Re: [PATCH bpf-next 4/7] s390: bpf: Fix off-by-one in tail call count limiting
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: 2021-08-09 12:25:06
Also in:
bpf
On Mon, 2021-08-09 at 11:34 +0200, Johan Almbladh wrote:
quoted hunk ↗ jump to hunk
Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls. Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the behaviour of the interpreter. Verified with the test_bpf test suite on qemu-system-s390x. Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> --- arch/s390/net/bpf_jit_comp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)diff --git a/arch/s390/net/bpf_jit_comp.cb/arch/s390/net/bpf_jit_comp.c index 88419263a89a..f6cdf13285ed 100644--- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c@@ -1363,7 +1363,7 @@ static noinline int bpf_jit_insn(struct bpf_jit*jit, struct bpf_prog *fp, jit->prg); /* - * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT) + * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT) * goto out; */@@ -1377,8 +1377,8 @@ static noinline int bpf_jit_insn(struct bpf_jit*jit, struct bpf_prog *fp, EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0, REG_15, off); /* clij %w1,MAX_TAIL_CALL_CNT,0x2,out */
This comment needs to be updated as well.
patch_2_clij = jit->prg; - EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1, MAX_TAIL_CALL_CNT, - 2, jit->prg); + EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1, + MAX_TAIL_CALL_CNT - 1, 2, jit->prg); /* * prog = array->ptrs[index];
With that: Tested-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>