Re: [PATCH RFC bpf-next 1/2] bpf: propagate nullness information for reg to reg comparisons

[John Fastabend <john.fastabend@gmail.com>]

Yonghong Song wrote:
> 
> 
> On 8/23/22 4:15 PM, John Fastabend wrote:
> > Eduard Zingerman wrote:
> >> Propagate nullness information for branches of register to register
> >> equality compare instructions. The following rules are used:
> >> - suppose register A maybe null
> >> - suppose register B is not null
> >> - for JNE A, B, ... - A is not null in the false branch
> >> - for JEQ A, B, ... - A is not null in the true branch
> >>
> >> E.g. for program like below:
> >>
> >>    r6 = skb->sk;
> >>    r7 = sk_fullsock(r6);
> >>    r0 = sk_fullsock(r6);
> >>    if (r0 == 0) return 0;    (a)
> >>    if (r0 != r7) return 0;   (b)
> >>    *r7->type;                (c)
> >>    return 0;
> >>
> >> It is safe to dereference r7 at point (c), because of (a) and (b).
> > 
> > I think the idea makes sense. Perhaps Yonhong can comment seeing he was active
> > on the LLVM thread. I just scanned the LLVM side for now will take a look
> > in more detail in a bit.
> 
> The issue is discovered when making some changes in llvm compiler.
> I think it is good to add support in verifier so in the future
> if compiler generates such code patterns, user won't get
> surprised verification failure.
> 

I agree. Read the LLVM thread as well.