Alexei Starovoitov
c04c0d2b96
bpf: increase complexity limit and maximum program size ...
Large verifier speed improvements allow to increase
verifier complexity limit.
Now regardless of the program composition and its size it takes
little time for the verifier to hit insn_processed limit.
On typical x86 machine non-debug kernel processes 1M instructions
in 1/10 of a second.
(before these speed improvements specially crafted programs
could be hitting multi-second verification times)
Full kasan kernel with debug takes ~1 second for the same 1M insns.
Hence bump the BPF_COMPLEXITY_LIMIT_INSNS limit to 1M.
Also increase the number of instructions per program
from 4k to internal BPF_COMPLEXITY_LIMIT_INSNS limit.
4k limit was confusing to users, since small programs with hundreds
of insns could be hitting BPF_COMPLEXITY_LIMIT_INSNS limit.
Sometimes adding more insns and bpf_trace_printk debug statements
would make the verifier accept the program while removing
code would make the verifier reject it.
Some user space application started to add #define MAX_FOO to
their programs and do:
MAX_FOO=100;
again:
compile with MAX_FOO;
try to load;
if (fails_to_load) { reduce MAX_FOO; goto again; }
to be able to fit maximum amount of processing into single program.
Other users artificially split their single program into a set of programs
and use all 32 iterations of tail_calls to increase compute limits.
And the most advanced folks used unlimited tc-bpf filter list
to execute many bpf programs.
Essentially the users managed to workaround 4k insn limit.
This patch removes the limit for root programs from uapi.
BPF_COMPLEXITY_LIMIT_INSNS is the kernel internal limit
and success to load the program no longer depends on program size,
but on 'smartness' of the verifier only.
The verifier will continue to get smarter with every kernel release.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-04-04 01:27:38 +02:00
bpf: increase complexity limit and maximum program size
2019-04-04 01:27:38 +02:00
Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-03-12 14:08:19 -07:00
kvm_config: add CONFIG_VIRTIO_MENU
2018-10-24 20:55:56 -04:00
kdb: use bool for binary state indicators
2018-12-30 08:31:52 +00:00
memblock: drop memblock_alloc_*_nopanic() variants
2019-03-12 10:04:02 -07:00
perf/core improvements and fixes:
2019-03-22 22:50:41 +01:00
kernel/gcov/gcc_3_4.c: use struct_size() in kzalloc()
2019-03-07 18:32:02 -08:00
genirq: Mark expected switch case fall-through
2019-03-23 12:32:01 +01:00
Merge branch 'for-5.1/atomic-replace' into for-linus
2019-03-05 15:56:59 +01:00
locking/lockdep: Only call init_rcu_head() after RCU has been initialized
2019-03-09 14:15:51 +01:00
treewide: add checks for the return value of memblock_alloc*()
2019-03-12 10:04:02 -07:00
fbdev changes for v5.1:
2019-03-15 14:22:59 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-03-06 07:59:36 -08:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-03-24 11:42:10 -07:00
time/jiffies: Make refined_jiffies static
2019-03-22 13:38:26 +01:00
ftrace: Fix warning using plain integer as NULL & spelling corrections
2019-03-26 08:35:36 -04:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
async: Add support for queueing on specific NUMA node
2019-01-31 14:20:54 +01:00
audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL
2019-02-03 17:49:35 -05:00
audit: hide auditsc_get_stamp and audit_serial prototypes
2019-02-07 21:44:27 -05:00
audit: add syscall information to CONFIG_CHANGE records
2019-01-18 17:53:29 -05:00
audit: hand taken context to audit_kill_trees for syscall logging
2019-01-14 18:01:05 -05:00
audit: add syscall information to CONFIG_CHANGE records
2019-01-18 17:53:29 -05:00
audit: mark expected switch fall-through
2019-02-12 20:17:13 -05:00
audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL
2019-02-03 17:49:35 -05:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-10-31 08:54:14 -07:00
LSM: add SafeSetID module that gates setid calls
2019-01-25 11:22:43 -08:00
time: make adjtime compat handling available for 32 bit
2019-02-07 00:13:27 +01:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
Linux 5.0-rc5
2019-02-04 08:57:24 +01:00
kexec: export PG_offline to VMCOREINFO
2019-03-05 21:07:14 -08:00
SELinux: Remove cred security blob poisoning
2019-01-08 13:18:44 -08:00
delayacct: track delays from thrashing cache pages
2018-10-26 16:26:32 -07:00
Merge branch 'for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2019-03-07 10:11:41 -08:00
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
2018-10-31 08:54:12 -07:00
5.1 Merge Window Pull Request
2019-03-09 15:53:03 -08:00
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex: Ensure that futex address is aligned in handle_futex_death()
2019-03-22 13:05:26 +01:00
kernel/hung_task.c: Use continuously blocked time when reporting.
