From: Yonghong Song <yhs@meta.com>
To: kernel test robot <lkp@intel.com>, Yonghong Song <yhs@fb.com>
Cc: oe-kbuild-all@lists.linux.dev
Subject: Re: [RFC PATCH bpf-next 02/13] bpf: Add verifier support for sign-extension load insns
Date: Sun, 2 Jul 2023 11:06:55 -0700 [thread overview]
Message-ID: <ffbbf440-6108-000a-bfb8-5662329392b4@meta.com> (raw)
In-Reply-To: <202307022221.ZvtBGOCA-lkp@intel.com>
On 7/2/23 7:28 AM, kernel test robot wrote:
> Hi Yonghong,
>
> [This is a private test report for your RFC patch.]
> kernel test robot noticed the following build warnings:
>
> [auto build test WARNING on bpf-next/master]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Yonghong-Song/bpf-Support-new-sign-extension-load-insns/20230629-144251
> base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
> patch link: https://lore.kernel.org/r/20230629063726.1649316-1-yhs%40fb.com
> patch subject: [RFC PATCH bpf-next 02/13] bpf: Add verifier support for sign-extension load insns
> config: x86_64-randconfig-x061-20230702 (https://download.01.org/0day-ci/archive/20230702/202307022221.ZvtBGOCA-lkp@intel.com/config )
> compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
> reproduce: (https://download.01.org/0day-ci/archive/20230702/202307022221.ZvtBGOCA-lkp@intel.com/reproduce )
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202307022221.ZvtBGOCA-lkp@intel.com/
>
> sparse warnings: (new ones prefixed by >>)
> kernel/bpf/verifier.c:18560:38: sparse: sparse: subtraction of functions? Share your drugs
>>> kernel/bpf/verifier.c:6322:86: sparse: sparse: cast truncates bits from constant value (7fffffff becomes ff)
>>> kernel/bpf/verifier.c:6323:86: sparse: sparse: cast truncates bits from constant value (80000000 becomes 0)
>>> kernel/bpf/verifier.c:6325:87: sparse: sparse: cast truncates bits from constant value (7fffffff becomes ffff)
> kernel/bpf/verifier.c:6326:87: sparse: sparse: cast truncates bits from constant value (80000000 becomes 0)
> kernel/bpf/verifier.c: note: in included file (through include/linux/bpf.h, include/linux/bpf-cgroup.h):
> include/linux/bpfptr.h:65:40: sparse: sparse: cast to non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast from non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast to non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast from non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast to non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast from non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast to non-scalar
> include/linux/bpfptr.h:65:40: sparse: sparse: cast from non-scalar
>
> vim +6322 kernel/bpf/verifier.c
>
> 6241
> 6242 /* check whether memory at (regno + off) is accessible for t = (read | write)
> 6243 * if t==write, value_regno is a register which value is stored into memory
> 6244 * if t==read, value_regno is a register which will receive the value from memory
> 6245 * if t==write && value_regno==-1, some unknown value is stored into memory
> 6246 * if t==read && value_regno==-1, don't care what we read from memory
> 6247 */
> 6248 static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno,
> 6249 int off, int bpf_size, enum bpf_access_type t,
> 6250 int value_regno, bool strict_alignment_once, bool sign_ext_ld)
> 6251 {
> 6252 struct bpf_reg_state *regs = cur_regs(env);
> 6253 struct bpf_reg_state *reg = regs + regno;
> 6254 struct bpf_func_state *state;
> 6255 int size, err = 0;
> 6256
> 6257 size = bpf_size_to_bytes(bpf_size);
> 6258 if (size < 0)
> 6259 return size;
> 6260
> 6261 /* alignment checks will add in reg->off themselves */
> 6262 err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
> 6263 if (err)
> 6264 return err;
> 6265
> 6266 /* for access checks, reg->off is just part of off */
> 6267 off += reg->off;
> 6268
> 6269 if (reg->type == PTR_TO_MAP_KEY) {
> 6270 if (t == BPF_WRITE) {
> 6271 verbose(env, "write to change key R%d not allowed\n", regno);
> 6272 return -EACCES;
> 6273 }
> 6274
> 6275 err = check_mem_region_access(env, regno, off, size,
> 6276 reg->map_ptr->key_size, false);
> 6277 if (err)
> 6278 return err;
> 6279 if (value_regno >= 0)
> 6280 mark_reg_unknown(env, regs, value_regno);
