Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1705454

Re: [PATCH v4 net-next 01/13] bpf/verifier: rework value tracking

Show all headers | View raw

On 07/08/17 00:35, Daniel Borkmann wrote:
> On 08/03/2017 06:11 PM, Edward Cree wrote:
>> Unifies adjusted and unadjusted register value types (e.g. FRAME_POINTER is
>>   now just a PTR_TO_STACK with zero offset).
>> Tracks value alignment by means of tracking known & unknown bits.  This
>>   also replaces the 'reg->imm' (leading zero bits) calculations for (what
>>   were) UNKNOWN_VALUEs.
>> If pointer leaks are allowed, and adjust_ptr_min_max_vals returns -EACCES,
>>   treat the pointer as an unknown scalar and try again, because we might be
>>   able to conclude something about the result (e.g. pointer & 0x40 is either
>>   0 or 0x40).
>>
>> Signed-off-by: Edward Cree <ecree@solarflare.com>
> [...]
>> -            dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
>> +    if (BPF_CLASS(insn->code) != BPF_ALU64) {
>> +        /* 32-bit ALU ops are (32,32)->64 */
>> +        coerce_reg_to_32(dst_reg);
>> +        coerce_reg_to_32(src_reg);
>>       }
>
> Looks like the same check was added twice here right after
> the first one?
Yes, it must've gotten duplicated when I rebased.  Thanks for spotting it!
> Shouldn't we just temporarily coerce the src
> reg to 32 bit here given in the actual op the src reg is not
> being modified?
You're quite right, I need to make a copy of the src_reg state and use
 that, at least in the case where it's a real register.  Probably the
 place to do it is at the call sites in adjust_reg_min_max_vals().
I'll sprinkle a few consts around as well, to catch that sort of thing.

-Ed

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v4 net-next 00/13] bpf: rewrite value tracking in verifier Edward Cree <ecree@solarflare.com> - 2017-08-03 18:10 +0200
  [PATCH v4 net-next 04/13] bpf/verifier: more concise register state  logs for constant var_off Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 11/13] selftests/bpf: variable offset negative  tests Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 08/13] selftests/bpf: add test for bogus  operations on pointers Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 07/13] selftests/bpf: add a test to test_align Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 09/13] selftests/bpf: don't try to access past  MAX_PACKET_OFF in test_verifier Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 05/13] selftests/bpf: change test_verifier  expectations Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 02/13] nfp: change bpf verifier hooks to match new  verifier data structures Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
    Re: [PATCH v4 net-next 02/13] nfp: change bpf verifier hooks to  match new verifier data structures David Miller <davem@davemloft.net> - 2017-08-07 06:10 +0200
  [PATCH v4 net-next 13/13] bpf/verifier: increase complexity limit to  128k Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 06/13] selftests/bpf: rewrite test_align Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 10/13] selftests/bpf: add tests for subtraction &  negative numbers Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  [PATCH v4 net-next 12/13] Documentation: describe the new eBPF  verifier value tracking behaviour Edward Cree <ecree@solarflare.com> - 2017-08-03 18:20 +0200
  Re: [PATCH v4 net-next 01/13] bpf/verifier: rework value tracking Daniel Borkmann <daniel@iogearbox.net> - 2017-08-07 01:40 +0200
    Re: [PATCH v4 net-next 01/13] bpf/verifier: rework value tracking Edward Cree <ecree@solarflare.com> - 2017-08-07 14:40 +0200

csiph-web