diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 069a8822c30d..4aaa0a287a45 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c
[ ... ]
-static void bpf_trampoline_setup_tail_call_cnt(u32 *image, struct codegen_context *ctx,
int func_frame_offset, int r4_off)+static void bpf_trampoline_setup_tail_call_info(u32 *image, struct codegen_context *ctx,
int func_frame_offset,int bpf_dummy_frame_size, int r4_off){ if (IS_ENABLED(CONFIG_PPC64)) { /* See bpf_jit_stack_tailcallinfo_offset() */
int tailcallcnt_offset = 7 * 8;
int tailcallinfo_offset = BPF_PPC_STACK_SAVE + SZL;
[ ... ]
EMIT(PPC_RAW_STL(_R3, _R1, func_frame_offset- bpf_dummy_frame_size - tailcallinfo_offset));
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The new setup function stores tail_call_info at offset (func_frame_offset - bpf_dummy_frame_size - tailcallinfo_offset) from R1. Since func_frame_offset = bpf_dummy_frame_size + bpf_frame_size, this resolves to (bpf_frame_size - 56), which is a positive offset from R1.
However, the corresponding bpf_trampoline_restore_tail_call_cnt() function was not updated. It still reads from (R1 - 56):
static void bpf_trampoline_restore_tail_call_cnt(...) { if (IS_ENABLED(CONFIG_PPC64)) { int tailcallcnt_offset = 7 * 8; EMIT(PPC_RAW_LL(_R3, _R1, -tailcallcnt_offset)); ^^^^^^^^^^^^^^^^^^ ... } }
Is there an offset mismatch here? The setup function stores at R1 + (bpf_frame_size - 56) while restore reads from R1 - 56. These point to different memory locations since bpf_frame_size is a positive value (at minimum ~200 bytes given the frame contents).
When BPF_TRAMP_F_TAIL_CALL_CTX is set, the restore function would read incorrect data after the traced function returns, potentially causing wrong tail call context to be propagated.
@@ -801,6 +830,12 @@ static int __arch_prepare_bpf_trampoline(...) } }
- /* Room for 64-bit tail_call_cnt */
- bpf_frame_size += SZL;
- /* Room for nvr save area */
- bpf_frame_size += BPF_PPC_STACK_SAVE;
- /* Padding to align stack frame, if any */ bpf_frame_size = round_up(bpf_frame_size, SZL * 2);
The frame size is increased by 56 bytes (SZL + BPF_PPC_STACK_SAVE = 8 + 48) for the tail_call_info and nvr save area. This affects all calculations using bpf_frame_size, including the store offset in the setup function, but the restore function continues to use a hardcoded negative offset.
--- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20713322833