On Tue, 2024-12-03 at 18:41 -0800, Kumar Kartikeya Dwivedi wrote:
[...]
> +/* r2 with offset is checked, which marks r1 with off=0 as non-NULL */
> +SEC("tp_btf/bpf_testmod_test_raw_tp_null")
> +__failure
> +__msg("3: (07) r2 += 8 ; R2_w=trusted_ptr_or_null_sk_buff(id=1,off=8)")
> +__msg("4: (15) if r2 == 0x0 goto pc+2 ; R2_w=trusted_ptr_or_null_sk_buff(id=2,off=8)")
> +__msg("5: (bf) r1 = r1 ; R1_w=trusted_ptr_sk_buff()")
This looks like a bug.
'r1 != 0' does not follow from 'r2 == r1 + 8 and r2 != 0'.
> +int BPF_PROG(test_raw_tp_null_copy_check_with_off, struct sk_buff *skb)
> +{
> + asm volatile (
> + "r1 = *(u64 *)(r1 +0); \
> + r2 = r1; \
> + r3 = 0; \
> + r2 += 8; \
> + if r2 == 0 goto jmp2; \
> + r1 = r1; \
> + *(u64 *)(r3 +0) = r3; \
> + jmp2: "
> + ::
> + : __clobber_all
> + );
> + return 0;
> +}
[...]
