From mboxrd@z Thu Jan 1 00:00:00 1970 From: Edward Cree Subject: [PATCH bpf-next] bpf/verifier: properly clear union members after a ctx read Date: Tue, 4 Sep 2018 15:19:52 +0100 Message-ID: <0b724ba4-9ddf-e635-0bd5-201658355cf5@solarflare.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Cc: To: , Return-path: Received: from dispatch1-us1.ppe-hosted.com ([67.231.154.164]:50798 "EHLO dispatch1-us1.ppe-hosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727072AbeIDSpY (ORCPT ); Tue, 4 Sep 2018 14:45:24 -0400 Content-Language: en-GB Sender: netdev-owner@vger.kernel.org List-ID: In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access() has supplied a reg_type, the other members of the register state are set appropriately. Previously reg.range was set to 0, but as it is in a union with reg.map_ptr, which is larger, upper bytes of the latter were left in place. This then caused the memcmp() in regsafe() to fail, preventing some branches from being pruned (and occasionally causing the same program to take a varying number of processed insns on repeated verifier runs). Signed-off-by: Edward Cree --- Possibly something might need adding to __mark_reg_unknown() as well to clear map_ptr/range, I'm not sure (though doing so did not affect the processed insn count on the cilium programs). kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index f4ff0c569e54..49e4ea66fdd3 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1640,9 +1640,9 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn else mark_reg_known_zero(env, regs, value_regno); - regs[value_regno].id = 0; - regs[value_regno].off = 0; - regs[value_regno].range = 0; + /* Clear id, off, and union(map_ptr, range) */ + memset(regs + value_regno, 0, + offsetof(struct bpf_reg_state, var_off)); regs[value_regno].type = reg_type; }