> 6281 } else if (reg->type == PTR_TO_MAP_VALUE) {
> 6282 struct btf_field *kptr_field = NULL;
> 6283
> 6284 if (t == BPF_WRITE && value_regno >= 0 &&
> 6285 is_pointer_value(env, value_regno)) {
> 6286 verbose(env, "R%d leaks addr into map\n", value_regno);
> 6287 return -EACCES;
> 6288 }
> 6289 err = check_map_access_type(env, regno, off, size, t);
> 6290 if (err)
> 6291 return err;
> 6292 err = check_map_access(env, regno, off, size, false, ACCESS_DIRECT);
> 6293 if (err)
> 6294 return err;
> 6295 if (tnum_is_const(reg->var_off))
> 6296 kptr_field = btf_record_find(reg->map_ptr->record,
> 6297 off + reg->var_off.value, BPF_KPTR);
> 6298 if (kptr_field) {
> 6299 err = check_map_kptr_access(env, regno, value_regno, insn_idx, kptr_field);
> 6300 } else if (t == BPF_READ && value_regno >= 0) {
> 6301 struct bpf_map *map = reg->map_ptr;
> 6302
> 6303 /* if map is read-only, track its contents as scalars */
> 6304 if (tnum_is_const(reg->var_off) &&
> 6305 bpf_map_is_rdonly(map) &&
> 6306 map->ops->map_direct_value_addr) {
> 6307 int map_off = off + reg->var_off.value;
> 6308 u64 val = 0;
> 6309
> 6310 err = bpf_map_direct_read(map, map_off, size,
> 6311 &val);
> 6312 if (err)
> 6313 return err;
> 6314
> 6315 regs[value_regno].type = SCALAR_VALUE;
> 6316 __mark_reg_known(®s[value_regno], val);
> 6317 } else {
> 6318 mark_reg_unknown(env, regs, value_regno);
> 6319
> 6320 if (sign_ext_ld) {
> 6321 if (size == 1) {
>> 6322 regs[value_regno].smax_value = (char)INT_MAX;
>> 6323 regs[value_regno].smin_value = (char)INT_MIN;
> 6324 } else if (size == 2) {
>> 6325 regs[value_regno].smax_value = (short)INT_MAX;
> 6326 regs[value_regno].smin_value = (short)INT_MIN;
The above codes are intentional. if this caused compilation warning, I
will try to rewrite the silence the warnings.
Thanks!
> 6327 } else if (size == 4) {
> 6328 regs[value_regno].smax_value = INT_MAX;
> 6329 regs[value_regno].smin_value = INT_MIN;
> 6330 }
> 6331 }
> 6332 }
> 6333 }
[...]
next prev parent reply other threads:[~2023-07-02 18:07 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-29 6:37 [RFC PATCH bpf-next 00/13] bpf: Support new insns from cpu v4 Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 01/13] bpf: Support new sign-extension load insns Yonghong Song
2023-07-03 0:53 ` Alexei Starovoitov
2023-07-03 15:29 ` Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 02/13] bpf: Add verifier support for " Yonghong Song
2023-07-02 14:28 ` kernel test robot
2023-07-02 18:06 ` Yonghong Song [this message]
2023-06-29 6:37 ` [RFC PATCH bpf-next 03/13] bpf: Support new sign-extension mov insns Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 04/13] bpf: Support new unconditional bswap instruction Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 05/13] bpf: Support new signed div/mod instructions Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 06/13] bpf: Support new 32bit offset jmp instruction Yonghong Song
2023-06-29 6:37 ` [RFC PATCH bpf-next 07/13] bpf: Add kernel/bpftool asm support for new instructions Yonghong Song
2023-07-03 2:01 ` kernel test robot
2023-06-29 6:38 ` [RFC PATCH bpf-next 08/13] selftests/bpf: Add unit tests for new sign-extension load insns Yonghong Song
2023-06-29 6:38 ` [RFC PATCH bpf-next 09/13] selftests/bpf: Add unit tests for new sign-extension mov insns Yonghong Song
2023-06-29 6:38 ` [RFC PATCH bpf-next 10/13] selftests/bpf: Add unit tests for new bswap insns Yonghong Song
2023-06-29 6:38 ` [RFC PATCH bpf-next 11/13] selftests/bpf: Add unit tests for new sdiv/smod insns Yonghong Song
2023-06-29 6:38 ` [RFC PATCH bpf-next 12/13] selftests/bpf: Add unit tests for new gotol insn Yonghong Song
2023-06-29 6:38 ` [RFC PATCH bpf-next 13/13] selftests/bpf: Add a cpuv4 test runner for cpu=v4 testing Yonghong Song
[not found] ` <PH7PR21MB38786422B9929D253E279810A325A@PH7PR21MB3878.namprd21.prod.outlook.com>
2023-06-29 14:17 ` [RFC PATCH bpf-next 00/13] bpf: Support new insns from cpu v4 Yonghong Song
2023-07-03 21:11 ` Daniel Xu
2023-07-03 23:36 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ffbbf440-6108-000a-bfb8-5662329392b4@meta.com \
--to=yhs@meta.com \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.