linux-kernel - [PATCH bpf-next 1/3] bpf: verifier: Store null elision decision in insn_aux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <222efbc63de2519fd345e558cf27649220ccffa2.1737433945.git.dxu@dxuuu.xyz>
Date: Mon, 20 Jan 2025 21:35:10 -0700
From: Daniel Xu <dxu@...uu.xyz>
To: daniel@...earbox.net,
	ast@...nel.org,
	andrii@...nel.org
Cc: john.fastabend@...il.com,
	martin.lau@...ux.dev,
	eddyz87@...il.com,
	song@...nel.org,
	yonghong.song@...ux.dev,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org,
	bpf@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH bpf-next 1/3] bpf: verifier: Store null elision decision in insn_aux_data

Save the null elision decision from verification so that it can be
reused later during bpf_map_lookup_elem inlining. There's a generated
jump that can be omitted if the null was elided.

Signed-off-by: Daniel Xu <dxu@...uu.xyz>
---
 include/linux/bpf_verifier.h | 4 ++++
 kernel/bpf/verifier.c        | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 32c23f2a3086..1bcd6d66e546 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -515,6 +515,10 @@ struct bpf_map_ptr_state {
 	struct bpf_map *map_ptr;
 	bool poison;
 	bool unpriv;
+	/* true if instruction is a bpf_map_lookup_elem() with statically
+	 * known in-bounds key.
+	 */
+	bool inbounds;
 };
 
 /* Possible states for alu_state member. */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 74525392714e..e83145c2260d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11265,8 +11265,10 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		if (func_id == BPF_FUNC_map_lookup_elem &&
 		    can_elide_value_nullness(meta.map_ptr->map_type) &&
 		    meta.const_map_key >= 0 &&
-		    meta.const_map_key < meta.map_ptr->max_entries)
+		    meta.const_map_key < meta.map_ptr->max_entries) {
 			ret_flag &= ~PTR_MAYBE_NULL;
+			env->insn_aux_data[insn_idx].map_ptr_state.inbounds = true;
+		}
 
 		regs[BPF_REG_0].map_ptr = meta.map_ptr;
 		regs[BPF_REG_0].map_uid = meta.map_uid;
-- 
2.47.1