mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
bpf: Track spilled unbounded scalars
Support the pattern where an unbounded scalar is spilled to the stack, then boundary checks are performed on the src register, after which the stack frame slot is refilled into a register. Before this commit, the verifier didn't treat the src register and the stack slot as related if the src register was an unbounded scalar. The register state wasn't copied, the id wasn't preserved, and the stack slot was marked as STACK_MISC. Subsequent boundary checks on the src register wouldn't result in updating the boundaries of the spilled variable on the stack. After this commit, the verifier will preserve the bond between src and dst even if src is unbounded, which permits to do boundary checks on src and refill dst later, still remembering its boundaries. Such a pattern is sometimes generated by clang when compiling complex long functions. One test is adjusted to reflect that now unbounded scalars are tracked. Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20240127175237.526726-2-maxtram95@gmail.com
This commit is contained in:
parent
943b043aee
commit
e67ddd9b1c
|
@ -4380,20 +4380,6 @@ static u64 reg_const_value(struct bpf_reg_state *reg, bool subreg32)
|
|||
return subreg32 ? tnum_subreg(reg->var_off).value : reg->var_off.value;
|
||||
}
|
||||
|
||||
static bool __is_scalar_unbounded(struct bpf_reg_state *reg)
|
||||
{
|
||||
return tnum_is_unknown(reg->var_off) &&
|
||||
reg->smin_value == S64_MIN && reg->smax_value == S64_MAX &&
|
||||
reg->umin_value == 0 && reg->umax_value == U64_MAX &&
|
||||
reg->s32_min_value == S32_MIN && reg->s32_max_value == S32_MAX &&
|
||||
reg->u32_min_value == 0 && reg->u32_max_value == U32_MAX;
|
||||
}
|
||||
|
||||
static bool register_is_bounded(struct bpf_reg_state *reg)
|
||||
{
|
||||
return reg->type == SCALAR_VALUE && !__is_scalar_unbounded(reg);
|
||||
}
|
||||
|
||||
static bool __is_pointer_value(bool allow_ptr_leaks,
|
||||
const struct bpf_reg_state *reg)
|
||||
{
|
||||
|
@ -4504,7 +4490,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
|
|||
return err;
|
||||
|
||||
mark_stack_slot_scratched(env, spi);
|
||||
if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) && env->bpf_capable) {
|
||||
if (reg && !(off % BPF_REG_SIZE) && reg->type == SCALAR_VALUE && env->bpf_capable) {
|
||||
bool reg_value_fits;
|
||||
|
||||
reg_value_fits = get_reg_width(reg) <= BITS_PER_BYTE * size;
|
||||
|
|
|
@ -452,9 +452,9 @@ l0_%=: r1 >>= 16; \
|
|||
SEC("raw_tp")
|
||||
__log_level(2)
|
||||
__success
|
||||
__msg("fp-8=0m??mmmm")
|
||||
__msg("fp-16=00mm??mm")
|
||||
__msg("fp-24=00mm???m")
|
||||
__msg("fp-8=0m??scalar()")
|
||||
__msg("fp-16=00mm??scalar()")
|
||||
__msg("fp-24=00mm???scalar()")
|
||||
__naked void spill_subregs_preserve_stack_zero(void)
|
||||
{
|
||||
asm volatile (
|
||||
|
|
Loading…
Reference in a new issue