Re: [PATCH bpf-next v5 1/2] bpf: Only enforce 8 frame call stack limit for all-static stacks

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Mar 13, 2026 at 10:40 PM EDT, Alexei Starovoitov wrote:
> On Wed, Mar 11, 2026 at 11:28 AM Emil Tsalapatis <emil@etsalapatis.com> wrote:
>>
>> The BPF verifier currently enforces a call stack depth of 8 frames,
>> regardless of the actual stack space consumption of those frames. The
>> limit is necessary for static call stacks, because the bookkeeping data
>> structures used by the verifier when stepping into static functions
>> during verification only support 8 stack frames. However, this
>> limitation only matters for static stack frames: Global subprogs are
>> verified by themselves and do not require limiting the call depth.
>>
>> Relax this limitation to only apply to static stack frames. Verification
>> now only fails when there is a sequence of 8 calls to non-global
>> subprogs. Calling into a global subprog resets the counter. This allows
>> deeper call stacks, provided all frames still fit in the stack.
>>
>> The change does not increase the maximum size of the call stack, only
>> the maximum number of frames we can place in it.
>>
>> Also change the progs/test_global_func3.c selftest to use static
>> functions, since with the new patch it would otherwise unexpectedly
>> pass verification.
>>
>> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
>> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
>> ---
>>  include/linux/bpf_verifier.h                  |  9 +++
>>  kernel/bpf/verifier.c                         | 62 +++++++++++++------
>>  .../selftests/bpf/progs/test_global_func3.c   | 18 +++---
>>  3 files changed, 61 insertions(+), 28 deletions(-)
>>
>> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
>> index 090aa26d1c98..f31194c2f0a8 100644
>> --- a/include/linux/bpf_verifier.h
>> +++ b/include/linux/bpf_verifier.h
>> @@ -742,6 +742,12 @@ struct bpf_scc_info {
>>
>>  struct bpf_liveness;
>>
>> +struct bpf_subprog_call_depth_info {
>> +       int ret_insn; /* caller instruction where we return to. */
>> +       int caller; /* caller subprogram idx */
>> +       int frame; /* # of consecutive static call stack frames on top of stack */
>> +};
>> +
>>  /* single container for all structs
>>   * one verifier_env per bpf_check() call
>>   */
>> @@ -851,6 +857,9 @@ struct bpf_verifier_env {
>>         u32 scc_cnt;
>>         struct bpf_iarray *succ;
>>         struct bpf_iarray *gotox_tmp_buf;
>> +
>> +       /* temporary state used for call frame depth calculation */
>> +       struct bpf_subprog_call_depth_info *dinfo;
>
> It doesn't have to be part of env, right?
> Could you just pass it as another argument to check_max_stack_depth_subprog() ?
>
> 'env' is for things that need to be around for most of the verifier's
> duration.
> This one was added to 'env' just to avoid an extra argument
> between check_max_stack_depth() and check_max_stack_depth_subprog().
> Why?
> Seems like a wrong tradeoff.
>
> and with that struct bpf_subprog_call_depth_info can be local
> in verifier.c?
>

Moving the struct out of env and into verifier.c is a strict improvement
over the current version, I will adjust the patch and respin.

> pw-bot: cr