)]}'
{
  "commit": "a0595f9128766f4e2268f9759647426b7e42b5b7",
  "tree": "05bdb559c5f30e6b33bee86806885a4b0fa9c525",
  "parents": [
    "74cb00063155925f157328087a76d1909df91832"
  ],
  "author": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Wed Nov 28 21:16:04 2018 -0800"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Fri Nov 30 19:59:07 2018 -0800"
  },
  "message": "bpf: add per-insn complexity limit\n\nmalicious bpf program may try to force the verifier to remember\na lot of distinct verifier states.\nPut a limit to number of per-insn \u0027struct bpf_verifier_state\u0027.\nNote that hitting the limit doesn\u0027t reject the program.\nIt potentially makes the verifier do more steps to analyze the program.\nIt means that malicious programs will hit BPF_COMPLEXITY_LIMIT_INSNS sooner\ninstead of spending cpu time walking long link list.\n\nThe limit of BPF_COMPLEXITY_LIMIT_STATES\u003d\u003d64 affects cilium progs\nwith slight increase in number of \"steps\" it takes to successfully verify\nthe programs:\n                       before    after\nbpf_lb-DLB_L3.o         1940      1940\nbpf_lb-DLB_L4.o         3089      3089\nbpf_lb-DUNKNOWN.o       1065      1065\nbpf_lxc-DDROP_ALL.o     28052  |  28162\nbpf_lxc-DUNKNOWN.o      35487  |  35541\nbpf_netdev.o            10864     10864\nbpf_overlay.o           6643      6643\nbpf_lcx_jit.o           38437     38437\n\nBut it also makes malicious program to be rejected in 0.4 seconds vs 6.5\nHence apply this limit to unprivileged programs only.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "09f0d964abbbf93b0fd0ddfc30f4c9fa1390f461",
      "old_mode": 33188,
      "old_path": "kernel/bpf/verifier.c",
      "new_id": "0b1fcbd151fe99fe2ba32ca1ecf82cf71fc13a8f",
      "new_mode": 33188,
      "new_path": "kernel/bpf/verifier.c"
    }
  ]
}