37086bfdc7
When BPF_FETCH is set, atomic instructions load a value from memory into a register. The current verifier code first checks via check_mem_access whether we can access the memory, and then checks via check_reg_arg whether we can write into the register. For loads, check_reg_arg has the side-effect of marking the register's value as unkonwn, and check_mem_access has the side effect of propagating bounds from memory to the register. This currently only takes effect for stack memory. Therefore with the current order, bounds information is thrown away, but by simply reversing the order of check_reg_arg vs. check_mem_access, we can instead propagate bounds smartly. A simple test is added with an infinite loop that can only be proved unreachable if this propagation is present. This is implemented both with C and directly in test_verifier using assembly. Suggested-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210202135002.4024825-1-jackmanb@google.com
28 lines
840 B
C
28 lines
840 B
C
{
|
|
"BPF_ATOMIC bounds propagation, mem->reg",
|
|
.insns = {
|
|
/* a = 0; */
|
|
/*
|
|
* Note this is implemented with two separate instructions,
|
|
* where you might think one would suffice:
|
|
*
|
|
* BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
*
|
|
* This is because BPF_ST_MEM doesn't seem to set the stack slot
|
|
* type to 0 when storing an immediate.
|
|
*/
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
|
|
/* b = atomic_fetch_add(&a, 1); */
|
|
BPF_MOV64_IMM(BPF_REG_1, 1),
|
|
BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_1, -8),
|
|
/* Verifier should be able to tell that this infinite loop isn't reachable. */
|
|
/* if (b) while (true) continue; */
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "back-edge",
|
|
},
|