From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 69-171-232-181.mail-mxout.facebook.com (69-171-232-181.mail-mxout.facebook.com [69.171.232.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D532D40912B for ; Fri, 10 Jul 2026 22:52:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=69.171.232.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783723943; cv=none; b=YE+Zw9cDde4Oeff5FmP0y2RaGxpWMd6NbTWOo1Pdpw9yq8WwSv2Uz+P5prfv9w04jWKNdvZARA1qCeNgPu/4giH3JsHU6IN4RLcONn8JY0J9X/uj51hwRHydwHg4PZM5sPsOZDDFz+fnv/C8CtpWlhE3aPBC7/d+kOt7/n3DNcY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783723943; c=relaxed/simple; bh=5HjyDVoT/7PCpCX78t1Hvn5ETIt76MrTeaLepuqyHjI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IBNjD827KtMTbBoK27N2zEF/FjyyiBFXbRcayjfKibk61Z2Br+1Ljox9VPYaKFnOvGh/uONH5ujEXxPBGVWU67lI8SK+rmL4+1WSSOyKl9R6i79FB6M5iv2skShWCydgOrsI6QfYIGd4G2mrn5/u3W0Q17wGhBGkWa9sTecuQrc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=69.171.232.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id 2017E1D7B99603; Fri, 10 Jul 2026 15:52:17 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , kernel-team@fb.com Subject: [PATCH bpf-next v3 2/3] bpf, x86: Fix trampoline stack size for 128-bit arguments Date: Fri, 10 Jul 2026 15:52:17 -0700 Message-ID: <20260710225217.4014393-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710225206.4013062-1-yonghong.song@linux.dev> References: <20260710225206.4013062-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size =3D=3D 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it. Fixes: a9c5ad31fbdc ("bpf: x86: Support in-register struct arguments in t= rampoline programs") Signed-off-by: Yonghong Song --- arch/x86/net/bpf_jit_comp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index de7515ea1bea..0b8bd30f7c87 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3369,11 +3369,8 @@ static int __arch_prepare_bpf_trampoline(struct bp= f_tramp_image *im, void *rw_im WARN_ON_ONCE((flags & BPF_TRAMP_F_INDIRECT) && (flags & ~(BPF_TRAMP_F_INDIRECT | BPF_TRAMP_F_RET_FENTRY_RET))); =20 - /* extra registers for struct arguments */ - for (i =3D 0; i < m->nr_args; i++) { - if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) - nr_regs +=3D (m->arg_size[i] + 7) / 8 - 1; - } + for (i =3D 0; i < m->nr_args; i++) + nr_regs +=3D (m->arg_size[i] + 7) / 8 - 1; =20 /* x86-64 supports up to MAX_BPF_FUNC_ARGS arguments. 1-6 * are passed through regs, the remains are through stack. --=20 2.53.0-Meta