From: Yonghong Song <yonghong.song@linux.dev>
To: bot+bpf-ci@kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net,
eddyz87@gmail.com, kernel-team@fb.com, martin.lau@kernel.org,
mason@kernel.org, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next v10 07/24] bpf: Verify an unwind through landing pads and epilogues
Date: Fri, 9 Oct 2026 17:25:58 +0200 [thread overview]
Message-ID: <1f517342-2123-4a51-8581-99d04108c0d9@linux.dev> (raw)
In-Reply-To: <59c036011bdc8e7bee4cdb78ab4ed375729668c9e99f62a82b7c156c80967bc9@mail.kernel.org>
On 10/9/26 7:13 AM, bot+bpf-ci@kernel.org wrote:
>> bpf: Verify an unwind through landing pads and epilogues
> TL;DR: Nit only: unwind_frames() sets r0 to zero in two calls;
> __mark_reg_const_zero() could do it in one, as process_iter_next_call() does,
> and the explanatory comment could go. No bug.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 0cf30220b777..1553c7d5bbdb 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -19203,6 +19212,135 @@ enum {
> [ ... ]
>> +static int unwind_frames(struct bpf_verifier_env *env, bool *do_print_state)
>> +{
> [ ... ]
>
>> + /*
>> + * The call clobbered r1-r5, and r0 holds the zero the fixups put
>> + * there. Mark r0 unknown first: the known-zero helper keeps a NOT_INIT
>> + * type.
>> + */
>> + clear_caller_saved_regs(env, cur_regs(env));
>> + mark_reg_unknown(env, cur_regs(env), BPF_REG_0);
>> + mark_reg_known_zero(env, cur_regs(env), BPF_REG_0);
> this isn't a bug, but could this use __mark_reg_const_zero(env,
> &cur_regs(env)[BPF_REG_0]), as process_iter_next_call() does, and drop
> the part of the comment that explains why two calls are needed?
>
> unwind_frames() sets r0 to a scalar zero in two steps here:
> mark_reg_unknown() sets the SCALAR_VALUE type, then mark_reg_known_zero()
> sets the value. __mark_reg_const_zero() already sets the type to
> SCALAR_VALUE, the value to known zero, and precise to !bpf_capable in one
> call. process_iter_next_call() and check_kfunc_call() both use it for
> r0 this way.
Okay, will do (with better code) in the next revision.
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/37884246994
next prev parent reply other threads:[~2026-10-09 15:26 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-09 4:14 [PATCH bpf-next v10 00/24] bpf: Run exception cleanup landing pads when bpf_unwind() unwinds Yonghong Song
2026-10-09 4:14 ` [PATCH bpf-next v10 01/24] bpf: Pack bpf_insn_aux_data flags into bit fields Yonghong Song
2026-10-09 4:14 ` [PATCH bpf-next v10 02/24] bpf: Accept the compiler's exception cleanup table at program load Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 03/24] bpf: Add the bpf_unwind() and bpf_unwind_resume() kfuncs Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 04/24] bpf: Keep a call site's landing pad in insn_aux_data, add lookups Yonghong Song
2026-10-09 4:28 ` sashiko-bot
2026-10-09 15:10 ` Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 05/24] bpf: Mark covered call sites and check a program can take a table Yonghong Song
2026-10-09 4:34 ` sashiko-bot
2026-10-09 15:13 ` Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 06/24] bpf: Make exception landing pads reachable in the CFG Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 07/24] bpf: Verify an unwind through landing pads and epilogues Yonghong Song
2026-10-09 4:40 ` sashiko-bot
2026-10-09 15:24 ` Yonghong Song
2026-10-09 5:13 ` bot+bpf-ci
2026-10-09 15:25 ` Yonghong Song [this message]
2026-10-09 4:15 ` [PATCH bpf-next v10 08/24] bpf: Refuse a callback that can unwind Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 09/24] bpf: Refuse a landing pad that does not resume Yonghong Song
2026-10-10 15:08 ` Alexei Starovoitov
2026-10-11 18:26 ` Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 10/24] bpf: Do not use a private stack for a program that can unwind Yonghong Song
2026-10-09 4:45 ` sashiko-bot
2026-10-09 15:38 ` Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 11/24] bpf: Prepare JITed programs for dispatching cleanup pads Yonghong Song
2026-10-09 4:35 ` sashiko-bot
2026-10-09 16:12 ` Yonghong Song
2026-10-09 5:13 ` bot+bpf-ci
2026-10-09 16:39 ` Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 12/24] bpf: Dispatch cleanup pads by rewriting return addresses Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 13/24] bpf: Refuse a trampoline that calls a subprog that can unwind Yonghong Song
2026-10-09 4:15 ` [PATCH bpf-next v10 14/24] bpf, x86: Dispatch exception cleanup pads at run time Yonghong Song
2026-10-09 4:32 ` sashiko-bot
2026-10-09 16:51 ` Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 15/24] bpf, arm64: " Yonghong Song
2026-10-09 4:30 ` sashiko-bot
2026-10-09 16:55 ` Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 16/24] libbpf: Resolve the compiler's _Unwind_Resume to the kernel's kfunc Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 17/24] libbpf: Add cleanup_info to bpf_prog_load_opts Yonghong Song
2026-10-09 4:26 ` sashiko-bot
2026-10-09 4:16 ` [PATCH bpf-next v10 18/24] libbpf: Collect .bpf_cleanup records and pass them to the kernel Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 19/24] libbpf: Carry the exception cleanup table through the light skeleton Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 20/24] libbpf: Let the static linker carry .bpf_cleanup relocations Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 21/24] selftests/bpf: Add end-to-end and negative .bpf_cleanup exception tests Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 22/24] selftests/bpf: Add __set_global() and __ret_global() test tags Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 23/24] selftests/bpf: Cover more accepted .bpf_cleanup exception shapes Yonghong Song
2026-10-09 4:16 ` [PATCH bpf-next v10 24/24] selftests/bpf: Load an exception cleanup program from a light skeleton Yonghong Song
2026-10-10 15:15 ` [PATCH bpf-next v10 00/24] bpf: Run exception cleanup landing pads when bpf_unwind() unwinds Alexei Starovoitov
2026-10-11 17:30 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1f517342-2123-4a51-8581-99d04108c0d9@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=ihor.solodrai@linux.dev \
--cc=kernel-team@fb.com \
--cc=martin.lau@kernel.org \
--cc=mason@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox