From: "Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>
To: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>,
bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
linux-kernel@vger.kernel.org, rlmenge@gmail.com,
hargar@microsoft.com, apais@microsoft.com
Subject: Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
Date: Tue, 01 Sep 2026 09:11:13 +0200 [thread overview]
Message-ID: <d4e2ae332a9505cc2cee5a236ff86efb@oss.cyber.gouv.fr> (raw)
In-Reply-To: <CAE5sdEiGA+chRkkNGOWL89AFDNXor1RKHMEmouCNoCXVd4fc-g@mail.gmail.com>
On 2026-09-01 00:57, Siddharth Chintamaneni wrote:
> On Tue, 25 Aug 2026 at 18:10, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
>>
>> On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
>> > Hello,
>> >
>> > With the help of AI models, I found a bug in the x86 timed may_goto path that
>> > leads to a verifier/JIT state mismatch on private-stack programs.
>> >
>> > The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
>> > and the x86 trampoline reconstructs the counter pointer from native %rbp. That
>> > is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
>> > accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
>> > uses %rbp and ends up reading and writing the native JIT frame instead of the
>> > private BPF stack.
>> >
>> > The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
>> > may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
>> > however KASAN does not trigger because the bad write stays inside the native
>> > JIT frame. Yet, the saved-register corruption is observable.
>> >
>> > I have not included a patch here because the fix seems subtle to me and would
>> > likely touch many files for different arch.
>> >
>> > I can share the minimal reproducer and other details privately with maintainers
>> > if useful.
>>
>> Just send a fix and a selftest to the list.
>>
>
> Jeremy,
>
> I just wanted to check whether you're working on a patch for this. if
> not, I'd be happy to take a look.
Hello,
No, not at the moment.
Feel free to ask if I can be of some help
Regards,
Jérémy
next prev parent reply other threads:[~2026-09-01 7:35 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-24 21:31 [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state Jérémy Jean
2026-08-26 1:09 ` Alexei Starovoitov
2026-08-31 22:57 ` Siddharth Chintamaneni
2026-09-01 7:11 ` Jérémy Jean [this message]
2026-09-01 17:42 ` Siddharth Chintamaneni
2026-09-02 22:59 ` Siddharth Chintamaneni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d4e2ae332a9505cc2cee5a236ff86efb@oss.cyber.gouv.fr \
--to=jeremy.jean@oss.cyber.gouv.fr \
--cc=alexei.starovoitov@gmail.com \
--cc=apais@microsoft.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=hargar@microsoft.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rlmenge@gmail.com \
--cc=sidchintamaneni@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox