Re: [PATCH bpf 1/2] bpf: Reject >8 byte return values on return-reading trampoline paths

[Yonghong Song <yonghong.song@linux.dev>]

On 7/10/26 7:58 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] The x86 BPF trampoline generation under-allocates stack space for 16-byte scalar arguments (e.g., __int128), leading to an out-of-bounds stack write that overwrites the saved RBP and return address.
> --
>
> --- Patch [1]: [PATCH bpf 1/2] bpf: Reject >8 byte return values on return-reading trampoline paths ---
> commit 8947b8106804bc7e7328c045366441fc0d165459
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Reject >8 byte return values on return-reading trampoline paths
>
> This patch rejects BPF trampoline attachments for types like fexit, fmod_ret,
> and struct_ops if the target function has a return value larger than 8 bytes.
> Previously, the trampoline accepted 16-byte return values (e.g., __int128) but
> only saved and restored 8 bytes, which corrupted the return value seen by the
> caller.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 6515d4d3c0032..26d281b77a6e7 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -19137,6 +19151,14 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
>>   		if (ret < 0)
>>   			return ret;
>>   
>> +		if (tgt_info->fmodel.ret_size > 8 &&
>> +		    attach_uses_trampoline_retval(prog->expected_attach_type)) {
> [Severity: High]
> This is a pre-existing issue, but while this patch addresses >8 byte return
> values, does the BPF trampoline also have a similar problem with >8 byte
> arguments?
>
> In kernel/bpf/btf.c:btf_distill_func_proto(), 16-byte arguments like __int128
> are accepted, but __get_type_fmodel_flags() does not set BTF_FMODEL_STRUCT_ARG
> for them because they are BTF_KIND_INT, not structs.
>
> In arch/x86/net/bpf_jit_comp.c:__arch_prepare_bpf_trampoline(), the stack
> size calculation relies on this flag:
>
> 		if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG)
> 			nr_regs += (m->arg_size[i] + 7) / 8 - 1;
>
> Because the flag isn't set for __int128, it is incorrectly counted as
> 1 register, under-allocating the stack space by 8 bytes per 16-byte
> scalar argument.
>
> Later during code generation, save_args() computes
> arg_regs = (m->arg_size[i] + 7) / 8, which evaluates to 2. It performs
> two 8-byte stack stores, which will underflow the allocated boundary and
> overwrite the saved RBP and potentially the return address.
>
> Could this lead to out-of-bounds stack writes for fentry/fexit programs
> attached to functions with 16-byte scalar arguments?

Looks like this indeed an issue for x86.
Since the __int128 issue exists for both return value and argument,
I will send v2 to address both of them together.

>
>> +			bpf_log(log,
>> +				"Attach to function %s with a >8 byte return value is not supported for this attach type\n",
>> +				tname);
>> +			return -EOPNOTSUPP;
>> +		}