verifier.c (d9439c21a9e4769bfd83a03ab39056164d44ac31) verifier.c (1ef22b6865a73a8aed36d43375fe8c7b30869326)
1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
3 * Copyright (c) 2016 Facebook
4 * Copyright (c) 2018 Covalent IO, Inc. http://covalent.io
5 */
6#include <uapi/linux/btf.h>
7#include <linux/bpf-cgroup.h>
8#include <linux/kernel.h>

--- 3722 unchanged lines hidden (view full) ---

3731{
3732 struct backtrack_state *bt = &env->bt;
3733 struct bpf_verifier_state *st = env->cur_state;
3734 int first_idx = st->first_insn_idx;
3735 int last_idx = env->insn_idx;
3736 struct bpf_func_state *func;
3737 struct bpf_reg_state *reg;
3738 bool skip_first = true;
1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
3 * Copyright (c) 2016 Facebook
4 * Copyright (c) 2018 Covalent IO, Inc. http://covalent.io
5 */
6#include <uapi/linux/btf.h>
7#include <linux/bpf-cgroup.h>
8#include <linux/kernel.h>

--- 3722 unchanged lines hidden (view full) ---

3731{
3732 struct backtrack_state *bt = &env->bt;
3733 struct bpf_verifier_state *st = env->cur_state;
3734 int first_idx = st->first_insn_idx;
3735 int last_idx = env->insn_idx;
3736 struct bpf_func_state *func;
3737 struct bpf_reg_state *reg;
3738 bool skip_first = true;
3739 int i, err;
3739 int i, fr, err;
3740
3741 if (!env->bpf_capable)
3742 return 0;
3743
3744 /* set frame number from which we are starting to backtrack */
3745 bt_init(bt, frame);
3746
3747 /* Do sanity checks against current state of register and/or stack

--- 92 unchanged lines hidden (view full) ---

3840 WARN_ONCE(1, "verifier backtracking bug");
3841 return -EFAULT;
3842 }
3843 }
3844 st = st->parent;
3845 if (!st)
3846 break;
3847
3740
3741 if (!env->bpf_capable)
3742 return 0;
3743
3744 /* set frame number from which we are starting to backtrack */
3745 bt_init(bt, frame);
3746
3747 /* Do sanity checks against current state of register and/or stack

--- 92 unchanged lines hidden (view full) ---

3840 WARN_ONCE(1, "verifier backtracking bug");
3841 return -EFAULT;
3842 }
3843 }
3844 st = st->parent;
3845 if (!st)
3846 break;
3847
3848 func = st->frame[frame];
3849 bitmap_from_u64(mask, bt_reg_mask(bt));
3850 for_each_set_bit(i, mask, 32) {
3851 reg = &func->regs[i];
3852 if (reg->type != SCALAR_VALUE) {
3853 bt_clear_reg(bt, i);
3854 continue;
3848 for (fr = bt->frame; fr >= 0; fr--) {
3849 func = st->frame[fr];
3850 bitmap_from_u64(mask, bt_frame_reg_mask(bt, fr));
3851 for_each_set_bit(i, mask, 32) {
3852 reg = &func->regs[i];
3853 if (reg->type != SCALAR_VALUE) {
3854 bt_clear_frame_reg(bt, fr, i);
3855 continue;
3856 }
3857 if (reg->precise)
3858 bt_clear_frame_reg(bt, fr, i);
3859 else
3860 reg->precise = true;
3855 }
3861 }
3856 if (reg->precise)
3857 bt_clear_reg(bt, i);
3858 else
3859 reg->precise = true;
3860 }
3861
3862
3862 bitmap_from_u64(mask, bt_stack_mask(bt));
3863 for_each_set_bit(i, mask, 64) {
3864 if (i >= func->allocated_stack / BPF_REG_SIZE) {
3865 /* the sequence of instructions:
3866 * 2: (bf) r3 = r10
3867 * 3: (7b) *(u64 *)(r3 -8) = r0
3868 * 4: (79) r4 = *(u64 *)(r10 -8)
3869 * doesn't contain jmps. It's backtracked
3870 * as a single block.
3871 * During backtracking insn 3 is not recognized as
3872 * stack access, so at the end of backtracking
3873 * stack slot fp-8 is still marked in stack_mask.
3874 * However the parent state may not have accessed
3875 * fp-8 and it's "unallocated" stack space.
3876 * In such case fallback to conservative.
3877 */
3878 mark_all_scalars_precise(env, st);
3879 bt_reset(bt);
3880 return 0;
3881 }
3863 bitmap_from_u64(mask, bt_frame_stack_mask(bt, fr));
3864 for_each_set_bit(i, mask, 64) {
3865 if (i >= func->allocated_stack / BPF_REG_SIZE) {
3866 /* the sequence of instructions:
3867 * 2: (bf) r3 = r10
3868 * 3: (7b) *(u64 *)(r3 -8) = r0
3869 * 4: (79) r4 = *(u64 *)(r10 -8)
3870 * doesn't contain jmps. It's backtracked
3871 * as a single block.
3872 * During backtracking insn 3 is not recognized as
3873 * stack access, so at the end of backtracking
3874 * stack slot fp-8 is still marked in stack_mask.
3875 * However the parent state may not have accessed
3876 * fp-8 and it's "unallocated" stack space.
3877 * In such case fallback to conservative.
3878 */
3879 mark_all_scalars_precise(env, st);
3880 bt_reset(bt);
3881 return 0;
3882 }
3882
3883
3883 if (!is_spilled_scalar_reg(&func->stack[i])) {
3884 bt_clear_slot(bt, i);
3885 continue;
3884 if (!is_spilled_scalar_reg(&func->stack[i])) {
3885 bt_clear_frame_slot(bt, fr, i);
3886 continue;
3887 }
3888 reg = &func->stack[i].spilled_ptr;
3889 if (reg->precise)
3890 bt_clear_frame_slot(bt, fr, i);
3891 else
3892 reg->precise = true;
3886 }
3893 }
3887 reg = &func->stack[i].spilled_ptr;
3888 if (reg->precise)
3889 bt_clear_slot(bt, i);
3890 else
3891 reg->precise = true;
3894 if (env->log.level & BPF_LOG_LEVEL2) {
3895 fmt_reg_mask(env->tmp_str_buf, TMP_STR_BUF_LEN,
3896 bt_frame_reg_mask(bt, fr));
3897 verbose(env, "mark_precise: frame%d: parent state regs=%s ",
3898 fr, env->tmp_str_buf);
3899 fmt_stack_mask(env->tmp_str_buf, TMP_STR_BUF_LEN,
3900 bt_frame_stack_mask(bt, fr));
3901 verbose(env, "stack=%s: ", env->tmp_str_buf);
3902 print_verifier_state(env, func, true);
3903 }
3892 }
3904 }
3893 if (env->log.level & BPF_LOG_LEVEL2) {
3894 verbose(env, "parent %s regs=%x stack=%llx marks:",
3895 !bt_empty(bt) ? "didn't have" : "already had",
3896 bt_reg_mask(bt), bt_stack_mask(bt));
3897 print_verifier_state(env, func, true);
3898 }
3899
3900 if (bt_empty(bt))
3901 break;
3902
3903 last_idx = st->last_insn_idx;
3904 first_idx = st->first_insn_idx;
3905 }
3906 return 0;

--- 15358 unchanged lines hidden --- 		3905
3906 if (bt_empty(bt))
3907 break;
3908
3909 last_idx = st->last_insn_idx;
3910 first_idx = st->first_insn_idx;
3911 }
3912 return 0;

--- 15358 unchanged lines hidden ---