diff options
| -rw-r--r-- | include/linux/bpf_verifier.h | 1 | ||||
| -rw-r--r-- | kernel/bpf/loops.c | 19 |
2 files changed, 20 insertions, 0 deletions
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 7fb1e315de48..1458e50a1ad1 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -741,6 +741,7 @@ struct bpf_insn_aux_data { bool is_iter_next; /* bpf_iter_<type>_next() kfunc call */ bool call_with_percpu_alloc_ptr; /* {this,per}_cpu_ptr() with prog percpu alloc */ bool arena_scalar; /* ldx/stx/st/atomic through a number, it's an address in arena */ + bool bb_end; /* last instruction of a basic block */ u8 alu_state; /* used in combination with alu_limit */ /* true if STX or LDX instruction is a part of a spill/fill * pattern for a bpf_fastcall call. diff --git a/kernel/bpf/loops.c b/kernel/bpf/loops.c index 8a6dc805e559..2568079c2945 100644 --- a/kernel/bpf/loops.c +++ b/kernel/bpf/loops.c @@ -5,8 +5,23 @@ #include <linux/sched/signal.h> #include <linux/bpf_verifier.h> +static bool is_cfg_jump(struct bpf_insn *insn) +{ + u8 class = BPF_CLASS(insn->code); + u8 opcode = BPF_OP(insn->code); + + switch (class) { + case BPF_JMP: + case BPF_JMP32: + return opcode != BPF_CALL; + default: + return false; + } +} + static struct bpf_iarray **compute_predecessors(struct bpf_verifier_env *env) { + struct bpf_insn_aux_data *aux = env->insn_aux_data; struct bpf_iarray *succ, *preds, **result; struct bpf_prog *prog = env->prog; u32 *num_preds, i, s, len = prog->len; @@ -54,6 +69,10 @@ static struct bpf_iarray **compute_predecessors(struct bpf_verifier_env *env) preds = result[s]; preds->items[preds->cnt++] = i; } + if (succ->cnt > 1 || + (succ->cnt == 1 && num_preds[succ->items[0]] > 1) || + is_cfg_jump(insn)) + aux[i].bb_end = true; if (bpf_is_ldimm64(insn)) i++; } |