Re: [PATCH bpf-next 1/6] bpf: Do register range validation early

[Mykyta Yatsenko <mykyta.yatsenko5@gmail.com>]

On 4/1/26 3:16 AM, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> Instead of checking src/dst range multiple times during
> the main verifier pass do them once.
> 
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> ---
resolve_pseudo_ldimm64() runs earlier into verification, so it makes 
sense to move this basic check there and remove from other places. Looks 
good, other than issue that AI found.
>   kernel/bpf/verifier.c | 34 ++++++++--------------------------
>   1 file changed, 8 insertions(+), 26 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8c1cf2eb6cbb..3ec786361698 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2249,13 +2249,6 @@ static void __mark_reg_const_zero(const struct bpf_verifier_env *env, struct bpf
>   static void mark_reg_known_zero(struct bpf_verifier_env *env,
>   				struct bpf_reg_state *regs, u32 regno)
>   {
> -	if (WARN_ON(regno >= MAX_BPF_REG)) {
> -		verbose(env, "mark_reg_known_zero(regs, %u)\n", regno);
> -		/* Something bad happened, let's kill all regs */
> -		for (regno = 0; regno < MAX_BPF_REG; regno++)
> -			__mark_reg_not_init(env, regs + regno);
> -		return;
> -	}
>   	__mark_reg_known_zero(regs + regno);
>   }
>   
> @@ -2908,13 +2901,6 @@ static void __mark_reg_unknown(const struct bpf_verifier_env *env,
>   static void mark_reg_unknown(struct bpf_verifier_env *env,
>   			     struct bpf_reg_state *regs, u32 regno)
>   {
> -	if (WARN_ON(regno >= MAX_BPF_REG)) {
> -		verbose(env, "mark_reg_unknown(regs, %u)\n", regno);
> -		/* Something bad happened, let's kill all regs except FP */
> -		for (regno = 0; regno < BPF_REG_FP; regno++)
> -			__mark_reg_not_init(env, regs + regno);
> -		return;
> -	}
>   	__mark_reg_unknown(env, regs + regno);
>   }
>   
> @@ -2947,13 +2933,6 @@ static void __mark_reg_not_init(const struct bpf_verifier_env *env,
>   static void mark_reg_not_init(struct bpf_verifier_env *env,
>   			      struct bpf_reg_state *regs, u32 regno)
>   {
> -	if (WARN_ON(regno >= MAX_BPF_REG)) {
> -		verbose(env, "mark_reg_not_init(regs, %u)\n", regno);
> -		/* Something bad happened, let's kill all regs except FP */
> -		for (regno = 0; regno < BPF_REG_FP; regno++)
> -			__mark_reg_not_init(env, regs + regno);
> -		return;
> -	}
>   	__mark_reg_not_init(env, regs + regno);
>   }
>   
> @@ -3958,11 +3937,6 @@ static int __check_reg_arg(struct bpf_verifier_env *env, struct bpf_reg_state *r
>   	struct bpf_reg_state *reg;
>   	bool rw64;
>   
> -	if (regno >= MAX_BPF_REG) {
> -		verbose(env, "R%d is invalid\n", regno);
> -		return -EINVAL;
> -	}
> -
>   	mark_reg_scratched(env, regno);
>   
>   	reg = &regs[regno];
> @@ -22070,6 +22044,14 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env)
>   			verbose(env, "unknown opcode %02x\n", insn->code);
>   			return -EINVAL;
>   		}
> +		if (insn->dst_reg >= MAX_BPF_REG) {
> +			verbose(env, "R%d is invalid\n", insn->dst_reg);
> +			return -EINVAL;
> +		}
> +		if (insn->src_reg >= MAX_BPF_REG) {
> +			verbose(env, "R%d is invalid\n", insn->src_reg);
> +			return -EINVAL;
> +		}
>   	}
>   
>   	/* now all pseudo BPF_LD_IMM64 instructions load valid