Re: [PATCH bpf-next v2 01/10] bpf: Record each half of a paired return value in verifier diagnostics

[Yonghong Song <yonghong.song@linux.dev>]

On 8/25/26 2:59 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index e036ae20bf6b9..9aa29c3670087 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -10403,10 +10403,14 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
>>   		 * return to the caller whatever the callee had in the
>>   		 * return register(s)
>>   		 */
>> -		bpf_diag_mod_begin(env, &caller->regs[BPF_REG_0], r0, BPF_DIAG_MOD_WRITE);
>> -		for (i = 0; i < nregs; i++)
>> -			caller->regs[ret_regs[i]] = callee->regs[ret_regs[i]];
>> -		bpf_diag_mod_end(env);
>> +		for (i = 0; i < nregs; i++) {
>> +			u32 regno = ret_regs[i];
>> +
>> +			bpf_diag_mod_begin(env, &caller->regs[regno], &callee->regs[regno],
>> +					   BPF_DIAG_MOD_WRITE);
>> +			caller->regs[regno] = callee->regs[regno];
>> +			bpf_diag_mod_end(env);
>> +		}
>>   	}
>>
>>   	/* for callbacks like bpf_loop or bpf_for_each_map_elem go back to callsite,
> This fix looks correct for prepare_func_exit(). Should check_func_call()
> and check_kfunc_call() get the same per-return-register diagnostic scope,
> or is R2 intentionally left out there?
>
> Commit 0630ad00d96d introduced the same pattern in three places, and this
> patch addresses only prepare_func_exit().
>
> In check_func_call(), the global-subprog path has:
>
>      bpf_diag_mod_begin(env, &caller->regs[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE);
>      ...
>      nregs = bpf_ret_reg_pair(env, subprog) ? 2 : 1;
>      for (i = 0; i < nregs; i++)
>              mark_reg_unknown(env, caller->regs, ret_regs[i]);
>      bpf_diag_mod_end(env);
>
> When nregs is 2, mark_reg_unknown() writes into caller->regs[BPF_REG_2],
> but the scope target is caller->regs[BPF_REG_0], so the write emits no
> BPF_DIAG_HISTORY_MOD event.
>
> Similarly in check_kfunc_call():
>
>      bpf_diag_mod_begin(env, &regs[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE);
>      ...
>      mark_kfunc_ret_regs(env, regs, t->size);   /* writes R0 and, for 8 < size <= 16, R2 */
>      ...
>      bpf_diag_mod_end(env);
>
> When t->size is between 8 and 16 bytes, mark_kfunc_ret_regs() writes the
> second half into R2, but again with no MOD event.
>
> In both cases R2 does get a BPF_DIAG_MOD_CALLER_SAVED scrub record, so
> the history shows R2 as clobbered by the call but never shows it being
> written with the second half of the return value.

Yes, I need to add these two cases for bpf_diag_mod.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32899532405