bpf: track immediate values written to stack by BPF_ST instruction
authorEduard Zingerman <eddyz87@gmail.com>
Tue, 14 Feb 2023 23:20:27 +0000 (01:20 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 28 Jun 2023 09:12:28 +0000 (11:12 +0200)
commit461fc3391c5263710113d0ae9b89c077d197543d
tree6396358c77f8de73504c9a8193a0e22b754303d6
parentb36ba84f09a142b2564932b42735e04bb0907395
bpf: track immediate values written to stack by BPF_ST instruction

[ Upstream commit ecdf985d7615356b78241fdb159c091830ed0380 ]

For aligned stack writes using BPF_ST instruction track stored values
in a same way BPF_STX is handled, e.g. make sure that the following
commands produce similar verifier knowledge:

  fp[-8] = 42;             r1 = 42;
                       fp[-8] = r1;

This covers two cases:
 - non-null values written to stack are stored as spill of fake
   registers;
 - null values written to stack are stored as STACK_ZERO marks.

Previously both cases above used STACK_MISC marks instead.

Some verifier test cases relied on the old logic to obtain STACK_MISC
marks for some stack values. These test cases are updated in the same
commit to avoid failures during bisect.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230214232030.1502829-2-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: 713274f1f2c8 ("bpf: Fix verifier id tracking of scalars on spill")
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/verifier.c
tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c