Re: [PATCH bpf-next v2 1/2] selftests/bpf: Keep int return type for tailcall subprogs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incomplete application of compiler optimization mitigation in `classifier_0`.
--

commit 230de7228ec64290b0e30a90f68ca96dd2ee6dd0
Author: Yonghong Song <yonghong.song@linux.dev>
selftests/bpf: Keep int return type for tailcall subprogs

This commit updates tailcall subprograms to prevent LLVM 23 from optimizing
their return types from 'int' to 'void', which would cause verifier failures.
It uses barrier_var() and __sink() to ensure the compiler retains the int
return type.

> diff --git a/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
> index ae94c9c70ab7d..6fde0ab921486 100644
> --- a/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
> +++ b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
[ ... ]
> @@ -41,16 +44,22 @@ int classifier_0(struct __sk_buff *skb)
>  static __noinline
>  int subprog_tail1(struct __sk_buff *skb)
>  {
> +	int ret = 0;
> +
>  	bpf_tail_call_static(skb, &jmp_table, 1);
> -	return 0;
> +	barrier_var(ret);
> +	return ret;
>  }
>  
>  __auxiliary
>  SEC("tc")
>  int classifier_1(struct __sk_buff *skb)
>  {
> +	int ret;
> +
>  	count1++;
> -	subprog_tail1(skb);
> +	ret = subprog_tail1(skb);
> +	__sink(ret);
>  	return 0;
>  }

[Severity: Medium]
In classifier_1() here, the return value of subprog_tail1() is captured and
sunk using __sink() to prevent optimization. Should classifier_0() also be
updated symmetrically to capture and sink the return value of subprog_tail0()?

Looking at classifier_0() in the same file:

__auxiliary
SEC("tc")
int classifier_0(struct __sk_buff *skb)
{
	count0++;
	subprog_tail0(skb);
	return 0;
}

While the return value of subprog_tail0() is currently sunk elsewhere in
tailcall_bpf2bpf_hierarchy_2(), leaving this callsite unsunk could
potentially leave the code fragile to LLVM optimizations that might create a
void-returning clone of subprog_tail0() specifically for classifier_0().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609233402.2711071-1-yonghong.song@linux.dev?part=1