On Thu, Mar 21, 2019 at 10:33:06AM +0100, Paul Chaignon wrote:
> On Wed, Mar 20, 2019 at 11:31PM, Yonghong Song wrote:
> > On 3/20/19 5:57 AM, Paul Chaignon wrote:
> > > The BPF verifier checks the maximum number of call stack frames twice,
> > > first in the main CFG traversal (do_check) and then in a subsequent
> > > traversal (check_max_stack_depth). If the second check fails, it logs a
> > > 'verifier bug' warning and errors out, as the number of call stack frames
> > > should have been verified already.
> > >
> > > However, the second check may fail without indicating a verifier bug: if
> > > the excessive function calls reside in dead code, the main CFG traversal
> > > may not visit them; the subsequent traversal visits all instructions,
> > > including dead code.
> > >
> > > This case raises the question of how invalid dead code should be treated.
> >
> > Maybe we should do this check after dead code elimination to be
> > consistent with do_check? There could some other kinds of illegal stuff
>
> To be clear, are you suggesting we run check_max_stack_depth after the
> dead code elimination? That would indeed solve this issue, but Jakub made
> the exact reverse change not so long ago, in 9b38c40 ("bpf: verifier:
> reorder stack size check with dead code sanitization"). I think the idea
> was to avoid having code modifications in between code checks.
I think it's fine fix as it is.
I've applied it to bpf tree, since the verifier shouldn't be warning like this.
As far as changing the order back I think it's good to keep 'too many frames'
check before dead code elimination.
'too many frames' is similar to 'too many instructions'.
The verifier rejects large programs before removing dead code.
So in that sense it's similar.
