diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2025-11-19 17:03:54 +0100 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-11-21 17:45:30 -0800 |
| commit | e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd (patch) | |
| tree | ee388231d3516c87fe8bae96623e6b4756537c6c /kernel/bpf/liveness.c | |
| parent | 978da762ea4517da1f4c270eb95bc289f81c176a (diff) | |
bpf: correct stack liveness for tail calls
This updates bpf_insn_successors() reflecting that control flow might
jump over the instructions between tail call and function exit, verifier
might assume that some writes to parent stack always happen, which is
not the case.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Martin Teichmann <martin.teichmann@xfel.eu>
Link: https://lore.kernel.org/r/20251119160355.1160932-4-martin.teichmann@xfel.eu
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/bpf/liveness.c')
| -rw-r--r-- | kernel/bpf/liveness.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c index a7240013fd9d..60db5d655495 100644 --- a/kernel/bpf/liveness.c +++ b/kernel/bpf/liveness.c @@ -482,11 +482,12 @@ bpf_insn_successors(struct bpf_verifier_env *env, u32 idx) struct bpf_prog *prog = env->prog; struct bpf_insn *insn = &prog->insnsi[idx]; const struct opcode_info *opcode_info; - struct bpf_iarray *succ; + struct bpf_iarray *succ, *jt; int insn_sz; - if (unlikely(insn_is_gotox(insn))) - return env->insn_aux_data[idx].jt; + jt = env->insn_aux_data[idx].jt; + if (unlikely(jt)) + return jt; /* pre-allocated array of size up to 2; reset cnt, as it may have been used already */ succ = env->succ; |