On Wed, Dec 20, 2023 at 11:40:10PM +0200, Maxim Mikityanskiy wrote:
When the width of a fill is smaller than the width of the preceding spill, the information about scalar boundaries can still be preserved, as long as it's coerced to the right width (done by coerce_reg_to_size). Even further, if the actual value fits into the fill width, the ID can be preserved as well for further tracking of equal scalars.
Implement the above improvements, which makes narrowing fills behave the same as narrowing spills and MOVs between registers.
Two tests are adjusted to accommodate for endianness differences and to take into account that it's now allowed to do a narrowing fill from the least significant bits.
reg_bounds_sync is added to coerce_reg_to_size to correctly adjust umin/umax boundaries after the var_off truncation, for example, a 64-bit value 0xXXXXXXXX00000000, when read as a 32-bit, gets umin = 0, umax = 0xFFFFFFFF, var_off = (0x0; 0xffffffff00000000), which needs to be synced down to umax = 0, otherwise reg_bounds_sanity_check doesn't pass.
Signed-off-by: Maxim Mikityanskiy maxim@isovalent.com
kernel/bpf/verifier.c | 20 ++++++++++--- .../selftests/bpf/progs/verifier_spill_fill.c | 28 +++++++++++++------ 2 files changed, 35 insertions(+), 13 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9b5053389739..b6e252539e52 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4772,7 +4772,13 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, if (dst_regno < 0) return 0;
if (!(off % BPF_REG_SIZE) && size == spill_size) {
if (size <= spill_size &&+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
!(off % BPF_REG_SIZE)+#else
!((off + size - spill_size) % BPF_REG_SIZE)+#endif
If I understand correctly, it is preferred to keep endianess checking macro out of verfier.c and have helper function handle them instead.
E.g. See bpf_ctx_narrow_access_offset() from include/linux/filter.h
[...]