mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2025-01-09 23:34:42 +08:00
37086bfdc7
When BPF_FETCH is set, atomic instructions load a value from memory into a register. The current verifier code first checks via check_mem_access whether we can access the memory, and then checks via check_reg_arg whether we can write into the register. For loads, check_reg_arg has the side-effect of marking the register's value as unkonwn, and check_mem_access has the side effect of propagating bounds from memory to the register. This currently only takes effect for stack memory. Therefore with the current order, bounds information is thrown away, but by simply reversing the order of check_reg_arg vs. check_mem_access, we can instead propagate bounds smartly. A simple test is added with an infinite loop that can only be proved unreachable if this propagation is present. This is implemented both with C and directly in test_verifier using assembly. Suggested-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210202135002.4024825-1-jackmanb@google.com
25 lines
498 B
C
25 lines
498 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include <stdbool.h>
|
|
|
|
#ifdef ENABLE_ATOMICS_TESTS
|
|
bool skip_tests __attribute((__section__(".data"))) = false;
|
|
#else
|
|
bool skip_tests = true;
|
|
#endif
|
|
|
|
SEC("fentry/bpf_fentry_test1")
|
|
int BPF_PROG(sub, int x)
|
|
{
|
|
#ifdef ENABLE_ATOMICS_TESTS
|
|
int a = 0;
|
|
int b = __sync_fetch_and_add(&a, 1);
|
|
/* b is certainly 0 here. Can the verifier tell? */
|
|
while (b)
|
|
continue;
|
|
#endif
|
|
return 0;
|
|
}
|