bpf: Preserve boundaries and track scalars on narrowing fill
authorMaxim Mikityanskiy <maxim@isovalent.com>
Sat, 27 Jan 2024 17:52:34 +0000 (19:52 +0200)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 2 Feb 2024 21:22:14 +0000 (13:22 -0800)
commitc1e6148cb4f83cec841db1f066e8db4a86c1f118
treed27fac029e258f1f529907e0c05ab9ce458ee021
parent6be503cec6c9bccd64f72c03697011d2e2b96fc3
bpf: Preserve boundaries and track scalars on narrowing fill

When the width of a fill is smaller than the width of the preceding
spill, the information about scalar boundaries can still be preserved,
as long as it's coerced to the right width (done by coerce_reg_to_size).
Even further, if the actual value fits into the fill width, the ID can
be preserved as well for further tracking of equal scalars.

Implement the above improvements, which makes narrowing fills behave the
same as narrowing spills and MOVs between registers.

Two tests are adjusted to accommodate for endianness differences and to
take into account that it's now allowed to do a narrowing fill from the
least significant bits.

reg_bounds_sync is added to coerce_reg_to_size to correctly adjust
umin/umax boundaries after the var_off truncation, for example, a 64-bit
value 0xXXXXXXXX00000000, when read as a 32-bit, gets umin = 0, umax =
0xFFFFFFFF, var_off = (0x0; 0xffffffff00000000), which needs to be
synced down to umax = 0, otherwise reg_bounds_sanity_check doesn't pass.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20240127175237.526726-4-maxtram95@gmail.com
include/linux/bpf_verifier.h
kernel/bpf/verifier.c
tools/testing/selftests/bpf/progs/verifier_spill_fill.c