Currently, tailcall count is incremented in the interpreter even when tailcall fails due to non-existent prog. Fix this by holding off on the tailcall count increment until after NULL check on the prog. Fixes: 04fd61ab36ec ("bpf: allow bpf programs to tail-call other bpf programs") Suggested-by: Ilya Leoshkevich Signed-off-by: Hari Bathini --- kernel/bpf/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 1b9b18e5b03c..3f6b2263c8e0 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2057,12 +2057,12 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) if (unlikely(tail_call_cnt >= MAX_TAIL_CALL_CNT)) goto out; - tail_call_cnt++; - prog = READ_ONCE(array->ptrs[index]); if (!prog) goto out; + tail_call_cnt++; + /* ARG1 at this point is guaranteed to point to CTX from * the verifier side due to the fact that the tail call is * handled like a helper, that is, bpf_tail_call_proto, -- 2.53.0