Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover half-slot cleanup of pointer spills

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 1307 bytes --]

>     selftests/bpf: Cover half-slot cleanup of pointer spills
>
>     Add a verifier regression test for a pointer spill whose high half is
>     cleaned dead while the low half remains live. Force checkpoint creation
>     with BPF_F_TEST_STATE_FREQ and assert the verifier log reaches the
>     checkpoint and the subsequent 32-bit fill before rejecting the partial fill
>     from a non-scalar spill.
>
>     Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>     Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>

This is a regression test for a verifier bug where a partial 32-bit fill
from a pointer spill whose high half was cleaned dead could read a
non-scalar stack slot past the register-fill check.

The half-slot cleanup that destroys the spilled_ptr metadata when the hi
half is dead was introduced in __clean_func_state() by:

  be23266b4a08 ("bpf: 4-byte precise clean_verifier_state")

Should this test carry a Fixes: tag pointing at that commit, matching the
accompanying fix?

  Fixes: be23266b4a08 ("bpf: 4-byte precise clean_verifier_state")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/27700639579