mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 13:23:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Inline bpf_iter_num_new() kfunc

Browse Source 
bpf_for() expands to the bpf_iter_num_{new,next,destroy}() kfuncs, which
the verifier emits as regular calls. They are tiny and only touch the
8-byte on-stack iterator state, so open-code them in bpf_fixup_kfunc_call()
like the other special kfuncs there.

Start with bpf_iter_num_new(): R1 points to the iterator, R2/R3 hold
start/end. The inlined sequence mirrors the kfunc and returns the same
-EINVAL / -E2BIG / 0.

start > end is rejected first, so end - start fits in a u32; range-check
it as u32 on both sides ((u32)(end - start) in the kfunc). A movsx-based
check would emit a cpuv4 instruction that some JITs (x86-32, mips32,
sparc64) decode as a plain move and get wrong.

The emitted instructions are plain BPF, so the interpreter path stays
correct and no jit_required marking is needed.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260804134601.2305303-3-puranjay@kernel.org
This commit is contained in:
Puranjay Mohan
2026-08-04 06:45:54 -07:00
committed by Andrii Nakryiko
parent 8efd87051c
commit f8f2b567d5
2 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/bpf/bpf_iter.c
View File

@@ -782,8 +782,8 @@ __bpf_kfunc int bpf_iter_num_new(struct bpf_iter_num *it, int start, int end)
return -EINVAL;
}
/* avoid overflows, e.g., if start == INT_MIN and end == INT_MAX */
if ((s64)end - (s64)start > BPF_MAX_LOOPS) {
/* start <= end here, so end - start fits in a u32 without overflow */
if ((u32)(end - start) > BPF_MAX_LOOPS) {
s->cur = s->end = 0;
return -E2BIG;
}

24
kernel/bpf/verifier.c
View File

@@ -20006,6 +20006,30 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
insn_buf[4] = BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1);
insn_buf[5] = BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0);
*cnt = 6;
} else if (desc->func_id == special_kfunc_list[KF_bpf_iter_num_new]) {
/* inline bpf_iter_num_new(&it, start, end); R1=&it, R2=start, R3=end */
int i = 0;
/* if (start > end) goto einval; */
insn_buf[i++] = BPF_JMP32_REG(BPF_JSGT, BPF_REG_2, BPF_REG_3, 8);
/* r0 = (u32)end - (u32)start; if (r0 > BPF_MAX_LOOPS) goto e2big; */
insn_buf[i++] = BPF_MOV32_REG(BPF_REG_0, BPF_REG_3);
insn_buf[i++] = BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_2);
insn_buf[i++] = BPF_JMP_IMM(BPF_JGT, BPF_REG_0, BPF_MAX_LOOPS, 8);
/* s->cur = start - 1; s->end = end; return 0; */
insn_buf[i++] = BPF_ALU32_IMM(BPF_ADD, BPF_REG_2, -1);
insn_buf[i++] = BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2, 0);
insn_buf[i++] = BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, 4);
insn_buf[i++] = BPF_MOV64_IMM(BPF_REG_0, 0);
insn_buf[i++] = BPF_JMP_A(5);
/* einval: s->cur = s->end = 0; return -EINVAL; */
insn_buf[i++] = BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0);
insn_buf[i++] = BPF_MOV64_IMM(BPF_REG_0, -EINVAL);
insn_buf[i++] = BPF_JMP_A(2);
/* e2big: s->cur = s->end = 0; return -E2BIG; */
insn_buf[i++] = BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0);
insn_buf[i++] = BPF_MOV64_IMM(BPF_REG_0, -E2BIG);
*cnt = i;
}
if (env->insn_aux_data[insn_idx].arg_prog) {