bpf: move {prev_,}insn_idx into verifier env (c08435ec) · Commits · 戴 / test

include/linux/bpf_verifier.h

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -212,6 +212,8 @@ struct bpf_subprog_info {
	* one verifier_env per bpf_check() call		* one verifier_env per bpf_check() call
	*/		*/
	struct bpf_verifier_env {		struct bpf_verifier_env {
			u32 insn_idx;
			u32 prev_insn_idx;
	struct bpf_prog prog; / eBPF program being verified */		struct bpf_prog prog; / eBPF program being verified */
	const struct bpf_verifier_ops *ops;		const struct bpf_verifier_ops *ops;
	struct bpf_verifier_stack_elem head; / stack of verifier states to be processed */		struct bpf_verifier_stack_elem head; / stack of verifier states to be processed */

kernel/bpf/verifier.c

+38 −38

Original line number	Original line	Diff line number	Diff line
	@@ -5650,7 +5650,6 @@ static int do_check(struct bpf_verifier_env *env)
	struct bpf_insn *insns = env->prog->insnsi;		struct bpf_insn *insns = env->prog->insnsi;
	struct bpf_reg_state *regs;		struct bpf_reg_state *regs;
	int insn_cnt = env->prog->len, i;		int insn_cnt = env->prog->len, i;
	int insn_idx, prev_insn_idx = 0;
	int insn_processed = 0;		int insn_processed = 0;
	bool do_print_state = false;		bool do_print_state = false;

	@@ -5670,19 +5669,19 @@ static int do_check(struct bpf_verifier_env *env)
	BPF_MAIN_FUNC /* callsite */,		BPF_MAIN_FUNC /* callsite */,
	0 /* frameno */,		0 /* frameno */,
	0 /* subprogno, zero == main subprog */);		0 /* subprogno, zero == main subprog */);
	insn_idx = 0;
	for (;;) {		for (;;) {
	struct bpf_insn *insn;		struct bpf_insn *insn;
	u8 class;		u8 class;
	int err;		int err;

	if (insn_idx >= insn_cnt) {		if (env->insn_idx >= insn_cnt) {
	verbose(env, "invalid insn idx %d insn_cnt %d\n",		verbose(env, "invalid insn idx %d insn_cnt %d\n",
	insn_idx, insn_cnt);		env->insn_idx, insn_cnt);
	return -EFAULT;		return -EFAULT;
	}		}

	insn = &insns[insn_idx];		insn = &insns[env->insn_idx];
	class = BPF_CLASS(insn->code);		class = BPF_CLASS(insn->code);

	if (++insn_processed > BPF_COMPLEXITY_LIMIT_INSNS) {		if (++insn_processed > BPF_COMPLEXITY_LIMIT_INSNS) {
	@@ -5692,7 +5691,7 @@ static int do_check(struct bpf_verifier_env *env)
	return -E2BIG;		return -E2BIG;
	}		}

	err = is_state_visited(env, insn_idx);		err = is_state_visited(env, env->insn_idx);
	if (err < 0)		if (err < 0)
	return err;		return err;
	if (err == 1) {		if (err == 1) {
	@@ -5700,9 +5699,9 @@ static int do_check(struct bpf_verifier_env *env)
	if (env->log.level) {		if (env->log.level) {
	if (do_print_state)		if (do_print_state)
	verbose(env, "\nfrom %d to %d: safe\n",		verbose(env, "\nfrom %d to %d: safe\n",
	prev_insn_idx, insn_idx);		env->prev_insn_idx, env->insn_idx);
	else		else
	verbose(env, "%d: safe\n", insn_idx);		verbose(env, "%d: safe\n", env->insn_idx);
	}		}
	goto process_bpf_exit;		goto process_bpf_exit;
	}		}
	@@ -5715,10 +5714,10 @@ static int do_check(struct bpf_verifier_env *env)

