vbpf / prevail / 28819798744

87%

push

github

Sign-extend BPF_ST store immediates (#1159)

A BPF_ST store decoded its 32-bit immediate with zero_extend, so a 64-bit
(DW) store of a negative constant was modeled with a zero upper half:
*(u64*)(r10-8) = -1 became 0x00000000FFFFFFFF instead of the kernel's
sign-extended 0xFFFFFFFFFFFFFFFF. A later load of that cell then gave the
analyzer a small positive scalar where the runtime value is negative, which
can under-approximate the value's range.

Decode the immediate with sign_extend, matching the ALU-immediate path
(getBinValue) and the kernel's assignment of the s32 immediate to the target
location. Narrower stores are unaffected (the transformer masks to width).


Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

1 of 1 new or added line in 1 file covered. (100.0%)

9142 of 10572 relevant lines covered (86.47%)

6472611.17 hits per line