Commit c1ee85a9 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

bpf: fix visit_insn()'s detection of BPF_FUNC_timer_set_callback helper 



It's not correct to assume that any BPF_CALL instruction is a helper
call. Fix visit_insn()'s detection of bpf_timer_set_callback() helper by
also checking insn->code == 0. For kfuncs insn->code would be set to
BPF_PSEUDO_KFUNC_CALL, and for subprog calls it will be BPF_PSEUDO_CALL.

Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20230302235015.2044271-8-andrii@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 653ae3a8

kernel/bpf/verifier.c

+1 −1
Original line number Diff line number Diff line
@@ -13500,7 +13500,7 @@ static int visit_insn(int t, struct bpf_verifier_env *env) 
		return DONE_EXPLORING;









	case BPF_CALL:









		if (insn->imm == BPF_FUNC_timer_set_callback)









		if (insn->src_reg == 0 && insn->imm == BPF_FUNC_timer_set_callback)









			/* Mark this call insn as a prune point to trigger









			 * is_state_visited() check before call itself is









			 * processed by __check_func_call(). Otherwise new