From: Alexei Starovoitov Date: Wed, 19 Feb 2025 03:23:00 +0000 (-0800) Subject: Merge branch 'bpf-copy_verifier_state-should-copy-loop_entry-field' X-Git-Tag: v6.15-rc1~98^2~67 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=654765b5c6d62efad270ec5f8a57802dc253d128;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'bpf-copy_verifier_state-should-copy-loop_entry-field' Eduard Zingerman says: ==================== This patch set fixes a bug in copy_verifier_state() where the loop_entry field was not copied. This omission led to incorrect loop_entry fields remaining in env->cur_state, causing incorrect decisions about loop entry assignments in update_loop_entry(). An example of an unsafe program accepted by the verifier due to this bug can be found in patch #2. This bug can also cause an infinite loop in the verifier, see patch #5. Structure of the patch set: - Patch #1 fixes the bug but has a significant negative impact on verification performance for sched_ext programs. - Patch #3 mitigates the verification performance impact of patch #1 by avoiding clean_live_states() for states whose loop_entry is still being verified. This reduces the number of processed instructions for sched_ext programs by 28–92% in some cases. - Patches #5-6 simplify {get,update}_loop_entry() logic (and are not strictly necessary). - Patches #7–10 mitigate the memory overhead introduced by patch #1 when a program with iterator-based loop hits the 1M instruction limit. This is achieved by freeing states in env->free_list when their branches and used_as_loop_entry counts reach zero. Patches #1-4 were previously sent as a part of [1]. [1] https://lore.kernel.org/bpf/20250122120442.3536298-1-eddyz87@gmail.com/ ==================== Link: https://patch.msgid.link/20250215110411.3236773-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov --- 654765b5c6d62efad270ec5f8a57802dc253d128