bpf: fix states equal logic for varlen access (e2d2afe1) · Commits · 戴 / test

If we have a branch that looks something like this int foo = map->value; if (condition) { foo += blah; } else { foo = bar; } map->array[foo] = baz; We will incorrectly assume that the !condition branch is equal to the condition branch as the register for foo will be UNKNOWN_VALUE in both cases. We need to adjust this logic to only do this if we didn't do a varlen access after we processed the !condition branch, otherwise we have different ranges and need to check the other branch as well. Fixes: ("bpf: allow access into map value arrays") Reported-by:

Jann Horn <jannh@google.com> Signed-off-by:

Josef Bacik <jbacik@fb.com> Acked-by:

Alexei Starovoitov <ast@kernel.org> Acked-by:

Daniel Borkmann <daniel@iogearbox.net> Signed-off-by:

David S. Miller <davem@davemloft.net>

kernel/bpf/verifier.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -2454,6 +2454,7 @@ static bool states_equal(struct bpf_verifier_env *env,
		struct bpf_verifier_state *old,
		struct bpf_verifier_state *cur)
		{
		bool varlen_map_access = env->varlen_map_value_access;
		struct bpf_reg_state rold, rcur;
		int i;

		@@ -2467,12 +2468,17 @@ static bool states_equal(struct bpf_verifier_env *env,
		/* If the ranges were not the same, but everything else was and
		* we didn't do a variable access into a map then we are a-ok.
		*/
		if (!env->varlen_map_value_access &&
		if (!varlen_map_access &&
		rold->type == rcur->type && rold->imm == rcur->imm)
		continue;

		/* If we didn't map access then again we don't care about the
		* mismatched range values and it's ok if our old type was
		* UNKNOWN and we didn't go to a NOT_INIT'ed reg.
		*/
		if (rold->type == NOT_INIT \|\|
		(rold->type == UNKNOWN_VALUE && rcur->type != NOT_INIT))
		(!varlen_map_access && rold->type == UNKNOWN_VALUE &&
		rcur->type != NOT_INIT))
		continue;

		if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&

Admin message