* [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
@ 2026-08-24 21:31 Jérémy Jean
2026-08-26 1:09 ` Alexei Starovoitov
0 siblings, 1 reply; 6+ messages in thread
From: Jérémy Jean @ 2026-08-24 21:31 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Daniel Borkmann, linux-kernel,
Jérémy Jean
Hello,
With the help of AI models, I found a bug in the x86 timed may_goto path that
leads to a verifier/JIT state mismatch on private-stack programs.
The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
and the x86 trampoline reconstructs the counter pointer from native %rbp. That
is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
uses %rbp and ends up reading and writing the native JIT frame instead of the
private BPF stack.
The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
however KASAN does not trigger because the bad write stays inside the native
JIT frame. Yet, the saved-register corruption is observable.
I have not included a patch here because the fix seems subtle to me and would
likely touch many files for different arch.
I can share the minimal reproducer and other details privately with maintainers
if useful.
Best regards,
Jérémy
Fixes: 2fb761823ead ("bpf, x86: Add x86 JIT support for timed may_goto")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
2026-08-24 21:31 [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state Jérémy Jean
@ 2026-08-26 1:09 ` Alexei Starovoitov
2026-08-31 22:57 ` Siddharth Chintamaneni
0 siblings, 1 reply; 6+ messages in thread
From: Alexei Starovoitov @ 2026-08-26 1:09 UTC (permalink / raw)
To: Jérémy Jean, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, linux-kernel
On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
> Hello,
>
> With the help of AI models, I found a bug in the x86 timed may_goto path that
> leads to a verifier/JIT state mismatch on private-stack programs.
>
> The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
> and the x86 trampoline reconstructs the counter pointer from native %rbp. That
> is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
> accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
> uses %rbp and ends up reading and writing the native JIT frame instead of the
> private BPF stack.
>
> The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
> may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
> however KASAN does not trigger because the bad write stays inside the native
> JIT frame. Yet, the saved-register corruption is observable.
>
> I have not included a patch here because the fix seems subtle to me and would
> likely touch many files for different arch.
>
> I can share the minimal reproducer and other details privately with maintainers
> if useful.
Just send a fix and a selftest to the list.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
2026-08-26 1:09 ` Alexei Starovoitov
@ 2026-08-31 22:57 ` Siddharth Chintamaneni
2026-09-01 7:11 ` Jérémy Jean
0 siblings, 1 reply; 6+ messages in thread
From: Siddharth Chintamaneni @ 2026-08-31 22:57 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Jérémy Jean, bpf, Alexei Starovoitov, Daniel Borkmann,
linux-kernel, rlmenge, hargar, apais
On Tue, 25 Aug 2026 at 18:10, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
> > Hello,
> >
> > With the help of AI models, I found a bug in the x86 timed may_goto path that
> > leads to a verifier/JIT state mismatch on private-stack programs.
> >
> > The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
> > and the x86 trampoline reconstructs the counter pointer from native %rbp. That
> > is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
> > accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
> > uses %rbp and ends up reading and writing the native JIT frame instead of the
> > private BPF stack.
> >
> > The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
> > may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
> > however KASAN does not trigger because the bad write stays inside the native
> > JIT frame. Yet, the saved-register corruption is observable.
> >
> > I have not included a patch here because the fix seems subtle to me and would
> > likely touch many files for different arch.
> >
> > I can share the minimal reproducer and other details privately with maintainers
> > if useful.
>
> Just send a fix and a selftest to the list.
>
Jeremy,
I just wanted to check whether you're working on a patch for this. if
not, I'd be happy to take a look.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
2026-08-31 22:57 ` Siddharth Chintamaneni
@ 2026-09-01 7:11 ` Jérémy Jean
2026-09-01 17:42 ` Siddharth Chintamaneni
0 siblings, 1 reply; 6+ messages in thread
From: Jérémy Jean @ 2026-09-01 7:11 UTC (permalink / raw)
To: Siddharth Chintamaneni
Cc: Alexei Starovoitov, bpf, Alexei Starovoitov, Daniel Borkmann,
linux-kernel, rlmenge, hargar, apais
On 2026-09-01 00:57, Siddharth Chintamaneni wrote:
> On Tue, 25 Aug 2026 at 18:10, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
>>
>> On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
>> > Hello,
>> >
>> > With the help of AI models, I found a bug in the x86 timed may_goto path that
>> > leads to a verifier/JIT state mismatch on private-stack programs.
>> >
>> > The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
>> > and the x86 trampoline reconstructs the counter pointer from native %rbp. That
>> > is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
>> > accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
>> > uses %rbp and ends up reading and writing the native JIT frame instead of the
>> > private BPF stack.
