Commit 1f2a74b4 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

bpf: prevent r10 register from being marked as precise 



r10 is a special register that is not under BPF program's control and is
always effectively precise. The rest of precision logic assumes that
only r0-r9 SCALAR registers are marked as precise, so prevent r10 from
being marked precise.

This can happen due to signed cast instruction allowing to do something
like `r0 = (s8)r10;`, which later, if r0 needs to be precise, would lead
to an attempt to mark r10 as precise.

Prevent this with an extra check during instruction backtracking.

Fixes: 8100928c ("bpf: Support new sign-extension mov insns")
Reported-by: default avatar <syzbot+148110ee7cf72f39f33e@syzkaller.appspotmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Acked-by: default avatarYonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20240404214536.3551295-1-andrii@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent f9171700

kernel/bpf/verifier.c

+4 −2
Original line number Diff line number Diff line
@@ -3615,6 +3615,7 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, 
				 * sreg needs precision before this insn

				 */

				bt_clear_reg(bt, dreg);

				if (sreg != BPF_REG_FP)

					bt_set_reg(bt, sreg);

			} else {

				/* dreg = K
@@ -3631,6 +3632,7 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, 
				 * both dreg and sreg need precision

				 * before this insn

				 */

				if (sreg != BPF_REG_FP)

					bt_set_reg(bt, sreg);

			} /* else dreg += K

			   * dreg still needs precision before this insn