kernel/bpf/verifier.c

1186  * more precise STACK_ZERO.
1806 	 * in which case everything is forced to be precise)
1808 	reg->precise = !env->bpf_capable;
2310 	reg->precise = false;
2315  * initialize .precise as true when not bpf capable.
2321 	reg->precise = !env->bpf_capable;
3636 				 * as precise=true in this verifier state.
3661 		 * by 'precise' mark in corresponding register of this state.
3723 				 * precise, r0 and r6-r10 or any stack slot in
3838 			 * this insn. If only sreg was marked precise
3866  * . at the start all registers have precise=false.
3868  * . once precise value of the scalar register is used in:
3874  *   should be precise.
3876  *   are equivalent if both are not precise.
3880  * used to compute single precise scalar.
3882  * The approach of starting with precise=true for all registers and then
3883  * backtrack to mark a register as not precise when the verifier detects
3925 		verbose(env, "mark_precise: frame%d: falling back to forcing all scalars precise\n",
3929 	/* big hammer: mark all scalars precise in this path.
3930 	 * pop_stack may still get !precise scalars.
3940 				if (reg->type != SCALAR_VALUE || reg->precise)
3942 				reg->precise = true;
3944 					verbose(env, "force_precise: frame%d: forcing r%d to be precise\n",
3952 				if (reg->type != SCALAR_VALUE || reg->precise)
3954 				reg->precise = true;
3956 					verbose(env, "force_precise: frame%d: forcing fp%d to be precise\n",
3976 			reg->precise = false;
3984 			reg->precise = false;
4013 /* Collect a set of IDs for all registers currently marked as precise in env->bt.
4014  * Mark all registers with these IDs as precise.
4089  * precise.
4091  * One important and subtle aspect is that precise marks *do not matter* in
4102  * In the former case, precise markings in current state are completely
4104  * checkpointed ("old") state precise markings are important, and if old
4105  * state's register/slot is precise, regsafe() assumes current state's
4106  * register/slot as precise and checks value ranges exactly and precisely. If
4107  * states turn out to be compatible, current state's necessary precise
4108  * markings and any required parent states' precise markings are enforced
4111  * registers/slots as precise, we immediately discard current state. So what
4112  * actually matters is any of the precise markings propagated into current
4114  * As such, for scenario a) it doesn't matter if current state has precise
4119  * processed instruction always assumes precise SCALAR register/slot
4120  * knowledge: if precise value or range is useful to prune jump branch, BPF
4124  * what we mentioned above about state comparison ignoring precise markings
4125  * during state comparison, BPF verifier ignores and also assumes precise
4132  * is_state_visited() would enforce strict and precise SCALAR ranges, if
4147  * This also means that even if we needed precise SCALAR range to get to
4149  * never used in a precise context (i.e., it's precise value is not needed for
4151  * (i.e., precise marking set to false). This is what we rely on when we do
4152  * not set precise marking in current state. If no child state requires
4154  * be imprecise. If any child state does require this register to be precise,
4155  * we'll mark it precise later retroactively during precise markings
4158  * Skipping precise marking setting in current state is a mild version of
4160  * more aggressively by proactively forgetting any precise marking in the
4185 	 * slot, but don't set precise flag in current state, as precision
4211 		/* If some register with scalar ID is marked as precise,
4212 		 * make sure that all registers sharing this ID are also precise.
4239 			 * requested precise registers are R1-R5
4252 						reg->precise = true;
4313 				if (reg->precise)
4316 					reg->precise = true;
4333 				if (reg->precise)
4336 					reg->precise = true;
4358 	/* if we still have requested precise regs or slots, we missed
4360 	 * fallback to marking all precise
4596 			 * originating register to be precise to make
7928 	if (rold->precise || rcur->precise || regs_exact(rold, rcur, idmap))
8020  * imprecise scalar registers, if those registers were not precise at the
8025  * imprecise value on the first loop iteration and use it as precise on a second.
9930 		/* we are going to rely on register's precise value */
10435 		 * is finished, thus mark it precise.
14098 		} else if (dst_reg->precise) {
14099 			/* if dst_reg is precise, src_reg should be precise as well */
16731 		if (!rold->precise && exact == NOT_EXACT)
17169 /* find precise scalars in the previous equivalent state and
17186 			    !state_reg->precise ||
17204 			    !state_reg->precise ||
17619 	/* forget precise markings we inherited, see __mark_chain_precision */