From: David Vernet <void@manifault.com>
To: bpf@vger.kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
john.fastabend@gmail.com, martin.lau@linux.dev, song@kernel.org,
yhs@fb.com, kpsingh@kernel.org, sdf@google.com,
haoluo@google.com, jolsa@kernel.org, tj@kernel.org,
joannelkoong@gmail.com, linux-kernel@vger.kernel.org,
Kernel-team@fb.com
Subject: [PATCH 1/5] bpf: Clear callee saved regs after updating REG0
Date: Mon, 8 Aug 2022 08:53:37 -0700 [thread overview]
Message-ID: <20220808155341.2479054-1-void@manifault.com> (raw)
In the verifier, we currently reset all of the registers containing caller
saved args before updating the callee's return register (REG0). In a
follow-on patch, we will need to be able to be able to inspect the caller
saved registers when updating REG0 to determine if a dynptr that's passed
to a helper function was allocated by a helper, or allocated by a program.
This patch therefore updates check_helper_call() to clear the caller saved
regs after updating REG0.
Signed-off-by: David Vernet <void@manifault.com>
---
kernel/bpf/verifier.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 096fdac70165..938ba1536249 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7348,11 +7348,9 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
if (err)
return err;
- /* reset caller saved regs */
- for (i = 0; i < CALLER_SAVED_REGS; i++) {
- mark_reg_not_init(env, regs, caller_saved[i]);
- check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
- }
+ /* reset return reg */
+ mark_reg_not_init(env, regs, BPF_REG_0);
+ check_reg_arg(env, BPF_REG_0, DST_OP_NO_MARK);
/* helper call returns 64-bit value. */
regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
@@ -7488,6 +7486,13 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
regs[BPF_REG_0].ref_obj_id = dynptr_id;
}
+ /* reset remaining caller saved regs */
+ BUILD_BUG_ON(caller_saved[0] != BPF_REG_0);
+ for (i = 1; i < CALLER_SAVED_REGS; i++) {
+ mark_reg_not_init(env, regs, caller_saved[i]);
+ check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
+ }
+
do_refine_retval_range(regs, fn->ret_type, func_id, &meta);
err = check_map_func_compatibility(env, meta.map_ptr, func_id);
--
2.30.2
next reply other threads:[~2022-08-08 15:54 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-08 15:53 David Vernet [this message]
2022-08-08 15:53 ` [PATCH 2/5] bpf: Define new BPF_MAP_TYPE_USER_RINGBUF map type David Vernet
2022-08-11 23:22 ` Andrii Nakryiko
2022-08-12 16:21 ` David Vernet
2022-08-11 23:29 ` Andrii Nakryiko
2022-08-12 16:23 ` David Vernet
2022-08-16 18:43 ` Andrii Nakryiko
2022-08-08 15:53 ` [PATCH 3/5] bpf: Add bpf_user_ringbuf_drain() helper David Vernet
2022-08-08 21:55 ` kernel test robot
2022-08-11 23:22 ` Andrii Nakryiko
2022-08-12 0:01 ` David Vernet
2022-08-12 0:46 ` David Vernet
2022-08-16 18:57 ` Andrii Nakryiko
2022-08-16 22:14 ` David Vernet
2022-08-16 22:59 ` Andrii Nakryiko
2022-08-17 20:24 ` David Vernet
2022-08-17 21:03 ` David Vernet
2022-08-08 15:53 ` [PATCH 4/5] bpf: Add libbpf logic for user-space ring buffer David Vernet
2022-08-11 23:39 ` Andrii Nakryiko
2022-08-12 17:28 ` David Vernet
2022-08-16 19:09 ` Andrii Nakryiko
2022-08-17 14:02 ` David Vernet
2022-08-18 3:05 ` David Vernet
2022-08-08 15:53 ` [PATCH 5/5] selftests/bpf: Add selftests validating the user ringbuf David Vernet
2022-08-08 18:14 ` [PATCH 1/5] bpf: Clear callee saved regs after updating REG0 Joanne Koong
2022-08-08 18:50 ` David Vernet
2022-08-08 23:32 ` Joanne Koong
2022-08-09 12:47 ` David Vernet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220808155341.2479054-1-void@manifault.com \
--to=void@manifault.com \
--cc=Kernel-team@fb.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=joannelkoong@gmail.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=tj@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.