Re: [PATCH bpf-next v3 6/7] bpf,x86: Fix exception unwinding with outgoing stack arguments

[Yonghong Song <yonghong.song@linux.dev>]

On 5/15/26 8:51 PM, Kumar Kartikeya Dwivedi wrote:
> On Sat May 16, 2026 at 12:51 AM CEST, Yonghong Song wrote:
>> When a main program with exception_boundary has outgoing stack
>> arguments (e.g. from calling subprogs with >5 args), bpf_throw() fails
>> to correctly restore callee-saved registers, causing a kernel crash.
>>
>> The x86 JIT allocates the outgoing stack arg area below the
>> callee-saved registers via 'sub rsp, outgoing_rsp' in the prologue.
>> When bpf_throw() unwinds, it captures the main program's sp (which
>> includes this outgoing area) and passes it to the exception callback.
>> The callback gets rsp and rbp, followed by pop_callee_regs, but rsp
>> points into the outgoing arg area rather than the callee-saved
>> registers, so the pops restore garbage values. Returning to the
>> kernel with corrupted callee-saved registers causes a crash.
>>
>> Fix this by passing the main program's outgoing_rsp as the 4th
>> argument to the exception callback. The callback adjusts rsp with
>> 'add rsp, rcx' before popping callee-saved registers, correctly
>> skipping the outgoing arg area. When outgoing_rsp is 0 (the common
>> case), this is a no-op.
>>
>> Fixes: 324c3ca6eed6 ("bpf,x86: Implement JIT support for stack arguments")
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
> Do we need any adjustment for arm64?

Yes, after this patch lands, Puranjay can help with arm64 side.

>
> For this patch:
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
>> [...]