Re: [PATCH bpf-next v2 11/20] bpf, x86: Dispatch exception cleanup pads at run time

[Yonghong Song <yonghong.song@linux.dev>]

On 9/17/26 10:03 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] bpf, x86: garbage kfunc stack arguments in exception cleanup pads
> --
>
> commit 1e32297a3c2c4f6bbc4d458bc25563bed8167f6c
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf, x86: Dispatch exception cleanup pads at run time
>
> This commit provides the architecture-specific support for x86-64 exception
> cleanup pads. It forces a full callee-saved spill for programs with a cleanup
> table and introduces arch_bpf_run_cleanup_pad to execute the pads.
>
>> diff --git a/arch/x86/net/bpf_cleanup_pad.S b/arch/x86/net/bpf_cleanup_pad.S
>> new file mode 100644
>> index 0000000000000..da4b448ecf095
>> --- /dev/null
>> +++ b/arch/x86/net/bpf_cleanup_pad.S
> [ ... ]
>
>> +SYM_FUNC_START(arch_bpf_run_cleanup_pad)
>> +	ANNOTATE_NOENDBR
>> +
>> +	pushq %rbp
>> +	pushq %rbx
>> +	pushq %r12
>> +	pushq %r13
>> +	pushq %r14
>> +	pushq %r15
>> +	/* Keep the pad's entry rsp congruent to a normal call's. */
>> +	subq $8, %rsp
>> +
>> +	movq 0(%rdx), %r15
>> +	movq 8(%rdx), %r14
>> +	movq 16(%rdx), %r13
>> +	movq 24(%rdx), %rbx
>> +	movq 32(%rdx), %r12
>> +	/* rbp is BPF r10, so this is the whole of the pad's frame setup. */
>> +	movq %rsi, %rbp
>> +
>> +	/* CALL_NOSPEC needs the target in a register; rcx is BPF r4, dead. */
>> +	movq %rdi, %rcx
>> +
>> +	/* BPF r0 on the way into a pad, not whatever the kernel left in rax. */
>> +	movl $BPF_PAD_ENTRY_R0, %eax
>> +
>> +	CALL_NOSPEC rcx
> [Severity: High]
> Does this execution environment cause kfuncs with more than 5 arguments
> to read uninitialized garbage stack arguments?

We should be okay since we already have:

+       if (bpf_pseudo_kfunc_call(insn)) {
+               struct bpf_call_summary cs;
+
+               if (bpf_get_call_summary(env, insn, &cs) &&
+                   cs.arg_slot_cnt > MAX_BPF_FUNC_REG_ARGS) {
+                       verbose(env,
+                               "insn %u passes an on-stack call argument in an exception cleanup landing pad\n",
+                               i);
+                       return -EINVAL;
+               }
+       }

>
> In arch_bpf_run_cleanup_pad, the pad is executed on the unwinder's
> stack (rsp), while rbp is set to the original BPF frame.
>
> However, the JIT unconditionally writes outgoing kfunc stack arguments
> relative to BPF_REG_FP (rbp), as seen in emit_kfunc_arg_moves in
> arch/x86/net/bpf_jit_comp.c:
>
>                  else if (dst_mem)
>                          emit_stx(&prog, BPF_DW, BPF_REG_FP, reg,
>                                   stack_base + (dst - nreg) * 8);
>
> Because rbp and rsp are desynchronized in the pad, the arguments are
> written to the old frame. When the kfunc is called, the C calling
> convention requires it to read stack arguments from [rsp], which points
> to the unwinder's stack instead of the original frame, leading to
> garbage reads.
>