Re: [PATCH bpf-next v2 1/2] selftests/bpf: Keep int return type for tailcall subprogs

[Yonghong Song <yonghong.song@linux.dev>]

On 6/9/26 4:42 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Incomplete application of compiler optimization mitigation in `classifier_0`.
> --
>
> commit 230de7228ec64290b0e30a90f68ca96dd2ee6dd0
> Author: Yonghong Song <yonghong.song@linux.dev>
> selftests/bpf: Keep int return type for tailcall subprogs
>
> This commit updates tailcall subprograms to prevent LLVM 23 from optimizing
> their return types from 'int' to 'void', which would cause verifier failures.
> It uses barrier_var() and __sink() to ensure the compiler retains the int
> return type.
>
>> diff --git a/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
>> index ae94c9c70ab7d..6fde0ab921486 100644
>> --- a/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
>> +++ b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_hierarchy2.c
> [ ... ]
>> @@ -41,16 +44,22 @@ int classifier_0(struct __sk_buff *skb)
>>   static __noinline
>>   int subprog_tail1(struct __sk_buff *skb)
>>   {
>> +	int ret = 0;
>> +
>>   	bpf_tail_call_static(skb, &jmp_table, 1);
>> -	return 0;
>> +	barrier_var(ret);
>> +	return ret;
>>   }
>>   
>>   __auxiliary
>>   SEC("tc")
>>   int classifier_1(struct __sk_buff *skb)
>>   {
>> +	int ret;
>> +
>>   	count1++;
>> -	subprog_tail1(skb);
>> +	ret = subprog_tail1(skb);
>> +	__sink(ret);
>>   	return 0;
>>   }
> [Severity: Medium]
> In classifier_1() here, the return value of subprog_tail1() is captured and
> sunk using __sink() to prevent optimization. Should classifier_0() also be
> updated symmetrically to capture and sink the return value of subprog_tail0()?
>
> Looking at classifier_0() in the same file:
>
> __auxiliary
> SEC("tc")
> int classifier_0(struct __sk_buff *skb)
> {
> 	count0++;
> 	subprog_tail0(skb);
> 	return 0;
> }
>
> While the return value of subprog_tail0() is currently sunk elsewhere in
> tailcall_bpf2bpf_hierarchy_2(), leaving this callsite unsunk could
> potentially leave the code fragile to LLVM optimizations that might create a
> void-returning clone of subprog_tail0() specifically for classifier_0().

We should be fine. In the same file, we have  SEC("tc")
  int tailcall_bpf2bpf_hierarchy_2(struct __sk_buff *skb)
  {
-	int ret = 0;
+	int ret = 0, ret1, ret2;
  
  	clobber_regs_stack();
  
-	subprog_tail0(skb);
-	subprog_tail1(skb);
-
+	ret1 = subprog_tail0(skb);
+	ret2 = subprog_tail1(skb);
+	__sink(ret1);
+	__sink(ret2);
  	__sink(ret);
  	return (count1 << 16) | count0;
  }

This will guarantee subprog_tail0() will have a return value.