diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2015-07-13 20:49:32 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-07-13 13:11:41 -0700 |
| commit | c4675f935399cbdd3ba3869b0bf6c60528c8111a (patch) | |
| tree | f4ccb3f0c039382f2a3ce0a9247197a0712aeb03 /kernel | |
| parent | de551f2eb22a77a498cea9686f39e79f25329109 (diff) | |
| download | linux-c4675f935399cbdd3ba3869b0bf6c60528c8111a.tar.bz2 | |
ebpf: remove self-assignment in interpreter's tail call
ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1]
and thus has no effect. Add a comment instead, explaining what happens and
why it's okay to just remove it. Since from user space side, a tail call is
invoked as a pseudo helper function via bpf_tail_call_proto, the verifier
checks the arguments just like with any other helper function and makes
sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/core.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index c5bedc82bc1c..bf38f5e8196c 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -453,7 +453,11 @@ select_insn: if (unlikely(!prog)) goto out; - ARG1 = BPF_R1; + /* ARG1 at this point is guaranteed to point to CTX from + * the verifier side due to the fact that the tail call is + * handeled like a helper, that is, bpf_tail_call_proto, + * where arg1_type is ARG_PTR_TO_CTX. + */ insn = prog->insnsi; goto select_insn; out: |