bpf: fix env->peak_states computation

Compute env->peak_states as a maximum value of sum of
env->explored_states and env->free_list size.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250215110411.3236773-11-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index f920af30eb0697e138737fb0131a00d95029bdb2..bbd013c38ff9ffb87f52cc5a9324addd35f7cec3 100644 (file)
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -772,6 +772,8 @@ struct bpf_verifier_env {
        u32 peak_states;
        /* longest register parentage chain walked for liveness marking */
        u32 longest_mark_read_walk;
+       u32 free_list_size;
+       u32 explored_states_size;
        bpfptr_t fd_array;
 
        /* bit mask to keep track of whether a register has been accessed

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1d1f6a5902d88223d848df95fd7d2d2778bf5555..e57b7c94986056e832e191b72cacc42f0a3b4577 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1609,6 +1609,14 @@ static struct bpf_reference_state *find_lock_state(struct bpf_verifier_state *st
        return NULL;
 }
 
+static void update_peak_states(struct bpf_verifier_env *env)
+{
+       u32 cur_states;
+
+       cur_states = env->explored_states_size + env->free_list_size;
+       env->peak_states = max(env->peak_states, cur_states);
+}
+
 static void free_func_state(struct bpf_func_state *state)
 {
        if (!state)
@@ -1670,7 +1678,7 @@ static void maybe_free_verifier_state(struct bpf_verifier_env *env,
                list_del(&sl->node);
                free_verifier_state(&sl->state, false);
                kfree(sl);
-               env->peak_states--;
+               env->free_list_size--;
                sl = loop_entry_sl;
        }
 }
@@ -18858,6 +18866,8 @@ miss:
                        sl->in_free_list = true;
                        list_del(&sl->node);
                        list_add(&sl->node, &env->free_list);
+                       env->free_list_size++;
+                       env->explored_states_size--;
                        maybe_free_verifier_state(env, sl);
                }
        }
@@ -18884,7 +18894,8 @@ miss:
        if (!new_sl)
                return -ENOMEM;
        env->total_states++;
-       env->peak_states++;
+       env->explored_states_size++;
+       update_peak_states(env);
        env->prev_jmps_processed = env->jmps_processed;
        env->prev_insn_processed = env->insn_processed;