Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: Reduce stack consumption in check_stack_write_fixed_off

The fake_reg moved into env->fake_reg given it consumes a lot of stack
space (120 bytes). Migrate the fake_reg in check_stack_write_fixed_off()
as well now that we have it.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20240613115310.25383-2-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Daniel Borkmann and committed by
Alexei Starovoitov
e73cd1cf 92424801

+5 -4
+5 -4
kernel/bpf/verifier.c
··· 4549 4549 state->stack[spi].spilled_ptr.id = 0; 4550 4550 } else if (!reg && !(off % BPF_REG_SIZE) && is_bpf_st_mem(insn) && 4551 4551 env->bpf_capable) { 4552 - struct bpf_reg_state fake_reg = {}; 4552 + struct bpf_reg_state *tmp_reg = &env->fake_reg[0]; 4553 4553 4554 - __mark_reg_known(&fake_reg, insn->imm); 4555 - fake_reg.type = SCALAR_VALUE; 4556 - save_register_state(env, state, spi, &fake_reg, size); 4554 + memset(tmp_reg, 0, sizeof(*tmp_reg)); 4555 + __mark_reg_known(tmp_reg, insn->imm); 4556 + tmp_reg->type = SCALAR_VALUE; 4557 + save_register_state(env, state, spi, tmp_reg, size); 4557 4558 } else if (reg && is_spillable_regtype(reg->type)) { 4558 4559 /* register containing pointer is being spilled into stack */ 4559 4560 if (size != BPF_REG_SIZE) {