bpf: teach verifier to track stack depth

teach verifier to track bpf program stack depth

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 6bb38d76faf42a18437eb7565380b75a71096f78..fcc80ca1104562ad22ae435599c01fec95b11f5c 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -171,6 +171,7 @@ struct bpf_prog_aux {
        atomic_t refcnt;
        u32 used_map_cnt;
        u32 max_ctx_offset;
+       u32 stack_depth;
        struct latch_tree_node ksym_tnode;
        struct list_head ksym_lnode;
        const struct bpf_verifier_ops *ops;

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 28113d0e8e92cb6693f2bee3fb92af82f750e3cd..d96f27ff9f6f3bb02d477ad2123dbea0fdf9a96a 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -926,6 +926,10 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
                        verbose("invalid stack off=%d size=%d\n", off, size);
                        return -EACCES;
                }
+
+               if (env->prog->aux->stack_depth < -off)
+                       env->prog->aux->stack_depth = -off;
+
                if (t == BPF_WRITE) {
                        if (!env->allow_ptr_leaks &&
                            state->stack_slot_type[MAX_BPF_STACK + off] == STACK_SPILL &&
@@ -1032,6 +1036,9 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
                return -EACCES;
        }
 
+       if (env->prog->aux->stack_depth < -off)
+               env->prog->aux->stack_depth = -off;
+
        if (meta && meta->raw_mode) {
                meta->access_size = access_size;
                meta->regno = regno;
@@ -3167,7 +3174,8 @@ process_bpf_exit:
                insn_idx++;
        }
 
-       verbose("processed %d insns\n", insn_processed);
+       verbose("processed %d insns, stack depth %d\n",
+               insn_processed, env->prog->aux->stack_depth);
        return 0;
 }