bpf: cleanup register_is_null() (914cb781) · Commits · 戴 / test

kernel/bpf/verifier.c

+10 −10

Original line number	Diff line number	Diff line
		@@ -1265,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins
		}

		/* Does this register contain a constant zero? */
		static bool register_is_null(struct bpf_reg_state reg)
		static bool register_is_null(struct bpf_reg_state *reg)
		{
		return reg.type == SCALAR_VALUE && tnum_equals_const(reg.var_off, 0);
		return reg->type == SCALAR_VALUE && tnum_equals_const(reg->var_off, 0);
		}

		/* when register 'regno' is passed into function that will read 'access_size'
		@@ -1280,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
		int access_size, bool zero_size_allowed,
		struct bpf_call_arg_meta *meta)
		{
		struct bpf_reg_state *reg = cur_regs(env) + regno;
		struct bpf_verifier_state *state = env->cur_state;
		struct bpf_reg_state *regs = state->regs;
		int off, i, slot, spi;

		if (regs[regno].type != PTR_TO_STACK) {
		if (reg->type != PTR_TO_STACK) {
		/* Allow zero-byte read from NULL, regardless of pointer type */
		if (zero_size_allowed && access_size == 0 &&
		register_is_null(regs[regno]))
		register_is_null(reg))
		return 0;

		verbose(env, "R%d type=%s expected=%s\n", regno,
		reg_type_str[regs[regno].type],
		reg_type_str[reg->type],
		reg_type_str[PTR_TO_STACK]);
		return -EACCES;
		}

		/* Only allow fixed-offset stack reads */
		if (!tnum_is_const(regs[regno].var_off)) {
		if (!tnum_is_const(reg->var_off)) {
		char tn_buf[48];

		tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off);
		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
		verbose(env, "invalid variable stack read R%d var_off=%s\n",
		regno, tn_buf);
		}
		off = regs[regno].off + regs[regno].var_off.value;
		off = reg->off + reg->var_off.value;
		if (off >= 0 \|\| off < -MAX_BPF_STACK \|\| off + access_size > 0 \|\|
		access_size < 0 \|\| (access_size == 0 && !zero_size_allowed)) {
		verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
		@@ -1412,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
		* passed in as argument, it's a SCALAR_VALUE type. Final test
		* happens during stack boundary checking.
		*/
		if (register_is_null(*reg) &&
		if (register_is_null(reg) &&
		arg_type == ARG_PTR_TO_MEM_OR_NULL)
		/* final test in check_stack_boundary() */;
		else if (!type_is_pkt_pointer(type) &&

Admin message