From b9ae810097f4416bafaff072459638944c674c6f Mon Sep 17 00:00:00 2001 From: basamaryan Date: Sun, 16 Nov 2025 22:41:29 -0800 Subject: [PATCH] UPSTREAM: Revert "bpf: fix buggy r0 retval refinement for tracing helpers" This reverts commit 3bd5bcafbbf3af6795575aab544783cda8ea3907. Change-Id: I23fb443c79c8133f20a856246a6c81d7cff49ace --- kernel/bpf/verifier.c | 45 +++++++++++-------------------------------- 1 file changed, 11 insertions(+), 34 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 8aee0ba4004c..555685c3974e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -229,7 +229,8 @@ struct bpf_call_arg_meta { bool pkt_access; int regno; int access_size; - u64 msize_max_value; + s64 msize_smax_value; + u64 msize_umax_value; int ref_obj_id; int func_id; u32 btf_id; @@ -3610,7 +3611,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, /* remember the mem_size which may be used later * to refine return values. */ - meta->msize_max_value = reg->umax_value; + meta->msize_smax_value = reg->smax_value; + meta->msize_umax_value = reg->umax_value; /* The register is SCALAR_VALUE; the access check * happens using its boundaries. @@ -4142,44 +4144,21 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) return 0; } -static int do_refine_retval_range(struct bpf_verifier_env *env, - struct bpf_reg_state *regs, int ret_type, - int func_id, struct bpf_call_arg_meta *meta) +static void do_refine_retval_range(struct bpf_reg_state *regs, int ret_type, + int func_id, + struct bpf_call_arg_meta *meta) { struct bpf_reg_state *ret_reg = ®s[BPF_REG_0]; - struct bpf_reg_state tmp_reg = *ret_reg; - bool ret; if (ret_type != RET_INTEGER || (func_id != BPF_FUNC_get_stack && func_id != BPF_FUNC_probe_read_str)) - return 0; - - /* Error case where ret is in interval [S32MIN, -1]. */ - ret_reg->smin_value = S32_MIN; - ret_reg->smax_value = -1; + return; + ret_reg->smax_value = meta->msize_smax_value; + ret_reg->umax_value = meta->msize_umax_value; __reg_deduce_bounds(ret_reg); __reg_bound_offset(ret_reg); - __update_reg_bounds(ret_reg); - - ret = push_stack(env, env->insn_idx + 1, env->insn_idx, false); - if (!ret) - return -EFAULT; - - *ret_reg = tmp_reg; - - /* Success case where ret is in range [0, msize_max_value]. */ - ret_reg->smin_value = 0; - ret_reg->smax_value = meta->msize_max_value; - ret_reg->umin_value = ret_reg->smin_value; - ret_reg->umax_value = ret_reg->smax_value; - - __reg_deduce_bounds(ret_reg); - __reg_bound_offset(ret_reg); - __update_reg_bounds(ret_reg); - - return 0; } static int @@ -4447,9 +4426,7 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn regs[BPF_REG_0].ref_obj_id = id; } - err = do_refine_retval_range(env, regs, fn->ret_type, func_id, &meta); - if (err) - return err; + do_refine_retval_range(regs, fn->ret_type, func_id, &meta); err = check_map_func_compatibility(env, meta.map_ptr, func_id); if (err)