[BUG] bpf: x86 timed may_goto corrupts private-stack JIT state

[Jérémy Jean]

Hello,

With the help of AI models, I found a bug in the x86 timed may_goto path that
leads to a verifier/JIT state mismatch on private-stack programs.

The root cause is that timed may_goto fixups pass a stack offset in BPF_REG_AX
and the x86 trampoline reconstructs the counter pointer from native %rbp. That
is incorrect once private-stack JIT mode is enabled: ordinary BPF frame pointer
accesses are remapped from %rbp to %r9, but arch_bpf_timed_may_goto() still
uses %rbp and ends up reading and writing the native JIT frame instead of the
private BPF stack.

The bug was introduced by 2fb761823ead ("bpf, x86: Add x86 JIT support for timed
may_goto"). I reproduced it on a KASAN-enabled x86_64 kernel based on v7.2,
however KASAN does not trigger because the bad write stays inside the native
JIT frame. Yet, the saved-register corruption is observable.

I have not included a patch here because the fix seems subtle to me and would
likely touch many files for different arch.

I can share the minimal reproducer and other details privately with maintainers
if useful.

Best regards,
Jérémy

Fixes: 2fb761823ead ("bpf, x86: Add x86 JIT support for timed may_goto")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>