On 31/07/18 18:17, Arthur Fabre wrote:

When check_alu_op() handles a BPF_MOV64 between two registers,
it calls check_reg_arg(DST_OP) on the dst register, marking it as unbounded.
If the src and dst register are the same, this marks the src as
unbounded, which can lead to unexpected errors for further checks that
rely on bounds info. For example:

	BPF_MOV64_IMM(BPF_REG_2, 0),
	BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
	BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
	BPF_MOV64_IMM(BPF_REG_0, 0),
	BPF_EXIT_INSN(),

results in:

	"math between ctx pointer and register with unbounded min value is not
        allowed"

check_alu_op() now uses check_reg_arg(DST_OP_NO_MARK), and MOVs
that need to mark the dst register (MOVIMM, MOV32) do so.

Added a test case for MOV64 dst == src, and dst != src.

Signed-off-by: Arthur Fabre <redacted>
---
v2: Add mov64 tests, always use DST_OP_NO_MARK

 kernel/bpf/verifier.c                       |  6 +++--
 tools/testing/selftests/bpf/test_verifier.c | 26 +++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

Acked-by: Edward Cree <redacted>