On 30/07/18 13:03, Daniel Borkmann wrote: > On 07/30/2018 12:58 PM, Arthur Fabre wrote: >> The check_alu_op() call handles 32bit and 64bit cases, but then in the >> 32bit case >> mark_reg_unknown() is called, discarding all the dst register state. >> I think this is equivalent to keeping a copy of dst and always marking >> dst as unknown. >> >> I think we could actually always use check_reg_arg() with DST_OP_NO_MARK: >> >> In the 32bit case, we call mark_reg_unknown() anyways. >> >> In the 64bit case, we copy src to dst, so marking dst as unknown is >> pointless. >> >> For plain BPF, we call __mark_reg_known() anyways. > For imms this approach would be buggy since we leave a stale reg->off behind > which is uncleared from previous reg state. So for them the mark_reg_unknown() > is useful in the sense that it clears all reg state whereas __mark_reg_known() > might only initialize a subset of it. I guess the right thing is to change the existing call to DST_OP_NO_MARK, and then in the "case: R = imm" branch add another check_reg_arg(DST_OP) (or maybe just a mark_reg_unknown()).
-Ed
