Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c

3 messages, 2 authors, 2021-07-15 · open the first message on its own page

Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c

From: Colin Ian King <hidden>
Date: 2021-07-15 12:02:16

Hi

Static analysis with cppcheck picked up an interesting issue with the
following inline helper function in arch/s390/net/bpf_jit_comp.c :

static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
{
        u32 r1 = reg2hex[b1];

        if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
                jit->seen_reg[r1] = 1;
}

Although I believe r1 is always within range, the range check on r1 is
being performed before the more cache/memory expensive lookup on
jit->seen_reg[r1].  I can't see why the range change is being performed
after the access of jit->seen_reg[r1]. The following seems more correct:

	if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
                jit->seen_reg[r1] = 1;

..since the check on r1 are less expensive than !jit->seen_reg[r1] and
also the range check ensures the array access is not out of bounds. I
was just wondering if I'm missing something deeper to why the order is
the way it is.

Colin

Re: Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c

From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: 2021-07-15 12:09:53

On Thu, 2021-07-15 at 13:02 +0100, Colin Ian King wrote:
Hi

Static analysis with cppcheck picked up an interesting issue with the
following inline helper function in arch/s390/net/bpf_jit_comp.c :

static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
{
        u32 r1 = reg2hex[b1];

        if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
                jit->seen_reg[r1] = 1;
}

Although I believe r1 is always within range, the range check on r1
is
being performed before the more cache/memory expensive lookup on
jit->seen_reg[r1].  I can't see why the range change is being
performed
after the access of jit->seen_reg[r1]. The following seems more
correct:

        if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
                jit->seen_reg[r1] = 1;

..since the check on r1 are less expensive than !jit->seen_reg[r1]
and
also the range check ensures the array access is not out of bounds. I
was just wondering if I'm missing something deeper to why the order
is
the way it is.

Colin
Hi,

I think your analysis is correct, thanks for spotting this!
Even though I don't think the performance difference would be 
measurable here, not confusing future readers is a good reason
to make a change that you suggest.
Do you plan to send a patch?

Best regards,
Ilya

Re: Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c

From: Colin Ian King <hidden>
Date: 2021-07-15 12:40:25

On 15/07/2021 13:09, Ilya Leoshkevich wrote:
On Thu, 2021-07-15 at 13:02 +0100, Colin Ian King wrote:
quoted
Hi

Static analysis with cppcheck picked up an interesting issue with the
following inline helper function in arch/s390/net/bpf_jit_comp.c :

static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
{
        u32 r1 = reg2hex[b1];

        if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
                jit->seen_reg[r1] = 1;
}

Although I believe r1 is always within range, the range check on r1
is
being performed before the more cache/memory expensive lookup on
jit->seen_reg[r1].  I can't see why the range change is being
performed
after the access of jit->seen_reg[r1]. The following seems more
correct:

        if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
                jit->seen_reg[r1] = 1;

..since the check on r1 are less expensive than !jit->seen_reg[r1]
and
also the range check ensures the array access is not out of bounds. I
was just wondering if I'm missing something deeper to why the order
is
the way it is.

Colin
Hi,

I think your analysis is correct, thanks for spotting this!
Even though I don't think the performance difference would be 
measurable here, not confusing future readers is a good reason
to make a change that you suggest.
Do you plan to send a patch?
I'll send a patch later today.  Colin
Best regards,
Ilya

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help