Commit e33dfe14 authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Pu Lehui
Browse files

bpf: verifier: Improve function state reallocation

mainline inclusion
from mainline-v5.14-rc1
commit c69431aa
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VT
CVE: CVE-2023-52452

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c69431aab67a



--------------------------------

Resizing and copying stack and reference tracking state currently
does a lot of kfree / kmalloc when the size of the tracked set changes.
The logic in copy_*_state and realloc_*_state is also hard to follow.

Refactor this into two core functions. copy_array copies from a source
into a destination. It avoids reallocation by taking the allocated
size of the destination into account via ksize(). The function is
essentially krealloc_array, with the difference that the contents of
dst are not preserved. realloc_array changes the size of an array and
zeroes newly allocated items. Contrary to krealloc both functions don't
free the destination if the size is zero. Instead we rely on free_func_state
to clean up.

realloc_stack_state is renamed to grow_stack_state to better convey
that it never shrinks the stack state.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210429134656.122225-2-lmb@cloudflare.com


Conflicts:
	kernel/bpf/verifier.c
Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
parent 513f709d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment