[PATCH net-next] ebpf: remove self-assignment in interpreter's tail call

[PATCH net-next] ebpf: remove self-assignment in interpreter's tail call

[Daniel Borkmann]

ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1]
and thus has no effect. Add a comment instead, explaining what happens and
why it's okay to just remove it. Since from user space side, a tail call is
invoked as a pseudo helper function via bpf_tail_call_proto, the verifier
checks the arguments just like with any other helper function and makes
sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 kernel/bpf/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index c5bedc8..bf38f5e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -453,7 +453,11 @@ select_insn:
 		if (unlikely(!prog))
 			goto out;
 
-		ARG1 = BPF_R1;
+		/* ARG1 at this point is guaranteed to point to CTX from
+		 * the verifier side due to the fact that the tail call is
+		 * handeled like a helper, that is, bpf_tail_call_proto,
+		 * where arg1_type is ARG_PTR_TO_CTX.
+		 */
 		insn = prog->insnsi;
 		goto select_insn;
 out:
-- 
1.9.3

Re: [PATCH net-next] ebpf: remove self-assignment in interpreter's tail call

[Alexei Starovoitov]

On 7/13/15 11:49 AM, Daniel Borkmann wrote:
> ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1]
> and thus has no effect. Add a comment instead, explaining what happens and
> why it's okay to just remove it. Since from user space side, a tail call is
> invoked as a pseudo helper function via bpf_tail_call_proto, the verifier
> checks the arguments just like with any other helper function and makes
> sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX.
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Thanks!
Acked-by: Alexei Starovoitov <ast@plumgrid.com>

Re: [PATCH net-next] ebpf: remove self-assignment in interpreter's tail call

[David Miller]

From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 13 Jul 2015 20:49:32 +0200

> ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1]
> and thus has no effect. Add a comment instead, explaining what happens and
> why it's okay to just remove it. Since from user space side, a tail call is
> invoked as a pseudo helper function via bpf_tail_call_proto, the verifier
> checks the arguments just like with any other helper function and makes
> sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX.
> 
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Applied, thanks Daniel.