Re: [PATCH bpf-next v4 4/8] bpf: verifier: permit non-zero returns from async callbacks

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2025-09-15 at 21:18 +0100, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> The verifier currently enforces a zero return value for all async
> callbacks—a constraint originally introduced for bpf_timer. That
> restriction is too narrow for other async use cases.
> 
> Relax the rule by allowing non-zero return codes from async callbacks in
> general, while preserving the zero-return requirement for bpf_timer to
> maintain its existing semantics.
> 
> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

>  kernel/bpf/verifier.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index ede511ac7908..102e72c8d070 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10863,7 +10863,7 @@ static int set_timer_callback_state(struct bpf_verifier_env *env,
>  	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
>  	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
>  	callee->in_async_callback_fn = true;
> -	callee->callback_ret_range = retval_range(0, 1);
> +	callee->callback_ret_range = retval_range(0, 0);

Discussed this with Mykyta off-list, note for reviewers:

  For function frame states with ->in_async_callback_fn set to true
  verifier ignores ->callback_ret_range. So the above hunk does not
  change verifier behavior.
  A change below is necessary to take ->callback_ret_range into account.

>  	return 0;
>  }
>  
> @@ -17148,9 +17148,8 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const char
>  	}
>  
>  	if (frame->in_async_callback_fn) {
> -		/* enforce return zero from async callbacks like timer */
>  		exit_ctx = "At async callback return";
> -		range = retval_range(0, 0);
> +		range = frame->callback_ret_range;
>  		goto enforce_retval;
>  	}
>