diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-10-09 03:47:36 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-09 20:29:13 +0000 |
| commit | 366b4c68d83042a45574272eddff8a76c9c25164 (patch) | |
| tree | bc8d79a1b64440566236c473ba107b3c39dc2822 /kernel | |
| parent | f21dcf26986c9aafe2ec12f80c440da7394dfb21 (diff) | |
| download | linux-next-366b4c68d83042a45574272eddff8a76c9c25164.tar.gz linux-next-366b4c68d83042a45574272eddff8a76c9c25164.zip | |
bpf: Allow subrange relations for PTR_TO_STACK in regsafe()
regsafe() currently requires an exact match for PTR_TO_STACK registers.
This prevents an explored state from pruning a current state whose
variable-offset range is a subset of the explored range.
This change allows a checkpoint containing a widened stack pointer to
cover narrower offsets reached on subsequent loop iterations,
for example [-56, -8] within [-64, -8].
Merge the PTR_TO_STACK case with PTR_TO_MEM and others, as the set of
necessary checks is almost identical. The only difference is a map_uid
check, which is not needed for PTR_TO_STACK. All locations that
produce PTR_TO_STACK reset map_uid to zero.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261009-scev-minimal-rebase-v3-18-bcba9bc53ac9@gmail.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/states.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c index 18bf7b660c2f..345079cf64d3 100644 --- a/kernel/bpf/states.c +++ b/kernel/bpf/states.c @@ -610,6 +610,7 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold, case PTR_TO_MEM: case PTR_TO_BUF: case PTR_TO_TP_BUFFER: + case PTR_TO_STACK: /* If the new min/max/var_off satisfy the old ones and * everything else matches, we are OK. */ @@ -643,8 +644,6 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold, /* new val must satisfy old val knowledge */ return range_within(rold, rcur) && tnum_in(rold->var_off, rcur->var_off); - case PTR_TO_STACK: - return regs_exact(rold, rcur, idmap); case PTR_TO_ARENA: return true; case PTR_TO_INSN: |