CC: [email protected] In-Reply-To: <[email protected]> References: <[email protected]> TO: Christy Lee <[email protected]> TO: [email protected] TO: [email protected] TO: [email protected] CC: [email protected] CC: [email protected] CC: [email protected]
Hi Christy, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on bpf-next/master] url: https://github.com/0day-ci/linux/commits/Christy-Lee/Improve-verifier-log-readability/20211214-022202 base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master :::::: branch date: 7 hours ago :::::: commit date: 7 hours ago config: x86_64-randconfig-m001-20211213 (https://download.01.org/0day-ci/archive/20211214/[email protected]/config) compiler: gcc-9 (Debian 9.3.0-22) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> Reported-by: Dan Carpenter <[email protected]> smatch warnings: kernel/bpf/verifier.c:11339 do_check() error: uninitialized symbol 'prev_log_len'. kernel/bpf/verifier.c:11340 do_check() error: uninitialized symbol 'prev_insn_print_len'. vim +/prev_log_len +11339 kernel/bpf/verifier.c c64b7983288e63 Joe Stringer 2018-10-02 11278 58e2af8b3a6b58 Jakub Kicinski 2016-09-21 11279 static int do_check(struct bpf_verifier_env *env) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11280 { 4c7ccf82b1a3c7 Christy Lee 2021-12-13 11281 u32 prev_log_len, prev_insn_print_len; 6f8a57ccf85117 Andrii Nakryiko 2020-04-23 11282 bool pop_log = !(env->log.level & BPF_LOG_LEVEL2); 51c39bb1d5d105 Alexei Starovoitov 2020-01-09 11283 struct bpf_verifier_state *state = env->cur_state; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11284 struct bpf_insn *insns = env->prog->insnsi; 638f5b90d46016 Alexei Starovoitov 2017-10-31 11285 struct bpf_reg_state *regs; 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11286 int insn_cnt = env->prog->len; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11287 bool do_print_state = false; b5dc0163d8fd78 Alexei Starovoitov 2019-06-15 11288 int prev_insn_idx = -1; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11289 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11290 for (;;) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11291 struct bpf_insn *insn; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11292 u8 class; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11293 int err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11294 b5dc0163d8fd78 Alexei Starovoitov 2019-06-15 11295 env->prev_insn_idx = prev_insn_idx; c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11296 if (env->insn_idx >= insn_cnt) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11297 verbose(env, "invalid insn idx %d insn_cnt %d\n", c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11298 env->insn_idx, insn_cnt); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11299 return -EFAULT; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11300 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11301 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11302 insn = &insns[env->insn_idx]; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11303 class = BPF_CLASS(insn->code); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11304 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11305 if (++env->insn_processed > BPF_COMPLEXITY_LIMIT_INSNS) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11306 verbose(env, 61bd5218eef349 Jakub Kicinski 2017-10-09 11307 "BPF program is too large. Processed %d insn\n", 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11308 env->insn_processed); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11309 return -E2BIG; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11310 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11311 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11312 err = is_state_visited(env, env->insn_idx); f1bca824dabba4 Alexei Starovoitov 2014-09-29 11313 if (err < 0) f1bca824dabba4 Alexei Starovoitov 2014-09-29 11314 return err; f1bca824dabba4 Alexei Starovoitov 2014-09-29 11315 if (err == 1) { f1bca824dabba4 Alexei Starovoitov 2014-09-29 11316 /* found equivalent state, can prune the search */ 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11317 if (env->log.level & BPF_LOG_LEVEL) { f1bca824dabba4 Alexei Starovoitov 2014-09-29 11318 if (do_print_state) 979d63d50c0c0f Daniel Borkmann 2019-01-03 11319 verbose(env, "\nfrom %d to %d%s: safe\n", 979d63d50c0c0f Daniel Borkmann 2019-01-03 11320 env->prev_insn_idx, env->insn_idx, 979d63d50c0c0f Daniel Borkmann 2019-01-03 11321 env->cur_state->speculative ? 