Re: [PATCH bpf-next v6 04/10] bpf: Handle R2 as a return register in precision backtracking

[Eduard Zingerman <eddyz87@gmail.com>]

On Sun, 2026-08-16 at 21:22 -0700, Yonghong Song wrote:
> Precision backtracking treats only R0 as a return register at a
> call/return boundary, so once the verifier starts modeling R2 that way,
> marking the second half of such a return precise would trip the
> "unexpected regs" checks in backtrack_insn() and reject a valid
> program.
> 
> Marking the upper half precise, for example by branching on it after a
> call to a static subprogram, walks backtracking into the callee and
> reaches its BPF_EXIT with R2 still set in the mask. Handle R2 like R0
> in boundaries where a call defines the return registers.
> 
> R2 differs from R0 in that it is an argument register as well, so it is
> part of the BPF_REGMASK_ARGS check and has to be cleared before that check
> rather than next to R0. Clear it unconditionally, rather than only where
> the callee or the kfunc really does return a pair. That gives up the
> "unexpected regs" assertion for R2, and in exchange keeps backtracking
> free of any BTF lookup. Nothing is lost: a callee that does not return
> a pair leaves the caller's R2 uninitialized, so the main verification
> pass has already rejected any program that reads it, and backtracking
> is never asked for its precision.
> 
> At BPF_EXIT the return registers are sampled before the callback path
> clears R1-R5. That clear does not touch R0, but it does cover R2, and
> running it first would drop a pair return whenever the instruction
> following the call happens to be one that invokes a callback.
> 
> Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...