From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 66-220-155-179.mail-mxout.facebook.com (66-220-155-179.mail-mxout.facebook.com [66.220.155.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 109E13B6BF3 for ; Thu, 13 Aug 2026 20:02:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.220.155.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786651349; cv=none; b=ky+h8nx9GuP+ugPS0YzpzSeih26Q0seYL2gKgCu0BuEy/ZsohN1fdggjMh9+OJyU4eunylQzyAN8/EcDun8RzmaJrwdIkQ27UfaUl2kTATLZprUyrkeST20O4Ti16tUCsOl1yrA3JbALHB5mevdsGh/e+Khsq04kti3DzkIIN70= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786651349; c=relaxed/simple; bh=RTWlpC4ufVo4KMrO9jjgG9iNAOBUpXZKNUFl/0C5LWE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zu4TrJTNS3ZBk5LjxzkgnLNxcA64gmsqXQuTtIA8U9mF82Kpys50pNoidUdbRRcehZSJU7xYZ1WUxAbVq56BcUsnPvgOoSJ6R1c9vbJIfskE+pROnlYgKCS5yov/oJp1iFe0vYiW07uS+NAZfxMuNBwtWdr1tLA6FrN37GeRoXo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=66.220.155.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id 34F0B23E02E802; Thu, 13 Aug 2026 13:02:15 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , kernel-team@fb.com Subject: [PATCH bpf-next v5 01/11] bpf: Factor check_global_ret_scalar_reg() out of the global return check Date: Thu, 13 Aug 2026 13:02:15 -0700 Message-ID: <20260813200215.1993264-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260813200210.1991507-1-yonghong.song@linux.dev> References: <20260813200210.1991507-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable check_global_subprog_return_code() verifies that a global subprogram returns void, an arena pointer, or register R0 holding a scalar value. Later patches in this series add 16-byte aggregate return support, whose second half is returned in R2 and needs the same validation. Factor the per-register check into check_global_ret_scalar_reg(env, regno= ) so that it can be reused for R2. No functional change. Signed-off-by: Yonghong Song --- kernel/bpf/verifier.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6ac1afced20b..03570c693d35 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -16654,37 +16654,45 @@ static int check_return_code(struct bpf_verifie= r_env *env, int regno, const char return 0; } =20 -static int check_global_subprog_return_code(struct bpf_verifier_env *env= ) +static int check_global_ret_scalar_reg(struct bpf_verifier_env *env, u32= regno) { - struct bpf_reg_state *reg =3D reg_state(env, BPF_REG_0); - struct bpf_func_state *cur_frame =3D cur_func(env); + struct bpf_reg_state *reg; int err; =20 - if (subprog_returns_void(env, cur_frame->subprogno)) - return 0; - - err =3D check_reg_arg(env, BPF_REG_0, SRC_OP); + err =3D check_reg_arg(env, regno, SRC_OP); if (err) return err; =20 /* Pointers to arena are safe to pass between subprograms. */ - if (is_arena_reg(env, BPF_REG_0)) + if (is_arena_reg(env, regno)) return 0; =20 - if (is_pointer_value(env, BPF_REG_0)) { - verbose(env, "R%d leaks addr as return value\n", BPF_REG_0); + if (is_pointer_value(env, regno)) { + verbose(env, "R%d leaks addr as return value\n", regno); return -EACCES; } =20 + reg =3D reg_state(env, regno); if (reg->type !=3D SCALAR_VALUE) { - verbose(env, "At subprogram exit the register R0 is not a scalar value= (%s)\n", - reg_type_str(env, reg->type)); + verbose(env, "At subprogram exit the register R%d is not a scalar valu= e (%s)\n", + regno, reg_type_str(env, reg->type)); return -EINVAL; } =20 return 0; } =20 +static int check_global_subprog_return_code(struct bpf_verifier_env *env= ) +{ + struct bpf_func_state *cur_frame =3D cur_func(env); + u32 subprog =3D cur_frame->subprogno; + + if (subprog_returns_void(env, subprog)) + return 0; + + return check_global_ret_scalar_reg(env, BPF_REG_0); +} + /* Bitmask with 1s for all caller saved registers */ #define ALL_CALLER_SAVED_REGS ((1u << CALLER_SAVED_REGS) - 1) =20 --=20 2.53.0-Meta