On Thu, 15 Feb 2024 at 02:10, Eduard Zingerman <eddyz87@xxxxxxxxx> wrote:
>
> On Thu, 2024-02-01 at 04:20 +0000, Kumar Kartikeya Dwivedi wrote:
> > Global subprogs are not descended during symbolic execution, but we
> > summarized whether they can throw an exception (reachable from another
> > exception throwing subprog) in mark_exception_reachable_subprogs added
> > by the previous patch.
>
> [...]
>
> > Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions")
> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
> > ---
>
> Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
>
> Also, did you consider global subprograms that always throw?
> E.g. do some logging and unconditionally call bpf_throw().
>
I have an example for that in the exception test suite, but I will add
a test for that with lingering references around.
> [...]
>
> > @@ -9505,6 +9515,9 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
> > mark_reg_unknown(env, caller->regs, BPF_REG_0);
> > caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> >
> > + if (env->cur_state->global_subprog_call_exception)
> > + verbose(env, "Func#%d ('%s') may throw exception, exploring program path where exception is thrown\n",
> > + subprog, sub_name);
>
> Nit: Maybe move this log entry to do_check?
> It would be printed right before returning to do_check() anyways.
> Maybe add a log level check?
>
Hmm, true. I was actually even considering whether all frame_desc logs
should also be LOG_LEVEL2?
> > /* continue with next insn after call */
> > return 0;
> > }
>
> [...]
