> selftests/bpf: Cover half-slot cleanup of pointer spills
>
> Add a verifier regression test for a pointer spill whose high half is
> cleaned dead while the low half remains live. Force checkpoint creation
> with BPF_F_TEST_STATE_FREQ and assert the verifier log reaches the
> checkpoint and the subsequent 32-bit fill before rejecting the partial
> fill
> from a non-scalar spill.
>
> Acked-by: Eduard Zingerman <[email protected]>
> Signed-off-by: Nuoqi Gui <[email protected]>
This is a regression test for a verifier bug where a partial 32-bit fill
from a pointer spill whose high half was cleaned dead could read a
non-scalar stack slot past the register-fill check.
The half-slot cleanup that destroys the spilled_ptr metadata when the hi
half is dead was introduced in __clean_func_state() by:
be23266b4a08 ("bpf: 4-byte precise clean_verifier_state")
Should this test carry a Fixes: tag pointing at that commit, matching the
accompanying fix?
Fixes: be23266b4a08 ("bpf: 4-byte precise clean_verifier_state")
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/27700639579
