Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
MIME-Version: 1.0
From:   Hao Sun <sunhao.th@gmail.com>
Date:   Wed, 1 Nov 2023 14:56:34 +0100
Message-ID: <CACkBjsY3vMLVVO0zHd+CRcQPdykDhXv8-f2oD82+Jk5KJpq_8w@mail.gmail.com>
Subject: bpf: incorrectly reject program with `back-edge insn from 7 to 8`
To:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        John Fastabend <john.fastabend@gmail.com>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>,
        Yonghong Song <yonghong.song@linux.dev>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        Mykola Lysenko <mykolal@fb.com>, Shuah Khan <shuah@kernel.org>
Cc:     Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        bpf <bpf@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi,

The verifier incorrectly rejects the following prog in check_cfg() when
loading with root with confusing log `back-edge insn from 7 to 8`:
  /* 0: r9 = 2
   * 1: r3 = 0x20
   * 2: r4 = 0x35
   * 3: r8 = r4
   * 4: goto+3
   * 5: r9 -= r3
   * 6: r9 -= r4
   * 7: r9 -= r8
   * 8: r8 += r4
   * 9: if r8 < 0x64 goto-5
   * 10: r0 = r9
   * 11: exit
   * */
  BPF_MOV64_IMM(BPF_REG_9, 2),
  BPF_MOV64_IMM(BPF_REG_3, 0x20),
  BPF_MOV64_IMM(BPF_REG_4, 0x35),
  BPF_MOV64_REG(BPF_REG_8, BPF_REG_4),
  BPF_JMP_IMM(BPF_JA, 0, 0, 3),
  BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_3),
  BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_4),
  BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
  BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_4),
  BPF_JMP32_IMM(BPF_JLT, BPF_REG_8, 0x68, -5),
  BPF_MOV64_REG(BPF_REG_0, BPF_REG_9),
  BPF_EXIT_INSN()

-------- Verifier Log --------
func#0 @0
back-edge from insn 7 to 8
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0
peak_states 0 mark_read 0

This is not intentionally rejected, right?

Best
Hao