kernel/bpf/verifier.c

14451  * <reg1> <op> <reg2>, currently assuming reg2 is a constant
14453 static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
14457 	struct tnum t2 = is_jmp32 ? tnum_subreg(reg2->var_off) : reg2->var_off;
14462 	u64 umin2 = is_jmp32 ? (u64)reg2->u32_min_value : reg2->umin_value;
14463 	u64 umax2 = is_jmp32 ? (u64)reg2->u32_max_value : reg2->umax_value;
14464 	s64 smin2 = is_jmp32 ? (s64)reg2->s32_min_value : reg2->smin_value;
14465 	s64 smax2 = is_jmp32 ? (s64)reg2->s32_max_value : reg2->smax_value;
14484 			if (reg1->u32_min_value > reg2->u32_max_value ||
14485 			    reg1->u32_max_value < reg2->u32_min_value)
14487 			if (reg1->s32_min_value > reg2->s32_max_value ||
14488 			    reg1->s32_max_value < reg2->s32_min_value)
14508 			if (reg1->u32_min_value > reg2->u32_max_value ||
14509 			    reg1->u32_max_value < reg2->u32_min_value)
14511 			if (reg1->s32_min_value > reg2->s32_max_value ||
14512 			    reg1->s32_max_value < reg2->s32_min_value)
14517 		if (!is_reg_const(reg2, is_jmp32)) {
14518 			swap(reg1, reg2);
14521 		if (!is_reg_const(reg2, is_jmp32))
14642 /* compute branch direction of the expression "if (<reg1> opcode <reg2>) goto target;"
14649 static int is_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
14652 	if (reg_is_pkt_pointer_any(reg1) && reg_is_pkt_pointer_any(reg2) && !is_jmp32)
14653 		return is_pkt_ptr_branch_taken(reg1, reg2, opcode);
14655 	if (__is_pointer_value(false, reg1) || __is_pointer_value(false, reg2)) {
14658 		/* arrange that reg2 is a scalar, and reg1 is a pointer */
14659 		if (!is_reg_const(reg2, is_jmp32)) {
14661 			swap(reg1, reg2);
14663 		/* and ensure that reg2 is a constant */
14664 		if (!is_reg_const(reg2, is_jmp32))
14673 		val = reg_const_value(reg2, is_jmp32);
14688 	return is_scalar_branch_taken(reg1, reg2, opcode, is_jmp32);
14717 static void regs_refine_cond_op(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
14730 		swap(reg1, reg2);
14739 			reg1->u32_min_value = max(reg1->u32_min_value, reg2->u32_min_value);
14740 			reg1->u32_max_value = min(reg1->u32_max_value, reg2->u32_max_value);
14741 			reg1->s32_min_value = max(reg1->s32_min_value, reg2->s32_min_value);
14742 			reg1->s32_max_value = min(reg1->s32_max_value, reg2->s32_max_value);
14743 			reg2->u32_min_value = reg1->u32_min_value;
14744 			reg2->u32_max_value = reg1->u32_max_value;
14745 			reg2->s32_min_value = reg1->s32_min_value;
14746 			reg2->s32_max_value = reg1->s32_max_value;
14748 			t = tnum_intersect(tnum_subreg(reg1->var_off), tnum_subreg(reg2->var_off));
14750 			reg2->var_off = tnum_with_subreg(reg2->var_off, t);
14752 			reg1->umin_value = max(reg1->umin_value, reg2->umin_value);
14753 			reg1->umax_value = min(reg1->umax_value, reg2->umax_value);
14754 			reg1->smin_value = max(reg1->smin_value, reg2->smin_value);
14755 			reg1->smax_value = min(reg1->smax_value, reg2->smax_value);
14756 			reg2->umin_value = reg1->umin_value;
14757 			reg2->umax_value = reg1->umax_value;
14758 			reg2->smin_value = reg1->smin_value;
14759 			reg2->smax_value = reg1->smax_value;
14761 			reg1->var_off = tnum_intersect(reg1->var_off, reg2->var_off);
14762 			reg2->var_off = reg1->var_off;
14766 		if (!is_reg_const(reg2, is_jmp32))
14767 			swap(reg1, reg2);
14768 		if (!is_reg_const(reg2, is_jmp32))
14771 		/* try to recompute the bound of reg1 if reg2 is a const and
14774 		val = reg_const_value(reg2, is_jmp32);
14778 			 * in such a case both reg1 and reg2 would be constants,
14805 		if (!is_reg_const(reg2, is_jmp32))
14806 			swap(reg1, reg2);
14807 		if (!is_reg_const(reg2, is_jmp32))
14809 		val = reg_const_value(reg2, is_jmp32);
14830 		if (!is_reg_const(reg2, is_jmp32))
14831 			swap(reg1, reg2);
14832 		if (!is_reg_const(reg2, is_jmp32))
14834 		val = reg_const_value(reg2, is_jmp32);
14844 			reg1->u32_max_value = min(reg1->u32_max_value, reg2->u32_max_value);
14845 			reg2->u32_min_value = max(reg1->u32_min_value, reg2->u32_min_value);
14847 			reg1->umax_value = min(reg1->umax_value, reg2->umax_value);
14848 			reg2->umin_value = max(reg1->umin_value, reg2->umin_value);
14853 			reg1->u32_max_value = min(reg1->u32_max_value, reg2->u32_max_value - 1);
14854 			reg2->u32_min_value = max(reg1->u32_min_value + 1, reg2->u32_min_value);
14856 			reg1->umax_value = min(reg1->umax_value, reg2->umax_value - 1);
14857 			reg2->umin_value = max(reg1->umin_value + 1, reg2->umin_value);
14862 			reg1->s32_max_value = min(reg1->s32_max_value, reg2->s32_max_value);
14863 			reg2->s32_min_value = max(reg1->s32_min_value, reg2->s32_min_value);
14865 			reg1->smax_value = min(reg1->smax_value, reg2->smax_value);
14866 			reg2->smin_value = max(reg1->smin_value, reg2->smin_value);
14871 			reg1->s32_max_value = min(reg1->s32_max_value, reg2->s32_max_value - 1);
14872 			reg2->s32_min_value = max(reg1->s32_min_value + 1, reg2->s32_min_value);
14874 			reg1->smax_value = min(reg1->smax_value, reg2->smax_value - 1);
14875 			reg2->smin_value = max(reg1->smin_value + 1, reg2->smin_value);