diff options
author | Alexei Starovoitov <ast@kernel.org> | 2020-10-14 20:56:08 +0300 |
---|---|---|
committer | Daniel Borkmann <daniel@iogearbox.net> | 2020-10-15 17:05:31 +0300 |
commit | e688c3db7ca69bea1872c5706aec6a7fdf89df17 (patch) | |
tree | 349ebbc1f6d7a6e61e7c56a447ba8c926f811b79 /net/core/net-sysfs.c | |
parent | ccdf7fae3afaeaf0e5dd03311b86ffa56adf85ae (diff) | |
download | linux-e688c3db7ca69bea1872c5706aec6a7fdf89df17.tar.xz |
bpf: Fix register equivalence tracking.
The 64-bit JEQ/JNE handling in reg_set_min_max() was clearing reg->id in either
true or false branch. In the case 'if (reg->id)' check was done on the other
branch the counter part register would have reg->id == 0 when called into
find_equal_scalars(). In such case the helper would incorrectly identify other
registers with id == 0 as equivalent and propagate the state incorrectly.
Fix it by preserving ID across reg_set_min_max().
In other words any kind of comparison operator on the scalar register
should preserve its ID to recognize:
r1 = r2
if (r1 == 20) {
#1 here both r1 and r2 == 20
} else if (r2 < 20) {
#2 here both r1 and r2 < 20
}
The patch is addressing #1 case. The #2 was working correctly already.
Fixes: 75748837b7e5 ("bpf: Propagate scalar ranges through register assignments.")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Tested-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20201014175608.1416-1-alexei.starovoitov@gmail.com
Diffstat (limited to 'net/core/net-sysfs.c')
0 files changed, 0 insertions, 0 deletions