• Eduard Zingerman's avatar
    bpf: make infinite loop detection in is_state_visited() exact · d5b892fd
    Eduard Zingerman authored
    Current infinite loops detection mechanism is speculative:
    - first, states_maybe_looping() check is done which simply does memcmp
      for R1-R10 in current frame;
    - second, states_equal(..., exact=false) is called. With exact=false
      states_equal() would compare scalars for equality only if in old
      state scalar has precision mark.
    
    Such logic might be problematic if compiler makes some unlucky stack
    spill/fill decisions. An artificial example of a false positive looks
    as follows:
    
            r0 = ... unknown scalar ...
            r0 &= 0xff;
            *(u64 *)(r10 - 8) = r0;
            r0 = 0;
        loop:
            r0 = *(u64 *)(r10 - 8);
            if r0 > 10 goto exit_;
            r0 += 1;
            *(u64 *)(r10 - 8) = r0;
            r0 = 0;
            goto loop;
    
    This commit updates call to states_equal to use exact=true, forcing
    all scalar comparisons to be exact.
    Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/r/20240108205209.838365-3-maxtram95@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    d5b892fd
verifier.c 625 KB