On Sat, 2025-07-05 at 21:09 +0200, Luis Gerhorst wrote:
We must terminate the speculative analysis if the just-analyzed insn had nospec_result set. Using cur_aux() here is wrong because insn_idx might have been incremented by do_check_insn(). Therefore, introduce and use insn_aux variable.
Also change cur_aux(env)->nospec in case do_check_insn() ever manages to increment insn_idx but still fail.
Change the warning to check the insn class (which prevents it from triggering for ldimm64, for which nospec_result would not be problematic) and use verifier_bug_if().
In line with Eduard's suggestion, do not introduce prev_aux() because that requires one to understand that after do_check_insn() call what was current became previous. This would at-least require a comment.
Fixes: d6f1c85f2253 ("bpf: Fall back to nospec for Spectre v1") Reported-by: Paul Chaignon paul.chaignon@gmail.com Reported-by: Eduard Zingerman eddyz87@gmail.com Reported-by: syzbot+dc27c5fb8388e38d2d37@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010.GAE@google.com/ Link: https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.camel@g... Suggested-by: Eduard Zingerman eddyz87@gmail.com Signed-off-by: Luis Gerhorst luis.gerhorst@fau.de
Acked-by: Eduard Zingerman eddyz87@gmail.com
[...]