From 33a154a96e71a34a1bcca9f40da343dbbf7b38b4 Mon Sep 17 00:00:00 2001
From: Alexei Starovoitov <ast@kernel.org>
Date: Thu, 1 Oct 2026 14:52:55 +0000
Subject: selftests/bpf: Test packet range of pointers sharing an id

Add tests where two packet pointers share an id and tightening one
pointer's umax from its var_off would put it less than their constant
distance from the other's umax: with an index & 0x38 capped at 50, the
base pointer keeps umax 50, so the pointer 8 bytes further on must keep
umax 58, even though its known bits allow at most 56.

These refused a valid program or accepted an out-of-bounds access before
the fix:

- check the advanced copy, load through the base: valid, was refused;
- check the base, load the byte at base + 1 through a copy advanced by
  8: was accepted;
- check base + 4, load 4 bytes at base + 2 through base + 8: reads two
  bytes past the checked range, was accepted;
- the same as the second with data_meta pointers checked against data:
  was accepted.

These pass with and without the fix and cover nearby paths:

- subtract an unknown scalar from a checked pointer and load below it
  (the range is kept across a new id);
- reach a load through two paths whose checks cover 8 and 7 bytes after
  the loaded pointer; the second path must not be pruned by the first;
- spill a copy of a pointer, check the pointer, fill the copy and load
  one byte past the checked range: the load is refused, and the copy
  has the range of the check.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 scripts/atomic/fallbacks/acquire             |  5 +++++
 scripts/atomic/fallbacks/add_negative        |  3 +++
 scripts/atomic/fallbacks/add_unless          |  3 +++
 scripts/atomic/fallbacks/andnot              |  3 +++
 scripts/atomic/fallbacks/cmpxchg             |  3 +++
 scripts/atomic/fallbacks/dec                 |  3 +++
 scripts/atomic/fallbacks/dec_and_test        |  3 +++
 scripts/atomic/fallbacks/dec_if_positive     | 11 +++++++++++
 scripts/atomic/fallbacks/dec_unless_positive | 10 ++++++++++
 scripts/atomic/fallbacks/fence               |  7 +++++++
 scripts/atomic/fallbacks/fetch_add_unless    | 10 ++++++++++
 scripts/atomic/fallbacks/inc                 |  3 +++
 scripts/atomic/fallbacks/inc_and_test        |  3 +++
 scripts/atomic/fallbacks/inc_not_zero        |  3 +++
 scripts/atomic/fallbacks/inc_unless_negative | 10 ++++++++++
 scripts/atomic/fallbacks/read_acquire        | 12 ++++++++++++
 scripts/atomic/fallbacks/release             |  4 ++++
 scripts/atomic/fallbacks/set_release         |  8 ++++++++
 scripts/atomic/fallbacks/sub_and_test        |  3 +++
 scripts/atomic/fallbacks/try_cmpxchg         |  7 +++++++
 scripts/atomic/fallbacks/xchg                |  3 +++
 21 files changed, 117 insertions(+)
 create mode 100755 scripts/atomic/fallbacks/acquire
 create mode 100755 scripts/atomic/fallbacks/add_negative
 create mode 100755 scripts/atomic/fallbacks/add_unless
 create mode 100755 scripts/atomic/fallbacks/andnot
 create mode 100644 scripts/atomic/fallbacks/cmpxchg
 create mode 100755 scripts/atomic/fallbacks/dec
 create mode 100755 scripts/atomic/fallbacks/dec_and_test
 create mode 100755 scripts/atomic/fallbacks/dec_if_positive
 create mode 100755 scripts/atomic/fallbacks/dec_unless_positive
 create mode 100755 scripts/atomic/fallbacks/fence
 create mode 100755 scripts/atomic/fallbacks/fetch_add_unless
 create mode 100755 scripts/atomic/fallbacks/inc
 create mode 100755 scripts/atomic/fallbacks/inc_and_test
 create mode 100755 scripts/atomic/fallbacks/inc_not_zero
 create mode 100755 scripts/atomic/fallbacks/inc_unless_negative
 create mode 100755 scripts/atomic/fallbacks/read_acquire
 create mode 100755 scripts/atomic/fallbacks/release
 create mode 100755 scripts/atomic/fallbacks/set_release
 create mode 100755 scripts/atomic/fallbacks/sub_and_test
 create mode 100755 scripts/atomic/fallbacks/try_cmpxchg
 create mode 100644 scripts/atomic/fallbacks/xchg

