Re: [PATCH bpf-next v3 04/10] bpf, x86: add helper to emit kasan checks in x86 JITed programs

["Alexis Lothoré" <alexis.lothore@bootlin.com>]

On Wed Jul 1, 2026 at 12:16 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] emit_kasan_check() fails to save BPF_REG_AX (R10), leading to memory corruption when combined with constant blinding.
> --
>
> commit 4c7e1a72bec793ca4ed19fd754408dd627715a3c
> Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
>
> bpf, x86: add helper to emit kasan checks in x86 JITed programs
>
> This patch adds emit_kasan_check() to emit KASAN shadow memory checks before
> memory accesses in x86 JIT-compiled BPF programs. The helper saves temporary
> registers before calling the KASAN functions, but deliberately omits r10 and
> r11 to reduce overhead.
>
>> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
>> index 054e043ffcd22..68c5f9f94e5e2 100644
>> --- a/arch/x86/net/bpf_jit_comp.c
>> +++ b/arch/x86/net/bpf_jit_comp.c
>
> [ ... ]
>
>> @@ -1110,6 +1121,90 @@ static void maybe_emit_1mod(u8 **pprog, u32 reg, bool is64)
>>  	*pprog = prog;
>>  }
>>  
>> +static int emit_kasan_check(struct bpf_verifier_env *env, u8 **pprog,
>> +			    u32 addr_reg, struct bpf_insn *insn, u8 *ip,
>> +			    bool is_write, bool accesses_stack_only)
>> +{
>
> [ ... ]
>
>> +	/* Save r8 */
>> +	EMIT2(0x41, 0x50);
>> +	/* Save r9 */
>> +	EMIT2(0x41, 0x51);
>> +
>
> [Severity: Critical]
> Can this lead to data corruption when BPF constant blinding is enabled?
>
> The commit message notes that r10 and r11 are skipped here to reduce
> overhead. However, when constant blinding is enabled, bpf_jit_blind_insn()
> in kernel/bpf/core.c translates BPF_ST_MEM into a sequence that uses
> BPF_REG_AX (which maps to x86's r10) as the source register:
>
> kernel/bpf/core.c:bpf_jit_blind_insn() {
>         ...
>         case BPF_ST | BPF_MEM | BPF_DW:
>                 *to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^ from->imm);
>                 *to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
>                 *to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX,
>                                     from->off);
>         ...
> }
>
> When do_jit() processes this BPF_STX_MEM, it first calls emit_kasan_check(),
> which invokes the C function __asan_storeX. Since __asan_storeX is a standard
> C function, it is permitted by the System V AMD64 ABI to clobber caller-saved
> registers like r10.
>
> Upon returning from the KASAN check, r10 might contain garbage. Then do_jit()
> calls emit_stx() which will use this clobbered r10 as the data to be written,
> potentially writing corrupted data to memory.
>
> Should BPF_REG_AX (r10) be explicitly saved and restored here to prevent this?
>
>> +	/* mov rdi, addr_reg */
>> +	EMIT_mov(BPF_REG_1, addr_reg);
>> +

Sashiko keeps on raising concerns on r10/r11 being possibly clobbered by
_asan functions. It has been suggested in the RFC to drop those
registers, and I have already given a few elements here ([1]) and
proposed to keep those skipped anyway. No one raised complaints about
this so far, so unless it changes, I'll keep those registers skipped.

Alexis

[1] https://lore.kernel.org/all/DJ5HDX2K5CTF.YRZ9TDI6QCII@bootlin.com/


>
> [ ... ]




-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com