]> www.infradead.org Git - users/hch/xfs.git/commit
bpf: Handle scalar spill vs all MISC in stacksafe()
authorEduard Zingerman <eddyz87@gmail.com>
Sat, 27 Jan 2024 17:52:36 +0000 (19:52 +0200)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 2 Feb 2024 21:22:14 +0000 (13:22 -0800)
commit6efbde200bf3cf2dbf6e7181893fed13a79c789b
tree0b91ca2602847f5df1035b1b80bf01ab8872bb3c
parent067313a85c6f213932518f12f628810f0092492b
bpf: Handle scalar spill vs all MISC in stacksafe()

When check_stack_read_fixed_off() reads value from an spi
all stack slots of which are set to STACK_{MISC,INVALID},
the destination register is set to unbound SCALAR_VALUE.

Exploit this fact by allowing stacksafe() to use a fake
unbound scalar register to compare 'mmmm mmmm' stack value
in old state vs spilled 64-bit scalar in current state
and vice versa.

Veristat results after this patch show some gains:

./veristat -C -e file,prog,states -f 'states_pct>10'  not-opt after
File                     Program                States   (DIFF)
-----------------------  ---------------------  ---------------
bpf_overlay.o            tail_rev_nodeport_lb4    -45 (-15.85%)
bpf_xdp.o                tail_lb_ipv4            -541 (-19.57%)
pyperf100.bpf.o          on_event                -680 (-10.42%)
pyperf180.bpf.o          on_event               -2164 (-19.62%)
pyperf600.bpf.o          on_event               -9799 (-24.84%)
strobemeta.bpf.o         on_event               -9157 (-65.28%)
xdp_synproxy_kern.bpf.o  syncookie_tc             -54 (-19.29%)
xdp_synproxy_kern.bpf.o  syncookie_xdp            -74 (-24.50%)

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20240127175237.526726-6-maxtram95@gmail.com
kernel/bpf/verifier.c