• Andrii Nakryiko's avatar
    bpf: fix precision backtracking instruction iteration · 4bb7ea94
    Andrii Nakryiko authored
    Fix an edge case in __mark_chain_precision() which prematurely stops
    backtracking instructions in a state if it happens that state's first
    and last instruction indexes are the same. This situations doesn't
    necessarily mean that there were no instructions simulated in a state,
    but rather that we starting from the instruction, jumped around a bit,
    and then ended up at the same instruction before checkpointing or
    marking precision.
    
    To distinguish between these two possible situations, we need to consult
    jump history. If it's empty or contain a single record "bridging" parent
    state and first instruction of processed state, then we indeed
    backtracked all instructions in this state. But if history is not empty,
    we are definitely not done yet.
    
    Move this logic inside get_prev_insn_idx() to contain it more nicely.
    Use -ENOENT return code to denote "we are out of instructions"
    situation.
    
    This bug was exposed by verifier_loop1.c's bounded_recursion subtest, once
    the next fix in this patch set is applied.
    Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
    Fixes: b5dc0163 ("bpf: precise scalar_value tracking")
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Link: https://lore.kernel.org/r/20231110002638.4168352-3-andrii@kernel.orgSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    4bb7ea94
verifier.c 613 KB