arg_track_join() logs state transitions at CFG merge points. For stack arg slots (r >= MAX_BPF_REG), it printed "r11:", "r12:", etc., which is misleading since r11 is a special register (BPF_REG_PARAMS) not meaningful to the user. Fix it to print "sa0:", "sa1:", etc., matching the per-instruction transition log in arg_track_log() which already uses the "sa" prefix. Update the existing stack_arg_pruning_type_mismatch selftest to expect the corrected format.
Unified · Split
| @@ -806,7 +806,9 @@ static bool arg_track_join(struct bpf_verifier_env *env, int idx, int target, in · 805 unmodified lines | |||
| 806 | return true; | 806 | return true; |
| 807 | 807 | ||
| 808 | verbose(env, "arg JOIN insn %d -> %d ", idx, target); | 808 | verbose(env, "arg JOIN insn %d -> %d ", idx, target); |
| 809 | if (r >= 0) | 809 | if (r >= MAX_BPF_REG) |
| 810 | verbose(env, "sa%d: ", r - MAX_BPF_REG); | ||
| 811 | else if (r >= 0) | ||
| 810 | verbose(env, "r%d: ", r); | 812 | verbose(env, "r%d: ", r); |
| 811 | else | 813 | else |
| 812 | verbose(env, "fp%+d: ", r * 8); | 814 | verbose(env, "fp%+d: ", r * 8); |
| @@ -117,7 +117,7 @@ __description("stack_arg: pruning with different stack arg types") · 116 unmodified lines | |||
| 117 | __failure __log_level(2) | 117 | __failure __log_level(2) |
| 118 | __flag(BPF_F_TEST_STATE_FREQ) | 118 | __flag(BPF_F_TEST_STATE_FREQ) |
| 119 | __msg("arg JOIN insn 9 -> 10 r1: fp0-8 + _ => fp0-8|fp0+0") | 119 | __msg("arg JOIN insn 9 -> 10 r1: fp0-8 + _ => fp0-8|fp0+0") |
| 120 | __msg("arg JOIN insn 9 -> 10 r11: fp0-8 + _ => fp0-8|fp0+0") | 120 | __msg("arg JOIN insn 9 -> 10 sa0: fp0-8 + _ => fp0-8|fp0+0") |
| 121 | __msg("R{{[0-9]}} invalid mem access 'scalar'") | 121 | __msg("R{{[0-9]}} invalid mem access 'scalar'") |
| 122 | __naked void stack_arg_pruning_type_mismatch(void) | 122 | __naked void stack_arg_pruning_type_mismatch(void) |
| 123 | { | 123 | { |