The timed may_goto fixup now passes the resolved counter pointer through
BPF_REG_AX instead of a stack offset.
Copy the pointer directly into the first argument register rather than
adding it to the BPF frame pointer again.
Fixes: 16175375da36 ("bpf, arm64: Add JIT support for timed may_goto")
Reported-by: Jeremy Jean <[email protected]>
Link:
https://lore.kernel.org/all/[email protected]/
Assisted-by: Copilot:gpt-5.6-sol
Signed-off-by: Siddharth Chintamaneni <[email protected]>
---
arch/arm64/net/bpf_timed_may_goto.S | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/net/bpf_timed_may_goto.S
b/arch/arm64/net/bpf_timed_may_goto.S
index a9a802711a7f..53148c9a1c58 100644
--- a/arch/arm64/net/bpf_timed_may_goto.S
+++ b/arch/arm64/net/bpf_timed_may_goto.S
@@ -14,16 +14,10 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
stp x3, x4, [sp, #48]
/*
- * Stack depth was passed in BPF_REG_AX (x9), add it to the BPF_FP
- * (x25) to get the pointer to count and timestamp and pass it as the
- * first argument in x0.
- *
- * Before generating the call to arch_bpf_timed_may_goto, the verifier
- * generates a load instruction using FP, i.e. REG_AX = *(u64 *)(FP -
- * stack_off_cnt), so BPF_REG_FP (x25) is always set up by the arm64
- * jit in this case.
+ * BPF_REG_AX (x9) contains the count and timestamp pointer; pass it as
+ * the first argument in x0.
*/
- add x0, x9, x25
+ mov x0, x9
bl bpf_check_timed_may_goto
/* BPF_REG_AX(x9) will be stored into count, so move return value to
it. */
mov x9, x0
--
2.43.0
