Re: [PATCH bpf-next v3 0/3] bpf: Fix trampoline handling of 128-bit values

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Sat Jul 11, 2026 at 12:52 AM CEST, Yonghong Song wrote:
> The BPF trampoline preserves only 8 bytes of a target function's return
> value (R0), and its register save area under-allocates space for 128-bit
> arguments for x86_64. These two problems lead to memory corruption or
> incorrect values observed by BPF programs and the real caller.
>
> This series fixes both issues and adds two selftests, otherwise, each of
> them will fail if without the corresponding fix.
>

This is almost ready, but CI currently fails for tracing_struct tests. [0]

My AI agent suggests the following root cause, which sounds like a pahole issue.

"
• The failure is caused by missing module BTF, not by the trampoline fix itself.

  tracing_struct/int128_args fails with -ESRCH because pahole omits
  bpf_testmod_test_int128_arg() from bpf_testmod.ko’s BTF. The failure occurs
  before the BPF program attaches; see .kdev/logs/vm-cmd.log:3.

  The problematic signature is tools/testing/selftests/bpf/test_kmods/bpf_testmod.c:184:

  bpf_testmod_test_int128_arg(__int128 a, int b, long c)

  On x86-64:

  - a consumes rdi:rsi.
  - b, the second source parameter, is therefore in rdx.
  - pahole maps the second parameter positionally to rsi, sees b in rdx, and
    marks the function as having unexpected register usage.
  - Kernel BTF generation enables consistent_func, so the complete function is
    omitted from BTF (scripts/Makefile.btf:17).

  Verbose pahole confirmed:

  bpf_testmod_test_int128_arg : skipping BTF encoding of function due to unexpected register usage for parameter

  This also means the comment claiming that putting __int128 first prevents the pahole issue is incorrect.

  A scratch probe with the exact kdev Clang and pahole showed:

  int128_first : skipping BTF encoding ...
  FUNC int128_last ...

  The likely test correction is to use:

  bpf_testmod_test_int128_arg(int b, long c, __int128 a)

  and update tools/testing/selftests/bpf/progs/tracing_struct_int128.c:12 to
  read b from ctx[0], c from ctx[1], and the return value from ctx[4]. With two
  preceding scalar registers, the 128-bit argument starts at an even register
  pair on arm64 too. This still exercises the four-slot allocation that the x86
  patch fixes.
"

  [0]: https://github.com/kernel-patches/bpf/pull/12778

> Changelogs:
>   v2 -> v3:
>     - v2: https://lore.kernel.org/bpf/20260710182204.1085329-1-yonghong.song@linux.dev/
>     - Align __int128 argument at even position enforced by arm64.
>   v1 -> v2:
>     - v1: https://lore.kernel.org/bpf/20260710144404.2579671-1-yonghong.song@linux.dev/
>     - Also handle __int128 arguments for x86_64.
>
> Yonghong Song (3):
>   bpf: Reject >8 byte return values on return-reading trampoline paths
>   bpf, x86: Fix trampoline stack size for 128-bit arguments
>   selftests/bpf: Add tests for >8 byte return value and 128-bit
>     arguments
>
>  arch/x86/net/bpf_jit_comp.c                   |  7 ++--
>  kernel/bpf/bpf_struct_ops.c                   | 12 +++++++
>  kernel/bpf/verifier.c                         | 25 +++++++++++++
>  .../bpf/prog_tests/tracing_failure.c          | 12 +++++++
>  .../selftests/bpf/prog_tests/tracing_struct.c | 36 +++++++++++++++++++
>  .../selftests/bpf/progs/tracing_failure.c     |  6 ++++
>  .../bpf/progs/tracing_struct_int128.c         | 18 ++++++++++
>  .../selftests/bpf/test_kmods/bpf_testmod.c    | 32 +++++++++++++++++
>  8 files changed, 143 insertions(+), 5 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/progs/tracing_struct_int128.c