Re: [PATCH bpf-next v5 00/16] bpf: Support stack arguments for BPF functions and kfuncs

Yonghong Song
2026-04-18T18:55:04Z

On 4/18/26 11:47 AM, Alexei Starovoitov wrote:
> On Sat Apr 18, 2026 at 9:39 AM PDT, Puranjay Mohan wrote:
>> + /* call1: subprog_7args_inner_call(1,2,3,4,5,6,7)
>> + * internally calls subprog_7args(1,2,3,4,5,100,200)=315
>> + * which clobbers stack arg registers with 100, 200.
>> + * Returns 315.
>> + */
>> + "r1 = 1;"
>> + "r2 = 2;"
>> + "r3 = 3;"
>> + "r4 = 4;"
>> + "r5 = 5;"
>> + "*(u64 *)(r11 - 8) = 6;"
>> + "*(u64 *)(r11 - 16) = 7;"
>> + "call subprog_7args_with_inner_call;"
>> + "r6 = r0;" /* 315 */
>> + /* call2: reuse r11 stores from call1 (no re-store).
>> + * subprog_7args(1,2,3,4,5,6,7) should return 28.
>> + * If clobbered: subprog_7args(1,2,3,4,5,100,200)=315.
>> + */
>> + "r1 = 1;"
>> + "r2 = 2;"
>> + "r3 = 3;"
>> + "r4 = 4;"
>> + "r5 = 5;"
>> + /*
>> + * the 6th and 7th arg should be 6, 7 as set above.
>> + * But the inner call in subprog_7args_inner_call clobbered
>> + * them and reusing again without a re-store will be wrong.
>> + */
>> + "call subprog_7args;" /* should return 28, but will be 315 due to clobber */
> Puranjay is correct.
> The verifier should error here.
> callee can modify 6 and 7th args in place in the stack.
> All args register or stack are caller saved.
> I believe it matches other archs.

Agree. verifier should do invalidation of stack argument slots after
copying states from caller to callee. I did have invalidation in v4:
https://lore.kernel.org/bpf/20260412045955.257613-1-yonghong.song@linux.dev/
In v5, I tried to do some optimization. But sashiko-bot and bot+bpf-ci
pointed the issue. I will bring back invalidation in verifier which
should fix the issue.