selftests/bpf: Check that JMP32 pointer vs zero jumps are not predictedgrafted

Add jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which
the verifier used to skip, contains an out of bounds map value access,
hence w/o the previous patch the program is accepted. See previous patch
for detailed description.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

1 files changed, 109 insertions, 0 deletions

diff --git a/rust/syn/tt.rs b/rust/syn/tt.rs
new file mode 100644
index 000000000..fc7adec3d
--- /dev/null
+++ b/rust/syn/tt.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+use proc_macro2::{Delimiter, TokenStream, TokenTree};
+use std::hash::{Hash, Hasher};
+
+pub(crate) struct TokenTreeHelper<'a>(pub &'a TokenTree);
+
+impl<'a> PartialEq for TokenTreeHelper<'a> {
+    fn eq(&self, other: &Self) -> bool {
+        use proc_macro2::Spacing;
+
+        match (self.0, other.0) {
+            (TokenTree::Group(g1), TokenTree::Group(g2)) => {
+                match (g1.delimiter(), g2.delimiter()) {
+                    (Delimiter::Parenthesis, Delimiter::Parenthesis)
+                    | (Delimiter::Brace, Delimiter::Brace)
+                    | (Delimiter::Bracket, Delimiter::Bracket)
+                    | (Delimiter::None, Delimiter::None) => {}
+                    _ => return false,
+                }
+
+                let s1 = g1.stream().into_iter();
+                let mut s2 = g2.stream().into_iter();
+
+                for item1 in s1 {
+                    let item2 = match s2.next() {
+                        Some(item) => item,
+                        None => return false,
+                    };
+                    if TokenTreeHelper(&item1) != TokenTreeHelper(&item2) {
+                        return false;
+                    }
+                }
+                s2.next().is_none()
+            }
+            (TokenTree::Punct(o1), TokenTree::Punct(o2)) => {
+                o1.as_char() == o2.as_char()
+                    && match (o1.spacing(), o2.spacing()) {
+                        (Spacing::Alone, Spacing::Alone) | (Spacing::Joint, Spacing::Joint) => true,
+                        _ => false,
+                    }
+            }
+            (TokenTree::Literal(l1), TokenTree::Literal(l2)) => l1.to_string() == l2.to_string(),
+            (TokenTree::Ident(s1), TokenTree::Ident(s2)) => s1 == s2,
+            _ => false,
+        }
+    }
+}
+
+impl<'a> Hash for TokenTreeHelper<'a> {
+    fn hash<H: Hasher>(&self, h: &mut H) {
+        use proc_macro2::Spacing;
+
+        match self.0 {
+            TokenTree::Group(g) => {
+                0u8.hash(h);
+                match g.delimiter() {
+                    Delimiter::Parenthesis => 0u8.hash(h),
+                    Delimiter::Brace => 1u8.hash(h),
+                    Delimiter::Bracket => 2u8.hash(h),
+                    Delimiter::None => 3u8.hash(h),
+                }
+
+                for item in g.stream() {
+                    TokenTreeHelper(&item).hash(h);
+                }
+                0xFFu8.hash(h); // terminator w/ a variant we don't normally hash
+            }
+            TokenTree::Punct(op) => {
+                1u8.hash(h);
+                op.as_char().hash(h);
+                match op.spacing() {
+                    Spacing::Alone => 0u8.hash(h),
+                    Spacing::Joint => 1u8.hash(h),
+                }
+            }
+            TokenTree::Literal(lit) => (2u8, lit.to_string()).hash(h),
+            TokenTree::Ident(word) => (3u8, word).hash(h),
+        }
+    }
+}
+
+pub(crate) struct TokenStreamHelper<'a>(pub &'a TokenStream);
+
+impl<'a> PartialEq for TokenStreamHelper<'a> {
+    fn eq(&self, other: &Self) -> bool {
+        let left = self.0.clone().into_iter().collect::<Vec<_>>();
+        let right = other.0.clone().into_iter().collect::<Vec<_>>();
+        if left.len() != right.len() {
+            return false;
+        }
+        for (a, b) in left.into_iter().zip(right) {
+            if TokenTreeHelper(&a) != TokenTreeHelper(&b) {
+                return false;
+            }
+        }
+        true
+    }
+}
+
+impl<'a> Hash for TokenStreamHelper<'a> {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        let tts = self.0.clone().into_iter().collect::<Vec<_>>();
+        tts.len().hash(state);
+        for tt in tts {
+            TokenTreeHelper(&tt).hash(state);
+        }
+    }
+}