diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-10-13 23:24:36 -0700 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-10-15 00:23:19 +0200 |
| commit | e980770b431a7d459da4eca37c0300ca07058e54 (patch) | |
| tree | 515238775253983cc16761a0bedc380a2e727e8b /kernel/fail_function.c | |
| parent | 201a454df948021916e051b0a84a674f4f0f9671 (diff) | |
bpf: More precise stack liveness effects for global func params
The following types can be returned by the btf_prepare_func_args():
- ARG_PTR_TO_CTX
- ARG_PTR_TO_BTF_ID (+ flags)
- ARG_PTR_TO_MEM (+ flags)
- ARG_PTR_TO_ARENA
- ARG_PTR_TO_DYNPTR
- ARG_SCALAR
Of these, valid programs can pass frame pointer only as
ARG_PTR_TO_{MEM,BTF_ID,DYNPTR}. Additionally, pointer arithmetic
allows the following trick:
0: (bf) r1 = r10
1: (07) r1 += -8
2: (1f) r1 -= r10
3: (85) call pc+1 // r1=fp0 ?
4: (95) exit
This commit changes bpf_global_subprog_stack_access_bytes() to handle
ARG_SCALAR and ARG_PTR_TO_DYNPTR, thus addressing the full set of
possible returned values.
Fixes: 8212c1c2986d ("bpf: Derive global subprog stack liveness from BTF signatures")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-1-6d9d61965486@gmail.com
Diffstat (limited to 'kernel/fail_function.c')
0 files changed, 0 insertions, 0 deletions