[PATCH bpf-next 2/7] arm64: bpf: Fix off-by-one in tail call count limiting
From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Date: 2021-08-09 09:35:16
Also in:
bpf
Subsystem:
arm64 port (aarch64 architecture), bpf jit for arm64, bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Catalin Marinas, Will Deacon, Daniel Borkmann, Alexei Starovoitov, Puranjay Mohan, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls. Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the behaviour of the interpreter. Verified with the test_bpf test suite on qemu-system-aarch64. Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> --- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 41c23f474ea6..cda53e33bbec 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c@@ -286,11 +286,11 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) emit(A64_CMP(0, r3, tmp), ctx); emit(A64_B_(A64_COND_CS, jmp_offset), ctx); - /* if (tail_call_cnt > MAX_TAIL_CALL_CNT) + /* if (tail_call_cnt >= MAX_TAIL_CALL_CNT) * goto out; * tail_call_cnt++; */ - emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx); + emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT - 1, ctx); emit(A64_CMP(1, tcc, tmp), ctx); emit(A64_B_(A64_COND_HI, jmp_offset), ctx); emit(A64_ADD_I(1, tcc, tcc, 1), ctx);
--
2.25.1