Skip to content

Commit 86fc6ee

Browse files
Alexei Starovoitovborkmann
authored andcommitted
bpf: Relax verifier recursion check.
In the following bpf subprogram: static int timer_cb(void *map, void *key, void *value) { bpf_timer_set_callback(.., timer_cb); } the 'timer_cb' is a pointer to a function. ld_imm64 insn is used to carry this pointer. bpf_pseudo_func() returns true for such ld_imm64 insn. Unlike bpf_for_each_map_elem() the bpf_timer_set_callback() is asynchronous. Relax control flow check to allow such "recursion" that is seen as an infinite loop by check_cfg(). The distinction between bpf_for_each_map_elem() the bpf_timer_set_callback() is done in the follow up patch. Signed-off-by: Alexei Starovoitov <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Andrii Nakryiko <[email protected]> Acked-by: Toke Høiland-Jørgensen <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
1 parent 40ec00a commit 86fc6ee

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

kernel/bpf/verifier.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9463,8 +9463,12 @@ static int visit_func_call_insn(int t, int insn_cnt,
94639463
init_explored_state(env, t + 1);
94649464
if (visit_callee) {
94659465
init_explored_state(env, t);
9466-
ret = push_insn(t, t + insns[t].imm + 1, BRANCH,
9467-
env, false);
9466+
ret = push_insn(t, t + insns[t].imm + 1, BRANCH, env,
9467+
/* It's ok to allow recursion from CFG point of
9468+
* view. __check_func_call() will do the actual
9469+
* check.
9470+
*/
9471+
bpf_pseudo_func(insns + t));
94689472
}
94699473
return ret;
94709474
}

0 commit comments

Comments
 (0)