Re: [PATCH bpf-next 4/7] bpf, arm64: Convert struct_ops arena arguments in the trampoline

On Fri Aug 14, 2026 at 4:10 AM CEST, Xu Kuohai wrote:
> On 8/14/2026 3:20 AM, Puranjay Mohan wrote:
>
> [...]
>
>>>> +static void emit_arena_arg_conv(struct jit_ctx *ctx, u8 dst, u8 src, bool nullable, u8 base_lo)
>>>> +{
>>>> +	if (nullable) {
>>>> +		if (dst != src)
>>>> +			emit(A64_MOV(1, dst, src), ctx);
>>>> +		/* skip the subtraction so that NULL stays NULL */
>>>> +		emit(A64_CBZ(1, dst, 2), ctx);
>>>> +		src = dst;
>>>> +	}
>>>> +	emit(A64_SUB(0, dst, src, base_lo), ctx);
>>> Maybe I'm missing something, do we need to validate whether the
>>> address in the src register is really inside the current bpf
>>> prog's arena?
>> The JIT can assume that it is a kernel address into the arena as it
>> comes from struct ops.
>
> Thanks for the clarification, but I'm still confused. What makes the
> assumption hold? How does struct_ops ensure the address passed is
> inside the arena used by the current prog?
>

I think we would expect the kernel caller passing the address to the struct_ops
callback to have something that points into the arena region. If that
expectation is broken it should be treated as a kernel bug and be dealt with
accordingly.

Does that clarify your concern, or did I miss what confused you here?

> [...]