Re: [PATCH bpf-next v3 8/9] bpf, x86: Fix stack-passed arguments for indirect trampolines

On Mon, 2026-08-03 at 14:51 +0200, Kumar Kartikeya Dwivedi wrote:
> From: Tejun Heo <[email protected]>
> 
> save_args() reads stack-passed arguments relative to rbp assuming two
> return addresses sit between the saved rbp and the arguments, which
> holds when the trampoline is entered through the fentry call from a
> traced function. An indirect trampoline is called through a function
> pointer, so only the caller's return address is on the stack and the
> arguments start at rbp + 16, not rbp + 24. Every stack-passed argument
> of a struct_ops callback with more than six argument slots is read one
> slot off.
> 
> This has gone unnoticed because no in-tree struct_ops member passes
> arguments on the stack. The jmp-entry form already accounts for having
> a single return address; treat BPF_TRAMP_F_INDIRECT the same way.
> 
> Fixes: 473e3150e30a ("bpf, x86: allow function arguments up to 12 for TRACING")
> Cc: Jiri Olsa <[email protected]>
> Signed-off-by: Tejun Heo <[email protected]>
> Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>
> ---

Tested-by: Eduard Zingerman <[email protected]>

...