bpf Trampoline Overflow

Vulnerability analysis

When the x86 BPF trampoline prepares to save function arguments for a traced function, it under-counts the number of registers needed for 128-bit scalar arguments such as __int128. The original code only added extra register slots for arguments explicitly flagged as struct arguments, but the BTF type distillation layer accepts any argument up to 16 bytes, including plain 128-bit scalars that also require two registers. As a result, the register save area on the stack is too small, and the argument-saving routine writes past the end of the allocated area into adjacent stack slots. The fix computes the register count from the actual argument size for every argument, ensuring the save area is always large enough. This path is reachable locally by loading a BPF tracing program (fentry/fexit/fmod_ret) that targets a kernel function with __int128 parameters, which requires CAP_BPF or, on configurations where unprivileged BPF is enabled, no special privileges.