[PATCH bpf-next] bpf: Fix arm64 KASAN false positive after bpf_throw

[PATCH bpf-next] bpf: Fix arm64 KASAN false positive after bpf_throw

[Mykyta Yatsenko]

From: Mykyta Yatsenko <yatsenko@meta.com>

arm64 passes zero as the stack pointer while walking BPF frames, so
bpf_throw() leaves stale KASAN stack poison after jumping to the
exception callback.

Use the frame pointer as the fallback stack watermark.

Fixes: e74cb1b42213 ("arm64: stacktrace: Implement arch_bpf_stack_walk() for the BPF JIT")
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
---
 kernel/bpf/helpers.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 6388b6b23e49..bbad75895331 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -3395,11 +3395,13 @@ __bpf_kfunc void bpf_throw(u64 cookie)
 		WARN_ON_ONCE(!ctx.aux->exception_boundary);
 	WARN_ON_ONCE(!ctx.bp);
 	WARN_ON_ONCE(!ctx.cnt);
-	/* Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
+	/*
+	 * Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
 	 * deeper stack depths than ctx.sp as we do not return from bpf_throw,
-	 * which skips compiler generated instrumentation to do the same.
+	 * which skips compiler generated instrumentation to do the same. Some
+	 * architectures cannot recover sp while unwinding, so fall back to bp.
 	 */
-	kasan_unpoison_task_stack_below((void *)(long)ctx.sp);
+	kasan_unpoison_task_stack_below((void *)(long)(ctx.sp ?: ctx.bp));
 	ctx.aux->bpf_exception_cb(cookie, ctx.sp + ctx.aux->stack_arg_sp_adjust, ctx.bp, 0, 0);
 	WARN(1, "A call to BPF exception callback should never return\n");
 }

---
base-commit: 53cc65185a51fa9dd288cd1137a21467eced2df4
change-id: 20260812-hello_world-2b03ed2aa5b4

Best regards,
--  
Mykyta Yatsenko <yatsenko@meta.com>

Re: [PATCH bpf-next] bpf: Fix arm64 KASAN false positive after bpf_throw

[Ihor Solodrai]

On 8/12/26 7:47 AM, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> arm64 passes zero as the stack pointer while walking BPF frames, so
> bpf_throw() leaves stale KASAN stack poison after jumping to the
> exception callback.
> 
> Use the frame pointer as the fallback stack watermark.
> 
> Fixes: e74cb1b42213 ("arm64: stacktrace: Implement arch_bpf_stack_walk() for the BPF JIT")
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>

Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>

https://github.com/kernel-patches/vmtest/actions/runs/31634900957/job/94290630981

> ---
>  kernel/bpf/helpers.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 6388b6b23e49..bbad75895331 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3395,11 +3395,13 @@ __bpf_kfunc void bpf_throw(u64 cookie)
>  		WARN_ON_ONCE(!ctx.aux->exception_boundary);
>  	WARN_ON_ONCE(!ctx.bp);
>  	WARN_ON_ONCE(!ctx.cnt);
> -	/* Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
> +	/*
> +	 * Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
>  	 * deeper stack depths than ctx.sp as we do not return from bpf_throw,
> -	 * which skips compiler generated instrumentation to do the same.
> +	 * which skips compiler generated instrumentation to do the same. Some
> +	 * architectures cannot recover sp while unwinding, so fall back to bp.
>  	 */
> -	kasan_unpoison_task_stack_below((void *)(long)ctx.sp);
> +	kasan_unpoison_task_stack_below((void *)(long)(ctx.sp ?: ctx.bp));
>  	ctx.aux->bpf_exception_cb(cookie, ctx.sp + ctx.aux->stack_arg_sp_adjust, ctx.bp, 0, 0);
>  	WARN(1, "A call to BPF exception callback should never return\n");
>  }
> 
> ---
> base-commit: 53cc65185a51fa9dd288cd1137a21467eced2df4
> change-id: 20260812-hello_world-2b03ed2aa5b4
> 
> Best regards,
> --  
> Mykyta Yatsenko <yatsenko@meta.com>
>