bpf: handle ldimm64 properly in check_cfg()
authorAndrii Nakryiko <andrii@kernel.org>
Fri, 10 Nov 2023 00:26:36 +0000 (16:26 -0800)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 10 Nov 2023 04:11:20 +0000 (20:11 -0800)
commit3feb263bb516ee7e1da0acd22b15afbb9a7daa19
treeb29c0f1447aad1aca146c40769a05a39d420d71a
parentfe69a1b1b6ed9ffc2c578c63f526026a8ab74f0c
bpf: handle ldimm64 properly in check_cfg()

ldimm64 instructions are 16-byte long, and so have to be handled
appropriately in check_cfg(), just like the rest of BPF verifier does.

This has implications in three places:
  - when determining next instruction for non-jump instructions;
  - when determining next instruction for callback address ldimm64
    instructions (in visit_func_call_insn());
  - when checking for unreachable instructions, where second half of
    ldimm64 is expected to be unreachable;

We take this also as an opportunity to report jump into the middle of
ldimm64. And adjust few test_verifier tests accordingly.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Reported-by: Hao Sun <sunhao.th@gmail.com>
Fixes: 475fb78fbf48 ("bpf: verifier (add branch/goto checks)")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231110002638.4168352-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
include/linux/bpf.h
kernel/bpf/verifier.c
tools/testing/selftests/bpf/verifier/ld_imm64.c