Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

[linux.git] / kernel / bpf / verifier.c

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 39f2dcbc4cbc0021de60d8dcea178b2de93e74d1..1eddb713b815c3820dd996b4d34770e4c784ab71 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -140,7 +140,7 @@ struct bpf_verifier_stack_elem {
        struct bpf_verifier_stack_elem *next;
 };
 
-#define BPF_COMPLEXITY_LIMIT_INSNS     65536
+#define BPF_COMPLEXITY_LIMIT_INSNS     98304
 #define BPF_COMPLEXITY_LIMIT_STACK     1024
 
 #define BPF_MAP_PTR_POISON ((void *)0xeB9F + POISON_POINTER_DELTA)
@@ -2640,6 +2640,7 @@ static int check_cfg(struct bpf_verifier_env *env)
                                env->explored_states[t + 1] = STATE_LIST_MARK;
                } else {
                        /* conditional jump with two edges */
+                       env->explored_states[t] = STATE_LIST_MARK;
                        ret = push_insn(t, t + 1, FALLTHROUGH, env);
                        if (ret == 1)
                                goto peek_stack;
@@ -2798,6 +2799,12 @@ static bool states_equal(struct bpf_verifier_env *env,
                     rcur->type != NOT_INIT))
                        continue;
 
+               /* Don't care about the reg->id in this case. */
+               if (rold->type == PTR_TO_MAP_VALUE_OR_NULL &&
+                   rcur->type == PTR_TO_MAP_VALUE_OR_NULL &&
+                   rold->map_ptr == rcur->map_ptr)
+                       continue;
+
                if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
                    compare_ptrs_to_packet(rold, rcur))
                        continue;
@@ -2932,6 +2939,9 @@ static int do_check(struct bpf_verifier_env *env)
                        goto process_bpf_exit;
                }
 
+               if (need_resched())
+                       cond_resched();
+
                if (log_level > 1 || (log_level && do_print_state)) {
                        if (log_level > 1)
                                verbose("%d:", insn_idx);