From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: <sashiko-reviews@lists.linux.dev>, <bpf@vger.kernel.org>
Subject: Re: [PATCH bpf v2 7/9] bpf: One may_goto time slice per prog invocation
Date: Sat, 31 Oct 2026 22:30:50 +0000 [thread overview]
Message-ID: <DMJDO9F7MS0Q.1KWWWLKDATXA4@gmail.com> (raw)
In-Reply-To: <sashiko-outbox-192205@kernel.org>
On Sat, Oct 31, 2026 at 03:25 PM sashiko-bot@kernel.org <sashiko-bot@kernel.org> wrote:
>> + off = off >= 0 ? off + tail_cnt : off - jmp;
>> + if (off == (s16)off) {
>> + insn_buf[cnt++] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, off);
>
> [Severity: Medium]
> Can constant blinding cause the 16-bit jump offset in may_goto_expand_timed()
> to overflow S16_MIN on backward branches?
Not a bug. That's the limit of blinding, not of may_goto.
Blinding adds 2 insns to each insn with a constant. A loop body of 32K
insns with five constants in it fails with the same -ERANGE before this
patch. Every conditional jump of a prog has this limit.
[...]
>> + bpf_timed_may_goto_save(prog, &saved);
>> callback_fn((u64)(long)map, (u64)(long)key, (u64)(long)value, 0, 0);
>> + bpf_timed_may_goto_restore(prog, &saved);
>
> [Severity: Medium]
> What prevents bpf_timer_cb() and bpf_wq_work() from reading a mismatched pair
> of cb->prog and cb->callback_fn when bpf_async_update_prog_callback() runs
> concurrently?
Nothing. The race is there, but it's harmless.
Two progs have to set a callback on the same timer at the moment when it
fires. Then the callback uses the count and timestamp that its prog left
on this cpu. Nobody sets them anew, so the callback gets less time, never
more. The limit of 250 ms holds. The other prog gets its values back.
next prev parent reply other threads:[~2026-10-31 22:30 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-31 21:55 [PATCH bpf v2 0/9] bpf: One may_goto time slice per prog invocation Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 1/9] bpf: Emit timed may_goto for JITed progs only Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 2/9] selftests/bpf: Don't cast a pointer to .bss in arena_htab_asm Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 3/9] selftests/bpf: Give the first loop of cond_break5 an end Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 4/9] selftests/bpf: End the loop of parallel_test_bitmap after 50 ms Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 5/9] s390/bpf: Support internal-only MOV instruction to resolve per-CPU addrs Alexei Starovoitov
2026-10-31 22:26 ` bot+bpf-ci
2026-10-31 21:55 ` [PATCH bpf v2 6/9] bpf: Pass a pointer to arch_bpf_timed_may_goto() Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 7/9] bpf: One may_goto time slice per prog invocation Alexei Starovoitov
2026-10-31 22:25 ` sashiko-bot
2026-10-31 22:30 ` Alexei Starovoitov [this message]
2026-10-31 22:37 ` bot+bpf-ci
2026-10-31 22:50 ` Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 8/9] bpf: End bpf_loop() when the time of may_goto is up Alexei Starovoitov
2026-10-31 21:55 ` [PATCH bpf v2 9/9] selftests/bpf: Test one may_goto time slice per prog invocation Alexei Starovoitov
2026-10-31 22:12 ` sashiko-bot
2026-10-31 22:31 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMJDO9F7MS0Q.1KWWWLKDATXA4@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.