When windening SCEV expressions like *fp-8 -> (any *fp-8 *fp-16), fp-8 might be not yet allocated. Expose a utility function such that widening logic can handle this. Signed-off-by: Eduard Zingerman --- include/linux/bpf_verifier.h | 3 ++- kernel/bpf/verifier.c | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 5ec9495d42b1..ab86b75888c3 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -522,7 +522,7 @@ static inline u32 bpf_stack_nr_slots(const struct bpf_func_state *frame) /* * Stack slot @spi of @frame, covering bytes [fp - (spi + 1) * 8, fp - spi * 8). - * The caller must ensure spi < bpf_stack_nr_slots(frame), see grow_stack_state(). + * The caller must ensure spi < bpf_stack_nr_slots(frame), see bpf_grow_stack_state(). */ static inline struct bpf_stack_state *bpf_stack_slot(const struct bpf_func_state *frame, u32 spi) { @@ -1297,6 +1297,7 @@ void bpf_bt_sync_linked_regs(struct backtrack_state *bt, struct bpf_jmp_history_ void bpf_mark_reg_not_init(const struct bpf_verifier_env *env, struct bpf_reg_state *reg); void bpf_mark_reg_unknown_imprecise(struct bpf_reg_state *reg); +int bpf_grow_stack_state(struct bpf_verifier_env *env, struct bpf_func_state *state, int size); void bpf_mark_all_scalars_precise(struct bpf_verifier_env *env, struct bpf_verifier_state *st); void bpf_clear_singular_ids(struct bpf_verifier_env *env, struct bpf_verifier_state *st); diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e317cdae749e..47a632a6749a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1456,7 +1456,7 @@ static int resize_reference_state(struct bpf_verifier_state *state, size_t n) /* Possibly update state->allocated_stack to be at least size bytes. Also * possibly update the function's high-water mark in its bpf_subprog_info. */ -static int grow_stack_state(struct bpf_verifier_env *env, struct bpf_func_state *state, int size) +int bpf_grow_stack_state(struct bpf_verifier_env *env, struct bpf_func_state *state, int size) { size_t old_n = bpf_stack_nr_slots(state), n; @@ -6705,7 +6705,7 @@ static int check_stack_access_within_bounds( /* Note that there is no stack access with offset zero, so the needed stack * size is -min_off, not -min_off+1. */ - return grow_stack_state(env, state, -min_off /* size */); + return bpf_grow_stack_state(env, state, -min_off /* size */); } static bool get_func_retval_range(struct bpf_prog *prog, -- 2.53.0