From c4fbc5592da0f759cff184d1cf6752ed4de4b14c Mon Sep 17 00:00:00 2001
From: Maria Matejka <mq@ucw.cz>
Date: Thu, 13 Jun 2024 15:49:56 +0200
Subject: [PATCH] Filter global values are not used directly from config

---
 conf/conf.c     |  1 +
 filter/config.Y |  3 +++
 filter/filter.c | 25 +++++++++++++++++++++++--
 filter/filter.h |  1 +
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/conf/conf.c b/conf/conf.c
index 02a750a4..981db709 100644
--- a/conf/conf.c
+++ b/conf/conf.c
@@ -139,6 +139,7 @@ config_parse(struct config *c)
     goto cleanup;
 
   cf_lex_init(NULL, c);
+  filter_preconfig(c);
   sysdep_preconfig(c);
   protos_preconfig(c);
   mpls_preconfig(c);
diff --git a/filter/config.Y b/filter/config.Y
index 353e27ae..4d8b30c7 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -401,6 +401,9 @@ CF_KEYWORDS(FUNCTION, PRINT, PRINTN, UNSET, RETURN,
 CF_GRAMMAR
 
 conf: FILTER STACKS expr expr ';' {
+  if (($3 < 16) || ($4 < 16))
+    /* Check for self-crippling values */
+    cf_error("Filter stack values lesser than 16 not supported");
   new_config->filter_vstk = $3;
   new_config->filter_estk = $4;
  }
diff --git a/filter/filter.c b/filter/filter.c
index fd2c16b1..c9a49bac 100644
--- a/filter/filter.c
+++ b/filter/filter.c
@@ -50,6 +50,15 @@ enum f_exception {
   FE_RETURN = 0x1,
 };
 
+/* Global filter runtime */
+static struct {
+  _Atomic u16 filter_vstk;
+  _Atomic u16 filter_estk;
+} global_filter_runtime = {
+  .filter_vstk = 128,
+  .filter_estk = 128,
+};
+
 struct filter_exec_stack {
   const struct f_line *line;		/* The line that is being executed */
   uint pos;				/* Instruction index in the line */
@@ -90,9 +99,9 @@ _Thread_local static struct filter_state filter_state;
 
 void (*bt_assert_hook)(int result, const struct f_line_item *assert);
 
-#define _f_stack_init(fs, px, def) ((fs).stack.px##stk = alloca(sizeof(*(fs).stack.px##stk) * ((fs).stack.px##len = (config && config->filter_##px##stk) ? config->filter_##px##stk : (def))))
+#define _f_stack_init(fs, px) ((fs).stack.px##stk = alloca(sizeof(*(fs).stack.px##stk) * ((fs).stack.px##len = atomic_load_explicit(&global_filter_runtime.filter_##px##stk, memory_order_relaxed))))
 
-#define f_stack_init(fs) ( _f_stack_init(fs, v, 128), _f_stack_init(fs, e, 128) )
+#define f_stack_init(fs) ( _f_stack_init(fs, v), _f_stack_init(fs, e) )
 
 static struct tbf rl_runtime_err = TBF_DEFAULT_LOG_LIMITS;
 
@@ -340,12 +349,24 @@ filter_same(const struct filter *new, const struct filter *old)
   return new->sym->flags & SYM_FLAG_SAME;
 }
 
+/* Initialize filter knobs */
+void
+filter_preconfig(struct config *new)
+{
+  new->filter_vstk = 128;
+  new->filter_estk = 128;
+}
+
 /**
  * filter_commit - do filter comparisons on all the named functions and filters
  */
 void
 filter_commit(struct config *new, struct config *old)
 {
+  /* Update filter stack size variables */
+  atomic_store_explicit(&global_filter_runtime.filter_vstk, new->filter_vstk, memory_order_relaxed);
+  atomic_store_explicit(&global_filter_runtime.filter_estk, new->filter_estk, memory_order_relaxed);
+
   if (!old)
     return;
 
diff --git a/filter/filter.h b/filter/filter.h
index 8d495e2d..d76d1d49 100644
--- a/filter/filter.h
+++ b/filter/filter.h
@@ -70,6 +70,7 @@ const char *filter_name(const struct filter *filter);
 int filter_same(const struct filter *new, const struct filter *old);
 int f_same(const struct f_line *f1, const struct f_line *f2);
 
+void filter_preconfig(struct config *new);
 void filter_commit(struct config *new, struct config *old);
 
 void filters_dump_all(void);