This patch set fixes BPF verifier logic around validating and enforcing return
values for BPF programs that have specific range of expected return values.
Both sync and async callbacks have similar logic and are fixes as well.
A few tests are added that would fail without the fixes in this patch set.
Also, while at it, we extend retval checking logic to use not just tnum value,
but also umin/umax range, avoiding future potential issues if expected range
cannot be represented precisely by tnum (e.g., [0, 2] is not representable by
tnum and is treated as [0, 3]).
There is a little bit of refactoring to unify async callback and program exit
logic to avoid duplication of checks as much as possible.
Andrii Nakryiko (10):
bpf: rearrange bpf_func_state fields to save a bit of memory
bpf: provide correct register name for exception callback retval check
bpf: enforce precision of R0 on callback return
bpf: enforce exact retval range on subprog/callback exit
selftests/bpf: add selftest validating callback result is enforced
bpf: enforce precise retval range on program exit
bpf: unify async callback and program retval checks
bpf: enforce precision of R0 on program/async callback return
selftests/bpf: validate async callback return value check correctness
selftests/bpf: adjust global_func15 test to validate prog exit
precision
include/linux/bpf_verifier.h | 9 +-
kernel/bpf/verifier.c | 133 +++++++++++-------
.../selftests/bpf/progs/exceptions_assert.c | 2 +-
.../selftests/bpf/progs/exceptions_fail.c | 2 +-
.../selftests/bpf/progs/test_global_func15.c | 31 +++-
.../selftests/bpf/progs/timer_failure.c | 31 ++--
.../selftests/bpf/progs/user_ringbuf_fail.c | 2 +-
.../bpf/progs/verifier_cgroup_inv_retcode.c | 8 +-
.../bpf/progs/verifier_netfilter_retcode.c | 2 +-
.../bpf/progs/verifier_subprog_precision.c | 45 ++++++
10 files changed, 198 insertions(+), 67 deletions(-)
--
2.34.1
