• Maxim Mikityanskiy's avatar
    bpf: Track spilled unbounded scalars · e67ddd9b
    Maxim Mikityanskiy authored
    
    
    Support the pattern where an unbounded scalar is spilled to the stack,
    then boundary checks are performed on the src register, after which the
    stack frame slot is refilled into a register.
    
    Before this commit, the verifier didn't treat the src register and the
    stack slot as related if the src register was an unbounded scalar. The
    register state wasn't copied, the id wasn't preserved, and the stack
    slot was marked as STACK_MISC. Subsequent boundary checks on the src
    register wouldn't result in updating the boundaries of the spilled
    variable on the stack.
    
    After this commit, the verifier will preserve the bond between src and
    dst even if src is unbounded, which permits to do boundary checks on src
    and refill dst later, still remembering its boundaries. Such a pattern
    is sometimes generated by clang when compiling complex long functions.
    
    One test is adjusted to reflect that now unbounded scalars are tracked.
    Signed-off-by: default avatarMaxim Mikityanskiy <maxim@isovalent.com>
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/bpf/20240127175237.526726-2-maxtram95@gmail.com
    e67ddd9b
verifier_spill_fill.c 30.8 KB