Re: [PATCH bpf-next v1 8/9] bpf, x86: Fix stack-passed arguments for indirect trampolines

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Thu Jul 16, 2026 at 12:14 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [Medium] The patch correctly fixes the struct_ops stack argument offset bug for x86, but leaves the exact same bug unfixed in the ARM64, RISC-V, and LoongArch BPF JIT implementations.
> --
>
> --- Patch [8]: [PATCH bpf-next v1 8/9] bpf, x86: Fix stack-passed arguments for indirect trampolines ---
> commit 804aec167442bbd8ddbbc13495bc188618bbaeaf
> Author: Tejun Heo <tj@kernel.org>
>
> bpf, x86: Fix stack-passed arguments for indirect trampolines
>
> This commit fixes a bug in the x86 BPF JIT where stack-passed arguments
> for indirect trampolines (such as struct_ops) were read from the wrong
> offset. It correctly adjusts the offset to account for only the caller's
> return address being on the stack, which fixes callbacks that have more
> than six arguments.
>
>> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
>> index 2f25353f135bd..672fe54dfeb8d 100644
>> --- a/arch/x86/net/bpf_jit_comp.c
>> +++ b/arch/x86/net/bpf_jit_comp.c
>> @@ -3074,6 +3074,7 @@ static void save_args(const struct btf_func_model *m, u8 **prog,
>>  {
>>  	int arg_regs, first_off = 0, nr_regs = 0, nr_stack_slots = 0;
>>  	bool use_jmp = bpf_trampoline_use_jmp(flags);
>> +	int stack_args_off = (use_jmp || (flags & BPF_TRAMP_F_INDIRECT)) ? 16 : 24;
>
> [Severity: Medium]
> This is a pre-existing issue, but does this same bug also need to be fixed
> in the ARM64, RISC-V, and LoongArch BPF JIT implementations?
>
> On ARM64, save_args() unconditionally hardcodes a 32-byte offset:
>
> arch/arm64/net/bpf_jit_comp.c:save_args() {
>     ...
>     soff = 32; /* on stack arguments start from FP + 32 */
>     ...
> }
>

Yes, but it will be sent separately as a separate patch.

> This seems to assume two 16-byte frames (FP+LR and FP+R9), but struct_ops
> only pushes one, meaning stack arguments would start at FP + 16.
>
> Similarly, on RISC-V and LoongArch, store_args() unconditionally skips 16
> bytes for the traced function's T0 and FP frame:
>
> arch/riscv/net/bpf_jit_comp64.c:store_args() {
>     ...
>     /* skip slots for T0 and FP of traced function */
>     emit_ld(RV_REG_T1, 16 + (i - RV_MAX_REG_ARGS) * 8, RV_REG_FP, ctx);
>     ...
> }
>
> For BPF_TRAMP_F_INDIRECT (is_struct_ops), the prologue aligns FP directly
> to the caller's SP, so arguments start exactly at FP. Will these hardcoded
> offsets cause the JIT to read 16 bytes past the actual arguments on these
> architectures as well?
>
>>  	int i, j, slot = 0;
>>
>>  	/* Store function arguments to stack.