netdev - Re: [PATCH bpf 1/2] bpf, riscv: limit to 33 tail calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Dec 2019 10:36:06 +0100
From:   Paul Chaignon <paul.chaignon@...nge.com>
To:     Björn Töpel <bjorn.topel@...il.com>
Cc:     Paul Burton <paulburton@...nel.org>,
        Mahshid Khezri <khezri.mahshid@...il.com>,
        paul.chaignon@...il.com, bpf <bpf@...r.kernel.org>,
        Netdev <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        linux-riscv@...ts.infradead.org
Subject: Re: [PATCH bpf 1/2] bpf, riscv: limit to 33 tail calls

On Mon, Dec 09, 2019 at 08:57:27PM +0100, Björn Töpel wrote:
> On Mon, 9 Dec 2019 at 19:52, Paul Chaignon <paul.chaignon@...nge.com> wrote:
> >
> > All BPF JIT compilers except RISC-V's and MIPS' enforce a 33-tail calls
> > limit at runtime.  In addition, a test was recently added, in tailcalls2,
> > to check this limit.
> >
> > This patch updates the tail call limit in RISC-V's JIT compiler to allow
> > 33 tail calls.  I tested it using the above selftest on an emulated
> > RISCV64.
> >
> 
> 33! ICK! ;-) Thanks for finding this!

Actually, Mahshid found it during her internship because she wanted to
check that the number of tail calls was limited.  And now I feel so
naive for trusting the doc...

> 
> Acked-by: Björn Töpel <bjorn.topel@...il.com>
> 
> > Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
> > Reported-by: Mahshid Khezri <khezri.mahshid@...il.com>
> > Signed-off-by: Paul Chaignon <paul.chaignon@...nge.com>
> > ---
> >  arch/riscv/net/bpf_jit_comp.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c
> > index 5451ef3845f2..7fbf56aab661 100644
> > --- a/arch/riscv/net/bpf_jit_comp.c
> > +++ b/arch/riscv/net/bpf_jit_comp.c
> > @@ -631,14 +631,14 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx)
> >                 return -1;
> >         emit(rv_bgeu(RV_REG_A2, RV_REG_T1, off >> 1), ctx);
> >
> > -       /* if (--TCC < 0)
> > +       /* if (TCC-- < 0)
> >          *     goto out;
> >          */
> >         emit(rv_addi(RV_REG_T1, tcc, -1), ctx);
> >         off = (tc_ninsn - (ctx->ninsns - start_insn)) << 2;
> >         if (is_13b_check(off, insn))
> >                 return -1;
> > -       emit(rv_blt(RV_REG_T1, RV_REG_ZERO, off >> 1), ctx);
> > +       emit(rv_blt(tcc, RV_REG_ZERO, off >> 1), ctx);
> >
> >         /* prog = array->ptrs[index];
> >          * if (!prog)
> > --
> > 2.17.1
> >