From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 117C1C433E7 for ; Thu, 15 Oct 2020 01:39:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AA08122254 for ; Thu, 15 Oct 2020 01:39:39 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZiBMS/r4" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389134AbgJOBji (ORCPT ); Wed, 14 Oct 2020 21:39:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50620 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389060AbgJOBjh (ORCPT ); Wed, 14 Oct 2020 21:39:37 -0400 Received: from mail-yb1-xb44.google.com (mail-yb1-xb44.google.com [IPv6:2607:f8b0:4864:20::b44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FE32C051132; Wed, 14 Oct 2020 16:09:45 -0700 (PDT) Received: by mail-yb1-xb44.google.com with SMTP id s89so644477ybi.12; Wed, 14 Oct 2020 16:09:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SC/LgnBpbVfq5lqBs6M8hXan4SDJHmAPTG16R7Au4wQ=; b=ZiBMS/r4ErmGIOXAooeA7XmMrf9AmiXugqhDCTehrPjIR1eXGu/i6OSAOQDYBkSjWk Qt2puwFg/3MLqTEu3DLrteLBi4QgvEN3vGnvjpICJszy8B5a01uXci138I5P8ecxm0bY y/xOo2wj1MsWTRjjPshhR9XM5+GTkYu51x8d2qucS+ZAD9eHC3hDZ4kwMdAFWz1RzFAp x+tHbnefQ8kEOdJYEmJlZTMOPMNgPmJO4qAxRvxdfrdAksRMLJqg7erchJp9F5cEYnF6 AILvHTgtulGgMuosoPxUF0nyO7HsIjubbFvwu/fKLa2j2p5Uc5DYXMriBqVXZRbZsXBU KSSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SC/LgnBpbVfq5lqBs6M8hXan4SDJHmAPTG16R7Au4wQ=; b=V4rBiJHfxTi55nRFjCZN21NlVrsMHnQlo71+Ie77r4tNsB8vWbmkLt4j4+V2bkxvQG q9QokfjEh2SYF7UlRTM5uBnD+SjxKtvnHzAAufFxUKHGGN2hgjFj91EcnJBeDAoAk4se V89dXRAvET6lnRSm3g9kv9GxvrJCFEy5aHJoFGb7Dh/TJ+ZDMu9m/IFzxE2oiOaIi4k8 sISpE5s1uhFPtbRVr7kb+nXWKmAytcTKhrd/AMkIp5ZGnS3+8bt8wAY/NRwLrCpGonVe Zd2UP77FkSyBPyoea7N5U4kTVZeG6UTExoiYJvw53F9Z9vDTUI40Sb24sfItrnEjFTF0 BeOg== X-Gm-Message-State: AOAM532EKf01r+BqVpTOPKrbG30D7blojHhb+h114be2MiAMp0M4Iayl KEj6cVwi1X0MzRWm1wN3T9KGwvQtF0+J4Pgyt6c= X-Google-Smtp-Source: ABdhPJyG8f/aMEuCgh8JKjtL23wyE26KKG0HVNdyETCDkBjWSurHxoPKI/9ZaVooW4yd8IbCg9zwSQvI42pkQPDlXX8= X-Received: by 2002:a25:3443:: with SMTP id b64mr1516173yba.510.1602716984539; Wed, 14 Oct 2020 16:09:44 -0700 (PDT) MIME-Version: 1.0 References: <20201014175608.1416-1-alexei.starovoitov@gmail.com> In-Reply-To: <20201014175608.1416-1-alexei.starovoitov@gmail.com> From: Andrii Nakryiko Date: Wed, 14 Oct 2020 16:09:33 -0700 Message-ID: Subject: Re: [PATCH bpf-next] bpf: Fix register equivalence tracking. To: Alexei Starovoitov Cc: "David S. Miller" , Daniel Borkmann , john fastabend , Networking , bpf , Kernel Team Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On Wed, Oct 14, 2020 at 10:59 AM Alexei Starovoitov wrote: > > From: Alexei Starovoitov > > The 64-bit JEQ/JNE handling in reg_set_min_max() was clearing reg->id in either > true or false branch. In the case 'if (reg->id)' check was done on the other > branch the counter part register would have reg->id == 0 when called into > find_equal_scalars(). In such case the helper would incorrectly identify other > registers with id == 0 as equivalent and propagate the state incorrectly. > Fix it by preserving ID across reg_set_min_max(). > In other words any kind of comparison operator on the scalar register > should preserve its ID to recognize: > r1 = r2 > if (r1 == 20) { > #1 here both r1 and r2 == 20 > } else if (r2 < 20) { > #2 here both r1 and r2 < 20 > } > > The patch is addressing #1 case. The #2 was working correctly already. > > Fixes: 75748837b7e5 ("bpf: Propagate scalar ranges through register assignments.") > Signed-off-by: Alexei Starovoitov > --- Number of underscores is a bit subtle a difference, but this fixes the bug, so: Acked-by: Andrii Nakryiko > kernel/bpf/verifier.c | 38 ++++++++++++------- > .../testing/selftests/bpf/verifier/regalloc.c | 26 +++++++++++++ > 2 files changed, 51 insertions(+), 13 deletions(-) > [...]