Re: [PATCH bpf-next v8 11/22] bpf: Dispatch cleanup pads by rewriting return addresses

[Yonghong Song <yonghong.song@linux.dev>]

On 10/3/26 2:26 PM, Alexei Starovoitov wrote:
> On Thu, Oct 01, 2026 at 06:31 AM Yonghong Song <yonghong.song@linux.dev> wrote:
>> +	if (!bpf_prog_need_blind(prog)) {
>> +		ret = bpf_exc_attach_main_prog(env, prog);
>> +		if (ret)
>> +			return ERR_PTR(ret);
>>   		return bpf_int_jit_compile(env, prog);
>> +	}
> bpf-ci is right. The table of a prog without subprogs is never read.
> Drop bpf_exc_attach_main_prog() and these hunks.

Ok, will dropl

>
> [...]
>
>> +	rcu_read_lock();
>> +	prog = bpf_prog_ksym_find(ip);
>> +	rcu_read_unlock();
>> +	if (!prog)
>> +		return !ctx->cnt;
> fexit attached to a subprog in the chain stops the walk here.
>    main -> A -> trampoline -> B -> C
> C calls bpf_unwind(). The return into B is rewritten. The next ip is in
> the trampoline, bpf_prog_ksym_find() returns NULL and the returns into
> A and main stay as they were.
> B returns 0 through the trampoline to A at callsite + 1.
> The verifier didn't see that path, or removed it as dead code.

I will reject such a case (fexit, fmod_ret and fsession) as they
all have the same issue.