Alexei Starovoitov
f1bca824da
bpf: add search pruning optimization to verifier ...
consider C program represented in eBPF:
int filter(int arg)
{
int a, b, c, *ptr;
if (arg == 1)
ptr = &a;
else if (arg == 2)
ptr = &b;
else
ptr = &c;
*ptr = 0;
return 0;
}
eBPF verifier has to follow all possible paths through the program
to recognize that '*ptr = 0' instruction would be safe to execute
in all situations.
It's doing it by picking a path towards the end and observes changes
to registers and stack at every insn until it reaches bpf_exit.
Then it comes back to one of the previous branches and goes towards
the end again with potentially different values in registers.
When program has a lot of branches, the number of possible combinations
of branches is huge, so verifer has a hard limit of walking no more
than 32k instructions. This limit can be reached and complex (but valid)
programs could be rejected. Therefore it's important to recognize equivalent
verifier states to prune this depth first search.
Basic idea can be illustrated by the program (where .. are some eBPF insns):
1: ..
2: if (rX == rY) goto 4
3: ..
4: ..
5: ..
6: bpf_exit
In the first pass towards bpf_exit the verifier will walk insns: 1, 2, 3, 4, 5, 6
Since insn#2 is a branch the verifier will remember its state in verifier stack
to come back to it later.
Since insn#4 is marked as 'branch target', the verifier will remember its state
in explored_states[4] linked list.
Once it reaches insn#6 successfully it will pop the state recorded at insn#2 and
will continue.
Without search pruning optimization verifier would have to walk 4, 5, 6 again,
effectively simulating execution of insns 1, 2, 4, 5, 6
With search pruning it will check whether state at #4 after jumping from #2
is equivalent to one recorded in explored_states[4] during first pass.
If there is an equivalent state, verifier can prune the search at #4 and declare
this path to be safe as well.
In other words two states at #4 are equivalent if execution of 1, 2, 3, 4 insns
and 1, 2, 4 insns produces equivalent registers and stack.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-10-01 21:30:33 -04:00
bpf: add search pruning optimization to verifier
2014-10-01 21:30:33 -04:00
kdb: Use ktime_get_ts()
2014-06-12 16:18:45 +02:00
perf: Fix a race condition in perf_remove_from_context()
2014-09-09 06:53:42 +02:00
kernel/gcov/fs.c: remove unnecessary null test before debugfs_remove
2014-08-08 15:57:24 -07:00
irq: Export handle_fasteoi_irq
2014-08-25 21:13:30 +02:00
arch, locking: Ciao arch_mutex_cpu_relax()
2014-07-17 12:32:47 +02:00
PM / sleep: Fix test_suspend= command line option
2014-09-03 01:21:03 +02:00
kernel/printk/printk.c: fix faulty logic in the case of recursive printk
2014-09-10 15:42:12 -07:00
rcu: Make nocb leader kthreads process pending callbacks after spawning
2014-08-28 05:59:59 -07:00
Merge branches 'pm-sleep', 'pm-cpufreq' and 'pm-cpuidle'
2014-08-11 23:19:48 +02:00
alarmtimer: Lock k_itimer during timer callback
2014-09-12 13:59:12 -07:00
trace: Fix epoll hang when we race with new entries
2014-08-25 20:18:11 -04:00
kernel/acct.c: fix coding style warnings and errors
2014-08-08 15:57:27 -07:00
CAPABILITIES: remove undefined caps from all processes
2014-07-24 21:53:47 +10:00
kernel/auditfilter.c: replace count*size kmalloc by kcalloc
2014-08-06 18:01:12 -07:00
auditsc: audit_krule mask accesses need bounds checking
2014-06-10 08:44:40 -07:00
kernel/backtracetest.c: replace no level printk by pr_info()
2014-06-04 16:54:14 -07:00
page-cgroup: get rid of NR_PCG_FLAGS
2014-08-08 15:57:18 -07:00
CAPABILITIES: remove undefined caps from all processes
2014-07-24 21:53:47 +10:00
cgroup: fix unbalanced locking
2014-09-18 12:32:52 -04:00
cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes
2014-07-15 11:05:09 -04:00
compat: nanosleep: Clarify error handling
2014-09-06 12:58:18 +02:00
x86/kprobes: Fix build errors and blacklist context_track_user
2014-06-14 09:07:44 +02:00
sched: Rework check_for_tasks()
2014-07-05 11:17:45 +02:00
Merge branch 'for-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2014-08-04 10:11:28 -07:00
crash_dump: Make is_kdump_kernel() accessible from modules
2014-08-25 15:42:19 -07:00
delayacct: Remove braindamaged type conversions
2014-07-23 10:18:06 -07:00
kernel/exec_domain.c: code clean-up
2014-06-04 16:54:15 -07:00
kernel/exit.c: fix coding style warnings and errors
2014-08-08 15:57:22 -07:00
seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock
2014-08-11 13:29:12 -07:00
futex: Unlock hb->lock in futex_wait_requeue_pi() error path
2014-09-12 22:04:36 +02:00
kernel/hung_task.c: convert simple_strtoul to kstrtouint
2014-06-04 16:54:15 -07:00
irq_work: Remove BUG_ON in irq_work_run()
2014-07-05 11:17:26 +02:00
kernel/kallsyms.c: fix %pB when there's no symbol at the address
2014-08-08 15:57:18 -07:00
kcmp: fix standard comparison bug
2014-09-10 15:42:12 -07:00
locking/rwsem: Add CONFIG_RWSEM_SPIN_ON_OWNER
2014-07-16 14:57:13 +02:00
kexec: create a new config option CONFIG_KEXEC_FILE for new syscall
2014-08-29 16:28:16 -07:00
signals: change wait_for_helper() to use kernel_sigaction()
2014-06-06 16:08:12 -07:00
kprobes: Skip kretprobe hit in NMI context to avoid deadlock
2014-08-08 10:38:04 +02:00
kthread_work: wake up worker only when the worker is idle
2014-07-28 14:07:52 -04:00
kernel/latencytop.c: convert seq_printf to seq_puts
2014-06-04 16:54:15 -07:00
bin2c: move bin2c in scripts/basic
2014-08-08 15:57:32 -07:00
module: Clean up ro/nx after early module load failures
2014-08-16 04:47:00 +09:30
namespaces: Use task_lock and not rcu to protect nsproxy
2014-07-29 18:08:50 -07:00
panic: add TAINT_SOFTLOCKUP
2014-08-08 15:57:24 -07:00
Add module param type 'ullong'
2014-07-17 22:07:37 +02:00
kernel/profile.c: use static const char instead of static char
2014-06-06 16:08:13 -07:00
sched: Remove proliferation of wait_on_bit() action functions
2014-07-16 15:10:39 +02:00
kernel/reboot.c: convert simple_strtoul to kstrtoint
2014-06-04 16:54:15 -07:00
kernel/res_counter.c: replace simple_strtoull by kstrtoull
2014-06-04 16:54:15 -07:00
resource: fix the case of null pointer access
2014-08-29 16:28:15 -07:00
net: bpf: make eBPF interpreter images read-only
2014-09-05 12:02:48 -07:00
Merge branch 'signal-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc
2014-08-09 09:58:12 -07:00
kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path
2014-08-06 18:01:22 -07:00
kernel/stop_machine.c: kernel-doc warning fix
2014-06-04 16:54:15 -07:00
sched: move no_new_privs into new atomic flags
2014-07-18 12:13:38 -07:00
bpf: enable bpf syscall on x64 and i386
2014-09-26 15:05:14 -04:00
mm, hugetlb: remove hugetlb_zero and hugetlb_infinity
2014-08-06 18:01:19 -07:00
ipv6: Allow accepting RA from local IP addresses.
2014-07-01 12:16:24 -07:00
KEYS: validate certificate trust only with builtin keys
2014-07-17 09:35:17 -04:00
kernel/test_kprobes.c: use current logging functions
2014-08-08 15:57:18 -07:00
torture: Avoid format string leak to thead name
2014-07-07 10:12:56 -07:00
tracing: syscall_regfunc() should not skip kernel threads
2014-06-21 00:15:26 -04:00
sched: Make task->start_time nanoseconds based
2014-07-23 10:18:05 -07:00
kernel/user.c: drop unused field 'files' from user_struct
2014-06-04 16:54:16 -07:00
proc: constify seq_operations
2014-08-08 15:57:22 -07:00
namespaces: Use task_lock and not rcu to protect nsproxy
2014-07-29 18:08:50 -07:00
sysctl: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
panic: add TAINT_SOFTLOCKUP
2014-08-08 15:57:24 -07:00
Merge branch 'for-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2014-08-04 10:09:27 -07:00
f1bca824da