Re: [PATCH bpf-next v8 11/22] bpf: Dispatch cleanup pads by rewriting return addresses

[Yonghong Song <yonghong.song@linux.dev>]

On 10/1/26 7:31 AM, bot+bpf-ci@kernel.org wrote:
>> bpf: Dispatch cleanup pads by rewriting return addresses
> TL;DR: Design question, not a bug: bpf_exc_attach_main_prog() in
> bpf_prog_jit_compile() builds a table for single-function programs that seems
> never to be read, so it and its error paths could possibly be dropped.
>
>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>> index d813fdde29e3..60905643cb9c 100644
>> --- a/kernel/bpf/core.c
>> +++ b/kernel/bpf/core.c
> [ ... ]
>
>> @@ -2632,9 +2633,14 @@ static struct bpf_prog *bpf_prog_jit_compile(struct bpf_verifier_env *env, struc
>>   {
>>   #ifdef CONFIG_BPF_JIT
>>   	struct bpf_prog *orig_prog;
>> +	int ret;
>>   
>> -	if (!bpf_prog_need_blind(prog))
>> +	if (!bpf_prog_need_blind(prog)) {
>> +		ret = bpf_exc_attach_main_prog(env, prog);
>> +		if (ret)
>> +			return ERR_PTR(ret);
>>   		return bpf_int_jit_compile(env, prog);
>> +	}
>>   
>>   	orig_prog = prog;
>>   	prog = bpf_jit_blind_constants(env, prog);
>> @@ -2648,6 +2654,12 @@ static struct bpf_prog *bpf_prog_jit_compile(struct bpf_verifier_env *env, struc
>>   		goto out_restore;
>>   	}
>>   
>> +	ret = bpf_exc_attach_main_prog(env, prog);
>> +	if (ret) {
>> +		bpf_jit_prog_release_other(orig_prog, prog);
>> +		return ERR_PTR(ret);
>> +	}
>> +
>>   	prog = bpf_int_jit_compile(env, prog);
>>   	if (prog->jited) {
>>   		bpf_jit_prog_release_other(prog, orig_prog);
> this isn't a bug, but is the table that bpf_exc_attach_main_prog() builds
> for a single-function program read anywhere?
>
> It only attaches a table when there are no subprograms:
>
> kernel/bpf/fixups.c:bpf_exc_attach_main_prog() {
>      if (!env || env->subprog_cnt > 1)
>          return 0;
>      return exc_info_for_subprog(env, prog, 0, prog->len);
> }
>
> The only reader of the table that I can find is bpf_unwind_rewrite(), and it
> returns at the first BPF frame before it does the pad lookup:
>
> kernel/bpf/helpers.c:bpf_unwind_rewrite() {
>      ...
>      if (ctx->cnt == 1)
>          return bpf_is_subprog(prog);
>
>      rec = bpf_exc_pad_for_ip(prog, ip);
>      ...
> }
>
> With no subprograms, the main frame is the only BPF frame, so it is always
> the one with ctx->cnt == 1 and bpf_exc_pad_for_ip() is not reached for it.
> The bpf_unwind() calls in such a program are already sent to their pad by
> the jump that bpf_exc_patch_unwind_calls() inserts.
>
> If that is right, could bpf_exc_attach_main_prog() and its two call sites in
> bpf_prog_jit_compile(), with the new 'return ERR_PTR(ret)' paths, be dropped
> so that bpf_prog_jit_compile() stays as it was?

You are right. So dead code. Will remove.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/36872142096