Re: [PATCH bpf-next 03/11] bpf: Raise the bound on a program's signature size

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index a93a8dc427d8c..575c4e5e44432 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -20972,6 +20972,13 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  	return 0;
>  }
>
> +/*
> + * Upper bound on the PKCS#7 signature blob passed with a program. Comfortably
> + * above the largest signature the kernel can verify, and far below anything
> + * that would make rejecting a load expensive.
> + */
> +#define BPF_PROG_MAX_SIGNATURE_SIZE	(64 * 1024)
> +
>  static enum bpf_sig_keyring bpf_classify_keyring(s32 keyring_id)
>  {
>  	switch (keyring_id) {
> @@ -21011,13 +21018,10 @@ static int bpf_prog_verify_signature(struct bpf_verifier_env *env,
>  	u64 data_sz;
>  	int err = 0;
>
> -	/*
> -	 * Don't attempt to use kmalloc_large or vmalloc for signatures.
> -	 * Practical signature for BPF program should be below this limit.
> -	 */
>  	if (!attr->signature_size ||
> -	    attr->signature_size > KMALLOC_MAX_CACHE_SIZE)
> +	    attr->signature_size > BPF_PROG_MAX_SIGNATURE_SIZE)
>  		return -EINVAL;
> +

Does this replacement actually lower the accepted signature size on
kernels with PAGE_SIZE >= 64 KiB?

The old bound was page-size dependent (include/linux/slab.h):

  #define KMALLOC_SHIFT_HIGH    (PAGE_SHIFT + 1)
  #define KMALLOC_MAX_CACHE_SIZE        (1UL << KMALLOC_SHIFT_HIGH)

so the previously accepted maximum was:

  PAGE_SIZE 4 KiB  -> 8 KiB    (new 64 KiB: raised)
  PAGE_SIZE 16 KiB -> 32 KiB   (new 64 KiB: raised)
  PAGE_SIZE 64 KiB -> 128 KiB  (new 64 KiB: HALVED)

On CONFIG_ARM64_64K_PAGES or ppc64 64K-page kernels, a BPF_PROG_LOAD
carrying a signature blob between 64 KiB and 128 KiB was accepted by the
pre-patch kernel and now returns -EINVAL. There is no other place that
validates attr->signature_size, so nothing softens the new rejection.

The changelog only describes the 4 KiB-page case ("signature_size is
bounded by KMALLOC_MAX_CACHE_SIZE, which is 8 KiB on a 4 KiB page system")
and frames the change purely as "Raise the bound"; the reduction on
64 KiB-page configurations is not mentioned.

Is the intent to make the ABI page-size independent? If so, should the
changelog say that explicitly? Or if the intent is only to raise, should
the constant be >= 128 KiB (or max(64 KiB, KMALLOC_MAX_CACHE_SIZE))?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32530917987