diff mbox series

[bpf-next,4/7] s390: bpf: Fix off-by-one in tail call count limiting

Message ID 20210809093437.876558-5-johan.almbladh@anyfinetworks.com (mailing list archive)
State Changes Requested
Delegated to: BPF
Headers show
Series Fix MAX_TAIL_CALL_CNT handling in eBPF JITs | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for bpf-next
netdev/subject_prefix success Link
netdev/cc_maintainers warning 2 maintainers not CCed: linux-s390@vger.kernel.org borntraeger@de.ibm.com
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 18 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link

Commit Message

Johan Almbladh Aug. 9, 2021, 9:34 a.m. UTC
Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls.
Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the
behaviour of the interpreter. Verified with the test_bpf test suite
on qemu-system-s390x.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
---
 arch/s390/net/bpf_jit_comp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Ilya Leoshkevich Aug. 9, 2021, 12:24 p.m. UTC | #1
On Mon, 2021-08-09 at 11:34 +0200, Johan Almbladh wrote:
> Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls.
> Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the
> behaviour of the interpreter. Verified with the test_bpf test suite
> on qemu-system-s390x.
> 
> Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
> ---
>  arch/s390/net/bpf_jit_comp.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/s390/net/bpf_jit_comp.c
> b/arch/s390/net/bpf_jit_comp.c
> index 88419263a89a..f6cdf13285ed 100644
> --- a/arch/s390/net/bpf_jit_comp.c
> +++ b/arch/s390/net/bpf_jit_comp.c
> @@ -1363,7 +1363,7 @@ static noinline int bpf_jit_insn(struct bpf_jit
> *jit, struct bpf_prog *fp,
>                                  jit->prg);
>  
>                 /*
> -                * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
> +                * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
>                  *         goto out;
>                  */
>  
> @@ -1377,8 +1377,8 @@ static noinline int bpf_jit_insn(struct bpf_jit
> *jit, struct bpf_prog *fp,
>                 EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0,
> REG_15, off);
>                 /* clij %w1,MAX_TAIL_CALL_CNT,0x2,out */

This comment needs to be updated as well.

>                 patch_2_clij = jit->prg;
> -               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> MAX_TAIL_CALL_CNT,
> -                                2, jit->prg);
> +               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> +                                MAX_TAIL_CALL_CNT - 1, 2, jit->prg);
>  
>                 /*
>                  * prog = array->ptrs[index];

With that:

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Johan Almbladh Aug. 9, 2021, 9:09 p.m. UTC | #2
On Mon, Aug 9, 2021 at 2:24 PM Ilya Leoshkevich <iii@linux.ibm.com> wrote:
>
> On Mon, 2021-08-09 at 11:34 +0200, Johan Almbladh wrote:
> > Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls.
> > Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the
> > behaviour of the interpreter. Verified with the test_bpf test suite
> > on qemu-system-s390x.
> >
> > Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
> > ---
> >  arch/s390/net/bpf_jit_comp.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/s390/net/bpf_jit_comp.c
> > b/arch/s390/net/bpf_jit_comp.c
> > index 88419263a89a..f6cdf13285ed 100644
> > --- a/arch/s390/net/bpf_jit_comp.c
> > +++ b/arch/s390/net/bpf_jit_comp.c
> > @@ -1363,7 +1363,7 @@ static noinline int bpf_jit_insn(struct bpf_jit
> > *jit, struct bpf_prog *fp,
> >                                  jit->prg);
> >
> >                 /*
> > -                * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
> > +                * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
> >                  *         goto out;
> >                  */
> >
> > @@ -1377,8 +1377,8 @@ static noinline int bpf_jit_insn(struct bpf_jit
> > *jit, struct bpf_prog *fp,
> >                 EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0,
> > REG_15, off);
> >                 /* clij %w1,MAX_TAIL_CALL_CNT,0x2,out */
>
> This comment needs to be updated as well.
>
> >                 patch_2_clij = jit->prg;
> > -               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> > MAX_TAIL_CALL_CNT,
> > -                                2, jit->prg);
> > +               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> > +                                MAX_TAIL_CALL_CNT - 1, 2, jit->prg);
> >
> >                 /*
> >                  * prog = array->ptrs[index];
>
> With that:
>
> Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
> Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
>

Fixing it. Thanks!
diff mbox series

Patch

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 88419263a89a..f6cdf13285ed 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1363,7 +1363,7 @@  static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 				 jit->prg);
 
 		/*
-		 * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
+		 * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
 		 *         goto out;
 		 */
 
@@ -1377,8 +1377,8 @@  static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0, REG_15, off);
 		/* clij %w1,MAX_TAIL_CALL_CNT,0x2,out */
 		patch_2_clij = jit->prg;
-		EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1, MAX_TAIL_CALL_CNT,
-				 2, jit->prg);
+		EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
+				 MAX_TAIL_CALL_CNT - 1, 2, jit->prg);
 
 		/*
 		 * prog = array->ptrs[index];