Re: [PATCH bpf-next] bpf: relax verifier restriction on BPF_MOV | BPF_ALU

[Edward Cree]

On 05/12/18 09:46, Jiong Wang wrote:
> There is NO processed instruction number regression, either with or without
> -mattr=+alu32.
<snip>
> Cilium bpf
> ===
> bpf_lb-DLB_L3.o         2110/2110    1730/1733
That looks like a regression of 3 insns in the 32-bit case.
May be worth investigating why.

> +                     dst_reg = insn->dst_reg;
> +                     regs[dst_reg] = regs[src_reg];
> +                     if (BPF_CLASS(insn->code) == BPF_ALU) {
> +                             /* Update type and range info. */
> +                             regs[dst_reg].type = SCALAR_VALUE;
> +                             coerce_reg_to_size(&regs[dst_reg], 4);
Won't this break when handed a pointer (as root, so allowed to leak
 it)?  E.g. (pointer + x) gets turned into scalar x, rather than
 unknown scalar in range [0, 0xffffffff].
The existing behaviour is correct for pointers: 32 unknown bits,
 because the value of the pointer base is unknown.
It's only for scalar_values that you want to copy and truncate the
 var_off and min/max from the src_reg.

-Ed