979d63d50c0c0f Daniel Borkmann 2019-01-03 11322 " (speculative execution)" : ""); f1bca824dabba4 Alexei Starovoitov 2014-09-29 11323 else c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11324 verbose(env, "%d: safe\n", env->insn_idx); f1bca824dabba4 Alexei Starovoitov 2014-09-29 11325 } f1bca824dabba4 Alexei Starovoitov 2014-09-29 11326 goto process_bpf_exit; f1bca824dabba4 Alexei Starovoitov 2014-09-29 11327 } f1bca824dabba4 Alexei Starovoitov 2014-09-29 11328 c3494801cd1785 Alexei Starovoitov 2018-12-03 11329 if (signal_pending(current)) c3494801cd1785 Alexei Starovoitov 2018-12-03 11330 return -EAGAIN; c3494801cd1785 Alexei Starovoitov 2018-12-03 11331 3c2ce60bdd3d57 Daniel Borkmann 2017-05-18 11332 if (need_resched()) 3c2ce60bdd3d57 Daniel Borkmann 2017-05-18 11333 cond_resched(); 3c2ce60bdd3d57 Daniel Borkmann 2017-05-18 11334 a41a40a9bfc92d Christy Lee 2021-12-13 11335 if ((env->log.level & BPF_LOG_LEVEL2) || 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11336 (env->log.level & BPF_LOG_LEVEL && do_print_state)) { a41a40a9bfc92d Christy Lee 2021-12-13 11337 if (verifier_state_scratched(env) && a41a40a9bfc92d Christy Lee 2021-12-13 11338 (env->log.level & BPF_LOG_LEVEL2)) 4c7ccf82b1a3c7 Christy Lee 2021-12-13 @11339 print_insn_state(env, prev_log_len, 4c7ccf82b1a3c7 Christy Lee 2021-12-13 @11340 prev_insn_print_len); c5fc9692d101d1 David S. Miller 2017-05-10 11341 else 979d63d50c0c0f Daniel Borkmann 2019-01-03 11342 verbose(env, "\nfrom %d to %d%s:", 979d63d50c0c0f Daniel Borkmann 2019-01-03 11343 env->prev_insn_idx, env->insn_idx, 979d63d50c0c0f Daniel Borkmann 2019-01-03 11344 env->cur_state->speculative ? 979d63d50c0c0f Daniel Borkmann 2019-01-03 11345 " (speculative execution)" : ""); f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11346 print_verifier_state(env, state->frame[state->curframe]); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11347 do_print_state = false; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11348 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11349 06ee7115b0d174 Alexei Starovoitov 2019-04-01 11350 if (env->log.level & BPF_LOG_LEVEL) { 7105e828c087de Daniel Borkmann 2017-12-20 11351 const struct bpf_insn_cbs cbs = { e6ac2450d6dee3 Martin KaFai Lau 2021-03-24 11352 .cb_call = disasm_kfunc_name, 7105e828c087de Daniel Borkmann 2017-12-20 11353 .cb_print = verbose, abe0884011f1a5 Jiri Olsa 2018-03-23 11354 .private_data = env, 7105e828c087de Daniel Borkmann 2017-12-20 11355 }; 7105e828c087de Daniel Borkmann 2017-12-20 11356 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11357 verbose_linfo(env, env->insn_idx, "; "); 4c7ccf82b1a3c7 Christy Lee 2021-12-13 11358 prev_log_len = env->log.len_used; c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11359 verbose(env, "%d: ", env->insn_idx); abe0884011f1a5 Jiri Olsa 2018-03-23 11360 print_bpf_insn(&cbs, insn, env->allow_ptr_leaks); 4c7ccf82b1a3c7 Christy Lee 2021-12-13 11361 prev_insn_print_len = env->log.len_used - prev_log_len; 4c7ccf82b1a3c7 Christy Lee 2021-12-13 11362 prev_log_len = env->log.len_used; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11363 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11364 cae1927c0b4a93 Jakub Kicinski 2017-12-27 11365 if (bpf_prog_is_dev_bound(env->prog->aux)) { c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11366 err = bpf_prog_offload_verify_insn(env, env->insn_idx, c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11367 env->prev_insn_idx); 13a27dfc669724 Jakub Kicinski 2016-09-21 11368 if (err) 13a27dfc669724 Jakub Kicinski 2016-09-21 11369 return err; cae1927c0b4a93 Jakub Kicinski 2017-12-27 11370 } 13a27dfc669724 Jakub Kicinski 2016-09-21 11371 638f5b90d46016 Alexei Starovoitov 2017-10-31 11372 regs = cur_regs(env); fe9a5ca7e370e6 Daniel Borkmann 2021-05-28 11373 sanitize_mark_insn_seen(env); b5dc0163d8fd78 Alexei Starovoitov 2019-06-15 11374 prev_insn_idx = env->insn_idx; fd978bf7fd3125 Joe Stringer 2018-10-02 11375 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11376 if (class == BPF_ALU || class == BPF_ALU64) { 1be7f75d1668d6 Alexei Starovoitov 2015-10-07 11377 err = check_alu_op(env, insn); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11378 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11379 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11380 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11381 } else if (class == BPF_LDX) { 3df126f35f88dc Jakub Kicinski 2016-09-21 