Re: [PATCH 1/2] bpf, riscv: add support for timed may_goto

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The RISC-V BPF JIT unconditionally moves the native return value (a0) into BPF_REG_0 (a5) after calling arch_bpf_timed_may_goto, silently corrupting BPF_REG_0.
--

--- Patch [1]: [PATCH 1/2] bpf, riscv: add support for timed may_goto ---
commit ed55df1d87b981cbd59d17bd2c3b607f3fa418d9
Author: Feng Jiang <jiangfeng@kylinos.cn>

bpf, riscv: add support for timed may_goto

This patch implements arch_bpf_timed_may_goto() for the RV64 JIT. It also
enables bpf_jit_supports_timed_may_goto() to allow the verifier to use the
timed expansion path. The assembly trampoline is designed to preserve BPF
registers R0-R5 across the call to the generic bpf_check_timed_may_goto().

> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index c03c1de16b79a..9832a19200c75 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
[ ... ]
> @@ -2157,3 +2157,8 @@ bool bpf_jit_supports_fsession(void)
>  {
>  	return true;
>  }
> +
> +bool bpf_jit_supports_timed_may_goto(void)
> +{
> +	return true;
> +}

[Severity: Critical]
Will enabling this feature cause the JIT to silently corrupt BPF_REG_0?

When the verifier emits a call to arch_bpf_timed_may_goto with src_reg == 0,
the RISC-V JIT's BPF_JMP | BPF_CALL case handles it. Because src_reg !=
BPF_PSEUDO_CALL, it appears the JIT will unconditionally emit:

arch/riscv/net/bpf_jit_comp64.c:bpf_jit_emit_insn() {
	...
		if (insn->src_reg != BPF_PSEUDO_CALL)
			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
	...
}

Even though the new assembly trampoline properly restores BPF_REG_0 (a5) and
BPF_REG_1 (a0) before returning, won't this newly emitted mv a5, a0
instruction overwrite BPF_REG_0 with BPF_REG_1 immediately after the call
returns?

Since the verifier assumes BPF_REG_0 is untouched by may_goto, could this
allow unverified pointers in BPF_REG_1 to bypass the verifier and lead to
memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-riscv-bpf-timed-may-goto-v1-0-3988601fe6ac@kylinos.cn?part=1