Re: [PATCH bpf 2/2] selftests/bpf: Add reg-invariants test for speculative pointer arithmetic

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 2469 bytes --]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> index bc038ac2df98..91d4600aa677 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> @@ -2267,6 +2267,47 @@ __naked void deduce64_from_32_wrapping_32bit(void)
>  	: __clobber_all);
>  }
>
> +/*
> + * Unprivileged variable pointer arithmetic on a PTR_TO_MAP_VALUE whose
> + * offset collapses to a constant. The Spectre-v1 speculative path snapshots
> + * the pointer while its r32 has just been blanked but its offset not yet
> + * synced; the following register move used to trip reg_bounds_sanity_check()
> + * ("const subreg tnum out of sync with range bounds"). With
> + * BPF_F_TEST_REG_INVARIANTS that violation turns into a load failure, so the
> + * unprivileged program must still load.
> + */

This isn't a bug, but would it read more clearly to say the base
PTR_TO_MAP_VALUE has a constant offset that the speculative snapshot
captures, rather than that the offset "collapses to a constant"? The
addend itself has to stay variable for sanitize_ptr_alu() to simulate the
path at all.

> +SEC("socket")
> +__success __success_unpriv
> +__flag(BPF_F_TEST_REG_INVARIANTS)
> +__naked void spec_ptr_alu_const_offset(void)
> +{
> +	asm volatile ("							\
> +	call %[bpf_ktime_get_ns];					\
> +	*(u64*)(r10 - 16) = r0;						\
> +	r1 = 0;								\
> +	*(u64*)(r10 - 8) = r1;						\
> +	r2 = r10;							\
> +	r2 += -8;							\
> +	r1 = %[map_hash_8b] ll;						\
> +	call %[bpf_map_lookup_elem];					\
> +	if r0 == 0 goto l0_%=;						\
> +	r1 = *(u64*)(r10 - 16);						\
> +	r2 = 0x40000000;						\
> +	if r1 > r2 goto l0_%=;						\
> +	if r1 s> 1 goto l0_%=;		/* r1 in [0, 1] */		\
> +	r0 += r1;			/* ptr += bounded scalar */	\
> +	r9 = r0;			/* used to trip the warning */	\
> +	*(u8*)(r0 + 0) = r1;						\
> +l0_%=:	r0 = 0;								\
> +	exit;								\
> +	"
> +	:
> +	: __imm(bpf_ktime_get_ns),
> +	  __imm(bpf_map_lookup_elem),
> +	  __imm_addr(map_hash_8b)
> +	: __clobber_all);
> +}
> +
>  /* Check that range_within() compares cnum ranges, not min/max projections. */
>  SEC("socket")
>  __failure __msg("div by zero")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32257333410