Re: [PATCH v1 3/4] LoongArch: BPF: Refactor jump offset calculation in tail call

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Spurious JIT compilation failure for large BPF programs with tail calls due to invalid jump offset calculation in the first JIT pass.
--

commit c7d3e2cbf4a615b76ec73b1fff169ff7f13381b9
Author: Tiezhu Yang <yangtiezhu@loongson.cn>

LoongArch: BPF: Refactor jump offset calculation in tail call

This patch modifies the jump offset calculation in emit_bpf_tail_call()
to use an absolute target reference anchor based on the next instruction
offset, ensuring immediate offsets land precisely on instruction boundaries.

> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
[ ... ]
> @@ -310,12 +306,12 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int insn)
[ ... ]
>  	off = offsetof(struct bpf_array, map.max_entries);
>  	emit_insn(ctx, ldwu, t1, a1, off);
>  	/* bgeu $a2, $t1, jmp_offset */
> +	jmp_offset = ctx->offset[insn + 1] - ctx->idx;
>  	if (emit_tailcall_jmp(ctx, BPF_JGE, a2, t1, jmp_offset) < 0)
>  		goto toofar;

[Severity: High]
Does this calculation cause large BPF programs to fail JIT compilation during
the first pass?

During the first JIT pass, ctx->offset[insn + 1] is not yet populated and will
be 0. As a result, jmp_offset evaluates to -ctx->idx. 

If ctx->idx exceeds 32767 for a large program, jmp_offset will fail the 16-bit
bounds check inside emit_tailcall_jmp(), causing JIT compilation to abort
prematurely.

Previously, jmp_offset used a small relative offset which safely fit within
the 16-bit limit during the initial pass.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630022705.11536-1-yangtiezhu@loongson.cn?part=3