Commit 5c1a3765 authored by Yonghong Song's avatar Yonghong Song Committed by Alexei Starovoitov
Browse files

bpf: Limit up to 512 bytes for bpf_global_percpu_ma allocation 



For percpu data structure allocation with bpf_global_percpu_ma,
the maximum data size is 4K. But for a system with large
number of cpus, bigger data size (e.g., 2K, 4K) might consume
a lot of memory. For example, the percpu memory consumption
with unit size 2K and 1024 cpus will be 2K * 1K * 1k = 2GB
memory.

We should discourage such usage. Let us limit the maximum data
size to be 512 for bpf_global_percpu_ma allocation.

Acked-by: default avatarHou Tao <houtao1@huawei.com>
Signed-off-by: default avatarYonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20231222031801.1290841-1-yonghong.song@linux.dev


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 0e2ba9f9

kernel/bpf/verifier.c

+8 −0
Original line number Diff line number Diff line
@@ -195,6 +195,8 @@ struct bpf_verifier_stack_elem { 
					  POISON_POINTER_DELTA))

#define BPF_MAP_PTR(X)		((struct bpf_map *)((X) & ~BPF_MAP_PTR_UNPRIV))









#define BPF_GLOBAL_PERCPU_MA_MAX_SIZE  512

















static int acquire_reference_state(struct bpf_verifier_env *env, int insn_idx);









static int release_reference(struct bpf_verifier_env *env, int ref_obj_id);









static void invalidate_non_owning_refs(struct bpf_verifier_env *env);








@@ -12160,6 +12162,12 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,







				}

















				if (meta.func_id == special_kfunc_list[KF_bpf_percpu_obj_new_impl]) {









					if (ret_t->size > BPF_GLOBAL_PERCPU_MA_MAX_SIZE) {









						verbose(env, "bpf_percpu_obj_new type size (%d) is greater than %d\n",









							ret_t->size, BPF_GLOBAL_PERCPU_MA_MAX_SIZE);









						return -EINVAL;









					}

















					if (!bpf_global_percpu_ma_set) {









						mutex_lock(&bpf_percpu_ma_lock);









						if (!bpf_global_percpu_ma_set) {