Re: [PATCH bpf-next v4 04/10] bpf, x86: add helper to emit kasan checks in x86 JITed programs

["Alexis Lothoré" <alexis.lothore@bootlin.com>]

On Wed Jul 8, 2026 at 10:16 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] emit_kasan_check() fails to save caller-saved registers r10 (BPF_REG_AX) and r11 (AUX_REG), causing them to be clobbered by C KASAN helpers.
> - [Low] The static function emit_kasan_check() is defined but never called, leading to a -Wunused-function compiler warning and build failure.

[...]

>> +static int emit_kasan_check(struct bpf_verifier_env *env, u8 **pprog,
>> +			    u32 addr_reg, struct bpf_insn *insn, u8 *ip,
>> +			    bool is_write, bool accesses_stack_only)
>> +{
>
> [Severity: Low]
> Does this introduce a -Wunused-function compiler warning? The static function
> emit_kasan_check() is added here but does not appear to be called anywhere in
> this patch. This could cause build failures on setups with -Werror, breaking
> git bisectability.

True, that standalone definition was intended to ease the review. I'll
keep it as is, unless anyone requires this to be squashed in the commit
actually calling the new helper.

[...]

>> +	/* Save rax */
>> +	EMIT1(0x50);
>> +	/* Save rcx */
>> +	EMIT1(0x51);
>> +	/* Save rdx */
>> +	EMIT1(0x52);
>> +	/* Save rsi */
>> +	EMIT1(0x56);
>> +	/* Save rdi */
>> +	EMIT1(0x57);
>> +	/* Save r8 */
>> +	EMIT2(0x41, 0x50);
>> +	/* Save r9 */
>> +	EMIT2(0x41, 0x51);
>
> [Severity: High]
> Could omitting r10 and r11 here lead to data corruption? 
>
> The commit message mentions skipping them to reduce overhead, but the called
> C functions (__asan_loadX, __asan_storeX) follow the System V AMD64 ABI and
> might clobber caller-saved registers like r10 and r11. 
>
> In the x86 BPF JIT, r10 is mapped to BPF_REG_AX, which is used across
> instructions to hold state (such as during constant blinding rewrites where
> BPF_ST_MEM is transformed into BPF_STX_MEM using BPF_REG_AX as its source).
>
> Would this result in storing garbage data when the C helper clobbers
> BPF_REG_AX?

Already discussed multiple time in the previous revisions.

Alexis
>
>> +
>> +	/* mov rdi, addr_reg */
>> +	EMIT_mov(BPF_REG_1, addr_reg);
> [ ... ]




-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com