Thread (3 messages) flat view 3 messages, 2 authors, 2021-07-15

Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c

From: Colin Ian King <hidden>
Date: 2021-07-15 12:02:16
Also in: bpf, linux-s390, lkml

Hi

Static analysis with cppcheck picked up an interesting issue with the
following inline helper function in arch/s390/net/bpf_jit_comp.c :

static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
{
        u32 r1 = reg2hex[b1];

        if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
                jit->seen_reg[r1] = 1;
}

Although I believe r1 is always within range, the range check on r1 is
being performed before the more cache/memory expensive lookup on
jit->seen_reg[r1].  I can't see why the range change is being performed
after the access of jit->seen_reg[r1]. The following seems more correct:

	if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
                jit->seen_reg[r1] = 1;

..since the check on r1 are less expensive than !jit->seen_reg[r1] and
also the range check ensures the array access is not out of bounds. I
was just wondering if I'm missing something deeper to why the order is
the way it is.

Colin

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help