From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 66-220-144-179.mail-mxout.facebook.com (66-220-144-179.mail-mxout.facebook.com [66.220.144.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C65A379C59 for ; Fri, 10 Jul 2026 18:22:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.220.144.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783707748; cv=none; b=HBOiW6QvKyrkSihgkQTbdDmpKSM2o9mEqMSdcL2jlbVse4XuC3kqQK5QAfrvrOI8AhjLY5uV0ju4KzYtyV2k0AIY6M6RR3wfKhVDrgQcePLYv99RSM5s0kGvea2HVVvVhwwkwMmLrfFFEhfY7JSv7FZd9bvVEbStS2Vav858tys= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783707748; c=relaxed/simple; bh=5HjyDVoT/7PCpCX78t1Hvn5ETIt76MrTeaLepuqyHjI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ns7llaWc5YAQSIrFg3XTR8P17ItgVQmK2B3BRR4ImvrMZLdAVoxRcWhTuR+qdIILVoyH4tR66WNiSVrD5IuwHBcBUSjXlS1Lgqll8JmsUWfDkgEpIPZCPIWOP1SARZSdv8uB3uB/i/MNY3X3A7PNQYnNGBitufxK1Tu2F1zbXok= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=66.220.144.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id 8758E1D718DAB9; Fri, 10 Jul 2026 11:22:14 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , kernel-team@fb.com Subject: [PATCH bpf v2 2/3] bpf, x86: Fix trampoline stack size for 128-bit arguments Date: Fri, 10 Jul 2026 11:22:14 -0700 Message-ID: <20260710182214.1087571-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710182204.1085329-1-yonghong.song@linux.dev> References: <20260710182204.1085329-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size =3D=3D 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it. Fixes: a9c5ad31fbdc ("bpf: x86: Support in-register struct arguments in t= rampoline programs") Signed-off-by: Yonghong Song --- arch/x86/net/bpf_jit_comp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index de7515ea1bea..0b8bd30f7c87 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3369,11 +3369,8 @@ static int __arch_prepare_bpf_trampoline(struct bp= f_tramp_image *im, void *rw_im WARN_ON_ONCE((flags & BPF_TRAMP_F_INDIRECT) && (flags & ~(BPF_TRAMP_F_INDIRECT | BPF_TRAMP_F_RET_FENTRY_RET))); =20 - /* extra registers for struct arguments */ - for (i =3D 0; i < m->nr_args; i++) { - if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) - nr_regs +=3D (m->arg_size[i] + 7) / 8 - 1; - } + for (i =3D 0; i < m->nr_args; i++) + nr_regs +=3D (m->arg_size[i] + 7) / 8 - 1; =20 /* x86-64 supports up to MAX_BPF_FUNC_ARGS arguments. 1-6 * are passed through regs, the remains are through stack. --=20 2.53.0-Meta