On Wed Jul 15, 2026 at 2:53 AM CEST, Ihor Solodrai wrote:
> On 7/9/26 3:01 AM, Alexis Lothoré (eBPF Foundation) wrote:
>> Add the emit_kasan_check() function that emits KASAN shadow memory
>> checks before memory accesses in JIT-compiled BPF programs. The
>> implementation relies on the existing __asan_{load,store}X functions
>> from KASAN subsystem. The helper:
>> - ensures that the kasan instrumention is actually needed: if the
>> instruction being processed accesses the program stack, we skip the
>> instrumentation, as those accesses are already protected with page
>> guards
>> - saves registers. This includes caller-saved registers, but also
>> temporary registers, as those were possibly used by the
>> affected program. Theoretically, r10 and r11 should be saved as well,
>> but the number of called function and their scope being limited, they
>> are skipped for the sake of reducing the overhead
>
> My clanker got very excited about r10 and r11 not being saved, just
> like sashiko. So I looked at this a bit closer. TL;DR it's fine
>
> I built the kernel with gcc 11.5, gcc 15.2 and clang 22 and
> disassembled __asan_{load,store}{1,2,4,8}: none of them touch r10 or
> r11. gcc goes up to r8, clang uses nothing above rdi.
Thanks for the double-check, my observations are aligned with yours :)
(https://lore.kernel.org/all/[email protected]/)
> However, kasan_check_range() does use r10/r11. And looks like we are
> ok only because the fixed-size helpers inline the shadow check and
> never call kasan_check_range().
>
> If any of the fixed-size 1/2/4/8 helpers ever actually call
> kasan_check_range(), r10 may get clobbered.
>
> Maybe we should leave a comment on emit_kasan_check() about this?..
Ok, I'll add a comment about this in emit_kasan_check.
[...]
>> static bool all_callee_regs_used[4] = {true, true, true, true};
>>
>> static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len)
>> @@ -1110,6 +1121,90 @@ static void maybe_emit_1mod(u8 **pprog, u32 reg, bool
>> is64)
>> *pprog = prog;
>> }
>>
>> +static int emit_kasan_check(struct bpf_verifier_env *env, u8 **pprog,
>> + u32 addr_reg, struct bpf_insn *insn, u8 *ip,
>> + bool is_write, bool accesses_stack_only)
>
>
> nit: IMO it's not nice to introduce functions with no caller as a
> separate patch: it triggers -Wunused-function on this commit, which
> may or may not be used in a build. I'd fold this in patch #6 where the
> function is actually called.
Ok, I'll fold it in the commit actually using the helper.
Thanks,
Alexis
--
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
