Re: Self-XORing BPF registers is undefined behavior
From: Eric Dumazet <hidden>
Date: 2018-12-13 11:06:34
On 12/13/2018 03:00 AM, Alexander Potapenko wrote:
Hi BPF maintainers, some time ago KMSAN found an issue in BPF code which we decided to suppress at that point, but now I'd like to bring it to your attention. Namely, some BPF programs may contain instructions that XOR a register with itself. This effectively results in the following C code: regs[BPF_REG_A] = regs[BPF_REG_A] ^ regs[BPF_REG_A]; or regs[BPF_REG_X] = regs[BPF_REG_X] ^ regs[BPF_REG_X]; being executed. According to the C11 standard this is undefined behavior, so KMSAN reports an error in this case.
eBPF is not C11 ;) XOR boolean operation on a cpu is following boolean logic, which is much stronger than any C standard.
Do you think it's feasible to explicitly initialize the register values like it's done here: https://github.com/google/kmsan/commit/813c0f3d45ebfa321d70b4b06cc054518dd1d90d ? Thanks, Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Straße, 33 80636 München Geschäftsführer: Paul Manicle, Halimah DeLaine Prado Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg