mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
bpf: take into account liveness when propagating precision
[ Upstream commit52c2b005a3
] When doing state comparison, if old state has register that is not marked as REG_LIVE_READ, then we just skip comparison, regardless what's the state of corresponing register in current state. This is because not REG_LIVE_READ register is irrelevant for further program execution and correctness. All good here. But when we get to precision propagation, after two states were declared equivalent, we don't take into account old register's liveness, and thus attempt to propagate precision for register in current state even if that register in old state was not REG_LIVE_READ anymore. This is bad, because register in current state could be anything at all and this could cause -EFAULT due to internal logic bugs. Fix by taking into account REG_LIVE_READ liveness mark to keep the logic in state comparison in sync with precision propagation. Fixes:a3ce685dd0
("bpf: fix precision tracking") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/r/20230309224131.57449-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
23634d119c
commit
c022b09fcc
1 changed files with 4 additions and 2 deletions
|
@ -10616,7 +10616,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
|
|||
state_reg = state->regs;
|
||||
for (i = 0; i < BPF_REG_FP; i++, state_reg++) {
|
||||
if (state_reg->type != SCALAR_VALUE ||
|
||||
!state_reg->precise)
|
||||
!state_reg->precise ||
|
||||
!(state_reg->live & REG_LIVE_READ))
|
||||
continue;
|
||||
if (env->log.level & BPF_LOG_LEVEL2)
|
||||
verbose(env, "frame %d: propagating r%d\n", i, fr);
|
||||
|
@ -10630,7 +10631,8 @@ static int propagate_precision(struct bpf_verifier_env *env,
|
|||
continue;
|
||||
state_reg = &state->stack[i].spilled_ptr;
|
||||
if (state_reg->type != SCALAR_VALUE ||
|
||||
!state_reg->precise)
|
||||
!state_reg->precise ||
|
||||
!(state_reg->live & REG_LIVE_READ))
|
||||
continue;
|
||||
if (env->log.level & BPF_LOG_LEVEL2)
|
||||
verbose(env, "frame %d: propagating fp%d\n",
|
||||
|
|
Loading…
Reference in a new issue