[PATCH] s390/bpf: perform r1 range checking before accessing jit->seen_reg[r1]

Subsystems: bpf jit for s390, bpf [general] (safe dynamic programs and tools), s390 architecture, the rest

STALE1869d LANDED

Landed in mainline as 91091656252f on 2021-07-15.

3 messages, 3 authors, 2021-07-15 · open the first message on its own page

[PATCH] s390/bpf: perform r1 range checking before accessing jit->seen_reg[r1]

From: Colin King <hidden>
Date: 2021-07-15 12:57:17

From: Colin Ian King <redacted>

Currently array jit->seen_reg[r1] is being accessed before the range
checking of index r1. The range changing on r1 should be performed
first since it will avoid any potential out-of-range accesses on the
array seen_reg[] and also it is more optimal to perform checks on
r1 before fetching data from the array.  Fix this by swapping the
order of the checks before the array access.

Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Colin Ian King <redacted>
---
 arch/s390/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 63cae0476bb4..2ae419f5115a 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -112,7 +112,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
 {
 	u32 r1 = reg2hex[b1];
 
-	if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
+	if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
 		jit->seen_reg[r1] = 1;
 }
 
-- 
2.31.1

Re: [PATCH] s390/bpf: perform r1 range checking before accessing jit->seen_reg[r1]

From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: 2021-07-15 17:02:27

On Thu, 2021-07-15 at 13:57 +0100, Colin King wrote:
quoted hunk
From: Colin Ian King <redacted>

Currently array jit->seen_reg[r1] is being accessed before the range
checking of index r1. The range changing on r1 should be performed
first since it will avoid any potential out-of-range accesses on the
array seen_reg[] and also it is more optimal to perform checks on
r1 before fetching data from the array.  Fix this by swapping the
order of the checks before the array access.

Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Colin Ian King <redacted>
---
 arch/s390/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/net/bpf_jit_comp.c
b/arch/s390/net/bpf_jit_comp.c
index 63cae0476bb4..2ae419f5115a 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -112,7 +112,7 @@ static inline void reg_set_seen(struct bpf_jit
*jit, u32 b1)
 {
        u32 r1 = reg2hex[b1];
 
-       if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
+       if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
                jit->seen_reg[r1] = 1;
 }
 
Looks good to me, thanks!

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

Re: [PATCH] s390/bpf: perform r1 range checking before accessing jit->seen_reg[r1]

From: patchwork-bot+netdevbpf@kernel.org
Date: 2021-07-15 17:50:08

Hello:

This patch was applied to bpf/bpf.git (refs/heads/master):

On Thu, 15 Jul 2021 13:57:12 +0100 you wrote:
From: Colin Ian King <redacted>

Currently array jit->seen_reg[r1] is being accessed before the range
checking of index r1. The range changing on r1 should be performed
first since it will avoid any potential out-of-range accesses on the
array seen_reg[] and also it is more optimal to perform checks on
r1 before fetching data from the array.  Fix this by swapping the
order of the checks before the array access.

[...]
Here is the summary with links:
  - s390/bpf: perform r1 range checking before accessing jit->seen_reg[r1]
    https://git.kernel.org/bpf/bpf/c/91091656252f

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help