Re: [PATCH bpf-next] bpf: Fix arm64 KASAN false positive after bpf_throw

On 8/12/26 7:47 AM, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <[email protected]>
> 
> arm64 passes zero as the stack pointer while walking BPF frames, so
> bpf_throw() leaves stale KASAN stack poison after jumping to the
> exception callback.
> 
> Use the frame pointer as the fallback stack watermark.
> 
> Fixes: e74cb1b42213 ("arm64: stacktrace: Implement arch_bpf_stack_walk() for the BPF JIT")
> Signed-off-by: Mykyta Yatsenko <[email protected]>

Tested-by: Ihor Solodrai <[email protected]>

https://github.com/kernel-patches/vmtest/actions/runs/31634900957/job/94290630981

> ---
>  kernel/bpf/helpers.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 6388b6b23e49..bbad75895331 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3395,11 +3395,13 @@ __bpf_kfunc void bpf_throw(u64 cookie)
>  		WARN_ON_ONCE(!ctx.aux->exception_boundary);
>  	WARN_ON_ONCE(!ctx.bp);
>  	WARN_ON_ONCE(!ctx.cnt);
> -	/* Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
> +	/*
> +	 * Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
>  	 * deeper stack depths than ctx.sp as we do not return from bpf_throw,
> -	 * which skips compiler generated instrumentation to do the same.
> +	 * which skips compiler generated instrumentation to do the same. Some
> +	 * architectures cannot recover sp while unwinding, so fall back to bp.
>  	 */
> -	kasan_unpoison_task_stack_below((void *)(long)ctx.sp);
> +	kasan_unpoison_task_stack_below((void *)(long)(ctx.sp ?: ctx.bp));
>  	ctx.aux->bpf_exception_cb(cookie, ctx.sp + ctx.aux->stack_arg_sp_adjust, ctx.bp, 0, 0);
>  	WARN(1, "A call to BPF exception callback should never return\n");
>  }
> 
> ---
> base-commit: 53cc65185a51fa9dd288cd1137a21467eced2df4
> change-id: 20260812-hello_world-2b03ed2aa5b4
> 
> Best regards,
> --  
> Mykyta Yatsenko <[email protected]>
>