netdev - Re: [PATCH net-next 4/4] bpf/verifier: document liveness analysis

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a90d2b5b-077e-a16a-c0ff-8d3b4e2a6669@fb.com>
Date:   Tue, 22 Aug 2017 08:59:01 -0700
From:   Alexei Starovoitov <ast@...com>
To:     Edward Cree <ecree@...arflare.com>, <davem@...emloft.net>,
        Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>
CC:     <netdev@...r.kernel.org>,
        iovisor-dev <iovisor-dev@...ts.iovisor.org>
Subject: Re: [PATCH net-next 4/4] bpf/verifier: document liveness analysis

On 8/22/17 8:55 AM, Edward Cree wrote:
> On 22/08/17 16:42, Alexei Starovoitov wrote:
>> On 8/22/17 6:27 AM, Edward Cree wrote:
>>>  static bool do_propagate_liveness(const struct bpf_verifier_state *state,
>>>                    struct bpf_verifier_state *parent)
>>>  {
>>> @@ -3457,6 +3463,15 @@ static bool do_propagate_liveness(const struct bpf_verifier_state *state,
>>>      return touched;
>>>  }
>>>
>>> +/* "parent" is "a state from which we reach the current state", but initially
>>> + * it is not the state->parent (i.e. "the state whose straight-line code leads
>>> + * to the current state"), instead it is the state that happened to arrive at
>>> + * a (prunable) equivalent of the current state.  See comment above
>>> + * do_propagate_liveness() for consequences of this.
>>> + * This function is just a more efficient way of calling mark_reg_read() or
>>> + * mark_stack_slot_read() on each reg in "parent" that is read in "state", so
>>> + * long as parent != state->parent.
>>> + */
>>
>> i'm confused with 'so long as parent != state->parent' which implies
>> looping and multiple iterations, whereas 'parent != state->parent'
>> condition is true only for the first iteration of
>> 'while (do_propagate_liveness(state, parent))' loop.
>> right ?
> I phrased it badly.  I mean that, the statement "this function is just a
>  way to mark_reg_read() all the things" is true only "so long as" (i.e.
>  under the condition) parent != state->parent.

got it.

> How about
> /* This function is just a more efficient way of calling mark_reg_read() or
>  * mark_stack_slot_read() on each reg in "parent" that is read in "state",
>  * though it requires that parent != state->parent in the call arguments.
>  */

Thanks. It's more clear to me. Ack