Re: [PATCH bpf-next v4 08/20] bpf: Walk the exception unwind in the verifier

[Yonghong Song <yonghong.song@linux.dev>]

On 9/22/26 4:43 PM, Eduard Zingerman wrote:
> On Mon, 2026-09-21 at 14:01 -0700, Yonghong Song wrote:
>
> ...
>
>> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
>> index aa631bb45f76..076739d4d974 100644
>> --- a/include/linux/bpf_verifier.h
>> +++ b/include/linux/bpf_verifier.h
> ...
>
>> @@ -991,6 +994,7 @@ struct bpf_verifier_env {
>>   	} cfg;
>>   	struct backtrack_state bt;
>>   	struct bpf_jmp_history_entry *cur_hist_ent;
>> +	u8 unwind_frames; /* scratch: frames the unwind popped to reach the next insn */
> Instead of maintaining this variable across calls to do_check() and
> unwind_step(), I think it should be possible to do bpf_push_jmp_history()
> in the uwind_step() itself.

Yes, bpf_push_jmp_history() is doable. But I think my next patch with
unwind_frames and cur_unwind_frames will be simpler. We can discuss this
in detail after posting next revision.

>
>>   	/* Per-callsite copy of parent's converged at_stack_in for cross-frame fills. */
>>   	struct arg_track **callsite_at_stack;
>>   	u32 pass_cnt; /* number of times do_check() was called */
>> diff --git a/kernel/bpf/backtrack.c b/kernel/bpf/backtrack.c
> ...
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 680ae191aa3f..2bc08c18ebc8 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> ...
>
>> @@ -18510,9 +18513,108 @@ enum {
>>   	INSN_IDX_UPDATED = 2,
>>   };
>>   
>> -static int process_bpf_exit_full(struct bpf_verifier_env *env,
>> -				 bool *do_print_state,
>> -				 bool exception_exit)
>> +static u32 unwind_pop_frame(struct bpf_verifier_env *env)
>> +{
> This function duplicates the code in prepare_func_exit(),
> I'd suggest renaming it to `pop_frame` and calling it from
> prepare_func_exit() as well.

Good point. We want to avoid duplication.

>
>> +	struct bpf_verifier_state *state = env->cur_state;
>> +	struct bpf_func_state *callee = state->frame[state->curframe];
>> +	u32 callsite = callee->callsite;
>> +	struct bpf_func_state *caller;
>> +
>> +	caller = state->frame[state->curframe - 1];
>> +	account_processed_insns(env, callee, caller);
>> +	free_func_state(callee);
>> +	state->frame[state->curframe--] = NULL;
>> +	invalidate_outgoing_stack_args(env, caller);
>> +	return callsite;
>> +}
> ...