Commit 960ea056 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Daniel Borkmann
Browse files

bpf: verifier: teach the verifier to reason about the BPF_JSET instruction 



Some JITs (nfp) try to optimize code on their own.  It could make
sense in case of BPF_JSET instruction which is currently not interpreted
by the verifier, meaning for instance that dead could would not be
detected if it was under BPF_JSET branch.

Teach the verifier basics of BPF_JSET, JIT optimizations will be
removed shortly.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarJiong Wang <jiong.wang@netronome.com>
Acked-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 5a8d5209

kernel/bpf/verifier.c

+20 −0
Original line number Diff line number Diff line
@@ -3859,6 +3859,12 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode) 
		if (tnum_is_const(reg->var_off))

			return !tnum_equals_const(reg->var_off, val);

		break;

	case BPF_JSET:

		if ((~reg->var_off.mask & reg->var_off.value) & val)

			return 1;

		if (!((reg->var_off.mask | reg->var_off.value) & val))

			return 0;

		break;

	case BPF_JGT:

		if (reg->umin_value > val)

			return 1;
@@ -3943,6 +3949,13 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg, 
		 */

		__mark_reg_known(false_reg, val);

		break;

	case BPF_JSET:

		false_reg->var_off = tnum_and(false_reg->var_off,

					      tnum_const(~val));

		if (is_power_of_2(val))

			true_reg->var_off = tnum_or(true_reg->var_off,

						    tnum_const(val));

		break;

	case BPF_JGT:

		false_reg->umax_value = min(false_reg->umax_value, val);

		true_reg->umin_value = max(true_reg->umin_value, val + 1);
@@ -4015,6 +4028,13 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg, 
		 */

		__mark_reg_known(false_reg, val);

		break;

	case BPF_JSET:

		false_reg->var_off = tnum_and(false_reg->var_off,

					      tnum_const(~val));

		if (is_power_of_2(val))

			true_reg->var_off = tnum_or(true_reg->var_off,

						    tnum_const(val));

		break;

	case BPF_JGT:

		true_reg->umax_value = min(true_reg->umax_value, val - 1);

		false_reg->umin_value = max(false_reg->umin_value, val);

CRA Git | Maintained and supported by SUSTech CRA and CCSE