From 2fa579694ddf3a96454669c764ca0c06dea50817 Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Fri, 9 Oct 2026 03:47:49 -0700 Subject: [PATCH] bpf: Record basic-block ends in insn_aux_data SCEV needs information about the program's basic-block structure. Piggyback on compute_predecessors() and set insn_aux_data->bb_end for an instruction if: - it has multiple successors, or - its sole successor has multiple predecessors, or - it is a jump instruction. Signed-off-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261009-scev-minimal-rebase-v3-31-bcba9bc53ac9@gmail.com --- include/linux/bpf_verifier.h | 1 + kernel/bpf/loops.c | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 7fb1e315de48..1458e50a1ad1 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -741,6 +741,7 @@ struct bpf_insn_aux_data { bool is_iter_next; /* bpf_iter__next() kfunc call */ bool call_with_percpu_alloc_ptr; /* {this,per}_cpu_ptr() with prog percpu alloc */ bool arena_scalar; /* ldx/stx/st/atomic through a number, it's an address in arena */ + bool bb_end; /* last instruction of a basic block */ u8 alu_state; /* used in combination with alu_limit */ /* true if STX or LDX instruction is a part of a spill/fill * pattern for a bpf_fastcall call. diff --git a/kernel/bpf/loops.c b/kernel/bpf/loops.c index 8a6dc805e559..2568079c2945 100644 --- a/kernel/bpf/loops.c +++ b/kernel/bpf/loops.c @@ -5,8 +5,23 @@ #include #include +static bool is_cfg_jump(struct bpf_insn *insn) +{ + u8 class = BPF_CLASS(insn->code); + u8 opcode = BPF_OP(insn->code); + + switch (class) { + case BPF_JMP: + case BPF_JMP32: + return opcode != BPF_CALL; + default: + return false; + } +} + static struct bpf_iarray **compute_predecessors(struct bpf_verifier_env *env) { + struct bpf_insn_aux_data *aux = env->insn_aux_data; struct bpf_iarray *succ, *preds, **result; struct bpf_prog *prog = env->prog; u32 *num_preds, i, s, len = prog->len; @@ -54,6 +69,10 @@ static struct bpf_iarray **compute_predecessors(struct bpf_verifier_env *env) preds = result[s]; preds->items[preds->cnt++] = i; } + if (succ->cnt > 1 || + (succ->cnt == 1 && num_preds[succ->items[0]] > 1) || + is_cfg_jump(insn)) + aux[i].bb_end = true; if (bpf_is_ldimm64(insn)) i++; }