11382 enum bpf_reg_type *prev_src_type, src_reg_type; 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11383 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11384 /* check for reserved fields is already done */ 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11385 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11386 /* check src operand */ dc503a8ad98474 Edward Cree 2017-08-15 11387 err = check_reg_arg(env, insn->src_reg, SRC_OP); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11388 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11389 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11390 dc503a8ad98474 Edward Cree 2017-08-15 11391 err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11392 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11393 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11394 725f9dcd58dedf Alexei Starovoitov 2015-04-15 11395 src_reg_type = regs[insn->src_reg].type; 725f9dcd58dedf Alexei Starovoitov 2015-04-15 11396 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11397 /* check that memory (src_reg + off) is readable, 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11398 * the state of dst_reg will be updated by this func 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11399 */ c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11400 err = check_mem_access(env, env->insn_idx, insn->src_reg, c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11401 insn->off, BPF_SIZE(insn->code), c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11402 BPF_READ, insn->dst_reg, false); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11403 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11404 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11405 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11406 prev_src_type = &env->insn_aux_data[env->insn_idx].ptr_type; 3df126f35f88dc Jakub Kicinski 2016-09-21 11407 3df126f35f88dc Jakub Kicinski 2016-09-21 11408 if (*prev_src_type == NOT_INIT) { 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11409 /* saw a valid insn 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11410 * dst_reg = *(u32 *)(src_reg + off) 3df126f35f88dc Jakub Kicinski 2016-09-21 11411 * save type to validate intersecting paths 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11412 */ 3df126f35f88dc Jakub Kicinski 2016-09-21 11413 *prev_src_type = src_reg_type; 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11414 c64b7983288e63 Joe Stringer 2018-10-02 11415 } else if (reg_type_mismatch(src_reg_type, *prev_src_type)) { 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11416 /* ABuser program is trying to use the same insn 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11417 * dst_reg = *(u32*) (src_reg + off) 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11418 * with different pointer types: 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11419 * src_reg == ctx in one branch and 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11420 * src_reg == stack|map in some other branch. 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11421 * Reject it. 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11422 */ 61bd5218eef349 Jakub Kicinski 2017-10-09 11423 verbose(env, "same insn cannot be used with different pointers\n"); 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11424 return -EINVAL; 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11425 } 9bac3d6d548e5c Alexei Starovoitov 2015-03-13 11426 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11427 } else if (class == BPF_STX) { 3df126f35f88dc Jakub Kicinski 2016-09-21 11428 enum bpf_reg_type *prev_dst_type, dst_reg_type; d691f9e8d4405c Alexei Starovoitov 2015-06-04 11429 91c960b0056672 Brendan Jackman 2021-01-14 11430 if (BPF_MODE(insn->code) == BPF_ATOMIC) { 91c960b0056672 Brendan Jackman 2021-01-14 11431 err = check_atomic(env, env->insn_idx, insn); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11432 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11433 return err; c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11434 env->insn_idx++; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11435 continue; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11436 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11437 5ca419f2864a2c Brendan Jackman 2021-01-14 11438 if (BPF_MODE(insn->code) != BPF_MEM || insn->imm != 0) { 5ca419f2864a2c Brendan Jackman 2021-01-14 11439 verbose(env, "BPF_STX uses reserved