(limited to 'scripts/atomic/fallbacks')

diff --git a/scripts/atomic/fallbacks/acquire b/scripts/atomic/fallbacks/acquire
new file mode 100755
index 000000000..4da0cab36
--- /dev/null
+++ b/scripts/atomic/fallbacks/acquire
@@ -0,0 +1,5 @@
+cat <<EOF
+	${ret} ret = arch_${atomic}_${pfx}${name}${sfx}_relaxed(${args});
+	__atomic_acquire_fence();
+	return ret;
+EOF
diff --git a/scripts/atomic/fallbacks/add_negative b/scripts/atomic/fallbacks/add_negative
new file mode 100755
index 000000000..1d3d4ab3a
--- /dev/null
+++ b/scripts/atomic/fallbacks/add_negative
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_${atomic}_add_return${order}(i, v) < 0;
+EOF
diff --git a/scripts/atomic/fallbacks/add_unless b/scripts/atomic/fallbacks/add_unless
new file mode 100755
index 000000000..95ecb2b74
--- /dev/null
+++ b/scripts/atomic/fallbacks/add_unless
@@ -0,0 +1,3 @@
+cat << EOF
+	return raw_${atomic}_fetch_add_unless(v, a, u) != u;
+EOF
diff --git a/scripts/atomic/fallbacks/andnot b/scripts/atomic/fallbacks/andnot
new file mode 100755
index 000000000..66760457e
--- /dev/null
+++ b/scripts/atomic/fallbacks/andnot
@@ -0,0 +1,3 @@
+cat <<EOF
+	${retstmt}raw_${atomic}_${pfx}and${sfx}${order}(~i, v);
+EOF
diff --git a/scripts/atomic/fallbacks/cmpxchg b/scripts/atomic/fallbacks/cmpxchg
new file mode 100644
index 000000000..1c8507f62
--- /dev/null
+++ b/scripts/atomic/fallbacks/cmpxchg
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_cmpxchg${order}(&v->counter, old, new);
+EOF
diff --git a/scripts/atomic/fallbacks/dec b/scripts/atomic/fallbacks/dec
new file mode 100755
index 000000000..60d286d40
--- /dev/null
+++ b/scripts/atomic/fallbacks/dec
@@ -0,0 +1,3 @@
+cat <<EOF
+	${retstmt}raw_${atomic}_${pfx}sub${sfx}${order}(1, v);
+EOF
diff --git a/scripts/atomic/fallbacks/dec_and_test b/scripts/atomic/fallbacks/dec_and_test
new file mode 100755
index 000000000..3a0278e0d
--- /dev/null
+++ b/scripts/atomic/fallbacks/dec_and_test
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_${atomic}_dec_return(v) == 0;
+EOF
diff --git a/scripts/atomic/fallbacks/dec_if_positive b/scripts/atomic/fallbacks/dec_if_positive
new file mode 100755
index 000000000..f65c11b4b
--- /dev/null
+++ b/scripts/atomic/fallbacks/dec_if_positive
@@ -0,0 +1,11 @@
+cat <<EOF
+	${int} dec, c = raw_${atomic}_read(v);
+
+	do {
+		dec = c - 1;
+		if (unlikely(dec < 0))
+			break;
+	} while (!raw_${atomic}_try_cmpxchg(v, &c, dec));
+
+	return dec;
+EOF
diff --git a/scripts/atomic/fallbacks/dec_unless_positive b/scripts/atomic/fallbacks/dec_unless_positive
new file mode 100755
index 000000000..d025361d7
--- /dev/null
+++ b/scripts/atomic/fallbacks/dec_unless_positive
@@ -0,0 +1,10 @@
+cat <<EOF
+	${int} c = raw_${atomic}_read(v);
+
+	do {
+		if (unlikely(c > 0))
+			return false;
+	} while (!raw_${atomic}_try_cmpxchg(v, &c, c - 1));
+
+	return true;
+EOF
diff --git a/scripts/atomic/fallbacks/fence b/scripts/atomic/fallbacks/fence
new file mode 100755
index 000000000..40d5b3976
--- /dev/null
+++ b/scripts/atomic/fallbacks/fence
@@ -0,0 +1,7 @@
+cat <<EOF
+	${ret} ret;
+	__atomic_pre_full_fence();
+	ret = arch_${atomic}_${pfx}${name}${sfx}_relaxed(${args});
+	__atomic_post_full_fence();
+	return ret;
+EOF
diff --git a/scripts/atomic/fallbacks/fetch_add_unless b/scripts/atomic/fallbacks/fetch_add_unless
new file mode 100755
index 000000000..8db7e9e17
--- /dev/null
+++ b/scripts/atomic/fallbacks/fetch_add_unless
