a258eebd | 27-Jun-2024 |
Konstantin Ananyev <konstantin.ananyev@huawei.com> |
bpf: fix load hangs with six IPv6 addresses
As described in https://bugs.dpdk.org/show_bug.cgi?id=1465, converting from following cBPF filter: "host 1::1 or host 1::1 or host 1::1 or host 1::1 or h
bpf: fix load hangs with six IPv6 addresses
As described in https://bugs.dpdk.org/show_bug.cgi?id=1465, converting from following cBPF filter: "host 1::1 or host 1::1 or host 1::1 or host 1::1 or host 1::1 or host 1::1" takes too long for BPF verifier to complete (up to 25 seconds).
Looking at it, I didn't find any actual functional bug.
In fact, it does what is expected: go through each possible path of BPF program and evaluate register/stack state for each instruction. The problem is that, for program with a lot of conditional branches, number of possible paths starts to grow exponentially and such walk becomes very excessive.
So to minimize number of evaluations, this patch implements heuristic similar to what Linux kernel does: state pruning. If from given instruction for given program state, we explore all possible paths and for each of them reach bpf_exit() without any complaints and a valid R0 value, then for that instruction this program state can be marked as 'safe'. When we later arrive at the same instruction with a state equivalent to an earlier instruction 'safe' state, we can prune the search.
For now, only states for JCC targets are saved/examined.
Plus add few extra logging for DEBUG level.
Bugzilla ID: 1465 Fixes: 8021917293d0 ("bpf: add extra validation for input BPF program") Cc: stable@dpdk.org
Reported-by: Isaac Boukris <iboukris@gmail.com> Signed-off-by: Konstantin Ananyev <konstantin.ananyev@huawei.com> Acked-by: Morten Brørup <mb@smartsharesystems.com> Acked-by: Stephen Hemminger <stephen@networkplumber.org>
show more ...
|