On Mon, Jul 15, 2024 at 4:02 PM Eduard Zingerman <eddyz87@xxxxxxxxx> wrote: > > There is a number of BPF helper functions that use ARG_ANYTHING to > mark parameters that are used as memory addresses. > An address of BPF stack slot could be passed as such parameter > for two such helper functions: > - bpf_probe_read_kernel > - bpf_probe_read_kernel_str > > This might lead to a surprising behavior in combination with nocsr > rewrites, e.g. consider the program below: > > 1: r1 = 1; > /* nocsr pattern with stack offset -16 */ > 2: *(u64 *)(r10 - 16) = r1; > 3: call %[bpf_get_smp_processor_id]; > 4: r1 = *(u64 *)(r10 - 16); > 5: r1 = r10; > 6: r1 += -8; > 7: r2 = 1; > 8: r3 = r10; > 9: r3 += -16; > /* bpf_probe_read_kernel(dst: &fp[-8], size: 1, src: &fp[-16]) */ > 10: call %[bpf_probe_read_kernel]; > 11: exit; > > Here nocsr rewrite logic would remove instructions (2) and (4). > However, (2) writes a value that is later read by a call at (10). This makes no sense to me. This bpf prog is broken. If probe_read is used to read stack it will read garbage. JITs and the verifier are allowed to do any transformation that keeps the program semantics and safety. pw-bot: cr
