system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-04 02:10:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

bpf: teach verifier actual bounds of bpf_get_smp_processor_id() result

Browse source 
bpf_get_smp_processor_id() helper returns current CPU on which BPF
program runs. It can't return value that is bigger than maximum allowed
number of CPUs (minus one, due to zero indexing). Teach BPF verifier to
recognize that. This makes it possible to use bpf_get_smp_processor_id()
result to index into arrays without extra checks, as demonstrated in
subsequent selftests/bpf patch.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20230711232400.1658562-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Andrii Nakryiko 2023-07-11 16:23:59 -07:00 committed by Alexei Starovoitov
parent 87e098e623
commit f42bcd168d
1 changed files with 26 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
kernel/bpf/verifier.c
View file

@ -25,6 +25,7 @@
#include <linux/btf_ids.h>
#include <linux/poison.h>
#include <linux/module.h>
#include <linux/cpumask.h>
#include "disasm.h"
@ -9116,19 +9117,33 @@ static void do_refine_retval_range(struct bpf_reg_state *regs, int ret_type,
{
struct bpf_reg_state *ret_reg = &regs[BPF_REG_0];
if (ret_type != RET_INTEGER ||
(func_id != BPF_FUNC_get_stack &&
func_id != BPF_FUNC_get_task_stack &&
func_id != BPF_FUNC_probe_read_str &&
func_id != BPF_FUNC_probe_read_kernel_str &&
func_id != BPF_FUNC_probe_read_user_str))
if (ret_type != RET_INTEGER)
return;
ret_reg->smax_value = meta->msize_max_value;
ret_reg->s32_max_value = meta->msize_max_value;
ret_reg->smin_value = -MAX_ERRNO;
ret_reg->s32_min_value = -MAX_ERRNO;
reg_bounds_sync(ret_reg);
switch (func_id) {
case BPF_FUNC_get_stack:
case BPF_FUNC_get_task_stack:
case BPF_FUNC_probe_read_str:
case BPF_FUNC_probe_read_kernel_str:
case BPF_FUNC_probe_read_user_str:
ret_reg->smax_value = meta->msize_max_value;
ret_reg->s32_max_value = meta->msize_max_value;
ret_reg->smin_value = -MAX_ERRNO;
ret_reg->s32_min_value = -MAX_ERRNO;
reg_bounds_sync(ret_reg);
break;
case BPF_FUNC_get_smp_processor_id:
ret_reg->umax_value = nr_cpu_ids - 1;
ret_reg->u32_max_value = nr_cpu_ids - 1;
ret_reg->smax_value = nr_cpu_ids - 1;
ret_reg->s32_max_value = nr_cpu_ids - 1;
ret_reg->umin_value = 0;
ret_reg->u32_min_value = 0;
ret_reg->smin_value = 0;
ret_reg->s32_min_value = 0;
reg_bounds_sync(ret_reg);
break;
}
}
static int