Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: simplify verifier register state assignments

verifier is using the following structure to track the state of registers:
struct reg_state {
enum bpf_reg_type type;
union {
int imm;
struct bpf_map *map_ptr;
};
};
and later on in states_equal() does memcmp(&old->regs[i], &cur->regs[i],..)
to find equivalent states.
Throughout the code of verifier there are assignements to 'imm' and 'map_ptr'
fields and it's not obvious that most of the assignments into 'imm' don't
need to clear extra 4 bytes (like mark_reg_unknown_value() does) to make sure
that memcmp doesn't go over junk left from 'map_ptr' assignment.

Simplify the code by converting 'int' into 'long'

Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Alexei Starovoitov and committed by
David S. Miller
4923ec0b ae95d712

+2 -4
+2 -4
kernel/bpf/verifier.c
··· 142 142 enum bpf_reg_type type; 143 143 union { 144 144 /* valid when type == CONST_IMM | PTR_TO_STACK */ 145 - int imm; 145 + long imm; 146 146 147 147 /* valid when type == CONST_PTR_TO_MAP | PTR_TO_MAP_VALUE | 148 148 * PTR_TO_MAP_VALUE_OR_NULL ··· 263 263 continue; 264 264 verbose(" R%d=%s", i, reg_type_str[t]); 265 265 if (t == CONST_IMM || t == PTR_TO_STACK) 266 - verbose("%d", env->cur_state.regs[i].imm); 266 + verbose("%ld", env->cur_state.regs[i].imm); 267 267 else if (t == CONST_PTR_TO_MAP || t == PTR_TO_MAP_VALUE || 268 268 t == PTR_TO_MAP_VALUE_OR_NULL) 269 269 verbose("(ks=%d,vs=%d)", ··· 480 480 for (i = 0; i < MAX_BPF_REG; i++) { 481 481 regs[i].type = NOT_INIT; 482 482 regs[i].imm = 0; 483 - regs[i].map_ptr = NULL; 484 483 } 485 484 486 485 /* frame pointer */ ··· 494 495 BUG_ON(regno >= MAX_BPF_REG); 495 496 regs[regno].type = UNKNOWN_VALUE; 496 497 regs[regno].imm = 0; 497 - regs[regno].map_ptr = NULL; 498 498 } 499 499 500 500 enum reg_arg_type {