Re: [PATCH v10 5/8] powerpc64/bpf: fix compare instruction emitted for tailcall

Thu, 06 Aug 2026 10:25:19 -0700 



On 05/08/26 11:37 am, Saket Kumar Bhaskar wrote:

From: Abhishek Dubey <[email protected]>

The tail_call_info field can contain either a scalar counter
value or a 64-bit pointer to the counter, using a 32-bit
compare (cmplwi) only checks the lower 32 bits, which can lead
to incorrect comparisions when location of counter is near 4GB
boundary. Use instruction cmpldi/cmplwi for accurate comparision
in corresponding cases.

Reported-by: [email protected]
Closes: https://lore.kernel.org/bpf/[email protected]/
Fixes: 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs")


Acked-by: Hari Bathini <[email protected]>

Signed-off-by: Abhishek Dubey <[email protected]>

Signed-off-by: Saket Kumar Bhaskar <[email protected]>
Tested-by: Yeswanth Krishna Tellakula <[email protected]>
---
  arch/powerpc/net/bpf_jit.h        | 6 ++++++
  arch/powerpc/net/bpf_jit_comp.c   | 2 +-
  arch/powerpc/net/bpf_jit_comp64.c | 8 ++++----
  3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index 6632de9871dd..af510da12d8e 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -188,6 +188,12 @@ struct codegen_context {

  
  #define bpf_to_ppc(r)	(ctx->b2p[r])
  
+#ifdef CONFIG_PPC64

+#define PPC_RAW_CMPLLI(a, i)    PPC_RAW_CMPLDI(a, i)
+#else
+#define PPC_RAW_CMPLLI(a, i)    PPC_RAW_CMPLWI(a, i)
+#endif
+
  #ifdef CONFIG_PPC32
  #define BPF_FIXUP_LEN 3 /* Three instructions => 12 bytes */
  #else
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 5d559d613f3a..8be5ded13a4a 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -768,7 +768,7 @@ static void bpf_trampoline_setup_tail_call_info(u32 *image, 
struct codegen_conte
                 * Setting the tail_call_info in trampoline's frame
                 * depending on if previous frame had value or reference.
                 */
-               EMIT(PPC_RAW_CMPLWI(_R3, MAX_TAIL_CALL_CNT));
+               EMIT(PPC_RAW_CMPLLI(_R3, MAX_TAIL_CALL_CNT));
                PPC_BCC_CONST_SHORT(COND_GT, 8);
                EMIT(PPC_RAW_ADDI(_R3, _R4, -BPF_PPC_TAILCALL));

  
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c

index 951eb10ca1f6..e80312171aa7 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -276,7 +276,7 @@ void bpf_jit_build_prologue(u32 *image, struct 
codegen_context *ctx)
                 */
                EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_2), _R1, 0));
                EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_1), bpf_to_ppc(TMP_REG_2), 
-(BPF_PPC_TAILCALL)));
-               EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+               EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
                PPC_BCC_CONST_SHORT(COND_GT, 8);
                EMIT(PPC_RAW_ADDI(bpf_to_ppc(TMP_REG_1), bpf_to_ppc(TMP_REG_2),
                                                                
-(BPF_PPC_TAILCALL)));
@@ -662,7 +662,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct 
codegen_context *ctx, u32 o
        PPC_BCC_SHORT(COND_GE, out);

  
  	EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_1), _R1, bpf_jit_stack_tailcallinfo_offset(ctx)));

-       EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+       EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
        PPC_BCC_CONST_SHORT(COND_LE, 8);

  
  	/* dereference TMP_REG_1 */

@@ -672,7 +672,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct 
codegen_context *ctx, u32 o
         * if (tail_call_info == MAX_TAIL_CALL_CNT)
         *   goto out;
         */
-       EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+       EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
        PPC_BCC_SHORT(COND_EQ, out);

  
  	/*

@@ -707,7 +707,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct 
codegen_context *ctx, u32 o
         * tail_call_info.
         */
        EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_2), _R1, 
bpf_jit_stack_tailcallinfo_offset(ctx)));
-       EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_2), MAX_TAIL_CALL_CNT));
+       EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_2), MAX_TAIL_CALL_CNT));
        PPC_BCC_CONST_SHORT(COND_GT, 8);

  
  	/* First get address of tail_call_info */

























					Reply via email to