Linux kernel source tree
Go to file
Eduard Zingerman bfc5c19b4b bpf: keep track of max number of bpf_loop callback iterations
commit bb124da69c upstream.

In some cases verifier can't infer convergence of the bpf_loop()
iteration. E.g. for the following program:

    static int cb(__u32 idx, struct num_context* ctx)
    {
        ctx->i++;
        return 0;
    }

    SEC("?raw_tp")
    int prog(void *_)
    {
        struct num_context ctx = { .i = 0 };
        __u8 choice_arr[2] = { 0, 1 };

        bpf_loop(2, cb, &ctx, 0);
        return choice_arr[ctx.i];
    }

Each 'cb' simulation would eventually return to 'prog' and reach
'return choice_arr[ctx.i]' statement. At which point ctx.i would be
marked precise, thus forcing verifier to track multitude of separate
states with {.i=0}, {.i=1}, ... at bpf_loop() callback entry.

This commit allows "brute force" handling for such cases by limiting
number of callback body simulations using 'umax' value of the first
bpf_loop() parameter.

For this, extend bpf_func_state with 'callback_depth' field.
Increment this field when callback visiting state is pushed to states
traversal stack. For frame #N it's 'callback_depth' field counts how
many times callback with frame depth N+1 had been executed.
Use bpf_func_state specifically to allow independent tracking of
callback depths when multiple nested bpf_loop() calls are present.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20231121020701.26440-11-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-31 16:18:59 -08:00
arch LoongArch/smp: Call rcutree_report_cpu_starting() earlier 2024-01-31 16:18:57 -08:00
block block: ensure we hold a queue reference when using queue limits 2024-01-25 15:35:57 -08:00
certs
crypto crypto: api - Disallow identical driver names 2024-01-31 16:18:49 -08:00
Documentation dt-bindings: net: snps,dwmac: Tx coe unsupported 2024-01-31 16:18:58 -08:00
drivers serial: Do not hold the port lock when setting rx-during-tx GPIO 2024-01-31 16:18:58 -08:00
fs ksmbd: Add missing set_freezable() for freezable kthread 2024-01-31 16:18:58 -08:00
include bpf: keep track of max number of bpf_loop callback iterations 2024-01-31 16:18:59 -08:00
init rootfs: Fix support for rootfstype= when root= is given 2024-01-25 15:35:46 -08:00
io_uring io_uring: adjust defer tw counting 2024-01-25 15:36:00 -08:00
ipc
kernel bpf: keep track of max number of bpf_loop callback iterations 2024-01-31 16:18:59 -08:00
lib crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init 2024-01-31 16:18:49 -08:00
LICENSES
mm mm: page_alloc: unreserve highatomic page blocks before oom 2024-01-31 16:18:57 -08:00
net ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work 2024-01-25 15:36:00 -08:00
rust rust: Ignore preserve-most functions 2024-01-25 15:35:41 -08:00
samples
scripts scripts/get_abi: fix source path leak 2024-01-31 16:18:55 -08:00
security lsm: new security_file_ioctl_compat() hook 2024-01-31 16:18:54 -08:00
sound soundwire: fix initializing sysfs for same devices on different buses 2024-01-31 16:18:47 -08:00
tools bpf: keep track of max number of bpf_loop callback iterations 2024-01-31 16:18:59 -08:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 6.6.14 2024-01-25 15:36:01 -08:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.