Re: [PATCH bpf-next v5 11/16] bpf: Support stack arguments for kfunc calls

bot+bpf-ci
2026-04-17T04:43:50Z

[-- Attachment #1: Type: text/plain, Size: 2566 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -20145,6 +20209,16 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
> if (!bpf_jit_supports_far_kfunc_call())
> insn->imm = BPF_CALL_IMM(desc->addr);
>
> + /*
> + * After resolving the kfunc address, insn->off is no longer needed
> + * for BTF fd index. Repurpose it to store the number of stack args
> + * so the JIT can marshal them.
> + */
> + if (desc->func_model.nr_args > MAX_BPF_FUNC_REG_ARGS)
> + insn->off = desc->func_model.nr_args - MAX_BPF_FUNC_REG_ARGS;
> + else
> + insn->off = 0;
> +

Is insn->off really "no longer needed for BTF fd index" after this
point? Looking at bpf_jit_find_kfunc_model() in kernel/bpf/fixups.c,
the function is called during JIT compilation from every BPF JIT backend
that supports kfunc calls (x86_32, s390, riscv64, ppc64, loongarch).

It performs a bsearch on the kfunc_tab keyed by (insn->imm, insn->off)
using kfunc_desc_cmp_by_imm_off:

kernel/bpf/fixups.c:kfunc_desc_cmp_by_imm_off() {
...
if (a->imm != b->imm)
return a->imm < b->imm ? -1 : 1;
if (a->offset != b->offset)
return a->offset < b->offset ? -1 : 1;
return 0;
}

The desc->offset was populated from the original insn->off during
bpf_add_kfunc_call(), where for module kfuncs it is a non-zero BTF fd
index.

The call order is:

bpf_check()
-> bpf_do_misc_fixups()
-> bpf_fixup_kfunc_call() (overwrites insn->off to 0 or stack_arg_count)
-> bpf_prog_select_runtime()
-> bpf_int_jit_compile()
-> arch JIT
-> bpf_jit_find_kfunc_model() (reads insn->off for bsearch key)

After this patch, for a kfunc with 5 or fewer args that lives in a
module (non-zero btf_fd_idx), insn->off is zeroed, and the bsearch will
fail to find the entry that was stored with offset=btf_fd_idx.

For kfuncs with more than 5 args, the new value of insn->off (stack arg
count) also will not match desc->offset (btf_fd_idx or 0), so module
kfuncs with stack args are also broken, and vmlinux kfuncs with more
than 5 args get a nonzero insn->off that no longer matches
desc->offset=0.

Can the stack arg count be communicated to the JIT without clobbering
the btf_fd_idx that bsearch still keys on?

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24546989054