bpf: recognize 64bit immediate loads as consts
authorJakub Kicinski <jakub.kicinski@netronome.com>
Wed, 21 Sep 2016 10:43:59 +0000 (11:43 +0100)
committerDavid S. Miller <davem@davemloft.net>
Wed, 21 Sep 2016 23:50:02 +0000 (19:50 -0400)
When running as parser interpret BPF_LD | BPF_IMM | BPF_DW
instructions as loading CONST_IMM with the value stored
in imm.  The verifier will continue not recognizing those
due to concerns about search space/program complexity
increase.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
kernel/bpf/verifier.c

index ee86a77..8c3f794 100644 (file)
@@ -1769,9 +1769,19 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
        if (err)
                return err;
 
-       if (insn->src_reg == 0)
-               /* generic move 64-bit immediate into a register */
+       if (insn->src_reg == 0) {
+               /* generic move 64-bit immediate into a register,
+                * only analyzer needs to collect the ld_imm value.
+                */
+               u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
+
+               if (!env->analyzer_ops)
+                       return 0;
+
+               regs[insn->dst_reg].type = CONST_IMM;
+               regs[insn->dst_reg].imm = imm;
                return 0;
+       }
 
        /* replace_map_fd_with_map_ptr() should have caught bad ld_imm64 */
        BUG_ON(insn->src_reg != BPF_PSEUDO_MAP_FD);