fields\n"); 5ca419f2864a2c Brendan Jackman 2021-01-14 11440 return -EINVAL; 5ca419f2864a2c Brendan Jackman 2021-01-14 11441 } 5ca419f2864a2c Brendan Jackman 2021-01-14 11442 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11443 /* check src1 operand */ dc503a8ad98474 Edward Cree 2017-08-15 11444 err = check_reg_arg(env, insn->src_reg, SRC_OP); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11445 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11446 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11447 /* check src2 operand */ dc503a8ad98474 Edward Cree 2017-08-15 11448 err = check_reg_arg(env, insn->dst_reg, SRC_OP); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11449 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11450 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11451 d691f9e8d4405c Alexei Starovoitov 2015-06-04 11452 dst_reg_type = regs[insn->dst_reg].type; d691f9e8d4405c Alexei Starovoitov 2015-06-04 11453 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11454 /* check that memory (dst_reg + off) is writeable */ c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11455 err = check_mem_access(env, env->insn_idx, insn->dst_reg, c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11456 insn->off, BPF_SIZE(insn->code), c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11457 BPF_WRITE, insn->src_reg, false); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11458 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11459 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11460 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11461 prev_dst_type = &env->insn_aux_data[env->insn_idx].ptr_type; 3df126f35f88dc Jakub Kicinski 2016-09-21 11462 3df126f35f88dc Jakub Kicinski 2016-09-21 11463 if (*prev_dst_type == NOT_INIT) { 3df126f35f88dc Jakub Kicinski 2016-09-21 11464 *prev_dst_type = dst_reg_type; c64b7983288e63 Joe Stringer 2018-10-02 11465 } else if (reg_type_mismatch(dst_reg_type, *prev_dst_type)) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11466 verbose(env, "same insn cannot be used with different pointers\n"); d691f9e8d4405c Alexei Starovoitov 2015-06-04 11467 return -EINVAL; d691f9e8d4405c Alexei Starovoitov 2015-06-04 11468 } d691f9e8d4405c Alexei Starovoitov 2015-06-04 11469 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11470 } else if (class == BPF_ST) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11471 if (BPF_MODE(insn->code) != BPF_MEM || 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11472 insn->src_reg != BPF_REG_0) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11473 verbose(env, "BPF_ST uses reserved fields\n"); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11474 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11475 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11476 /* check src operand */ dc503a8ad98474 Edward Cree 2017-08-15 11477 err = check_reg_arg(env, insn->dst_reg, SRC_OP); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11478 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11479 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11480 f37a8cb84cce18 Daniel Borkmann 2018-01-16 11481 if (is_ctx_reg(env, insn->dst_reg)) { 9d2be44a7f33d5 Joe Stringer 2018-10-02 11482 verbose(env, "BPF_ST stores into R%d %s is not allowed\n", 2a159c6f82381a Daniel Borkmann 2018-10-21 11483 insn->dst_reg, 2a159c6f82381a Daniel Borkmann 2018-10-21 11484 reg_type_str[reg_state(env, insn->dst_reg)->type]); f37a8cb84cce18 Daniel Borkmann 2018-01-16 11485 return -EACCES; f37a8cb84cce18 Daniel Borkmann 2018-01-16 11486 } f37a8cb84cce18 Daniel Borkmann 2018-01-16 11487 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11488 /* check that memory (dst_reg + off) is writeable */ c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11489 err = check_mem_access(env, env->insn_idx, insn->dst_reg, c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11490 insn->off, BPF_SIZE(insn->code), c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11491 BPF_WRITE, -1, false); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11492 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11493 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11494 092ed0968bb648 Jiong Wang 2019-01-26 11495 } else if (class == BPF_JMP || class == BPF_JMP32) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11496 u8 opcode = BPF_OP(insn->code); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11497 2589726d12a1b1 Alexei Starovoitov 