Re: [PATCH bpf-next 07/12] bpf, x86: Place kfunc arguments per the SysV calling convention

[Yonghong Song <yonghong.song@linux.dev>]

On 9/3/26 10:36 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] emit_kfunc_args() and bpf_jit_kfunc_stack_slots() silently ignore kfunc_arg_layout() errors for kfuncs requiring more than 12 argument eightbytes, leading to miscompiled BPF programs with incorrect argument placements.
> --
>
> commit f5201014b232baff8f1ba36c0b74d2c3e1e5ccf9
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf, x86: Place kfunc arguments per the SysV calling convention
>
> This commit updates the BPF JIT on x86 to conform to the SysV calling
> convention when placing kfunc arguments. It adjusts argument placements
> before a kfunc call to account for differing rules between BPF and SysV
> regarding stack and register usage. The outgoing argument area is sized
> to support both conventions.
>
>> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
>> --- a/arch/x86/net/bpf_jit_comp.c
>> +++ b/arch/x86/net/bpf_jit_comp.c
> [ ... ]
>> +static int emit_kfunc_args(const struct btf_func_model *fm, u8 **pprog,
>> +			   s32 stack_base)
>> +{
>> +	u8 *prog = *pprog, *start = prog;
>> +	bool done[MAX_BPF_FUNC_ARGS] = {};
>> +	u8 pos[MAX_BPF_FUNC_ARGS];
>> +	int i, j, n, todo = 0, parked = -1;
>> +
>> +	n = kfunc_arg_layout(fm, pos, ARRAY_SIZE(pos));
>> +	if (n < 0)
>> +		return 0;
> [Severity: Medium]
> Will this silently ignore errors if a kfunc requires more than 12 argument
> eightbytes?
>
> While the verifier limits the argument count to 12 (MAX_BPF_FUNC_ARGS),
> arguments can take up to 2 slots, so the total slots could reach 24.
> If a BPF program calls a registered kfunc that requires more than 12
> eightbyte slots (such as 7 struct arguments of 16 bytes each),
> kfunc_arg_layout() will return -EINVAL because max is hardcoded to 12 here.
>
> Since emit_kfunc_args() returns 0 instead of propagating the error code,
> could this cause the BPF program to compile successfully but execute with
> missing argument shuffle instructions? It seems the kfunc might read garbage
> from the 6th slot onwards, potentially causing panics or data corruption.
>
> This same pattern of silently ignoring layout errors appears in
> bpf_jit_kfunc_stack_slots():
>
> kernel/bpf/core.c:bpf_jit_kfunc_stack_slots() {
> 	...
> 		n = layout(fm, pos, ARRAY_SIZE(pos));
> 		if (n < 0)
> 			continue;
> 	...
> }
>
> Does this also leave stack calculations undersized?
>
> Though the stack corruption is mathematically averted because BPF's calling
> convention stack requirements always equal or exceed SysV's (making
> outgoing_rsp naturally sufficient), the silent argument corruption remains.
> As there are currently no mainline kfuncs that take more than 12 slots,
> this appears to be a latent regression.

This patch will be removed. I will simplify the jit.