Re: [PATCH bpf-next v5 05/11] bpf: Account R2 of register-pair returns in live register analysis

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Static (non-global) BPF subprograms returning a register pair are functionally broken because the verifier does not propagate R2 back to the caller frame.
--

--- Patch [5]: [PATCH bpf-next v5 05/11] bpf: Account R2 of register-pair returns in live register analysis ---
commit 35ab629244a73b2ad2baa7b7f0fd5b365c1b35e9
Author: Yonghong Song <yonghong.song@linux.dev>

bpf: Account R2 of register-pair returns in live register analysis

This commit updates the live register analysis to correctly mark R2 as read
at the BPF_EXIT of a subprogram that returns a register pair. This prevents
R2 from being considered dead and pruned incorrectly.

> diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
> index 74fc4b3f80d6e..71f998c6eb888 100644
> --- a/kernel/bpf/liveness.c
> +++ b/kernel/bpf/liveness.c
[ ... ]
> @@ -2191,7 +2193,7 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env,
>  			break;
>  		case BPF_EXIT:
>  			def = 0;
> -			use = r0;
> +			use = ret_reg_pair ? (r0 | r2) : r0;
>  			break;

[Severity: High]
This is a pre-existing issue, and wasn't introduced by this patch, but while
we are fixing liveness tracking for register-pair returns here, is the
propagation of R2 back to the caller missing in the verifier?

Looking at prepare_func_exit() in kernel/bpf/verifier.c:

    } else {
        /* return to the caller whatever r0 had in the callee */
        caller->regs[BPF_REG_0] = *r0;
    }

When a static BPF subprogram returning a 16-byte struct is called,
check_func_call() sets all caller-saved registers (including R2) to NOT_INIT.
When the callee exits, it seems we only copy BPF_REG_0 back to the
caller's state, leaving BPF_REG_2 as NOT_INIT.

If the caller attempts to read the second half of the returned struct in R2,
will the verifier reject it with an 'R2 !read_ok' error?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813200210.1991507-1-yonghong.song@linux.dev?part=5