Commit 8726679a authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

bpf: teach verifier to track stack depth 



teach verifier to track bpf program stack depth

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f696b8f4

include/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -171,6 +171,7 @@ struct bpf_prog_aux { 
	atomic_t refcnt;

	u32 used_map_cnt;

	u32 max_ctx_offset;

	u32 stack_depth;

	struct latch_tree_node ksym_tnode;

	struct list_head ksym_lnode;

	const struct bpf_verifier_ops *ops;

kernel/bpf/verifier.c

+9 −1
Original line number Diff line number Diff line
@@ -926,6 +926,10 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off, 
			verbose("invalid stack off=%d size=%d\n", off, size);

			return -EACCES;

		}



		if (env->prog->aux->stack_depth < -off)

			env->prog->aux->stack_depth = -off;



		if (t == BPF_WRITE) {

			if (!env->allow_ptr_leaks &&

			    state->stack_slot_type[MAX_BPF_STACK + off] == STACK_SPILL &&
@@ -1032,6 +1036,9 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
		return -EACCES;

	}



	if (env->prog->aux->stack_depth < -off)

		env->prog->aux->stack_depth = -off;



	if (meta && meta->raw_mode) {

		meta->access_size = access_size;

		meta->regno = regno;
@@ -3167,7 +3174,8 @@ static int do_check(struct bpf_verifier_env *env) 
		insn_idx++;

	}



	verbose("processed %d insns\n", insn_processed);

	verbose("processed %d insns, stack depth %d\n",

		insn_processed, env->prog->aux->stack_depth);

	return 0;

}