Re: [PATCH bpf-next v4 05/13] bpf: Account R2 of register-pair returns in live register analysis

[Yonghong Song <yonghong.song@linux.dev>]

On 8/10/26 6:09 PM, bot+bpf-ci@kernel.org wrote:
>> A BPF_EXIT of a subprogram returning a value larger than 8 bytes (a
>> struct/union or an __int128) reads R2 as well as R0, since the second half
>> of the return value is passed back in R2. compute_insn_live_regs() only
>> marked R0 used at exit, so a callee's R2 could be considered dead and
>> cleaned from checkpointed states, which would allow unsound state pruning.
>>
>> Mark R2 as read at the BPF_EXIT of a subprogram that does return a register
>> pair. bpf_compute_live_registers() walks the instructions in order and
>> env->subprog_info[] is sorted by subprogram start, so the containing
>> subprogram is tracked with a running index and its return convention is
>> queried once per subprogram through bpf_ret_reg_pair().
> This isn't a bug, but the description talks about tracking the containing
> subprogram with a running index while walking instructions in order. The
> code that landed uses a plain nested loop iterating over subprog_info[]
> directly:
>
> 	for (subprog = 0; subprog < env->subprog_cnt; subprog++) {
> 		start = env->subprog_info[subprog].start;
> 		end = env->subprog_info[subprog + 1].start;
> 		ret_reg_pair = bpf_ret_reg_pair(env, subprog);
>
> 		for (i = start; i < end; ++i)
> 			compute_insn_live_regs(env, &insns[i], &state[i], ret_reg_pair);
> 	}
>
> This nested form gets its [start, end) ranges straight from subprog_info[]
> (the same idiom mark_fastcall_patterns() uses), so neither "walks the
> instructions in order" nor the sortedness reasoning is what makes the loop
> correct. Would it be worth adjusting that paragraph to describe the nested
> loop form that landed?

Okay, will update the commit message.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31446101762