All of lore.kernel.org
 help / color / mirror / Atom feed
From: Yonghong Song <yonghong.song@linux.dev>
To: bot+bpf-ci@kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net,
	eddyz87@gmail.com, kernel-team@fb.com, martin.lau@kernel.org,
	clm@meta.com, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis
Date: Wed, 19 Aug 2026 08:58:00 -0700	[thread overview]
Message-ID: <8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev> (raw)
In-Reply-To: <c980dd5e462778928bef54067202b7861ff06e0e6abf6667d7cd8ee79f2431d8@mail.kernel.org>



On 8/18/26 11:32 PM, bot+bpf-ci@kernel.org wrote:
>>      bpf: Account R2 of register-pair returns in live register analysis
>>
>>      A BPF_EXIT of a subprogram returning a value larger than 8 bytes (a
>>      struct/union or an __int128) reads R2 as well as R0, since the second half
>>      of the return value is passed back in R2. compute_insn_live_regs() only
>>      marked R0 used at exit, so a callee's R2 could be considered dead and
>>      cleaned from checkpointed states, which would allow unsound state pruning.
>>
>>      Mark R2 as read at the BPF_EXIT of a subprogram that does return a register
>>      pair. bpf_compute_live_registers() now loops over the subprograms and, for
>>      each, over the [start, end) instruction range from env->subprog_info[], so
>>      the return convention is queried once per subprogram through
>>      bpf_ret_reg_pair() rather than once per instruction.
>>
>>      Marking R2 at every exit instead would be simpler, but R2 would then stay
>>      live backwards across any call that is not followed by a write to R2, which
>>      is nearly every program, and would needlessly hurt state pruning.
>>
>>      Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>>      Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> This commit fixes a bug where R2 was not marked as live at BPF_EXIT for
> subprograms returning register pairs, which could allow unsound state
> pruning. The bug was introduced when register-pair return support was
> added. Should this include:
>
>    Fixes: b176d222c14a ("bpf: Add helpers to describe the R0:R2 return register pair")

No need to have above Fixes in the same series.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32221968339


  reply	other threads:[~2026-08-19 15:58 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-19  5:52 [PATCH bpf-next v7 00/10] bpf: Support aggregate return values up to 16 bytes Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 01/10] bpf: Factor check_global_ret_scalar_reg() out of the global return check Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 02/10] bpf: Add helpers to describe the R0:R2 return register pair Yonghong Song
2026-08-19  6:17   ` sashiko-bot
2026-08-19 15:41     ` Yonghong Song
2026-08-19 15:50     ` Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 03/10] bpf: Wire up JIT support for 16-byte kfunc returns Yonghong Song
2026-08-19  6:49   ` bot+bpf-ci
2026-08-19 15:52     ` Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 04/10] bpf: Handle R2 as a return register in precision backtracking Yonghong Song
2026-08-19  6:03   ` sashiko-bot
2026-08-19 15:54     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis Yonghong Song
2026-08-19  6:20   ` sashiko-bot
2026-08-19 15:57     ` Yonghong Song
2026-08-19  6:32   ` bot+bpf-ci
2026-08-19 15:58     ` Yonghong Song [this message]
2026-08-19  5:53 ` [PATCH bpf-next v7 06/10] bpf: Add verifier support for 16-byte returns in R0:R2 Yonghong Song
2026-08-19  6:14   ` sashiko-bot
2026-08-19 16:01     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 07/10] bpf: Enable aggregate return types up to 16 bytes Yonghong Song
2026-08-19  6:13   ` sashiko-bot
2026-08-19 16:04     ` Yonghong Song
2026-08-19  6:50   ` bot+bpf-ci
2026-08-19 16:12     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 08/10] selftests/bpf: Add C tests for 16-byte returns in R0:R2 Yonghong Song
2026-08-19  6:49   ` bot+bpf-ci
2026-08-19 16:15     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 09/10] selftests/bpf: Add inline-asm and subprog tests for R0:R2 returns Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 10/10] Documentation/bpf: Document up to 16-byte kfunc return values in R0:R2 Yonghong Song

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev \
    --to=yonghong.song@linux.dev \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bot+bpf-ci@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=clm@meta.com \
    --cc=daniel@iogearbox.net \
    --cc=eddyz87@gmail.com \
    --cc=ihor.solodrai@linux.dev \
    --cc=kernel-team@fb.com \
    --cc=martin.lau@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.