Re: [PATCH bpf-next v5 00/16] bpf: Support stack arguments for BPF functions and kfuncs

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sat Apr 18, 2026 at 9:39 AM PDT, Puranjay Mohan wrote:
> +               /* call1: subprog_7args_inner_call(1,2,3,4,5,6,7)
> +                * internally calls subprog_7args(1,2,3,4,5,100,200)=315
> +                * which clobbers stack arg registers with 100, 200.
> +                * Returns 315.
> +                */
> +               "r1 = 1;"
> +               "r2 = 2;"
> +               "r3 = 3;"
> +               "r4 = 4;"
> +               "r5 = 5;"
> +               "*(u64 *)(r11 - 8) = 6;"
> +               "*(u64 *)(r11 - 16) = 7;"
> +               "call subprog_7args_with_inner_call;"
> +               "r6 = r0;" /* 315 */
> +               /* call2: reuse r11 stores from call1 (no re-store).
> +                * subprog_7args(1,2,3,4,5,6,7) should return 28.
> +                * If clobbered: subprog_7args(1,2,3,4,5,100,200)=315.
> +                */
> +               "r1 = 1;"
> +               "r2 = 2;"
> +               "r3 = 3;"
> +               "r4 = 4;"
> +               "r5 = 5;"
> +               /*
> +                * the 6th and 7th arg should be 6, 7 as set above.
> +                * But the inner call in subprog_7args_inner_call clobbered
> +                * them and reusing again without a re-store will be wrong.
> +                */
> +               "call subprog_7args;" /* should return 28, but will be 315 due to clobber */

Puranjay is correct.
The verifier should error here.
callee can modify 6 and 7th args in place in the stack.
All args register or stack are caller saved.
I believe it matches other archs.