Re: [PATCH bpf-next v5 04/10] bpf, x86: add helper to emit kasan checks in x86 JITed programs

["Alexis Lothoré" <alexis.lothore@bootlin.com>]

On Wed Jul 15, 2026 at 2:53 AM CEST, Ihor Solodrai wrote:
> On 7/9/26 3:01 AM, Alexis Lothoré (eBPF Foundation) wrote:
>> Add the emit_kasan_check() function that emits KASAN shadow memory
>> checks before memory accesses in JIT-compiled BPF programs. The
>> implementation relies on the existing __asan_{load,store}X functions
>> from KASAN subsystem. The helper:
>> - ensures that the kasan instrumention is actually needed: if the
>>   instruction being processed accesses the program stack, we skip the
>>   instrumentation, as those accesses are already protected with page
>>   guards
>> - saves registers. This includes caller-saved registers, but also
>>   temporary registers, as those were possibly used by the
>>   affected program. Theoretically, r10 and r11 should be saved as well,
>>   but the number of called function and their scope being limited, they
>>   are skipped for the sake of reducing the overhead
>
> My clanker got very excited about r10 and r11 not being saved, just
> like sashiko. So I looked at this a bit closer. TL;DR it's fine
>
> I built the kernel with gcc 11.5, gcc 15.2 and clang 22 and
> disassembled __asan_{load,store}{1,2,4,8}: none of them touch r10 or
> r11. gcc goes up to r8, clang uses nothing above rdi.

Thanks for the double-check, my observations are aligned with yours :)

(https://lore.kernel.org/all/DJ5HDX2K5CTF.YRZ9TDI6QCII@bootlin.com/)

> However, kasan_check_range() does use r10/r11.  And looks like we are
> ok only because the fixed-size helpers inline the shadow check and
> never call kasan_check_range().
>
> If any of the fixed-size 1/2/4/8 helpers ever actually call
> kasan_check_range(), r10 may get clobbered.
>
> Maybe we should leave a comment on emit_kasan_check() about this?..

Ok, I'll add a comment about this in emit_kasan_check.

[...]

>>  static bool all_callee_regs_used[4] = {true, true, true, true};
>>  
>>  static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len)
>> @@ -1110,6 +1121,90 @@ static void maybe_emit_1mod(u8 **pprog, u32 reg, bool is64)
>>  	*pprog = prog;
>>  }
>>  
>> +static int emit_kasan_check(struct bpf_verifier_env *env, u8 **pprog,
>> +			    u32 addr_reg, struct bpf_insn *insn, u8 *ip,
>> +			    bool is_write, bool accesses_stack_only)
>
>
> nit: IMO it's not nice to introduce functions with no caller as a
> separate patch: it triggers -Wunused-function on this commit, which
> may or may not be used in a build. I'd fold this in patch #6 where the
> function is actually called.

Ok, I'll fold it in the commit actually using the helper.

Thanks,

Alexis

-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com