Check that mark_chain_precision() is called for a NULL pointer passed as an __arg_trusted __arg_nullable argument of a global subprogram.
Unified · Split
| @@ -56,6 +56,30 @@ int trusted_task_arg_nullable(void *ctx) · 55 unmodified lines | ||
| 56 | 56 | return res; |
| 57 | 57 | } |
| 58 | 58 | |
| 59 | +/* | |
| 60 | + * Check that the verifier does not use checkpoints created | |
| 61 | + * on path with r1 == 0 to prune path with r1 != 0. | |
| 62 | + */ | |
| 63 | +SEC("?tp_btf/task_newtask") | |
| 64 | +__failure | |
| 65 | +__flag(BPF_F_TEST_STATE_FREQ) | |
| 66 | +__msg("R1 type=scalar expected=ptr_, trusted_ptr_, rcu_ptr_") | |
| 67 | +__naked int null_btf_id_arg_global_subprog(void) | |
| 68 | +{ | |
| 69 | + asm volatile ( | |
| 70 | + "call %[bpf_get_prandom_u32];" | |
| 71 | + "r1 = 42;" | |
| 72 | + "if r0 > 42 goto 1f;" | |
| 73 | + "r1 = 0;" | |
| 74 | + "1:" | |
| 75 | + "call subprog_trusted_task_nullable;" | |
| 76 | + "r0 = 0;" | |
| 77 | + "exit;" | |
| 78 | + : | |
| 79 | + : __imm(bpf_get_prandom_u32) | |
| 80 | + : __clobber_all); | |
| 81 | +} | |
| 82 | + | |
| 59 | 83 | __weak int subprog_trusted_task_nonnull(struct task_struct *task __arg_trusted) |
| 60 | 84 | { |
| 61 | 85 | return task->pid + task->tgid; |