
| 698 | "call %[bpf_get_prandom_u32];" | ||
| 699 | "r1 = 42;" | ||
| 700 | "if r0 > 42 goto 1f;" | ||
| 701 | "r1 = 0;" | ||
| 702 | "1:" | ||
| 703 | "call subprog_mem_arg;" | ||
| 704 | "r0 = 0;" | ||
| 705 | "exit;" | ||
| 706 | : | ||
| 707 | : __imm(bpf_get_prandom_u32) | ||
| 708 | : __clobber_all); | ||
| 709 | } | ||
| 710 | |||
| 679 | char _license[] SEC("license") = "GPL"; | 711 | char _license[] SEC("license") = "GPL"; |