SCEV integration logic might create two consecutive checkpoints at the same instruction w/o processing any instructions in between. This happens for loop-entry checkpoint -> regular checkpoint sequences, where the loop-entry checkpoint has to remain unchanged but the regular checkpoint is used for widening. This commit adapts bpf_mark_chain_precision() to support this. Signed-off-by: Eduard Zingerman --- include/linux/bpf_verifier.h | 5 ++++- kernel/bpf/backtrack.c | 5 +++++ kernel/bpf/states.c | 1 + 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 7e858bb05dd1..c0ed92a632d1 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -502,7 +502,10 @@ struct bpf_verifier_state { bool speculative; bool in_sleepable; - /* first and last insn idx of this verifier state */ + /* + * First and last insn idx of this verifier state. + * last_insn_idx is -1 if no instructions have been executed yet. + */ u32 first_insn_idx; u32 last_insn_idx; /* if this state is a backedge state then equal_state diff --git a/kernel/bpf/backtrack.c b/kernel/bpf/backtrack.c index 0e38b9575328..43d5740034c0 100644 --- a/kernel/bpf/backtrack.c +++ b/kernel/bpf/backtrack.c @@ -888,6 +888,10 @@ int bpf_mark_chain_precision(struct bpf_verifier_env *env, } if (last_idx < 0) { + /* Consecutive checkpoints can have no instructions between them. */ + if (st->parent) + goto parent; + /* we are at the entry into subprog, which * is expected for global funcs, but only if * requested precise registers are R1-R5 @@ -952,6 +956,7 @@ int bpf_mark_chain_precision(struct bpf_verifier_env *env, return -EFAULT; } } +parent: st = st->parent; if (!st) break; diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c index b1e2daefc264..470bff8d8dc8 100644 --- a/kernel/bpf/states.c +++ b/kernel/bpf/states.c @@ -1306,6 +1306,7 @@ int bpf_split_cur_state(struct bpf_verifier_env *env) } cur->parent = new; + cur->last_insn_idx = -1; cur->first_insn_idx = insn_idx; cur->dfs_depth = new->dfs_depth + 1; bpf_clear_jmp_history(cur); -- 2.53.0