Re: [PATCH bpf-next v3 19/20] selftests/bpf: Cover the exception cleanup shapes the chain does not reach

[Yonghong Song <yonghong.song@linux.dev>]

On 9/19/26 11:46 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/tools/testing/selftests/bpf/progs/exceptions_cleanup_shapes.c b/tools/testing/selftests/bpf/progs/exceptions_cleanup_shapes.c
>> new file mode 100644
>> index 000000000000..493f8e030652
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/progs/exceptions_cleanup_shapes.c
> [ ... ]
>
>> +/* 2. A callee called from both a covered and an uncovered site: the pad
>> + * belongs to the call site, not the callee. Either site can throw, and the RCU
>> + * lock between them is what an unwind out of the uncovered one leaks.
>> + */
>> +static __used __noinline __u64 shared_callee(__u64 x)
>> +{
>> +	if (x > 100)
>> +		bpf_throw(THROW_COOKIE);
>> +	return x + 1;
>> +}
>> +
>> +static __used __naked __noinline __u64 shared_frame(void)
>> +{
>> +	asm volatile (
>> +	"r1 = %[input] ll;"
>> +	"r6 = *(u64 *)(r1 + 0);"
>> +	"r1 = %[outer_input] ll;"
>> +	"r1 = *(u64 *)(r1 + 0);"
>> +	"call shared_callee;"		/* uncovered: no pad for its unwind */
>> +	"call bpf_rcu_read_lock;"
> Does the shape 2 header comment accurately describe what the code does?
>
> The comment states "the RCU lock between them is what an unwind out of
> the uncovered one leaks", but the uncovered call to shared_callee()
> happens before bpf_rcu_read_lock() is invoked. When the uncovered site
> throws (which prog_tests/exceptions_cleanup.c tests in the
> shared_callee_uncovered_throw subtest with outer_input = 101, input = 1),
> active_rcu_locks is 0 and there is nothing to leak.
>
> The verifier would also reject a throw with the lock held via
> check_resource_leak() in kernel/bpf/verifier.c, which checks at
> unwind_finish() and refuses with "bpf_throw cannot be used inside
> bpf_rcu_read_lock-ed region" if active_rcu_locks is set.
>
> The lock sits between the two call sites so that only the covered one
> unwinds with it held, making the pad's bpf_rcu_read_unlock() observable.
>
> Should the comment describe that the lock is taken between the two sites
> rather than before the uncovered one?

Yes, will change comment like
   ... the RCU lock is taken between them, so only the covered call unwinds holding it.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35492765538