Re: [PATCH bpf-next v4 2/6] riscv, bpf: Remove redundant ctx->offset initialization

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Buffer Overflow / JIT Convergence Failure due to violated monotonic shrinking guarantee
--

commit 1c7e15d4942628f7431314e8bb5d6ca1fb3134f1
Author: Pu Lehui <pulehui@huawei.com>

riscv, bpf: Remove redundant ctx->offset initialization

This commit removes the loop initializing ctx->offset and prev_ninsns in
bpf_int_jit_compile, operating under the assumption that the implicit
zero-initialization is sufficient and the manual setup is redundant.

> diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
> --- a/arch/riscv/net/bpf_jit_core.c
> +++ b/arch/riscv/net/bpf_jit_core.c
> @@ -79,11 +79,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  	if (build_body(ctx, extra_pass, NULL))
>  		goto out_offset;
>  
> -	for (i = 0; i < prog->len; i++) {
> -		prev_ninsns += 32;
> -		ctx->offset[i] = prev_ninsns;
> -	}
> -

[Severity: Critical]
Could removing this worst-case initialization loop cause a regression by
breaking the monotonic shrinking guarantee of the JIT convergence algorithm?

When ctx->offset is simply zero-initialized, forward branches will initially
evaluate to a zero or negative distance in the first pass. This causes the
JIT to emit short branch instructions. As targets resolve to their actual
positive offsets in subsequent passes, these branch distances increase,
which forces the JIT to expand the branch instructions.

Can this lead to a situation where a branch expands while another shrinks
by the same amount, resulting in a net zero size change for that pass?

If the JIT falsely detects convergence because ctx->ninsns equals
prev_ninsns, it allocates a fixed-size executable buffer based on that
length. In the final emission pass, if internal offsets shift again and
cause a branch to expand unexpectedly, would this result in an out-of-bounds
write past the allocated buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629140048.733346-1-pulehui@huaweicloud.com?part=2