Re: [PATCH bpf-next 07/12] bpf, x86: Place kfunc arguments per the SysV calling convention

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] emit_kfunc_args() and bpf_jit_kfunc_stack_slots() silently ignore kfunc_arg_layout() errors for kfuncs requiring more than 12 argument eightbytes, leading to miscompiled BPF programs with incorrect argument placements.
--

commit f5201014b232baff8f1ba36c0b74d2c3e1e5ccf9
Author: Yonghong Song <yonghong.song@linux.dev>

bpf, x86: Place kfunc arguments per the SysV calling convention

This commit updates the BPF JIT on x86 to conform to the SysV calling
convention when placing kfunc arguments. It adjusts argument placements
before a kfunc call to account for differing rules between BPF and SysV
regarding stack and register usage. The outgoing argument area is sized
to support both conventions.

> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
[ ... ]
> +static int emit_kfunc_args(const struct btf_func_model *fm, u8 **pprog,
> +			   s32 stack_base)
> +{
> +	u8 *prog = *pprog, *start = prog;
> +	bool done[MAX_BPF_FUNC_ARGS] = {};
> +	u8 pos[MAX_BPF_FUNC_ARGS];
> +	int i, j, n, todo = 0, parked = -1;
> +
> +	n = kfunc_arg_layout(fm, pos, ARRAY_SIZE(pos));
> +	if (n < 0)
> +		return 0;

[Severity: Medium]
Will this silently ignore errors if a kfunc requires more than 12 argument
eightbytes?

While the verifier limits the argument count to 12 (MAX_BPF_FUNC_ARGS),
arguments can take up to 2 slots, so the total slots could reach 24.
If a BPF program calls a registered kfunc that requires more than 12
eightbyte slots (such as 7 struct arguments of 16 bytes each),
kfunc_arg_layout() will return -EINVAL because max is hardcoded to 12 here.

Since emit_kfunc_args() returns 0 instead of propagating the error code,
could this cause the BPF program to compile successfully but execute with
missing argument shuffle instructions? It seems the kfunc might read garbage
from the 6th slot onwards, potentially causing panics or data corruption.

This same pattern of silently ignoring layout errors appears in
bpf_jit_kfunc_stack_slots():

kernel/bpf/core.c:bpf_jit_kfunc_stack_slots() {
	...
		n = layout(fm, pos, ARRAY_SIZE(pos));
		if (n < 0)
			continue;
	...
}

Does this also leave stack calculations undersized?

Though the stack corruption is mathematically averted because BPF's calling
convention stack requirements always equal or exceed SysV's (making
outgoing_rsp naturally sufficient), the silent argument corruption remains.
As there are currently no mainline kfuncs that take more than 12 slots,
this appears to be a latent regression.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904050957.3976119-1-yonghong.song@linux.dev?part=7