Re: [PATCH bpf-next v4 02/10] bpf: mark instructions accessing program stack

["Alexis Lothoré" <alexis.lothore@bootlin.com>]

On Wed Jul 8, 2026 at 10:10 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] In `adjust_insn_aux_data()`, when replacing an instruction with a single new instruction (`cnt == 1`), `data[off].non_stack_access` is incorrectly set by evaluating `is_mem_insn(insn)` instead of `is_mem_insn(insn + off)`.
> --
>
> --- Patch [2]: [PATCH bpf-next v4 02/10] bpf: mark instructions accessing program stack ---
> commit 764c11844e954d2fc0370d170803b0deb684733a
> Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
>
> bpf: mark instructions accessing program stack
>
> This commit introduces tracking of instructions that access non-stack memory
> to help JIT compilers emit KASAN checks. It adds logic to mark BPF
> instructions as stack-only by default and overrides this if any state
> indicates non-stack access, including adjustments during verifier patching.
>
>> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
>> index f515fc9669ce2..feee1f33de9d5 100644
>> --- a/kernel/bpf/fixups.c
>> +++ b/kernel/bpf/fixups.c
>
> [ ... ]
>
>> @@ -172,8 +184,14 @@ static void adjust_insn_aux_data(struct bpf_verifier_env *env,
>>  	 */
>>  	data[off].zext_dst = insn_has_def32(insn + off + cnt - 1);
>>  
>> -	if (cnt == 1)
>> +	if (cnt == 1) {
>> +		/* A non-memory accessing insn could have been replaced by a
>> +		 * memory accessing insn, systematically mark it for non-stack
>> +		 * access
>> +		 */
>> +		data[off].non_stack_access = is_mem_insn(insn);
>
> [Severity: High]
> Should this check be using is_mem_insn(insn + off) instead of
> is_mem_insn(insn)?

Aouch, true, my mistake.

> Since insn points to the start of the program (new_prog->insnsi), calling
> is_mem_insn(insn) evaluates the very first instruction of the program rather
> than the newly patched instruction at the targeted offset.
>
> If the first instruction happens to not be a memory access, will this
> incorrectly mark the patched instruction as not accessing non-stack memory
> and cause us to miss KASAN instrumentation?
>
>>  		return;
>> +	}
>>  	prog_len = new_prog->len;




-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com