diff options
author | Alexei Starovoitov <ast@kernel.org> | 2022-12-10 13:20:53 -0800 |
---|---|---|
committer | Alexei Starovoitov <ast@kernel.org> | 2022-12-10 13:36:22 -0800 |
commit | 99523094de48df65477cbbb9d8027f4bc4701794 (patch) | |
tree | de4c47b1ac47deceb055aef7fbab79f30dabebc0 /net/bpf | |
parent | f3212ad5b7e93c002bd2dbe552c2b0b0033317ff (diff) | |
parent | efd6286ff74a2fa2b45ed070d344cc0822b8ea6e (diff) | |
download | linux-99523094de48df65477cbbb9d8027f4bc4701794.tar.gz linux-99523094de48df65477cbbb9d8027f4bc4701794.tar.bz2 linux-99523094de48df65477cbbb9d8027f4bc4701794.zip |
Merge branch 'stricter register ID checking in regsafe()'
Eduard Zingerman says:
====================
This patch-set consists of a series of bug fixes for register ID
tracking in verifier.c:states_equal()/regsafe() functions:
- for registers of type PTR_TO_MAP_{KEY,VALUE}, PTR_TO_PACKET[_META]
the regsafe() should call check_ids() even if registers are
byte-to-byte equal;
- states_equal() must maintain idmap that covers all function frames
in the state because functions like mark_ptr_or_null_regs() operate
on all registers in the state;
- regsafe() must compare spin lock ids for PTR_TO_MAP_VALUE registers.
The last point covers issue reported by Kumar Kartikeya Dwivedi in [1],
I borrowed the test commit from there.
Note, that there is also an issue with register id tracking for
scalars described here [2], it would be addressed separately.
[1] https://lore.kernel.org/bpf/20221111202719.982118-1-memxor@gmail.com/
[2] https://lore.kernel.org/bpf/20221128163442.280187-2-eddyz87@gmail.com/
Eduard Zingerman (6):
bpf: regsafe() must not skip check_ids()
selftests/bpf: test cases for regsafe() bug skipping check_id()
bpf: states_equal() must build idmap for all function frames
selftests/bpf: verify states_equal() maintains idmap across all frames
bpf: use check_ids() for active_lock comparison
selftests/bpf: test case for relaxed prunning of active_lock.id
====================
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'net/bpf')
0 files changed, 0 insertions, 0 deletions