diff --git a/include/linux/bpf.h b/include/linux/bpf.h index df8a260b1fc4d5848c89a53f5bb50595f62f8b91..8f74a65aae23beeed4cb933dae0da8af6d11202f 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1660,7 +1660,7 @@ struct bpf_array { }; }; -#define BPF_COMPLEXITY_LIMIT_INSNS 1000000 /* yes. 1M insns */ +extern int bpf_complexity_limit_insns; #define MAX_TAIL_CALL_CNT 33 /* Maximum number of loops for bpf_loop and bpf_iter_num. diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 4dfb7f2255045f2c63c4da81139c5276cc59966c..7cbd88b7fb0404c53a319e38821c3e01905df6aa 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -58,6 +58,7 @@ static DEFINE_SPINLOCK(link_idr_lock); int sysctl_unprivileged_bpf_disabled __read_mostly = IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0; +int bpf_complexity_limit_insns = 1000000; /* yes. 1M insns */ int bpf_complexity_limit_jmp_seq = 8192; int bpf_spec_v1 = 0; int bpf_spec_v1_complexity_limit_jmp_seq = 4096; @@ -2588,7 +2589,7 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) return -EPERM; if (attr->insn_cnt == 0 || - attr->insn_cnt > (bpf_capable() ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS)) + attr->insn_cnt > (bpf_capable() ? bpf_complexity_limit_insns : BPF_MAXINSNS)) return -E2BIG; if (type != BPF_PROG_TYPE_SOCKET_FILTER && type != BPF_PROG_TYPE_CGROUP_SKB && @@ -5486,6 +5487,13 @@ static struct ctl_table bpf_syscall_table[] = { .mode = 0644, .proc_handler = bpf_stats_handler, }, + { + .procname = "bpf_complexity_limit_insns", + .data = &bpf_complexity_limit_insns, + .maxlen = sizeof(bpf_complexity_limit_insns), + .mode = 0644, + .proc_handler = proc_dointvec, + }, { .procname = "bpf_complexity_limit_jmp_seq", .data = &bpf_complexity_limit_jmp_seq, diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 043be689adcd1939243e0f5b0b5efa63ce2fa5ec..a1f83bce25289a01785a93a7fe95d4962c879ad6 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -16227,7 +16227,7 @@ static int do_check(struct bpf_verifier_env *env) insn = &insns[env->insn_idx]; class = BPF_CLASS(insn->code); - if (++env->insn_processed > BPF_COMPLEXITY_LIMIT_INSNS) { + if (++env->insn_processed > bpf_complexity_limit_insns) { verbose(env, "BPF program is too large. Processed %d insn\n", env->insn_processed); @@ -18916,7 +18916,7 @@ static void print_verification_stats(struct bpf_verifier_env *env) } verbose(env, "processed %d insns (limit %d) max_states_per_insn %d " "total_states %d peak_states %d mark_read %d\n", - env->insn_processed, BPF_COMPLEXITY_LIMIT_INSNS, + env->insn_processed, bpf_complexity_limit_insns, env->max_states_per_insn, env->total_states, env->peak_states, env->longest_mark_read_walk); }