On Tue, Nov 28, 2023 at 4:36 PM Andrii Nakryiko <andrii@xxxxxxxxxx> wrote:
>
> Instead of relying on potentially imprecise tnum representation of
> expected return value range for callbacks and subprogs, validate that
> umin/umax range satisfy exact expected range of return values.
>
> E.g., if callback would need to return [0, 2] range, tnum can't
> represent this precisely and instead will allow [0, 3] range. By
> checking umin/umax range, we can make sure that subprog/callback indeed
> returns only valid [0, 2] range.
>
> Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
> Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
> ---
> include/linux/bpf_verifier.h | 7 ++++++-
> kernel/bpf/verifier.c | 40 ++++++++++++++++++++++++++----------
> 2 files changed, 35 insertions(+), 12 deletions(-)
>
[...]
> @@ -9531,7 +9536,7 @@ static int set_rbtree_add_callback_state(struct bpf_verifier_env *env,
> __mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
> __mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
> callee->in_callback_fn = true;
> - callee->callback_ret_range = tnum_range(0, 1);
> + callee->callback_ret_range = retval_range(0, 1);
> return 0;
> }
>
> @@ -9560,6 +9565,19 @@ static bool in_rbtree_lock_required_cb(struct bpf_verifier_env *env)
> return is_rbtree_lock_required_kfunc(kfunc_btf_id);
> }
>
> +static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg)
> +{
> + return range.minval <= reg->umin_value && reg->umax_value <= range.maxval;
argh, I didn't update the core piece of logic to use smin/smax here.
I'll send v3 tomorrow, sorry for the spam...
> +}
> +
> +static struct tnum retval_range_as_tnum(struct bpf_retval_range range)
> +{
> + if (range.minval == range.maxval)
> + return tnum_const(range.minval);
> + else
> + return tnum_range(range.minval, range.maxval);
> +}
> +
[...]
