Go to file
Eduard Zingerman b3698c356a bpf: callchain sensitive stack liveness tracking using CFG
This commit adds a flow-sensitive, context-sensitive, path-insensitive
data flow analysis for live stack slots:
- flow-sensitive: uses program control flow graph to compute data flow
  values;
- context-sensitive: collects data flow values for each possible call
  chain in a program;
- path-insensitive: does not distinguish between separate control flow
  graph paths reaching the same instruction.

Compared to the current path-sensitive analysis, this approach trades
some precision for not having to enumerate every path in the program.
This gives a theoretical capability to run the analysis before main
verification pass. See cover letter for motivation.

The basic idea is as follows:
- Data flow values indicate stack slots that might be read and stack
  slots that are definitely written.
- Data flow values are collected for each
  (call chain, instruction number) combination in the program.
- Within a subprogram, data flow values are propagated using control
  flow graph.
- Data flow values are transferred from entry instructions of callee
  subprograms to call sites in caller subprograms.

In other words, a tree of all possible call chains is constructed.
Each node of this tree represents a subprogram. Read and write marks
are collected for each instruction of each node. Live stack slots are
first computed for lower level nodes. Then, information about outer
stack slots that might be read or are definitely written by a
subprogram is propagated one level up, to the corresponding call
instructions of the upper nodes. Procedure repeats until root node is
processed.

In the absence of value range analysis, stack read/write marks are
collected during main verification pass, and data flow computation is
triggered each time verifier.c:states_equal() needs to query the
information.

Implementation details are documented in kernel/bpf/liveness.c.
Quantitative data about verification performance changes and memory
consumption is in the cover letter.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250918-callchain-sensitive-liveness-v3-6-c3cd27bacc60@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-09-19 09:27:23 -07:00
arch bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() 2025-09-17 11:20:32 -07:00
block vfs-6.17-rc6.fixes 2025-09-08 07:53:01 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: sha512 - Implement export_core() and import_core() 2025-09-02 19:02:39 -07:00
Documentation bpf: Enforce RCU protection for KF_RCU_PROTECTED 2025-09-18 15:36:17 -07:00
drivers Power management fixes for 6.17-rc6 2025-09-11 08:11:16 -07:00
fs for-6.17-rc5-tag 2025-09-11 08:01:18 -07:00
include bpf: callchain sensitive stack liveness tracking using CFG 2025-09-19 09:27:23 -07:00
init 20 hotfixes. 15 are cc:stable and the remainder address post-6.16 issues 2025-09-10 21:19:34 -07:00
io_uring vfs-6.17-rc6.fixes 2025-09-08 07:53:01 -07:00
ipc vfs-6.17-rc1.mmap_prepare 2025-07-28 13:43:25 -07:00
kernel bpf: callchain sensitive stack liveness tracking using CFG 2025-09-19 09:27:23 -07:00
lib hardening fixes for v6.17-rc4 2025-08-31 08:56:45 -07:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm 20 hotfixes. 15 are cc:stable and the remainder address post-6.16 issues 2025-09-10 21:19:34 -07:00
net bpf: Explicitly check accesses to bpf_sock_addr 2025-09-17 16:15:17 +02:00
rust Rust fixes for v6.17 (2nd) 2025-09-06 12:33:09 -07:00
samples ftrace/samples: Fix function size computation 2025-09-05 18:39:12 -04:00
scripts Rust fixes for v6.17 (2nd) 2025-09-06 12:33:09 -07:00
security + Features 2025-08-04 08:17:28 -07:00
sound ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model 2025-09-01 13:51:57 +02:00
tools bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD 2025-09-18 19:11:42 -07:00
usr usr/include: openrisc: don't HDRTEST bpf_perf_event.h 2025-05-12 15:03:17 +09:00
virt Merge tag 'kvm-x86-no_assignment-6.17' of https://github.com/kvm-x86/linux into HEAD 2025-07-29 08:36:42 -04:00
.clang-format Linux 6.15-rc5 2025-05-06 16:39:25 +10:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: Retire Ralf Baechle 2024-11-12 15:48:59 +01:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore gitignore: allow .pylintrc to be tracked 2025-07-02 17:10:04 -06:00
.mailmap MAINTAINERS: Update Nobuhiro Iwamatsu's email address 2025-09-01 10:36:10 +02:00
.pylintrc docs: add a .pylintrc file with sys path for docs scripts 2025-04-09 12:10:33 -06:00
.rustfmt.toml
COPYING
CREDITS MAINTAINERS: retire Boris from TLS maintainers 2025-08-26 17:36:01 -07:00
Kbuild drm: ensure drm headers are self-contained and pass kernel-doc 2025-02-12 10:44:43 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS for-6.17-rc5-tag 2025-09-11 08:01:18 -07:00
Makefile Linux 6.17-rc5 2025-09-07 14:22:57 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.