>> >
>> > The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
>> > may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
>> > however KASAN does not trigger because the bad write stays inside the native
>> > JIT frame. Yet, the saved-register corruption is observable.
>> >
>> > I have not included a patch here because the fix seems subtle to me and would
>> > likely touch many files for different arch.
>> >
>> > I can share the minimal reproducer and other details privately with maintainers
>> > if useful.
>>
>> Just send a fix and a selftest to the list.
>>
>
> Jeremy,
>
> I just wanted to check whether you're working on a patch for this. if
> not, I'd be happy to take a look.
Hello,
No, not at the moment.
Feel free to ask if I can be of some help
Regards,
Jérémy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
2026-09-01 7:11 ` Jérémy Jean
@ 2026-09-01 17:42 ` Siddharth Chintamaneni
2026-09-02 22:59 ` Siddharth Chintamaneni
0 siblings, 1 reply; 6+ messages in thread
From: Siddharth Chintamaneni @ 2026-09-01 17:42 UTC (permalink / raw)
To: Jérémy Jean
Cc: Alexei Starovoitov, bpf, Alexei Starovoitov, Daniel Borkmann,
linux-kernel, rlmenge, hargar, apais
On Tue, 1 Sept 2026 at 00:11, Jérémy Jean <jeremy.jean@oss.cyber.gouv.fr> wrote:
>
> On 2026-09-01 00:57, Siddharth Chintamaneni wrote:
> > On Tue, 25 Aug 2026 at 18:10, Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> >>
> >> On Mon Aug 24, 2026 at 2:31 PM PDT, Jérémy Jean wrote:
> >> > Hello,
> >> >
> >> > With the help of AI models, I found a bug in the x86 timed may_goto path that
> >> > leads to a verifier/JIT state mismatch on private-stack programs.
> >> >
> >> > The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
> >> > and the x86 trampoline reconstructs the counter pointer from native %rbp. That
> >> > is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
> >> > accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
> >> > uses %rbp and ends up reading and writing the native JIT frame instead of the
> >> > private BPF stack.
> >> >
> >> > The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
> >> > may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
> >> > however KASAN does not trigger because the bad write stays inside the native
> >> > JIT frame. Yet, the saved-register corruption is observable.
> >> >
> >> > I have not included a patch here because the fix seems subtle to me and would
> >> > likely touch many files for different arch.
> >> >
> >> > I can share the minimal reproducer and other details privately with maintainers
> >> > if useful.
> >>
> >> Just send a fix and a selftest to the list.
> >>
> >
> > Jeremy,
> >
> > I just wanted to check whether you're working on a patch for this. if
> > not, I'd be happy to take a look.
>
> Hello,
>
> No, not at the moment.
> Feel free to ask if I can be of some help
>
Let me playaorund with it. I'll let you know if I have more questions. Thanks!
> Regards,
> Jérémy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state
2026-09-01 17:42 ` Siddharth Chintamaneni
@ 2026-09-02 22:59 ` Siddharth Chintamaneni
0 siblings, 0 replies; 6+ messages in thread
From: Siddharth Chintamaneni @ 2026-09-02 22:59 UTC (permalink / raw)
To: Jérémy Jean
Cc: Alexei Starovoitov, bpf, Alexei Starovoitov, Daniel Borkmann,
linux-kernel, rlmenge, hargar, apais
On Tue, 1 Sept 2026 at 10:42, Siddharth Chintamaneni
<sidchintamaneni@gmail.com> wrote:
>
<SNIP>
> > > Jeremy,
> > >
> > > I just wanted to check whether you're working on a patch for this. if
> > > not, I'd be happy to take a look.
> >
> > Hello,
> >
> > No, not at the moment.
> > Feel free to ask if I can be of some help
> >
>
> Let me playaorund with it. I'll let you know if I have more questions. Thanks!
>
I have a question for the maintainers - the fix involves changes to
all the arch specific trampolines `arch/*/net/bpf_timed_may_goto.S`.
Is it fine if I include all of them in a single patchset?
<SNIP>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-02 22:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-24 21:31 [BUG] bpf: x86 timed may_goto corrupts private-stack JIT state Jérémy Jean
2026-08-26 1:09 ` Alexei Starovoitov
2026-08-31 22:57 ` Siddharth Chintamaneni
2026-09-01 7:11 ` Jérémy Jean
2026-09-01 17:42 ` Siddharth Chintamaneni
2026-09-02 22:59 ` Siddharth Chintamaneni
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox