[bpf-next,v2,0/3] check bpf_func_state->callback_depth when pruning states

Message

Eduard Zingerman Feb. 16, 2024, 3:03 p.m. UTC

This patch-set fixes bug in states pruning logic hit in mailing list
discussion [0]. The details of the fix are in patch #2.
A change to the test case test_tcp_custom_syncookie.c is necessary,
otherwise updated verifier won't be able to process it due to
instruction complexity limit. This change is done in patch #1.

The main idea for the fix belongs to Yonghong Song,
mine contribution is merely in review and test cases.

There are some changes in verification performance:

File                       Program   Insns   (DIFF)  States (A)  States (B)  States (DIFF)
-------------------------  --------  --------------  ----------  ----------  -------------
pyperf600_bpf_loop.bpf.o   on_event    +53 (+1.09%)         323         330    +7 (+2.17%)
strobemeta_bpf_loop.bpf.o  on_event  +594 (+27.85%)         163         213  +50 (+30.67%)

(when tested using BPF selftests and Cilium object files)

Changelog:
v1 [1] -> v2:
- patch #2 commit message updated to better reflect verifier behavior
  with regards to checkpoints tree (suggested by Yonghong);
- veristat results added (suggested by Andrii).

[0] https://lore.kernel.org/bpf/[e-mail]/
[1] https://lore.kernel.org/bpf/[e-mail]/

Eduard Zingerman (3):
  selftests/bpf: update tcp_custom_syncookie to use scalar packet offset
  bpf: check bpf_func_state->callback_depth when pruning states
  selftests/bpf: test case for callback_depth states pruning logic

 kernel/bpf/verifier.c                         |  3 +
 .../bpf/progs/test_tcp_custom_syncookie.c     | 83 ++++++++++++-------
 .../bpf/progs/verifier_iterating_callbacks.c  | 70 ++++++++++++++++
 3 files changed, 126 insertions(+), 30 deletions(-)