[BUG] bpf: x86 timed may_goto corrupts private-stack JIT state

[BUG] bpf: x86 timed may_goto corrupts private-stack JIT state

[Jérémy Jean]

Hello,

With the help of AI models, I found a bug in the x86 timed may_goto path that
leads to a verifier/JIT state mismatch on private-stack programs.

The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
and the x86 trampoline reconstructs the counter pointer from native %rbp. That
is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
uses %rbp and ends up reading and writing the native JIT frame instead of the
private BPF stack.

The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
however KASAN does not trigger because the bad write stays inside the native
JIT frame. Yet, the saved-register corruption is observable.

I have not included a patch here because the fix seems subtle to me and would
likely touch many files for different arch.

I can share the minimal reproducer and other details privately with maintainers
if useful.

Best regards,
Jérémy

Fixes: 2fb761823ead ("bpf, x86: Add x86 JIT support for timed may_goto")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state

[Alexei Starovoitov]

On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
> Hello,
>
> With the help of AI models, I found a bug in the x86 timed may_goto path that
> leads to a verifier/JIT state mismatch on private-stack programs.
>
> The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
> and the x86 trampoline reconstructs the counter pointer from native %rbp. That
> is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
> accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
> uses %rbp and ends up reading and writing the native JIT frame instead of the
> private BPF stack.
>
> The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
> may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
> however KASAN does not trigger because the bad write stays inside the native
> JIT frame. Yet, the saved-register corruption is observable.
>
> I have not included a patch here because the fix seems subtle to me and would
> likely touch many files for different arch.
>
> I can share the minimal reproducer and other details privately with maintainers
> if useful.

Just send a fix and a selftest to the list.