diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2025-06-13 10:53:30 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-06-13 11:51:19 -0700 |
| commit | 3157f7e2999616ac91f4d559a8566214f74000a5 (patch) | |
| tree | 8e49fb984396c53c58ef8ba50bed44b512836687 /kernel | |
| parent | Merge branch 'veristat-memory-accounting-for-bpf-programs' (diff) | |
| download | linux-3157f7e2999616ac91f4d559a8566214f74000a5.tar.gz linux-3157f7e2999616ac91f4d559a8566214f74000a5.zip | |
bpf: handle jset (if a & b ...) as a jump in CFG computation
BPF_JSET is a conditional jump and currently verifier.c:can_jump()
does not know about that. This can lead to incorrect live registers
and SCC computation.
E.g. in the following example:
1: r0 = 1;
2: r2 = 2;
3: if r1 & 0x7 goto +1;
4: exit;
5: r0 = r2;
6: exit;
W/o this fix insn_successors(3) will return only (4), a jump to (5)
would be missed and r2 won't be marked as alive at (3).
Fixes: 14c8552db644 ("bpf: simple DFA-based live registers analysis")
Reported-by: syzbot+a36aac327960ff474804@syzkaller.appspotmail.com
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250613175331.3238739-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index fd81cff11617..a1c312e216ca 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23951,6 +23951,7 @@ static bool can_jump(struct bpf_insn *insn) case BPF_JSLT: case BPF_JSLE: case BPF_JCOND: + case BPF_JSET: return true; } |