]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: No need to simulate speculative domain for immediates
authorDaniel Borkmann <daniel@iogearbox.net>
Tue, 4 May 2021 08:58:25 +0000 (08:58 +0000)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 25 May 2021 20:08:53 +0000 (22:08 +0200)
commit299f5cec12b8d0c425d3e01db9605f8a90314fe2
tree317ec094c6308d8326d11468976212bdb228dab9
parentb671acde4d0e90b0d0062043f1e78f5e63381088
bpf: No need to simulate speculative domain for immediates

In 0b8f76b1f992 ("bpf: Fix leakage of uninitialized bpf stack under
speculation") we replaced masking logic with direct loads of immediates
if the register is a known constant. Given in this case we do not apply
any masking, there is also no reason for the operation to be truncated
under the speculative domain.

Therefore, there is also zero reason for the verifier to branch-off and
simulate this case, it only needs to do it for unknown but bounded scalars.
As a side-effect, this also enables few test cases that were previously
rejected due to simulation under zero truncation.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c