@@ -0,0 +1,10 @@
+cat << EOF
+	${int} c = raw_${atomic}_read(v);
+
+	do {
+		if (unlikely(c == u))
+			break;
+	} while (!raw_${atomic}_try_cmpxchg(v, &c, c + a));
+
+	return c;
+EOF
diff --git a/scripts/atomic/fallbacks/inc b/scripts/atomic/fallbacks/inc
new file mode 100755
index 000000000..56c770f59
--- /dev/null
+++ b/scripts/atomic/fallbacks/inc
@@ -0,0 +1,3 @@
+cat <<EOF
+	${retstmt}raw_${atomic}_${pfx}add${sfx}${order}(1, v);
+EOF
diff --git a/scripts/atomic/fallbacks/inc_and_test b/scripts/atomic/fallbacks/inc_and_test
new file mode 100755
index 000000000..7d16a10f2
--- /dev/null
+++ b/scripts/atomic/fallbacks/inc_and_test
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_${atomic}_inc_return(v) == 0;
+EOF
diff --git a/scripts/atomic/fallbacks/inc_not_zero b/scripts/atomic/fallbacks/inc_not_zero
new file mode 100755
index 000000000..1fcef1e55
--- /dev/null
+++ b/scripts/atomic/fallbacks/inc_not_zero
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_${atomic}_add_unless(v, 1, 0);
+EOF
diff --git a/scripts/atomic/fallbacks/inc_unless_negative b/scripts/atomic/fallbacks/inc_unless_negative
new file mode 100755
index 000000000..7b4b09868
--- /dev/null
+++ b/scripts/atomic/fallbacks/inc_unless_negative
@@ -0,0 +1,10 @@
+cat <<EOF
+	${int} c = raw_${atomic}_read(v);
+
+	do {
+		if (unlikely(c < 0))
+			return false;
+	} while (!raw_${atomic}_try_cmpxchg(v, &c, c + 1));
+
+	return true;
+EOF
diff --git a/scripts/atomic/fallbacks/read_acquire b/scripts/atomic/fallbacks/read_acquire
new file mode 100755
index 000000000..e319862d2
--- /dev/null
+++ b/scripts/atomic/fallbacks/read_acquire
@@ -0,0 +1,12 @@
+cat <<EOF
+	${int} ret;
+
+	if (__native_word(${atomic}_t)) {
+		ret = smp_load_acquire(&(v)->counter);
+	} else {
+		ret = raw_${atomic}_read(v);
+		__atomic_acquire_fence();
+	}
+
+	return ret;
+EOF
diff --git a/scripts/atomic/fallbacks/release b/scripts/atomic/fallbacks/release
new file mode 100755
index 000000000..1e6daf57b
--- /dev/null
+++ b/scripts/atomic/fallbacks/release
@@ -0,0 +1,4 @@
+cat <<EOF
+	__atomic_release_fence();
+	${retstmt}arch_${atomic}_${pfx}${name}${sfx}_relaxed(${args});
+EOF
diff --git a/scripts/atomic/fallbacks/set_release b/scripts/atomic/fallbacks/set_release
new file mode 100755
index 000000000..16a374ae6
--- /dev/null
+++ b/scripts/atomic/fallbacks/set_release
@@ -0,0 +1,8 @@
+cat <<EOF
+	if (__native_word(${atomic}_t)) {
+		smp_store_release(&(v)->counter, i);
+	} else {
+		__atomic_release_fence();
+		raw_${atomic}_set(v, i);
+	}
+EOF
diff --git a/scripts/atomic/fallbacks/sub_and_test b/scripts/atomic/fallbacks/sub_and_test
new file mode 100755
index 000000000..d1f746fe0
--- /dev/null
+++ b/scripts/atomic/fallbacks/sub_and_test
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_${atomic}_sub_return(i, v) == 0;
+EOF
diff --git a/scripts/atomic/fallbacks/try_cmpxchg b/scripts/atomic/fallbacks/try_cmpxchg
new file mode 100755
index 000000000..d4da82092
--- /dev/null
+++ b/scripts/atomic/fallbacks/try_cmpxchg
@@ -0,0 +1,7 @@
+cat <<EOF
+	${int} r, o = *old;
+	r = raw_${atomic}_cmpxchg${order}(v, o, new);
+	if (unlikely(r != o))
+		*old = r;
+	return likely(r == o);
+EOF
diff --git a/scripts/atomic/fallbacks/xchg b/scripts/atomic/fallbacks/xchg
new file mode 100644
index 000000000..e4def1e0d
--- /dev/null
+++ b/scripts/atomic/fallbacks/xchg
@@ -0,0 +1,3 @@
+cat <<EOF
+	return raw_xchg${order}(&v->counter, new);
+EOF
-- 
cgit v1.3.1