lkml.org 
[lkml]   [2022]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 05/15] bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
    Date
    From: John Fastabend <john.fastabend@gmail.com>

    commit 294f2fc6da27620a506e6c050241655459ccd6bd upstream.

    Currently, for all op verification we call __red_deduce_bounds() and
    __red_bound_offset() but we only call __update_reg_bounds() in bitwise
    ops. However, we could benefit from calling __update_reg_bounds() in
    BPF_ADD, BPF_SUB, and BPF_MUL cases as well.

    For example, a register with state 'R1_w=invP0' when we subtract from
    it,

    w1 -= 2

    Before coerce we will now have an smin_value=S64_MIN, smax_value=U64_MAX
    and unsigned bounds umin_value=0, umax_value=U64_MAX. These will then
    be clamped to S32_MIN, U32_MAX values by coerce in the case of alu32 op
    as done in above example. However tnum will be a constant because the
    ALU op is done on a constant.

    Without update_reg_bounds() we have a scenario where tnum is a const
    but our unsigned bounds do not reflect this. By calling update_reg_bounds
    after coerce to 32bit we further refine the umin_value to U64_MAX in the
    alu64 case or U32_MAX in the alu32 case above.

    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/158507151689.15666.566796274289413203.stgit@john-Precision-5820-Tower
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/verifier.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -5083,6 +5083,7 @@ static int adjust_scalar_min_max_vals(st
    coerce_reg_to_size(dst_reg, 4);
    }

    + __update_reg_bounds(dst_reg);
    __reg_deduce_bounds(dst_reg);
    __reg_bound_offset(dst_reg);
    return 0;

    \
     
     \ /
      Last update: 2022-08-09 20:09    [W:4.056 / U:1.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site