函数逻辑报告

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\bpf\verifier.c Create Date:2022-07-27 14:14:31
Last Modify:2022-05-19 20:02:10 Copyright©Brick
首页 函数Tree
注解内核,赢得工具下载SCCTEnglish

函数名称：Handles arithmetic on a pointer and a scalar: computes new min/max and var_off.* Caller should also handle BPF_MOV case separately.* If we return -EACCES, caller may want to try again treating pointer as a* scalar

函数原型：static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, struct bpf_insn *insn, const struct bpf_reg_state *ptr_reg, const struct bpf_reg_state *off_reg)

返回类型：int

参数：

类型参数名称
struct bpf_verifier_env *env
struct bpf_insn *insn
const struct bpf_reg_state *ptr_reg
const struct bpf_reg_state *off_reg
4567  vstate等于current verifier state
4568  state等于 call stack tracking [curframe]
4569  regs等于regs
4570  known等于Returns true if @a is a known constant
4571  smin_val等于 minimum possible (s64)value , smax_val等于 maximum possible (s64)value , smin_ptr等于 minimum possible (s64)value , smax_ptr等于 maximum possible (s64)value
4573  umin_val等于 minimum possible (u64)value , umax_val等于 maximum possible (u64)value , umin_ptr等于 minimum possible (u64)value , umax_ptr等于 maximum possible (u64)value
4575  dst等于 dest register , src等于 source register
4576  opcode等于alu/jmp fields ( opcode )
4579  dst_reg等于regs[dst]
4581  如果known且smin_val不等于smax_val或umin_val不等于umax_val的值或smin_val大于smax_val或umin_val大于umax_val则
4586  Mark a register as having a completely unknown (scalar) value.
4587  返回:0
4590  如果Instruction classes ( opcode )不等于alu mode in double word width 则
4592  verbose(env, "R%d 32-bit pointer arithmetic prohibited\n", dst)
4595  返回:负EACCES
4599  当: Ordering of fields matters. See states_equal() 恒等于points to map elem value or NULL
4600  verbose(env, "R%d pointer arithmetic on %s prohibited, null-check it first\n", dst, string representation of 'enum bpf_reg_type' [ Ordering of fields matters. See states_equal() ])
4602  返回:负EACCES
4603  当: Ordering of fields matters. See states_equal() 恒等于g points to struct bpf_map
4604  当: Ordering of fields matters. See states_equal() 恒等于skb->data + headlen
4605  当: Ordering of fields matters. See states_equal() 恒等于g points to struct bpf_sock
4606  当: Ordering of fields matters. See states_equal() 恒等于g points to struct bpf_sock or NULL
4607  当: Ordering of fields matters. See states_equal() 恒等于g points to sock_common
4608  当: Ordering of fields matters. See states_equal() 恒等于g points to sock_common or NULL
4609  当: Ordering of fields matters. See states_equal() 恒等于g points to struct tcp_sock
4610  当: Ordering of fields matters. See states_equal() 恒等于g points to struct tcp_sock or NULL
4611  当: Ordering of fields matters. See states_equal() 恒等于g points to struct xdp_sock
4612  verbose(env, "R%d pointer arithmetic on %s prohibited\n", dst, string representation of 'enum bpf_reg_type' [ Ordering of fields matters. See states_equal() ])
4614  返回:负EACCES
4615  当: Ordering of fields matters. See states_equal() 恒等于g points to map element value
4616  如果非allow_ptr_leaks且非known且smin_val小于0不等于smax_val小于0则
4617  verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n", off_reg == dst_reg ? dst : src)
4619  返回:负EACCES
4622  默认
4623  退出
4629  Ordering of fields matters. See states_equal() 等于 Ordering of fields matters. See states_equal()
4630  For PTR_TO_PACKET, used to find other pointers with the same variable * offset, so they can share range knowledge. * For PTR_TO_MAP_VALUE_OR_NULL this is used to share which map value we * came from, when one is tested for != NULL. * For PTR_TO_SOCKET thi等于 For PTR_TO_PACKET, used to find other pointers with the same variable * offset, so they can share range knowledge. * For PTR_TO_MAP_VALUE_OR_NULL this is used to share which map value we * came from, when one is tested for != NULL. * For PTR_TO_SOCKET thi
