linux-kernel - [PATCH] bpf/verifier: compress bpf_reg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260115152037.449362-1-realwujing@gmail.com>
Date: Thu, 15 Jan 2026 23:20:37 +0800
From: wujing <realwujing@...il.com>
To: Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>
Cc: Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	KP Singh <kpsingh@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>,
	Jiri Olsa <jolsa@...nel.org>,
	bpf@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	wujing <realwujing@...il.com>,
	Qiliang Yuan <yuanql9@...natelecom.cn>
Subject: [PATCH] bpf/verifier: compress bpf_reg_state by using bitfields

The struct bpf_reg_state is 112 bytes long on 64-bit architectures,
with several fields that have limited ranges. In particular, the bool
'precise' at the end causes 7 bytes of padding.

This patch packs 'frameno', 'subreg_def', and 'precise' into a single
u32/s32 bitfield block:
- frameno: 4 bits (sufficient for MAX_CALL_FRAMES=8)
- subreg_def: 27 bits (sufficient for 1M insns limit)
- precise: 1 bit

This reduces the size of struct bpf_reg_state from 112 to 104 bytes,
saving 8 bytes per register. This also reduces the size of
struct bpf_stack_state. Overall, it reduces peak memory usage of the
verifier for complex programs with millions of states.

The patch also updates states_maybe_looping() to use a non-bitfield
boundary for memcmp(), as offsetof() cannot be used on bitfields.

Signed-off-by: wujing <realwujing@...il.com>
Signed-off-by: Qiliang Yuan <yuanql9@...natelecom.cn>
---
 include/linux/bpf_verifier.h | 6 +++---
 kernel/bpf/verifier.c        | 6 ++++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 562f7e63be29..0f83360afb03 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -196,14 +196,14 @@ struct bpf_reg_state {
 	 * is used which is an index in bpf_verifier_state->frame[] array
 	 * pointing to bpf_func_state.
 	 */
-	u32 frameno;
+	u32 frameno:4;
 	/* Tracks subreg definition. The stored value is the insn_idx of the
 	 * writing insn. This is safe because subreg_def is used before any insn
 	 * patching which only happens after main verification finished.
 	 */
-	s32 subreg_def;
+	s32 subreg_def:27;
 	/* if (!precise && SCALAR_VALUE) min/max/tnum don't affect safety */
-	bool precise;
+	bool precise:1;
 };
 
 enum bpf_stack_slot_type {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 378341e1177f..5e5b831a518c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19641,10 +19641,12 @@ static bool states_maybe_looping(struct bpf_verifier_state *old,
 
 	fold = old->frame[fr];
 	fcur = cur->frame[fr];
-	for (i = 0; i < MAX_BPF_REG; i++)
+	for (i = 0; i < MAX_BPF_REG; i++) {
 		if (memcmp(&fold->regs[i], &fcur->regs[i],
-			   offsetof(struct bpf_reg_state, frameno)))
+			   offsetof(struct bpf_reg_state, ref_obj_id) +
+			   sizeof(fold->regs[i].ref_obj_id)))
 			return false;
+	}
 	return true;
 }
 
-- 
2.39.5