480 static void mark_reg_unknown_value(struct reg_state *regs, u32 regno)  in mark_reg_unknown_value()  argument
482 	BUG_ON(regno >= MAX_BPF_REG);  in mark_reg_unknown_value()
483 	regs[regno].type = UNKNOWN_VALUE;  in mark_reg_unknown_value()
484 	regs[regno].imm = 0;  in mark_reg_unknown_value()
485 	regs[regno].map_ptr = NULL;  in mark_reg_unknown_value()
494 static int check_reg_arg(struct reg_state *regs, u32 regno,  in check_reg_arg()  argument
497 	if (regno >= MAX_BPF_REG) {  in check_reg_arg()
498 		verbose("R%d is invalid\n", regno);  in check_reg_arg()
504 		if (regs[regno].type == NOT_INIT) {  in check_reg_arg()
505 			verbose("R%d !read_ok\n", regno);  in check_reg_arg()
510 		if (regno == BPF_REG_FP) {  in check_reg_arg()
515 			mark_reg_unknown_value(regs, regno);  in check_reg_arg()
627 static int check_map_access(struct verifier_env *env, u32 regno, int off,  in check_map_access()  argument
630 	struct bpf_map *map = env->cur_state.regs[regno].map_ptr;  in check_map_access()
652 static bool is_pointer_value(struct verifier_env *env, int regno)  in is_pointer_value()  argument
657 	switch (env->cur_state.regs[regno].type) {  in is_pointer_value()
672 static int check_mem_access(struct verifier_env *env, u32 regno, int off,  in check_mem_access()  argument
679 	if (state->regs[regno].type == PTR_TO_STACK)  in check_mem_access()
680 		off += state->regs[regno].imm;  in check_mem_access()
691 	if (state->regs[regno].type == PTR_TO_MAP_VALUE) {  in check_mem_access()
697 		err = check_map_access(env, regno, off, size);  in check_mem_access()
701 	} else if (state->regs[regno].type == PTR_TO_CTX) {  in check_mem_access()
711 	} else if (state->regs[regno].type == FRAME_PTR ||  in check_mem_access()
712 		   state->regs[regno].type == PTR_TO_STACK) {  in check_mem_access()
730 			regno, reg_type_str[state->regs[regno].type]);  in check_mem_access()
773 				int regno, int access_size)  in check_stack_boundary()  argument
779 	if (regs[regno].type != PTR_TO_STACK)  in check_stack_boundary()
782 	off = regs[regno].imm;  in check_stack_boundary()
786 			regno, off, access_size);  in check_stack_boundary()
800 static int check_func_arg(struct verifier_env *env, u32 regno,  in check_func_arg()  argument
803 	struct reg_state *reg = env->cur_state.regs + regno;  in check_func_arg()
811 		verbose("R%d !read_ok\n", regno);  in check_func_arg()
816 		if (is_pointer_value(env, regno)) {  in check_func_arg()
817 			verbose("R%d leaks addr into helper function\n", regno);  in check_func_arg()
838 		verbose("R%d type=%s expected=%s\n", regno,  in check_func_arg()
861 		err = check_stack_boundary(env, regno, (*mapp)->key_size);  in check_func_arg()
872 		err = check_stack_boundary(env, regno, (*mapp)->value_size);  in check_func_arg()
879 		if (regno == 0) {  in check_func_arg()
884 		err = check_stack_boundary(env, regno - 1, reg->imm);  in check_func_arg()