From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 66-220-144-179.mail-mxout.facebook.com (66-220-144-179.mail-mxout.facebook.com [66.220.144.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2AB673E0250 for ; Wed, 8 Jul 2026 20:09:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.220.144.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783541398; cv=none; b=aisR9QOY8awsrQT6QZpu6wPwPzpHe+oCTWTntHAKnzoJ0JLabCXeoG9GFMwoLQoo+UN+gr+9XgVmUTtvc/Jbu66Ct1rPfu3pplwiiBA2y3b72ELDWkQlU211E/aYssrxkPEumVmhdVrZY3hrpuCvg1Sruu5yo4gJRMDNmq5kdvw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783541398; c=relaxed/simple; bh=tIqqkSUrA34anda8eH9ICPhYJW0W5nJkiEaXeGEFjFg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IdVk9ecHuqwR4Ll6zoz4YuvIe9QmT46h7bz+qr96ilccmOI1EbEKwT1xGPzfwY/pZD77yYiTcB50+71utuUzxgLzsvma6Fy7ofNMuxe8bZLmGGH5B9NhffDccYtNrKghwgSprLUN9DXmk/q2Qn3iY/rQWNVP9LyWgFGpyOubtVQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=66.220.144.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id C12531D0B6F6E7; Wed, 8 Jul 2026 13:09:44 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman , kernel-team@fb.com Subject: [PATCH bpf-next 01/12] bpf: Factor check_global_ret_scalar_reg() out of the global return check Date: Wed, 8 Jul 2026 13:09:44 -0700 Message-ID: <20260708200944.2153909-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260708200939.2153664-1-yonghong.song@linux.dev> References: <20260708200939.2153664-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Function check_global_subprog_return_code() verifies that a global subpro= gram returns void, an arena pointer, or register R0 which holds a scalar value= . Later patches in this series add 16-byte aggregate return support, whose second half is returned in R2 and needs similar validation. Factor the per-register check into check_global_ret_scalar_reg(env, regno= ) so it can be reused for R2. Signed-off-by: Yonghong Song --- kernel/bpf/verifier.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 001ac53825da..3f34ce1a3107 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -16679,37 +16679,45 @@ static int check_return_code(struct bpf_verifie= r_env *env, int regno, const char return 0; } =20 -static int check_global_subprog_return_code(struct bpf_verifier_env *env= ) +static int check_global_ret_scalar_reg(struct bpf_verifier_env *env, u32= regno) { - struct bpf_reg_state *reg =3D reg_state(env, BPF_REG_0); - struct bpf_func_state *cur_frame =3D cur_func(env); + struct bpf_reg_state *reg; int err; =20 - if (subprog_returns_void(env, cur_frame->subprogno)) - return 0; - - err =3D check_reg_arg(env, BPF_REG_0, SRC_OP); + err =3D check_reg_arg(env, regno, SRC_OP); if (err) return err; =20 /* Pointers to arena are safe to pass between subprograms. */ - if (is_arena_reg(env, BPF_REG_0)) + if (is_arena_reg(env, regno)) return 0; =20 - if (is_pointer_value(env, BPF_REG_0)) { - verbose(env, "R%d leaks addr as return value\n", BPF_REG_0); + if (is_pointer_value(env, regno)) { + verbose(env, "R%d leaks addr as return value\n", regno); return -EACCES; } =20 + reg =3D reg_state(env, regno); if (reg->type !=3D SCALAR_VALUE) { - verbose(env, "At subprogram exit the register R0 is not a scalar value= (%s)\n", - reg_type_str(env, reg->type)); + verbose(env, "At subprogram exit the register R%d is not a scalar valu= e (%s)\n", + regno, reg_type_str(env, reg->type)); return -EINVAL; } =20 return 0; } =20 +static int check_global_subprog_return_code(struct bpf_verifier_env *env= ) +{ + struct bpf_func_state *cur_frame =3D cur_func(env); + u32 subprog =3D cur_frame->subprogno; + + if (subprog_returns_void(env, subprog)) + return 0; + + return check_global_ret_scalar_reg(env, BPF_REG_0); +} + /* Bitmask with 1s for all caller saved registers */ #define ALL_CALLER_SAVED_REGS ((1u << CALLER_SAVED_REGS) - 1) =20 --=20 2.53.0-Meta