github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-26 08:02:27 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Clear singular ids for scalars in is_state_visited()

Browse Source 
The verifier assigns ids to scalar registers/stack slots when they are
linked through a mov or stack spill/fill instruction. These ids are
later used to propagate newly found bounds from one register to all
registers that share the same id. The verifier also compares the ids of
these registers in current state and cached state when making pruning
decisions.

When an ID becomes singular (i.e., only a single register or stack slot
has that ID), it can no longer participate in bounds propagation. During
comparisons between current and cached states for pruning decisions,
however, such stale IDs can prevent pruning of otherwise equivalent
states.

Find and clear all singular ids before caching a state in
is_state_visited(). struct bpf_idset which is currently unused has been
repurposed for this use case.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20260203165102.2302462-3-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Puranjay Mohan 2026-02-03 08:50:58 -08:00 committed by Alexei Starovoitov
parent 3cd5c89065
commit b2a0aa3a87
2 changed files with 73 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
include/linux/bpf_verifier.h
View File

@ -697,8 +697,11 @@ struct bpf_idmap {
};
struct bpf_idset {
u32 count;
u32 ids[BPF_ID_MAP_SIZE];
u32 num_ids;
struct {
u32 id;
u32 cnt;
} entries[BPF_ID_MAP_SIZE];
};
/* see verifier.c:compute_scc_callchain() */

68
kernel/bpf/verifier.c
View File

@ -19461,6 +19461,72 @@ static void clean_verifier_state(struct bpf_verifier_env *env,
* doesn't meant that the states are DONE. The verifier has to compare
* the callsites
*/
/* Find id in idset and increment its count, or add new entry */
static void idset_cnt_inc(struct bpf_idset *idset, u32 id)
{
u32 i;
for (i = 0; i < idset->num_ids; i++) {
if (idset->entries[i].id == id) {
idset->entries[i].cnt++;
return;
}
}
/* New id */
if (idset->num_ids < BPF_ID_MAP_SIZE) {
idset->entries[idset->num_ids].id = id;
idset->entries[idset->num_ids].cnt = 1;
idset->num_ids++;
}
}
/* Find id in idset and return its count, or 0 if not found */
static u32 idset_cnt_get(struct bpf_idset *idset, u32 id)
{
u32 i;
for (i = 0; i < idset->num_ids; i++) {
if (idset->entries[i].id == id)
return idset->entries[i].cnt;
}
return 0;
}
/*
* Clear singular scalar ids in a state.
* A register with a non-zero id is called singular if no other register shares
* the same base id. Such registers can be treated as independent (id=0).
*/
static void clear_singular_ids(struct bpf_verifier_env *env,
struct bpf_verifier_state *st)
{
struct bpf_idset *idset = &env->idset_scratch;
struct bpf_func_state *func;
struct bpf_reg_state *reg;
idset->num_ids = 0;
bpf_for_each_reg_in_vstate(st, func, reg, ({
if (reg->type != SCALAR_VALUE)
continue;
if (!reg->id)
continue;
idset_cnt_inc(idset, reg->id & ~BPF_ADD_CONST);
}));
bpf_for_each_reg_in_vstate(st, func, reg, ({
if (reg->type != SCALAR_VALUE)
continue;
if (!reg->id)
continue;
if (idset_cnt_get(idset, reg->id & ~BPF_ADD_CONST) == 1) {
reg->id = 0;
reg->off = 0;
}
}));
}
static void clean_live_states(struct bpf_verifier_env *env, int insn,
struct bpf_verifier_state *cur)
{
@ -20459,6 +20525,8 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
if (env->bpf_capable)
mark_all_scalars_imprecise(env, cur);
clear_singular_ids(env, cur);
/* add new state to the head of linked list */
new = &new_sl->state;
err = copy_verifier_state(new, cur);