Re: [PATCH bpf-next 07/12] bpf: Reject >8 byte return values on return-reading trampoline paths

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-07-08 at 13:10 -0700, Yonghong Song wrote:
> btf_distill_func_proto() builds the function model used for kfunc calls,
> the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. A following
> patch relaxes it to accept a >8 and <=16 byte return value, which for the
> BPF target is passed back in the R0:R2 register pair.
> 
> But the BPF trampoline cannot preserve such a return. It saves and restores
> only 8 bytes of the return value (RAX on x86, i.e. R0), so the second half
> (RDX / R2) is not preserved across a program that observes the return
> value. A program attached to a function returning a 16-byte value (e.g.
> current_time() or ns_to_timespec64(), which return struct timespec64)
> would corrupt the value seen by the real caller and read a partial return
> value itself. struct_ops trampolines have the same limitation.
> 
> This only matters for the attach types that actually read the target's
> return value: fexit, fmod_ret and fsession (plus the _multi variants of
> fexit and fsession). fentry and fentry_multi run before the target returns
> and never touch the return value, so they can attach to a >8 byte-returning
> function safely.
> 
> Reject a >8 byte return value for the return-reading attach types in
> bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for
> struct_ops in bpf_struct_ops_desc_init(), ahead of the following patch that
> would otherwise let such a return through. kfunc and BPF-to-BPF subprogram
> calls, which the JIT does handle, are unaffected.
> 
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---

Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>

Maybe post this independently from the current patch-set?
Seem to be a standalone fix.