2019-06-15 11498 env->jmps_processed++; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11499 if (opcode == BPF_CALL) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11500 if (BPF_SRC(insn->code) != BPF_K || 2357672c54c3f7 Kumar Kartikeya Dwivedi 2021-10-02 11501 (insn->src_reg != BPF_PSEUDO_KFUNC_CALL 2357672c54c3f7 Kumar Kartikeya Dwivedi 2021-10-02 11502 && insn->off != 0) || f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11503 (insn->src_reg != BPF_REG_0 && e6ac2450d6dee3 Martin KaFai Lau 2021-03-24 11504 insn->src_reg != BPF_PSEUDO_CALL && e6ac2450d6dee3 Martin KaFai Lau 2021-03-24 11505 insn->src_reg != BPF_PSEUDO_KFUNC_CALL) || 092ed0968bb648 Jiong Wang 2019-01-26 11506 insn->dst_reg != BPF_REG_0 || 092ed0968bb648 Jiong Wang 2019-01-26 11507 class == BPF_JMP32) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11508 verbose(env, "BPF_CALL uses reserved fields\n"); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11509 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11510 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11511 d83525ca62cf8e Alexei Starovoitov 2019-01-31 11512 if (env->cur_state->active_spin_lock && d83525ca62cf8e Alexei Starovoitov 2019-01-31 11513 (insn->src_reg == BPF_PSEUDO_CALL || d83525ca62cf8e Alexei Starovoitov 2019-01-31 11514 insn->imm != BPF_FUNC_spin_unlock)) { d83525ca62cf8e Alexei Starovoitov 2019-01-31 11515 verbose(env, "function calls are not allowed while holding a lock\n"); d83525ca62cf8e Alexei Starovoitov 2019-01-31 11516 return -EINVAL; d83525ca62cf8e Alexei Starovoitov 2019-01-31 11517 } f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11518 if (insn->src_reg == BPF_PSEUDO_CALL) c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11519 err = check_func_call(env, insn, &env->insn_idx); e6ac2450d6dee3 Martin KaFai Lau 2021-03-24 11520 else if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) e6ac2450d6dee3 Martin KaFai Lau 2021-03-24 11521 err = check_kfunc_call(env, insn); f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11522 else 69c087ba6225b5 Yonghong Song 2021-02-26 11523 err = check_helper_call(env, insn, &env->insn_idx); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11524 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11525 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11526 } else if (opcode == BPF_JA) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11527 if (BPF_SRC(insn->code) != BPF_K || 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11528 insn->imm != 0 || 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11529 insn->src_reg != BPF_REG_0 || 092ed0968bb648 Jiong Wang 2019-01-26 11530 insn->dst_reg != BPF_REG_0 || 092ed0968bb648 Jiong Wang 2019-01-26 11531 class == BPF_JMP32) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11532 verbose(env, "BPF_JA uses reserved fields\n"); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11533 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11534 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11535 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11536 env->insn_idx += insn->off + 1; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11537 continue; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11538 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11539 } else if (opcode == BPF_EXIT) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11540 if (BPF_SRC(insn->code) != BPF_K || 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11541 insn->imm != 0 || 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11542 insn->src_reg != BPF_REG_0 || 092ed0968bb648 Jiong Wang 2019-01-26 11543 insn->dst_reg != BPF_REG_0 || 092ed0968bb648 Jiong Wang 2019-01-26 11544 class == BPF_JMP32) { 61bd5218eef349 Jakub Kicinski 2017-10-09 11545 verbose(env, "BPF_EXIT uses reserved fields\n"); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11546 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11547 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11548 d83525ca62cf8e Alexei Starovoitov 2019-01-31 11549 if (env->cur_state->active_spin_lock) { d83525ca62cf8e Alexei Starovoitov 2019-01-31 11550 verbose(env, "bpf_spin_unlock is missing\n"); d83525ca62cf8e Alexei Starovoitov 2019-01-31 11551 return -EINVAL; d83525ca62cf8e Alexei Starovoitov 2019-01-31 11552 } d83525ca62cf8e Alexei Starovoitov 2019-01-31 11553 f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11554 if (state->curframe) { f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11555 /* exit from nested function */ c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11556 err = prepare_func_exit(env, &env->insn_idx); f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11557 if (err) f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11558 return err; f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11559 do_print_state = true; f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11560 continue; f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11561 } f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 11562 fd978bf7fd3125 Joe Stringer 2018-10-02 11563 err = check_reference_leak(env); fd978bf7fd3125 Joe Stringer 2018-10-02 11564 if (err) fd978bf7fd3125 Joe Stringer 2018-10-02 11565 return err; fd978bf7fd3125 Joe Stringer 2018-10-02 11566 390ee7e29fc8e6 Alexei Starovoitov 2017-10-02 11567 err = check_return_code(env); 390ee7e29fc8e6 Alexei Starovoitov 2017-10-02 11568 if (err) 390ee7e29fc8e6 Alexei Starovoitov 2017-10-02 11569 return err; f1bca824dabba4 Alexei Starovoitov 2014-09-29 11570 process_bpf_exit: a41a40a9bfc92d Christy Lee 2021-12-13 11571 mark_verifier_state_scratched(env); 2589726d12a1b1 Alexei Starovoitov 2019-06-15 11572 update_branch_counts(env, env->cur_state); b5dc0163d8fd78 Alexei Starovoitov 2019-06-15 11573 err = pop_stack(env, &prev_insn_idx, 6f8a57ccf85117 Andrii Nakryiko 2020-04-23 11574 &env->insn_idx, pop_log); 638f5b90d46016 Alexei Starovoitov 2017-10-31 11575 if (err < 0) { 638f5b90d46016 Alexei Starovoitov 2017-10-31 11576 if (err != -ENOENT) 638f5b90d46016 Alexei Starovoitov 2017-10-31 11577 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11578 break; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11579 } else { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11580 do_print_state = true; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11581 continue; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11582 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11583 } else { c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11584 err = check_cond_jmp_op(env, insn, &env->insn_idx); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11585 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11586 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11587 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11588 } else if (class == BPF_LD) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11589 u8 mode = BPF_MODE(insn->code); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11590 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11591 if (mode == BPF_ABS || mode == BPF_IND) { ddd872bc3098f9 Alexei Starovoitov 2014-12-01 11592 err = check_ld_abs(env, insn); ddd872bc3098f9 Alexei Starovoitov 2014-12-01 11593 if (err) ddd872bc3098f9 Alexei Starovoitov 2014-12-01 11594 return err; ddd872bc3098f9 Alexei Starovoitov 2014-12-01 11595 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11596 } else if (mode == BPF_IMM) { 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11597 err = check_ld_imm(env, insn); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11598 if (err) 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11599 return err; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11600 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11601 env->insn_idx++; fe9a5ca7e370e6 Daniel Borkmann 2021-05-28 11602 sanitize_mark_insn_seen(env); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11603 } else { 61bd5218eef349 Jakub Kicinski 2017-10-09 11604 verbose(env, "invalid BPF_LD mode\n"); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11605 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11606 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11607 } else { 61bd5218eef349 Jakub Kicinski 2017-10-09 11608 verbose(env, "unknown insn class %d\n", class); 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11609 return -EINVAL; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11610 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11611 c08435ec7f2bc8 Daniel Borkmann 2019-01-03 11612 env->insn_idx++; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11613 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11614 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11615 return 0; 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11616 } 17a5267067f3c3 Alexei Starovoitov 2014-09-26 11617 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected] _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
