A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

UPSTREAM: Revert "bpf: fix buggy r0 retval refinement for tracing helpers"

Browse source 
This reverts commit 3bd5bcafbb.

Change-Id: I23fb443c79c8133f20a856246a6c81d7cff49ace
This commit is contained in:
basamaryan 2025-11-16 22:41:29 -08:00
commit b9ae810097
No known key found for this signature in database
GPG key ID: 210D5384FB2A5885
1 changed files with 11 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

45
kernel/bpf/verifier.c
View file

@ -229,7 +229,8 @@ struct bpf_call_arg_meta {
bool pkt_access;
int regno;
int access_size;
u64 msize_max_value;
s64 msize_smax_value;
u64 msize_umax_value;
int ref_obj_id;
int func_id;
u32 btf_id;
@ -3610,7 +3611,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
/* remember the mem_size which may be used later
* to refine return values.
*/
meta->msize_max_value = reg->umax_value;
meta->msize_smax_value = reg->smax_value;
meta->msize_umax_value = reg->umax_value;
/* The register is SCALAR_VALUE; the access check
* happens using its boundaries.
@ -4142,44 +4144,21 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
return 0;
}
static int do_refine_retval_range(struct bpf_verifier_env *env,
struct bpf_reg_state *regs, int ret_type,
int func_id, struct bpf_call_arg_meta *meta)
static void do_refine_retval_range(struct bpf_reg_state *regs, int ret_type,
int func_id,
struct bpf_call_arg_meta *meta)
{
struct bpf_reg_state *ret_reg = &regs[BPF_REG_0];
struct bpf_reg_state tmp_reg = *ret_reg;
bool ret;
if (ret_type != RET_INTEGER ||
(func_id != BPF_FUNC_get_stack &&
func_id != BPF_FUNC_probe_read_str))
return 0;
/* Error case where ret is in interval [S32MIN, -1]. */
ret_reg->smin_value = S32_MIN;
ret_reg->smax_value = -1;
return;
ret_reg->smax_value = meta->msize_smax_value;
ret_reg->umax_value = meta->msize_umax_value;
__reg_deduce_bounds(ret_reg);
__reg_bound_offset(ret_reg);
__update_reg_bounds(ret_reg);
ret = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
if (!ret)
return -EFAULT;
*ret_reg = tmp_reg;
/* Success case where ret is in range [0, msize_max_value]. */
ret_reg->smin_value = 0;
ret_reg->smax_value = meta->msize_max_value;
ret_reg->umin_value = ret_reg->smin_value;
ret_reg->umax_value = ret_reg->smax_value;
__reg_deduce_bounds(ret_reg);
__reg_bound_offset(ret_reg);
__update_reg_bounds(ret_reg);
return 0;
}
static int
@ -4447,9 +4426,7 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
regs[BPF_REG_0].ref_obj_id = id;
}
err = do_refine_retval_range(env, regs, fn->ret_type, func_id, &meta);
if (err)
return err;
do_refine_retval_range(regs, fn->ret_type, func_id, &meta);
err = check_map_func_compatibility(env, meta.map_ptr, func_id);
if (err)