tools/testing/selftests/bpf/verifier/atomic_fetch.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/bpf/verifier/atomic_fetch.c

File Facts

System: Linux kernel
Corpus path: tools/testing/selftests/bpf/verifier/atomic_fetch.c
Extension: .c
Size: 6701 bytes
Lines: 152
Domain: Support Tooling And Documentation
Bucket: tools
Inferred role: Support Tooling And Documentation: implementation source
Status: source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.
Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.

Dependency Surface

No C-style include directives detected by the generator.

Detected Declarations

No top-level syscall, struct, function, initcall, or export declaration detected by the generator.

Annotated Snippet

{
	"atomic dw/fetch and address leakage of (map ptr & -1) via stack slot",
	.insns = {
		BPF_LD_IMM64(BPF_REG_1, -1),
		BPF_LD_MAP_FD(BPF_REG_8, 0),
		BPF_LD_MAP_FD(BPF_REG_9, 0),
		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
		BPF_ATOMIC_OP(BPF_DW, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_2, 0),
		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	},
	.fixup_map_array_48b = { 2, 4 },
	.result = ACCEPT,
	.result_unpriv = REJECT,
	.errstr_unpriv = "leaking pointer from stack off -8",
},
{
	"atomic dw/fetch and address leakage of (map ptr & -1) via returned value",
	.insns = {
		BPF_LD_IMM64(BPF_REG_1, -1),
		BPF_LD_MAP_FD(BPF_REG_8, 0),
		BPF_LD_MAP_FD(BPF_REG_9, 0),
		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
		BPF_ATOMIC_OP(BPF_DW, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
		BPF_MOV64_REG(BPF_REG_9, BPF_REG_1),
		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	},
	.fixup_map_array_48b = { 2, 4 },
	.result = ACCEPT,
	.result_unpriv = REJECT,
	.errstr_unpriv = "leaking pointer from stack off -8",
},
{
	"atomic w/fetch and address leakage of (map ptr & -1) via stack slot",
	.insns = {
		BPF_LD_IMM64(BPF_REG_1, -1),
		BPF_LD_MAP_FD(BPF_REG_8, 0),
		BPF_LD_MAP_FD(BPF_REG_9, 0),
		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
		BPF_ATOMIC_OP(BPF_W, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_2, 0),
		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	},
	.fixup_map_array_48b = { 2, 4 },
	.result = REJECT,
	.errstr = "invalid size of register fill",
},
{
	"atomic w/fetch and address leakage of (map ptr & -1) via returned value",
	.insns = {
		BPF_LD_IMM64(BPF_REG_1, -1),
		BPF_LD_MAP_FD(BPF_REG_8, 0),
		BPF_LD_MAP_FD(BPF_REG_9, 0),
		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
		BPF_ATOMIC_OP(BPF_W, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
		BPF_MOV64_REG(BPF_REG_9, BPF_REG_1),
		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_EXIT_INSN(),
	},

Annotation

Atlas domain: Support Tooling And Documentation / tools.
Implementation status: source implementation candidate.
Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.

Implementation Notes

This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.