netdev - Re: [PATCH bpf-next 4/7] s390: bpf: Fix off-by-one in tail call count limiting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2f97353921497b8d603cd5fff05e136d4bfcb430.camel@linux.ibm.com>
Date:   Mon, 09 Aug 2021 14:24:41 +0200
From:   Ilya Leoshkevich <iii@...ux.ibm.com>
To:     Johan Almbladh <johan.almbladh@...finetworks.com>, ast@...nel.org,
        daniel@...earbox.net, andrii@...nel.org
Cc:     kafai@...com, songliubraving@...com, yhs@...com,
        john.fastabend@...il.com, kpsingh@...nel.org,
        netdev@...r.kernel.org, bpf@...r.kernel.org,
        illusionist.neo@...il.com, zlim.lnx@...il.com,
        paulburton@...nel.org, naveen.n.rao@...ux.ibm.com,
        sandipan@...ux.ibm.com, luke.r.nels@...il.com, bjorn@...nel.org,
        hca@...ux.ibm.com, gor@...ux.ibm.com, davem@...emloft.net,
        udknight@...il.com
Subject: Re: [PATCH bpf-next 4/7] s390: bpf: Fix off-by-one in tail call
 count limiting

On Mon, 2021-08-09 at 11:34 +0200, Johan Almbladh wrote:
> Before, the eBPF JIT allowed up to MAX_TAIL_CALL_CNT + 1 tail calls.
> Now, precisely MAX_TAIL_CALL_CNT is allowed, which is in line with the
> behaviour of the interpreter. Verified with the test_bpf test suite
> on qemu-system-s390x.
> 
> Signed-off-by: Johan Almbladh <johan.almbladh@...finetworks.com>
> ---
>  arch/s390/net/bpf_jit_comp.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/s390/net/bpf_jit_comp.c
> b/arch/s390/net/bpf_jit_comp.c
> index 88419263a89a..f6cdf13285ed 100644
> --- a/arch/s390/net/bpf_jit_comp.c
> +++ b/arch/s390/net/bpf_jit_comp.c
> @@ -1363,7 +1363,7 @@ static noinline int bpf_jit_insn(struct bpf_jit
> *jit, struct bpf_prog *fp,
>                                  jit->prg);
>  
>                 /*
> -                * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
> +                * if (tail_call_cnt++ >= MAX_TAIL_CALL_CNT)
>                  *         goto out;
>                  */
>  
> @@ -1377,8 +1377,8 @@ static noinline int bpf_jit_insn(struct bpf_jit
> *jit, struct bpf_prog *fp,
>                 EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0,
> REG_15, off);
>                 /* clij %w1,MAX_TAIL_CALL_CNT,0x2,out */

This comment needs to be updated as well.

>                 patch_2_clij = jit->prg;
> -               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> MAX_TAIL_CALL_CNT,
> -                                2, jit->prg);
> +               EMIT6_PCREL_RIEC(0xec000000, 0x007f, REG_W1,
> +                                MAX_TAIL_CALL_CNT - 1, 2, jit->prg);
>  
>                 /*
>                  * prog = array->ptrs[index];

With that:

Tested-by: Ilya Leoshkevich <iii@...ux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@...ux.ibm.com>