	if (env->log.level > 1 \|\| (env->log.level && do_print_state)) {		if (env->log.level > 1 \|\| (env->log.level && do_print_state)) {
	if (env->log.level > 1)		if (env->log.level > 1)
	verbose(env, "%d:", insn_idx);		verbose(env, "%d:", env->insn_idx);
	else		else
	verbose(env, "\nfrom %d to %d:",		verbose(env, "\nfrom %d to %d:",
	prev_insn_idx, insn_idx);		env->prev_insn_idx, env->insn_idx);
	print_verifier_state(env, state->frame[state->curframe]);		print_verifier_state(env, state->frame[state->curframe]);
	do_print_state = false;		do_print_state = false;
	}		}
	@@ -5729,20 +5728,20 @@ static int do_check(struct bpf_verifier_env *env)
	.private_data = env,		.private_data = env,
	};		};

	verbose_linfo(env, insn_idx, "; ");		verbose_linfo(env, env->insn_idx, "; ");
	verbose(env, "%d: ", insn_idx);		verbose(env, "%d: ", env->insn_idx);
	print_bpf_insn(&cbs, insn, env->allow_ptr_leaks);		print_bpf_insn(&cbs, insn, env->allow_ptr_leaks);
	}		}

	if (bpf_prog_is_dev_bound(env->prog->aux)) {		if (bpf_prog_is_dev_bound(env->prog->aux)) {
	err = bpf_prog_offload_verify_insn(env, insn_idx,		err = bpf_prog_offload_verify_insn(env, env->insn_idx,
	prev_insn_idx);		env->prev_insn_idx);
	if (err)		if (err)
	return err;		return err;
	}		}

	regs = cur_regs(env);		regs = cur_regs(env);
	env->insn_aux_data[insn_idx].seen = true;		env->insn_aux_data[env->insn_idx].seen = true;

	if (class == BPF_ALU \|\| class == BPF_ALU64) {		if (class == BPF_ALU \|\| class == BPF_ALU64) {
	err = check_alu_op(env, insn);		err = check_alu_op(env, insn);
	@@ -5768,13 +5767,13 @@ static int do_check(struct bpf_verifier_env *env)
	/* check that memory (src_reg + off) is readable,		/* check that memory (src_reg + off) is readable,
	* the state of dst_reg will be updated by this func		* the state of dst_reg will be updated by this func
	*/		*/
	err = check_mem_access(env, insn_idx, insn->src_reg, insn->off,		err = check_mem_access(env, env->insn_idx, insn->src_reg,
	BPF_SIZE(insn->code), BPF_READ,		insn->off, BPF_SIZE(insn->code),
	insn->dst_reg, false);		BPF_READ, insn->dst_reg, false);
	if (err)		if (err)
	return err;		return err;

	prev_src_type = &env->insn_aux_data[insn_idx].ptr_type;		prev_src_type = &env->insn_aux_data[env->insn_idx].ptr_type;

	if (*prev_src_type == NOT_INIT) {		if (*prev_src_type == NOT_INIT) {
	/* saw a valid insn		/* saw a valid insn
	@@ -5799,10 +5798,10 @@ static int do_check(struct bpf_verifier_env *env)
	enum bpf_reg_type *prev_dst_type, dst_reg_type;		enum bpf_reg_type *prev_dst_type, dst_reg_type;

	if (BPF_MODE(insn->code) == BPF_XADD) {		if (BPF_MODE(insn->code) == BPF_XADD) {
	err = check_xadd(env, insn_idx, insn);		err = check_xadd(env, env->insn_idx, insn);
	if (err)		if (err)
	return err;		return err;
	insn_idx++;		env->insn_idx++;
	continue;		continue;
	}		}

	@@ -5818,13 +5817,13 @@ static int do_check(struct bpf_verifier_env *env)
	dst_reg_type = regs[insn->dst_reg].type;		dst_reg_type = regs[insn->dst_reg].type;

