Verifier bug on MIPS32/Kernel 5.13.1, test_verifier "access skb fields ok"

Verifier bug on MIPS32/Kernel 5.13.1, test_verifier "access skb fields ok"

[Tony Ambardar]

Hello Daniel, Alexei, Andrii,

While testing my MIPS32 BPF JIT implementation, I encountered the
following verifier log message:
     "verifier bug. zext_dst is set, but no reg is defined"

Hopefully the details below will be helpful to you, but let me know if
more is needed.

Thanks,
Tony

===============================

root@OpenWrt:~# uname -a
Linux OpenWrt 5.13.1 #0 SMP Thu Jul 8 00:12:04 2021 mips GNU/Linux
root@OpenWrt:~# sysctl net.core.bpf_jit_enable=1
net.core.bpf_jit_enable = 1
root@OpenWrt:~# ./test_verifier_eb -v 277 277
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2652 at kernel/bpf/verifier.c:11826 bpf_check+0x1b48/0x27d4
[  153.342806] Modules linked in: pppoe ppp_async pppox ppp_generic
iptable_nat ipt_REJECT xt_time xt_tcpudp xt_tcpmss xt_statistic
xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit
xt_length xt_hl xt_helper xt_ecn xt_dscp xt_conntrack xt_connmark
xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT
xt_MASQUERADE xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY
slhc sch_mqprio sch_cake pcnet32 nf_reject_ipv4 nf_nat nf_log_syslog
nf_flow_table nf_conntrack_netlink nf_conncount iptable_raw
iptable_mangle iptable_filter ipt_ECN ip_tables crc_ccitt cls_flower
act_vlan pktgen sch_teql sch_sfq sch_red sch_prio sch_pie sch_multiq
sch_gred sch_fq sch_dsmark sch_codel em_text em_nbyte em_meta em_cmp
act_simple act_police act_pedit act_ipt act_csum libcrc32c em_ipset
cls_bpf act_bpf act_ctinfo act_connmark nf_conntrack nf_defrag_ipv6
nf_defrag_ipv4 sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32
cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic
act_skbedit
[  153.344320]  act_mirred act_gact xt_set ip_set_list_set
ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet
ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac
ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport
ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port
ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_mangle
ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ifb
dummy netlink_diag mii
CPU: 0 PID: 2652 Comm: test_verifier_e Tainted: G        W         5.13.1 #0
Stack : 00000001 c1544000 83466000 80192454 809a0000 00000004 00000000 00000000
        8374bb94 80d40000 82a1a484 80c1d5cb 80959230 00000001 8374bb38 8288c780
        00000000 00000000 80959230 8374b9d0 ffffefff 80c89c34 00000000 00000000
        00000000 d6730959 00000000 00055d61 00000001 80cc0000 00000000 80960000
        00000009 00002e32 00000001 c1544000 00000018 80603e88 00000000 80d40000
        ...
Call Trace:
[<80108cd0>] show_stack+0x28/0xf0
[<80590740>] dump_stack+0xa4/0xe0
[<80137298>] __warn+0xdc/0x110
[<80137328>] warn_slowpath_fmt+0x5c/0xac
[<802558ac>] bpf_check+0x1b48/0x27d4
[<80239e28>] bpf_prog_load+0x5a8/0xa4c
[<8023c2c0>] __do_sys_bpf+0x3e0/0x20b8
[<80114490>] syscall_common+0x34/0x58

---[ end trace 96a5d750c3c76985 ]---
#277/u access skb fields ok FAIL
Failed to load prog 'Bad address'!
verifier bug. zext_dst is set, but no reg is defined
processed 46 insns (limit 1000000) max_states_per_insn 0 total_states
5 peak_states 5 mark_read 2
#277/p access skb fields ok , verifier log:
processed 14 insns (limit 1000000) max_states_per_insn 0 total_states
1 peak_states 1 mark_read 1
OK
Summary: 1 PASSED, 0 SKIPPED, 1 FAILED