Messages in this thread | | | From | Colin Ian King <> | Subject | Range checking on r1 in function reg_set_seen in arch/s390/net/bpf_jit_comp.c | Date | Thu, 15 Jul 2021 13:02:10 +0100 |
| |
Hi
Static analysis with cppcheck picked up an interesting issue with the following inline helper function in arch/s390/net/bpf_jit_comp.c :
static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) { u32 r1 = reg2hex[b1];
if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15) jit->seen_reg[r1] = 1; }
Although I believe r1 is always within range, the range check on r1 is being performed before the more cache/memory expensive lookup on jit->seen_reg[r1]. I can't see why the range change is being performed after the access of jit->seen_reg[r1]. The following seems more correct:
if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1]) jit->seen_reg[r1] = 1;
..since the check on r1 are less expensive than !jit->seen_reg[r1] and also the range check ensures the array access is not out of bounds. I was just wondering if I'm missing something deeper to why the order is the way it is.
Colin
| |