2019-03-07 18:31:59 -08:00
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
bpf: Add module name [bpf] to ksymbols for bpf programs
2019-01-21 17:38:56 -03:00
bpf: introduce bpf_spin_lock
2019-02-01 20:55:38 +01:00
kconfig: warn no new line at end of file
2018-12-15 17:44:35 +09:00
kcov: convert kcov.refcount to refcount_t
2019-03-07 18:32:02 -08:00
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump
2018-12-06 14:38:50 +00:00
kprobes: Search non-suffixed symbol in blacklist
2019-02-13 08:16:40 +01:00
Merge branch 'akpm' (patches from Andrew)
2019-03-06 10:31:36 -08:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm
2018-12-28 12:11:52 -08:00
dynamic_debug: add static inline stub for ddebug_add_module
2019-03-07 18:32:00 -08:00
modsign: use all trusted keys to verify module signature
2018-11-07 14:41:41 +01:00
padata: clean an indentation issue, remove extraneous space
2018-11-16 14:11:04 +08:00
kernel/panic.c: taint: fix debugfs_simple_attr.cocci warnings
2019-03-07 18:31:59 -08:00
Fix failure path in alloc_pid()
2018-12-28 12:42:30 -08:00
signal: Use group_send_sig_info to kill all processes in a pid namespace
2018-09-16 16:08:25 +02:00
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
kernel/reboot.c: export pm_power_off_prepare
2018-09-11 16:13:24 +01:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-03-12 13:27:20 -07:00
device-dax for 5.1
2019-03-16 13:05:32 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-03-07 11:44:01 -08:00
pidfd patches for v5.1-rc1
2019-03-16 13:47:14 -07:00
cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
2019-01-30 19:27:00 +01:00
softirq: Don't skip softirq execution when softirq thread is parking
2019-02-10 21:51:39 +01:00
stackleak: Mark stackleak_track_stack() as notrace
2018-12-05 19:31:44 -08:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
Merge branch 'akpm' (patches from Andrew)
2019-03-07 19:25:37 -08:00
pidfd patches for v5.1-rc1
2019-03-16 13:47:14 -07:00
kernel/sysctl.c: define minmax conv functions in terms of non-minmax versions
2019-03-12 10:04:00 -07:00
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
genetlink: make policy common to family
2019-03-22 10:38:23 -04:00
Merge branches 'doc.2019.01.26a', 'fixes.2019.01.26a', 'sil.2019.01.26a', 'spdx.2019.02.09a', 'srcu.2019.01.26a' and 'torture.2019.01.26a' into HEAD
2019-02-09 08:47:52 -08:00
tracing: Replace synchronize_sched() and call_rcu_sched()
2018-11-27 09:21:41 -08:00
umh: add exit routine for UMH process
2019-01-11 18:05:40 -08:00
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
userns: also map extents in the reverse map to kernel IDs
2018-11-07 23:51:16 -06:00
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
watchdog/core: Make variables static
2019-03-22 13:40:17 +01:00
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
workqueue: Only unregister a registered lockdep key
2019-03-21 12:00:18 +01:00
psi: fix aggregation idle shut-off
2019-02-01 15:46:23 -08:00
c04c0d2b96