4632  如果非check_reg_sane_offset(env, off_reg, Ordering of fields matters. See states_equal() )或非check_reg_sane_offset(env, ptr_reg, Ordering of fields matters. See states_equal() )则返回:负EINVAL
4637  当:opcode恒等于BPF_ADD
4638  ret等于sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0)
4639  如果ret小于0则
4640  verbose(env, "R%d tried to add from different maps or paths\n", dst)
4641  返回:ret
4646  如果known且 Fixed part of pointer offset, pointer types only 加smin_val恒等于 Fixed part of pointer offset, pointer types only 加smin_val则
4667  如果signed_add_overflows(smin_ptr, smin_val)或signed_add_overflows(smax_ptr, smax_val)则
4671  否则
4675  如果umin_ptr加umin_val小于umin_ptr或umax_ptr加umax_val小于umax_ptr则
4679  否则
4683  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us.等于Add two tnums, return @a + @b
4684  Fixed part of pointer offset, pointer types only 等于 Fixed part of pointer offset, pointer types only
4685  Max size from any of the above. 等于 Max size from any of the above.
4686  如果reg_is_pkt_pointer(ptr_reg)则
4691  退出
4692  当:opcode恒等于BPF_SUB
4693  ret等于sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0)
4694  如果ret小于0则
4695  verbose(env, "R%d tried to sub from different maps or paths\n", dst)
4696  返回:ret
4698  如果dst_reg恒等于off_reg则
4700  verbose(env, "R%d tried to subtract pointer from scalar\n", dst)
4702  返回:负EACCES
4708  如果 Ordering of fields matters. See states_equal() 恒等于g == frame_pointer + offset 则
4709  verbose(env, "R%d subtraction from stack pointer prohibited\n", dst)
4711  返回:负EACCES
4713  如果known且 Fixed part of pointer offset, pointer types only 减smin_val恒等于 Fixed part of pointer offset, pointer types only 减smin_val则
4729  如果signed_sub_overflows(smin_ptr, smax_val)或signed_sub_overflows(smax_ptr, smin_val)则
4734  否则
4738  如果umin_ptr小于umax_val则
4742  否则
4747  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us.等于Subtract two tnums, return @a - @b
4748  Fixed part of pointer offset, pointer types only 等于 Fixed part of pointer offset, pointer types only
4749  Max size from any of the above. 等于 Max size from any of the above.
4750  如果reg_is_pkt_pointer(ptr_reg)则
4756  退出
4757  当:opcode恒等于BPF_AND
4758  当:opcode恒等于BPF_OR
4759  当:opcode恒等于BPF_XOR
4761  verbose(env, "R%d bitwise operator %s on pointer prohibited\n", dst, bpf_alu_string[opcode >> 4])
4763  返回:负EACCES
4764  默认
4766  verbose(env, "R%d pointer arithmetic with %s operator prohibited\n", dst, bpf_alu_string[opcode >> 4])
4768  返回:负EACCES
4771  如果非check_reg_sane_offset(env, dst_reg, Ordering of fields matters. See states_equal() )则返回:负EINVAL
4774  Attempts to improve min/max values based on var_off information
4775  Uses signed min/max values to inform unsigned, and vice-versa
4776  Attempts to improve var_off based on unsigned min/max information
4781  如果非allow_ptr_leaks则
4782  如果 Ordering of fields matters. See states_equal() 恒等于g points to map element value 且heck read/write into a map element with possible variable offset 则
4784  verbose(env, "R%d pointer arithmetic of map value goes out of range, prohibited for !root\n", dst)
4786  返回:负EACCES
4787  否则如果 Ordering of fields matters. See states_equal() 恒等于g == frame_pointer + offset 且check_stack_access(env, dst_reg, Fixed part of pointer offset, pointer types only + value, 1)则
4790  verbose(env, "R%d stack pointer arithmetic goes out of range, prohibited for !root\n", dst)
4792  返回:负EACCES
4796  返回:0
调用者
名称描述
adjust_reg_min_max_valsHandles ALU ops other than BPF_END, BPF_NEG and BPF_MOV: computes new min/max* and var_off.