[PATCH net-next] bpf: fix liveness propagation to parent in spilled stack slots

[Daniel Borkmann]

Using parent->regs[] when propagating REG_LIVE_READ for spilled regs
doesn't work since parent->regs[] denote the set of normal registers
but not spilled ones. Propagate to the correct regs.

Fixes: dc503a8ad984 ("bpf/verifier: track liveness for pruning")
Reported-by: Dan Carpenter <dan.carpen...@oracle.com>
Signed-off-by: Daniel Borkmann <dan...@iogearbox.net>
Acked-by: Edward Cree <ec...@solarflare.com>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 958ba84..40f669d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3460,7 +3460,7 @@ static bool do_propagate_liveness(const struct 
bpf_verifier_state *state,
                if (parent->spilled_regs[i].live & REG_LIVE_READ)
                        continue;
                if (state->spilled_regs[i].live == REG_LIVE_READ) {
-                       parent->regs[i].live |= REG_LIVE_READ;
+                       parent->spilled_regs[i].live |= REG_LIVE_READ;
                        touched = true;
                }
        }
-- 
1.9.3