lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 124/663] bpf: Clear subreg_def for global function return values
    Date
    From: Ilya Leoshkevich <iii@linux.ibm.com>

    [ Upstream commit 45159b27637b0fef6d5ddb86fc7c46b13c77960f ]

    test_global_func4 fails on s390 as reported by Yauheni in [1].

    The immediate problem is that the zext code includes the instruction,
    whose result needs to be zero-extended, into the zero-extension
    patchlet, and if this instruction happens to be a branch, then its
    delta is not adjusted. As a result, the verifier rejects the program
    later.

    However, according to [2], as far as the verifier's algorithm is
    concerned and as specified by the insn_no_def() function, branching
    insns do not define anything. This includes call insns, even though
    one might argue that they define %r0.

    This means that the real problem is that zero extension kicks in at
    all. This happens because clear_caller_saved_regs() sets BPF_REG_0's
    subreg_def after global function calls. This can be fixed in many
    ways; this patch mimics what helper function call handling already
    does.

    [1] https://lore.kernel.org/bpf/20200903140542.156624-1-yauheni.kaliuta@redhat.com/
    [2] https://lore.kernel.org/bpf/CAADnVQ+2RPKcftZw8d+B1UwB35cpBhpF5u3OocNh90D9pETPwg@mail.gmail.com/

    Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
    Reported-by: Yauheni Kaliuta <yauheni.kaliuta@redhat.com>
    Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20210212040408.90109-1-iii@linux.ibm.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/verifier.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index c09594e70f90a..6c2e4947beaeb 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -4786,8 +4786,9 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
    subprog);
    clear_caller_saved_regs(env, caller->regs);

    - /* All global functions return SCALAR_VALUE */
    + /* All global functions return a 64-bit SCALAR_VALUE */
    mark_reg_unknown(env, caller->regs, BPF_REG_0);
    + caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;

    /* continue with next insn after call */
    return 0;
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-02 04:10    [W:2.309 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site