	/* check that memory (dst_reg + off) is writeable */		/* check that memory (dst_reg + off) is writeable */
	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,		err = check_mem_access(env, env->insn_idx, insn->dst_reg,
	BPF_SIZE(insn->code), BPF_WRITE,		insn->off, BPF_SIZE(insn->code),
	insn->src_reg, false);		BPF_WRITE, insn->src_reg, false);
	if (err)		if (err)
	return err;		return err;

	prev_dst_type = &env->insn_aux_data[insn_idx].ptr_type;		prev_dst_type = &env->insn_aux_data[env->insn_idx].ptr_type;

	if (*prev_dst_type == NOT_INIT) {		if (*prev_dst_type == NOT_INIT) {
	*prev_dst_type = dst_reg_type;		*prev_dst_type = dst_reg_type;
	@@ -5852,9 +5851,9 @@ static int do_check(struct bpf_verifier_env *env)
	}		}

	/* check that memory (dst_reg + off) is writeable */		/* check that memory (dst_reg + off) is writeable */
	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,		err = check_mem_access(env, env->insn_idx, insn->dst_reg,
	BPF_SIZE(insn->code), BPF_WRITE,		insn->off, BPF_SIZE(insn->code),
	-1, false);		BPF_WRITE, -1, false);
	if (err)		if (err)
	return err;		return err;

	@@ -5872,9 +5871,9 @@ static int do_check(struct bpf_verifier_env *env)
	}		}

	if (insn->src_reg == BPF_PSEUDO_CALL)		if (insn->src_reg == BPF_PSEUDO_CALL)
	err = check_func_call(env, insn, &insn_idx);		err = check_func_call(env, insn, &env->insn_idx);
	else		else
	err = check_helper_call(env, insn->imm, insn_idx);		err = check_helper_call(env, insn->imm, env->insn_idx);
	if (err)		if (err)
	return err;		return err;

	@@ -5887,7 +5886,7 @@ static int do_check(struct bpf_verifier_env *env)
	return -EINVAL;		return -EINVAL;
	}		}

	insn_idx += insn->off + 1;		env->insn_idx += insn->off + 1;
	continue;		continue;

	} else if (opcode == BPF_EXIT) {		} else if (opcode == BPF_EXIT) {
	@@ -5901,8 +5900,8 @@ static int do_check(struct bpf_verifier_env *env)

	if (state->curframe) {		if (state->curframe) {
	/* exit from nested function */		/* exit from nested function */
	prev_insn_idx = insn_idx;		env->prev_insn_idx = env->insn_idx;
	err = prepare_func_exit(env, &insn_idx);		err = prepare_func_exit(env, &env->insn_idx);
	if (err)		if (err)
	return err;		return err;
	do_print_state = true;		do_print_state = true;
	@@ -5932,7 +5931,8 @@ static int do_check(struct bpf_verifier_env *env)
	if (err)		if (err)
	return err;		return err;
	process_bpf_exit:		process_bpf_exit:
	err = pop_stack(env, &prev_insn_idx, &insn_idx);		err = pop_stack(env, &env->prev_insn_idx,
			&env->insn_idx);
	if (err < 0) {		if (err < 0) {
	if (err != -ENOENT)		if (err != -ENOENT)
	return err;		return err;
	@@ -5942,7 +5942,7 @@ process_bpf_exit:
	continue;		continue;
	}		}
	} else {		} else {
	err = check_cond_jmp_op(env, insn, &insn_idx);		err = check_cond_jmp_op(env, insn, &env->insn_idx);
	if (err)		if (err)
	return err;		return err;
	}		}
	@@ -5959,8 +5959,8 @@ process_bpf_exit:
	if (err)		if (err)
	return err;		return err;

	insn_idx++;		env->insn_idx++;
	env->insn_aux_data[insn_idx].seen = true;		env->insn_aux_data[env->insn_idx].seen = true;
	} else {		} else {
	verbose(env, "invalid BPF_LD mode\n");		verbose(env, "invalid BPF_LD mode\n");
	return -EINVAL;		return -EINVAL;
	@@ -5970,7 +5970,7 @@ process_bpf_exit:
	return -EINVAL;		return -EINVAL;
	}		}

	insn_idx++;		env->insn_idx++;
	}		}

	verbose(env, "processed %d insns (limit %d), stack depth ",		verbose(env, "processed %d insns (limit %d), stack depth ",

Admin message