Skip to content

bpf: refactor max_depth computation in bpf_get_stack() #5825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kernel-patches-daemon-bpf-rc wants to merge 2 commits into from
Closed

bpf: refactor max_depth computation in bpf_get_stack() #5825

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7d7d2e2
bpf: refactor max_depth computation in bpf_get_stack()
ArnaudLcm Aug 26, 2025
da1451a
bpf: fix stackmap overflow check in __bpf_get_stackid()
ArnaudLcm Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 37 additions & 14 deletions kernel/bpf/stackmap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,28 @@ static inline int stack_map_data_size(struct bpf_map *map)
sizeof(struct bpf_stack_build_id) : sizeof(u64);
}

/**
* stack_map_calculate_max_depth - Calculate maximum allowed stack trace depth
* @size: Size of the buffer/map value in bytes
* @elem_size: Size of each stack trace element
* @flags: BPF stack trace flags (BPF_F_USER_STACK, BPF_F_USER_BUILD_ID, ...)
*
* Return: Maximum number of stack trace entries that can be safely stored
*/
static u32 stack_map_calculate_max_depth(u32 size, u32 elem_size, u64 flags)
{
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
u32 max_depth;
u32 curr_sysctl_max_stack = READ_ONCE(sysctl_perf_event_max_stack);

max_depth = size / elem_size;
max_depth += skip;
if (max_depth > curr_sysctl_max_stack)
return curr_sysctl_max_stack;

return max_depth;
}

static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
{
u64 elem_size = sizeof(struct stack_map_bucket) +
Expand Down Expand Up @@ -225,7 +247,7 @@ get_callchain_entry_for_task(struct task_struct *task, u32 max_depth)
}

static long __bpf_get_stackid(struct bpf_map *map,
struct perf_callchain_entry *trace, u64 flags)
struct perf_callchain_entry *trace, u64 flags, u32 max_depth)
{
struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
Expand All @@ -241,6 +263,8 @@ static long __bpf_get_stackid(struct bpf_map *map,

trace_nr = trace->nr - skip;
trace_len = trace_nr * sizeof(u64);
trace_nr = min(trace_nr, max_depth - skip);

ips = trace->ip + skip;
hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
id = hash & (smap->n_buckets - 1);
Expand Down Expand Up @@ -300,19 +324,17 @@ static long __bpf_get_stackid(struct bpf_map *map,
BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
u64, flags)
{
u32 max_depth = map->value_size / stack_map_data_size(map);
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
u32 elem_size = stack_map_data_size(map);
bool user = flags & BPF_F_USER_STACK;
struct perf_callchain_entry *trace;
bool kernel = !user;
u32 max_depth;

if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
return -EINVAL;

max_depth += skip;
if (max_depth > sysctl_perf_event_max_stack)
max_depth = sysctl_perf_event_max_stack;
max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);

trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
false, false);
Expand All @@ -321,7 +343,7 @@ BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
/* couldn't fetch the stack trace */
return -EFAULT;

return __bpf_get_stackid(map, trace, flags);
return __bpf_get_stackid(map, trace, flags, max_depth);
}

const struct bpf_func_proto bpf_get_stackid_proto = {
Expand Down Expand Up @@ -353,6 +375,7 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
bool kernel, user;
__u64 nr_kernel;
int ret;
u32 elem_size, max_depth;

/* perf_sample_data doesn't have callchain, use bpf_get_stackid */
if (!(event->attr.sample_type & PERF_SAMPLE_CALLCHAIN))
Expand All @@ -371,12 +394,13 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
return -EFAULT;

nr_kernel = count_kernel_ip(trace);

elem_size = stack_map_data_size(map);
if (kernel) {
__u64 nr = trace->nr;

trace->nr = nr_kernel;
ret = __bpf_get_stackid(map, trace, flags);
max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
ret = __bpf_get_stackid(map, trace, flags, max_depth);

/* restore nr */
trace->nr = nr;
Expand All @@ -388,7 +412,8 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
return -EFAULT;

flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
ret = __bpf_get_stackid(map, trace, flags);
max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
ret = __bpf_get_stackid(map, trace, flags, max_depth);
}
return ret;
}
Expand Down Expand Up @@ -438,10 +463,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
goto clear;
}

num_elem = size / elem_size;
max_depth = num_elem + skip;
if (sysctl_perf_event_max_stack < max_depth)
max_depth = sysctl_perf_event_max_stack;
max_depth = stack_map_calculate_max_depth(size, elem_size, flags);

if (may_fault)
rcu_read_lock(); /* need RCU for perf's callchain below */
Expand All @@ -460,6 +482,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
goto err_fault;
}

num_elem = size / elem_size;
trace_nr = trace->nr - skip;
trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
copy_len = trace_nr * elem_size;
Expand Down
Loading