Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Range checking on r1 in function reg_set_seen in
 arch/s390/net/bpf_jit_comp.c
To:     Ilya Leoshkevich <iii@linux.ibm.com>,
        Michael Holzheu <holzheu@linux.vnet.ibm.com>,
        Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc:     Heiko Carstens <hca@linux.ibm.com>,
        Vasily Gorbik <gor@linux.ibm.com>,
        Christian Borntraeger <borntraeger@de.ibm.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        linux-s390@vger.kernel.org,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        bpf@vger.kernel.org,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
References: <845025d4-11b9-b16d-1dd6-1e0bd66b0e20@canonical.com>
 <8b280523cf98294bee897615de84546e241b4e11.camel@linux.ibm.com>
From:   Colin Ian King <colin.king@canonical.com>
Message-ID: <96c114c8-1369-05d3-6b44-78ac4e5e73fb@canonical.com>
Date:   Thu, 15 Jul 2021 13:40:20 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
MIME-Version: 1.0
In-Reply-To: <8b280523cf98294bee897615de84546e241b4e11.camel@linux.ibm.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 15/07/2021 13:09, Ilya Leoshkevich wrote:
> On Thu, 2021-07-15 at 13:02 +0100, Colin Ian King wrote:
>> Hi
>>
>> Static analysis with cppcheck picked up an interesting issue with the
>> following inline helper function in arch/s390/net/bpf_jit_comp.c :
>>
>> static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
>> {
>>         u32 r1 = reg2hex[b1];
>>
>>         if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
>>                 jit->seen_reg[r1] = 1;
>> }
>>
>> Although I believe r1 is always within range, the range check on r1
>> is
>> being performed before the more cache/memory expensive lookup on
>> jit->seen_reg[r1].  I can't see why the range change is being
>> performed
>> after the access of jit->seen_reg[r1]. The following seems more
>> correct:
>>
>>         if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
>>                 jit->seen_reg[r1] = 1;
>>
>> ..since the check on r1 are less expensive than !jit->seen_reg[r1]
>> and
>> also the range check ensures the array access is not out of bounds. I
>> was just wondering if I'm missing something deeper to why the order
>> is
>> the way it is.
>>
>> Colin
> 
> Hi,
> 
> I think your analysis is correct, thanks for spotting this!
> Even though I don't think the performance difference would be 
> measurable here, not confusing future readers is a good reason
> to make a change that you suggest.
> Do you plan to send a patch?

I'll send a patch later today.  Colin
> 
> Best regards,
> Ilya
>