Re: [PATCH bpf-next v5 12/16] bpf: Enable stack argument support for x86_64

bot+bpf-ci
2026-04-18T01:04:19Z

[-- Attachment #1: Type: text/plain, Size: 1933 bytes --]

> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index e9b78040d703..32864dbc2c4e 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -3937,6 +3937,11 @@ bool bpf_jit_supports_kfunc_call(void)
> return true;
> }
>
> +bool bpf_jit_supports_stack_args(void)
> +{
> + return true;
> +}
> +

Does enabling this without the actual JIT implementation break bisection?

If bpf_jit_supports_stack_args() returns true, the verifier will allow
instructions using BPF_REG_PARAMS (register 11) to handle stack arguments.
However, since the JIT support isn't implemented in this commit, BPF_REG_PARAMS
is not yet defined in the JIT's reg2hex array.

Could this cause reg2hex[11] to implicitly default to 0, which maps to RAX
(BPF_REG_0)? If the verifier emits instructions using BPF_REG_PARAMS, the x86
JIT might miscompile them using RAX as the base register, potentially allowing
an arbitrary kernel memory write since R0 is controllable by the BPF program.

Additionally, it appears kfunc calls with >5 arguments won't have their
arguments correctly marshaled to the System V ABI (like moving the 6th argument
to R9), which could lead to reading uninitialized garbage from registers and
the stack.

The JIT implementation appears in a later commit in the series. Should the JIT
implementation be merged before or in the same patch as this feature enablement
to maintain bisection?

This concern was raised by sashiko-bot@kernel.org in v5 review:
https://lore.kernel.org/bpf/20260417050346.F2E3FC19425@smtp.kernel.org

> void *bpf_arch_text_copy(void *dst, void *src, size_t len)
> {
> if (text_poke_copy(dst, src, len) == NULL)

[ ... ]

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24592562564