On Mon, Apr 20, 2020 at 5:28 PM Luke Nelson <lukenels@xxxxxxxxxxxxxxxxx> wrote:
> This patch fixes an off by one error in the RV32 JIT handling for BPF
> tail call. Currently, the code decrements TCC before checking if it
> is less than zero. This limits the maximum number of tail calls to 32
> instead of 33 as in other JITs. The fix is to instead check the old
> value of TCC before decrementing.
>
> Fixes: 5f316b65e99f ("riscv, bpf: Add RV32G eBPF JIT")
> Signed-off-by: Luke Nelson <luke.r.nels@xxxxxxxxx>
> ---
> arch/riscv/net/bpf_jit_comp32.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/net/bpf_jit_comp32.c b/arch/riscv/net/bpf_jit_comp32.c
> index 302934177760..11083d4d5f2d 100644
> --- a/arch/riscv/net/bpf_jit_comp32.c
> +++ b/arch/riscv/net/bpf_jit_comp32.c
> @@ -770,12 +770,13 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx)
> emit_bcc(BPF_JGE, lo(idx_reg), RV_REG_T1, off, ctx);
>
> /*
> - * if ((temp_tcc = tcc - 1) < 0)
> + * temp_tcc = tcc - 1;
> + * if (tcc < 0)
> * goto out;
> */
> emit(rv_addi(RV_REG_T1, RV_REG_TCC, -1), ctx);
> off = (tc_ninsn - (ctx->ninsns - start_insn)) << 2;
> - emit_bcc(BPF_JSLT, RV_REG_T1, RV_REG_ZERO, off, ctx);
> + emit_bcc(BPF_JSLT, RV_REG_TCC, RV_REG_ZERO, off, ctx);
Nice catch!
Acked-by: Xi Wang <xi.wang@xxxxxxxxx>
