path: root/kernel/bpf
diff options
authorDaniel Borkmann <>2015-07-13 20:49:32 +0200
committerDavid S. Miller <>2015-07-13 13:11:41 -0700
commitc4675f935399cbdd3ba3869b0bf6c60528c8111a (patch)
treef4ccb3f0c039382f2a3ce0a9247197a0712aeb03 /kernel/bpf
parentde551f2eb22a77a498cea9686f39e79f25329109 (diff)
ebpf: remove self-assignment in interpreter's tail call
ARG1 = BPF_R1 as it stands, evaluates to regs[BPF_REG_1] = regs[BPF_REG_1] and thus has no effect. Add a comment instead, explaining what happens and why it's okay to just remove it. Since from user space side, a tail call is invoked as a pseudo helper function via bpf_tail_call_proto, the verifier checks the arguments just like with any other helper function and makes sure that the first argument (regs[BPF_REG_1])'s type is ARG_PTR_TO_CTX. Signed-off-by: Daniel Borkmann <> Acked-by: Alexei Starovoitov <> Signed-off-by: David S. Miller <>
Diffstat (limited to 'kernel/bpf')
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index c5bedc82bc1c..bf38f5e8196c 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -453,7 +453,11 @@ select_insn:
if (unlikely(!prog))
goto out;
- ARG1 = BPF_R1;
+ /* ARG1 at this point is guaranteed to point to CTX from
+ * the verifier side due to the fact that the tail call is
+ * handeled like a helper, that is, bpf_tail_call_proto,
+ * where arg1_type is ARG_PTR_TO_CTX.
+ */
insn = prog->insnsi;
goto select_insn;