Subject: Re: [PATCH bpf-next v2 1/4] bpf, verifier: Support direct helper calls from prologue/epilogue

From: Martin KaFai Lau <[email-masked]>
Date: Fri, 23 Jan 2026 15:49:34 -0800

On 1/23/26 9:05 AM, Jakub Sitnicki wrote:
> @@ -23909,6 +23928,9 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
>   			goto next_insn;
>   		}
>   patch_call_imm:
> +		if (env->insn_aux_data[i + delta].finalized_call)
> +			goto next_insn;
> +
>   		fn = env->ops->get_func_proto(insn->imm, env->prog);
>   		/* all functions that have prototype and verifier allowed
>   		 * programs to call them, must be real in-kernel functions
> @@ -23920,6 +23942,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
>   			return -EFAULT;
>   		}
>   		insn->imm = fn->func - __bpf_call_base;
> +		env->insn_aux_data[i + delta].finalized_call = true;
>   next_insn:
>   		if (subprogs[cur_subprog + 1].start == i + delta + 1) {
>   			subprogs[cur_subprog].stack_depth += stack_depth_extra;
> diff --git a/net/core/filter.c b/net/core/filter.c
> index d14401193b01..cb39388f69a9 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -9082,8 +9082,7 @@ static int bpf_unclone_prologue(struct bpf_insn *insn_buf, bool direct_write,
>   	/* ret = bpf_skb_pull_data(skb, 0); */
>   	*insn++ = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
>   	*insn++ = BPF_ALU64_REG(BPF_XOR, BPF_REG_2, BPF_REG_2);
> -	*insn++ = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
> -			       BPF_FUNC_skb_pull_data);
> +	*insn++ = BPF_EMIT_CALL(bpf_skb_pull_data);

Ihor reported that the test_map has started failing on arm64.

https://github.com/kernel-patches/bpf/actions/runs/21298510237/job/61311053284
https://github.com/kernel-patches/bpf/actions/runs/21298505282/job/61312363930
https://github.com/kernel-patches/bpf/actions/runs/21301695907/job/61321375157

For BPF_PROG_TYPE_SK_SKB, the BPF_FUNC_skb_pull_data has a different
func_proto. It is sk_skb_pull_data instead of bpf_skb_pull_data.
A different func needs to be emitted here based on prog type.
Not sure why it only fails on arm64.

The set has been reverted to get the CI going.
Please address the issue, add a test for this case, and
then respin. Thanks.