diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2015-07-13 14:49:32 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-07-13 16:11:41 -0400 |
| commit | c4675f935399cbdd3ba3869b0bf6c60528c8111a (patch) | |
| tree | f4ccb3f0c039382f2a3ce0a9247197a0712aeb03 | |
| parent | de551f2eb22a77a498cea9686f39e79f25329109 (diff) | |
ebpf: remove self-assignment in interpreter's tail call
ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1]
and thus has no effect. Add a comment instead, explaining what happens and
why it's okay to just remove it. Since from user space side, a tail call is
invoked as a pseudo helper function via bpf_tail_call_proto, the verifier
checks the arguments just like with any other helper function and makes
sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | kernel/bpf/core.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index c5bedc82bc1c..bf38f5e8196c 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c | |||
| @@ -453,7 +453,11 @@ select_insn: | |||
| 453 | if (unlikely(!prog)) | 453 | if (unlikely(!prog)) |
| 454 | goto out; | 454 | goto out; |
| 455 | 455 | ||
| 456 | ARG1 = BPF_R1; | 456 | /* ARG1 at this point is guaranteed to point to CTX from |
| 457 | * the verifier side due to the fact that the tail call is | ||
| 458 | * handeled like a helper, that is, bpf_tail_call_proto, | ||
| 459 | * where arg1_type is ARG_PTR_TO_CTX. | ||
| 460 | */ | ||
| 457 | insn = prog->insnsi; | 461 | insn = prog->insnsi; |
| 458 | goto select_insn; | 462 | goto select_insn; |
| 459 | out: | 463 | out: |
