Re: [PATCH bpf-next v5 00/16] bpf: Support stack arguments for BPF functions and kfuncs

Alexei Starovoitov
2026-04-18T18:47:07Z

On Sat Apr 18, 2026 at 9:39 AM PDT, Puranjay Mohan wrote:
> + /* call1: subprog_7args_inner_call(1,2,3,4,5,6,7)
> + * internally calls subprog_7args(1,2,3,4,5,100,200)=315
> + * which clobbers stack arg registers with 100, 200.
> + * Returns 315.
> + */
> + "r1 = 1;"
> + "r2 = 2;"
> + "r3 = 3;"
> + "r4 = 4;"
> + "r5 = 5;"
> + "*(u64 *)(r11 - 8) = 6;"
> + "*(u64 *)(r11 - 16) = 7;"
> + "call subprog_7args_with_inner_call;"
> + "r6 = r0;" /* 315 */
> + /* call2: reuse r11 stores from call1 (no re-store).
> + * subprog_7args(1,2,3,4,5,6,7) should return 28.
> + * If clobbered: subprog_7args(1,2,3,4,5,100,200)=315.
> + */
> + "r1 = 1;"
> + "r2 = 2;"
> + "r3 = 3;"
> + "r4 = 4;"
> + "r5 = 5;"
> + /*
> + * the 6th and 7th arg should be 6, 7 as set above.
> + * But the inner call in subprog_7args_inner_call clobbered
> + * them and reusing again without a re-store will be wrong.
> + */
> + "call subprog_7args;" /* should return 28, but will be 315 due to clobber */

Puranjay is correct.
The verifier should error here.
callee can modify 6 and 7th args in place in the stack.
All args register or stack are caller saved.
I believe it matches other archs.