Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 914cb781 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

bpf: cleanup register_is_null() 



don't pass large struct bpf_reg_state by value.
Instead pass it by pointer.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 3bf15921

kernel/bpf/verifier.c

+10 −10
Original line number Diff line number Diff line
@@ -1265,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins 
}



/* Does this register contain a constant zero? */

static bool register_is_null(struct bpf_reg_state reg)

static bool register_is_null(struct bpf_reg_state *reg)

{

	return reg.type == SCALAR_VALUE && tnum_equals_const(reg.var_off, 0);

	return reg->type == SCALAR_VALUE && tnum_equals_const(reg->var_off, 0);

}



/* when register 'regno' is passed into function that will read 'access_size'
@@ -1280,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
				int access_size, bool zero_size_allowed,

				struct bpf_call_arg_meta *meta)

{

	struct bpf_reg_state *reg = cur_regs(env) + regno;

	struct bpf_verifier_state *state = env->cur_state;

	struct bpf_reg_state *regs = state->regs;

	int off, i, slot, spi;



	if (regs[regno].type != PTR_TO_STACK) {

	if (reg->type != PTR_TO_STACK) {

		/* Allow zero-byte read from NULL, regardless of pointer type */

		if (zero_size_allowed && access_size == 0 &&

		    register_is_null(regs[regno]))

		    register_is_null(reg))

			return 0;



		verbose(env, "R%d type=%s expected=%s\n", regno,

			reg_type_str[regs[regno].type],

			reg_type_str[reg->type],

			reg_type_str[PTR_TO_STACK]);

		return -EACCES;

	}



	/* Only allow fixed-offset stack reads */

	if (!tnum_is_const(regs[regno].var_off)) {

	if (!tnum_is_const(reg->var_off)) {

		char tn_buf[48];



		tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off);

		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

		verbose(env, "invalid variable stack read R%d var_off=%s\n",

			regno, tn_buf);

	}

	off = regs[regno].off + regs[regno].var_off.value;

	off = reg->off + reg->var_off.value;

	if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||

	    access_size < 0 || (access_size == 0 && !zero_size_allowed)) {

		verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
@@ -1412,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
		 * passed in as argument, it's a SCALAR_VALUE type. Final test

		 * happens during stack boundary checking.

		 */

		if (register_is_null(*reg) &&

		if (register_is_null(reg) &&

		    arg_type == ARG_PTR_TO_MEM_OR_NULL)

			/* final test in check_stack_boundary() */;

		else if (!type_is_pkt_pointer(type) &&