diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-10-09 03:47:50 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-09 20:29:14 +0000 |
| commit | 60b0109ad195c8b131224cfe66cbd6277c8d47b4 (patch) | |
| tree | 92b1c080474b456cda155ea24ae46fa83a8eb7c4 /kernel | |
| parent | 2fa579694ddf3a96454669c764ca0c06dea50817 (diff) | |
bpf: Allow precision backtracking between overlapping checkpoints
SCEV integration logic might create two consecutive checkpoints at the
same instruction w/o processing any instructions in between.
This happens for loop-entry checkpoint -> regular checkpoint
sequences, where the loop-entry checkpoint has to remain unchanged
but the regular checkpoint is used for widening.
This commit adapts bpf_mark_chain_precision() to support this.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261009-scev-minimal-rebase-v3-32-bcba9bc53ac9@gmail.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/backtrack.c | 5 | ||||
| -rw-r--r-- | kernel/bpf/states.c | 1 |
2 files changed, 6 insertions, 0 deletions
diff --git a/kernel/bpf/backtrack.c b/kernel/bpf/backtrack.c index 0e38b9575328..43d5740034c0 100644 --- a/kernel/bpf/backtrack.c +++ b/kernel/bpf/backtrack.c @@ -888,6 +888,10 @@ int bpf_mark_chain_precision(struct bpf_verifier_env *env, } if (last_idx < 0) { + /* Consecutive checkpoints can have no instructions between them. */ + if (st->parent) + goto parent; + /* we are at the entry into subprog, which * is expected for global funcs, but only if * requested precise registers are R1-R5 @@ -952,6 +956,7 @@ int bpf_mark_chain_precision(struct bpf_verifier_env *env, return -EFAULT; } } +parent: st = st->parent; if (!st) break; diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c index b1e2daefc264..470bff8d8dc8 100644 --- a/kernel/bpf/states.c +++ b/kernel/bpf/states.c @@ -1306,6 +1306,7 @@ int bpf_split_cur_state(struct bpf_verifier_env *env) } cur->parent = new; + cur->last_insn_idx = -1; cur->first_insn_idx = insn_idx; cur->dfs_depth = new->dfs_depth + 1; bpf_clear_jmp_history(cur); |