Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\bpf\verifier.c Create Date:2022-07-28 13:00:46
Last Modify:2022-05-19 20:02:10 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:WARNING: This function does calculations on 64-bit values, but the actual* execution may occur on 32-bit values. Therefore, things like bitshifts* need extra checks in the 32-bit case.

Proto:static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, struct bpf_insn *insn, struct bpf_reg_state *dst_reg, struct bpf_reg_state src_reg)

Type:int

Parameter:

TypeParameterName
struct bpf_verifier_env *env
struct bpf_insn *insn
struct bpf_reg_state *dst_reg
struct bpf_reg_statesrc_reg
4808  regs = cur_regs(env)
4809  opcode = alu/jmp fields ( opcode )
4813  insn_bitness = If Instruction classes ( opcode ) == alu mode in double word width Then 64 Else 32
4814  dst = dest register
4817  If insn_bitness == 32 Then
4822  runcate register to smaller size (in bytes)* must be called with size < BPF_REG_SIZE
4823  runcate register to smaller size (in bytes)* must be called with size < BPF_REG_SIZE
4826  smin_val = minimum possible (s64)value
4827  smax_val = maximum possible (s64)value
4828  umin_val = minimum possible (u64)value
4829  umax_val = maximum possible (u64)value
4830  src_known = Returns true if @a is a known constant
4831  dst_known = Returns true if @a is a known constant
4833  If src_known && ( smin_val != smax_val || umin_val != umax_val ) || smin_val > smax_val || umin_val > umax_val Then
4838  Mark a register as having a completely unknown (scalar) value.
4839  Return 0
4842  If Not src_known && opcode != BPF_ADD && opcode != BPF_SUB && opcode != BPF_AND Then
4844  Mark a register as having a completely unknown (scalar) value.
4845  Return 0
4849  Case opcode == BPF_ADD
4850  ret = sanitize_val_alu(env, insn)
4851  If ret < 0 Then
4852  verbose(env, "R%d tried to add from different pointers or scalars\n", dst)
4853  Return ret
4855  If signed_add_overflows( minimum possible (s64)value , smin_val) || signed_add_overflows( maximum possible (s64)value , smax_val) Then
4859  Else
4863  If minimum possible (u64)value + umin_val < umin_val || maximum possible (u64)value + umax_val < umax_val Then
4867  Else
4871  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Add two tnums, return @a + @b
4872  Break
4873  Case opcode == BPF_SUB
4874  ret = sanitize_val_alu(env, insn)
4875  If ret < 0 Then
4876  verbose(env, "R%d tried to sub from different pointers or scalars\n", dst)
4877  Return ret
4879  If signed_sub_overflows( minimum possible (s64)value , smax_val) || signed_sub_overflows( maximum possible (s64)value , smin_val) Then
4884  Else
4888  If minimum possible (u64)value < umax_val Then
4892  Else
4897  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Subtract two tnums, return @a - @b
4898  Break
4899  Case opcode == BPF_MUL
4900  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Multiply two tnums, return @a *@b
4901  If smin_val < 0 || minimum possible (s64)value < 0 Then
4910  If umax_val > U32_MAX || maximum possible (u64)value > U32_MAX Then
4917  minimum possible (u64)value *= umin_val
4918  maximum possible (u64)value *= umax_val
4919  If maximum possible (u64)value > S64_MAX Then
4923  Else
4927  Break
4928  Case opcode == BPF_AND
4929  If src_known && dst_known Then
4937  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Bitwise-AND, return @a & @b
4938  minimum possible (u64)value = value
4939  maximum possible (u64)value = min - return minimum of two values of the same or compatible types*@x: first value*@y: second value( maximum possible (u64)value , umax_val)
4940  If minimum possible (s64)value < 0 || smin_val < 0 Then
4946  Else
4954  Attempts to improve min/max values based on var_off information
4955  Break
4956  Case opcode == BPF_OR
4957  If src_known && dst_known Then
4965  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Bitwise-OR, return @a | @b
4966  minimum possible (u64)value = max - return maximum of two values of the same or compatible types*@x: first value*@y: second value( minimum possible (u64)value , umin_val)
4967  maximum possible (u64)value = value | mask
4969  If minimum possible (s64)value < 0 || smin_val < 0 Then
4975  Else
4983  Attempts to improve min/max values based on var_off information
4984  Break
4985  Case opcode == BPF_LSH
4986  If umax_val >= insn_bitness Then
4990  mark_reg_unknown(env, regs, dest register )
4991  Break
4996  minimum possible (s64)value = S64_MIN
4997  maximum possible (s64)value = S64_MAX
4999  If maximum possible (u64)value > 1ULL << 63 - umax_val Then
5002  Else
5006  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Shift a tnum left (by a fixed shift)
5008  Attempts to improve min/max values based on var_off information
5009  Break
5010  Case opcode == BPF_RSH
5011  If umax_val >= insn_bitness Then
5015  mark_reg_unknown(env, regs, dest register )
5016  Break
5032  minimum possible (s64)value = S64_MIN
5033  maximum possible (s64)value = S64_MAX
5034  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Shift (rsh) a tnum right (by a fixed shift)
5035  minimum possible (u64)value >>= umax_val
5036  maximum possible (u64)value >>= umin_val
5038  Attempts to improve min/max values based on var_off information
5039  Break
5040  Case opcode == sign extending arithmetic shift right
5041  If umax_val >= insn_bitness Then
5045  mark_reg_unknown(env, regs, dest register )
5046  Break
5052  If insn_bitness == 32 Then
5055  Else
5060  For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset * from the pointed-to object, and is shared with all bpf_reg_states * with the same id as us. = Shift (arsh) a tnum right (by a fixed min_shift)
5066  minimum possible (u64)value = 0
5067  maximum possible (u64)value = U64_MAX
5068  Attempts to improve min/max values based on var_off information
5069  Break
5070  Default
5071  mark_reg_unknown(env, regs, dest register )
5072  Break
5075  If Instruction classes ( opcode ) != alu mode in double word width Then
5077  runcate register to smaller size (in bytes)* must be called with size < BPF_REG_SIZE
5080  Uses signed min/max values to inform unsigned, and vice-versa
5081  Attempts to improve var_off based on unsigned min/max information
5082  Return 0
Caller
NameDescribe
adjust_reg_min_max_valsHandles ALU ops other than BPF_END, BPF_NEG and BPF_MOV: computes new min/max* and var_off.