Re: [PATCH bpf-next v7 02/11] bpf: use last 8-bits for the nr_args in trampoline

[Menglong Dong <menglong.dong@linux.dev>]

On 2026/1/7 15:11 bot+bpf-ci@kernel.org write:
> > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > index 6e076485bf70..6b58f9a4dc92 100644
> > --- a/kernel/trace/bpf_trace.c
> > +++ b/kernel/trace/bpf_trace.c
> 
> [ ... ]
> 
> > @@ -1194,7 +1194,7 @@ const struct bpf_func_proto bpf_get_branch_snapshot_proto = {
> >  BPF_CALL_3(get_func_arg, void *, ctx, u32, n, u64 *, value)
> >  {
> >  	/* This helper call is inlined by verifier. */
> > -	u64 nr_args = ((u64 *)ctx)[-1];
> > +	u64 nr_args = ((u64 *)ctx)[-1] & 0xFF;
> 
> [ ... ]
> 
> > @@ -1214,7 +1214,7 @@ static const struct bpf_func_proto bpf_get_func_arg_proto = {
> >  BPF_CALL_2(get_func_ret, void *, ctx, u64 *, value)
> >  {
> >  	/* This helper call is inlined by verifier. */
> > -	u64 nr_args = ((u64 *)ctx)[-1];
> > +	u64 nr_args = ((u64 *)ctx)[-1] & 0xFF;
> >
> >  	*value = ((u64 *)ctx)[nr_args];
> >  	return 0;
> 
> Both get_func_arg() and get_func_ret() are updated with the 0xFF mask, but
> should get_func_arg_cnt() also receive the same treatment?
> 
> Current code in get_func_arg_cnt():
> 
>     BPF_CALL_1(get_func_arg_cnt, void *, ctx)
>     {
>         /* This helper call is inlined by verifier. */
>         return ((u64 *)ctx)[-1];
>     }
> 
> The comment says "inlined by verifier", but the verifier only inlines this
> helper for BPF_PROG_TYPE_TRACING programs. For BPF_PROG_TYPE_LSM programs
> with BPF_LSM_MAC attachment type, bpf_prog_has_trampoline() returns true,
> allowing access to this helper via tracing_prog_func_proto(). However,
> do_misc_fixups() only inlines for BPF_PROG_TYPE_TRACING, so LSM programs
> would call this non-inlined fallback function.
> 
> If subsequent patches store metadata in the upper bits of ctx[-1], could
> LSM programs calling bpf_get_func_arg_cnt() receive incorrect values?
> 
> Later commits in this series (93d4641b9513 "bpf,x86: add fsession support
> for x86_64") do use the upper bits for BPF_TRAMP_M_IS_RETURN and
> BPF_TRAMP_M_COOKIE flags. This regression is not fixed in the series.

Ah, good point. I missed the modification of get_func_arg_cnt(). It should
be:

     BPF_CALL_1(get_func_arg_cnt, void *, ctx)
     {
         /* This helper call is inlined by verifier. */
         return ((u64 *)ctx)[-1] & 0XFF;
     }

I'll fix it in the next version.

Thanks!
Menglong Dong

> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20773233136
>