]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: improve verifier state equivalence
authorAlexei Starovoitov <ast@fb.com>
Fri, 6 May 2016 02:49:11 +0000 (19:49 -0700)
committerDavid S. Miller <davem@davemloft.net>
Fri, 6 May 2016 20:01:54 +0000 (16:01 -0400)
commitf5e163ba731d1a023bcb31a2b276b70ecc99150c
treec2caeca835dc4a72ee04652e37274c98d4ad88eb
parent708cda7d2463519ebe4bb9fab9be41370d4bb646
bpf: improve verifier state equivalence

since UNKNOWN_VALUE type is weaker than CONST_IMM we can un-teach
verifier its recognition of constants in conditional branches
without affecting safety.
Ex:
if (reg == 123) {
  .. here verifier was marking reg->type as CONST_IMM
     instead keep reg as UNKNOWN_VALUE
}

Two verifier states with UNKNOWN_VALUE are equivalent, whereas
CONST_IMM_X != CONST_IMM_Y, since CONST_IMM is used for stack range
verification and other cases.
So help search pruning by marking registers as UNKNOWN_VALUE
where possible instead of CONST_IMM.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
kernel/bpf/verifier.c