github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Add bpf_same_memory_origin()

Browse Source 
When dealing with loops like:

  for (ptr = ...; ptr < end_ptr; ptr += 8)
    ...

Scalar evolution needs to know if ptr and end_ptr identify a same
memory location (possibly with different offsets). If they do,
it is sound to attempt to infer iteration bounds for such a loop.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261009-scev-minimal-rebase-v3-29-bcba9bc53ac9@gmail.com
This commit is contained in:
Eduard Zingerman 2026-10-09 03:47:47 -07:00 committed by Alexei Starovoitov
parent 97d592e69d
commit 4c3a56544b
No known key found for this signature in database
2 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/bpf_verifier.h
View File

@ -1822,6 +1822,8 @@ struct arg_access_info
bpf_global_subprog_stack_access_bytes(struct bpf_verifier_env *env,
struct bpf_insn *insn, int arg, int insn_idx);
int bpf_compute_subprog_arg_access(struct bpf_verifier_env *env);
bool bpf_same_memory_origin(const struct bpf_reg_state *reg_a,
const struct bpf_reg_state *reg_b);
int bpf_set_reg_range(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
struct cnum64 range, u16 base, u16 step);
bool bpf_reg_union_compatible(const struct bpf_reg_state *a, const struct bpf_reg_state *b);

49
kernel/bpf/verifier.c
View File

@ -17280,6 +17280,55 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
return 0;
}
/*
* Many checks done by this function are quite conservative.
* This is because main verification pass does not maintain
* enough information to track object identities for some
* of the interesting types, e.g. PTR_TO_MEM.
*/
bool bpf_same_memory_origin(const struct bpf_reg_state *reg_a,
const struct bpf_reg_state *reg_b)
{
if (reg_a == reg_b)
return true;
/* Require matching flags and base types. */
if (reg_a->type != reg_b->type)
return false;
/* NULL can't be compared to some base+offset pointer. */
if (type_may_be_null(reg_a->type))
return false;
switch (base_type(reg_a->type)) {
case PTR_TO_STACK:
return reg_a->frameno == reg_b->frameno;
case PTR_TO_MAP_VALUE:
if (reg_a->map_ptr != reg_b->map_ptr || reg_a->map_uid != reg_b->map_uid)
return false;
if (reg_a->id && reg_a->id == reg_b->id)
return true;
/*
* A plain single-element array has one stable value address,
* but not when BPF_F_INNER_MAP is set, see arraymap.c:array_map_meta_equal().
*/
if (reg_a->map_ptr->map_type == BPF_MAP_TYPE_ARRAY &&
reg_a->map_ptr->max_entries == 1 &&
!(reg_a->map_ptr->map_flags & BPF_F_INNER_MAP))
return true;
/*
* The rules above can be simplified / relaxed if:
* - fresh IDs would always be assigned for map-value lookups;
* - direct map value loads would always have and ID of zero.
*/
return false;
case PTR_TO_MEM:
case PTR_TO_BUF:
return reg_a->id && reg_a->id == reg_b->id;
default:
return false;
}
}
int bpf_set_reg_range(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
struct cnum64 range, u16 base, u16 step)
{