From: Yonghong Song <yonghong.song@linux.dev>
To: bot+bpf-ci@kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net,
eddyz87@gmail.com, kernel-team@fb.com, martin.lau@kernel.org,
clm@meta.com, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis
Date: Wed, 19 Aug 2026 08:58:00 -0700 [thread overview]
Message-ID: <8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev> (raw)
In-Reply-To: <c980dd5e462778928bef54067202b7861ff06e0e6abf6667d7cd8ee79f2431d8@mail.kernel.org>
On 8/18/26 11:32 PM, bot+bpf-ci@kernel.org wrote:
>> bpf: Account R2 of register-pair returns in live register analysis
>>
>> A BPF_EXIT of a subprogram returning a value larger than 8 bytes (a
>> struct/union or an __int128) reads R2 as well as R0, since the second half
>> of the return value is passed back in R2. compute_insn_live_regs() only
>> marked R0 used at exit, so a callee's R2 could be considered dead and
>> cleaned from checkpointed states, which would allow unsound state pruning.
>>
>> Mark R2 as read at the BPF_EXIT of a subprogram that does return a register
>> pair. bpf_compute_live_registers() now loops over the subprograms and, for
>> each, over the [start, end) instruction range from env->subprog_info[], so
>> the return convention is queried once per subprogram through
>> bpf_ret_reg_pair() rather than once per instruction.
>>
>> Marking R2 at every exit instead would be simpler, but R2 would then stay
>> live backwards across any call that is not followed by a write to R2, which
>> is nearly every program, and would needlessly hurt state pruning.
>>
>> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> This commit fixes a bug where R2 was not marked as live at BPF_EXIT for
> subprograms returning register pairs, which could allow unsound state
> pruning. The bug was introduced when register-pair return support was
> added. Should this include:
>
> Fixes: b176d222c14a ("bpf: Add helpers to describe the R0:R2 return register pair")
No need to have above Fixes in the same series.
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32221968339
next prev parent reply other threads:[~2026-08-19 15:58 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 5:52 [PATCH bpf-next v7 00/10] bpf: Support aggregate return values up to 16 bytes Yonghong Song
2026-08-19 5:52 ` [PATCH bpf-next v7 01/10] bpf: Factor check_global_ret_scalar_reg() out of the global return check Yonghong Song
2026-08-19 5:52 ` [PATCH bpf-next v7 02/10] bpf: Add helpers to describe the R0:R2 return register pair Yonghong Song
2026-08-19 6:17 ` sashiko-bot
2026-08-19 15:41 ` Yonghong Song
2026-08-19 15:50 ` Yonghong Song
2026-08-19 5:52 ` [PATCH bpf-next v7 03/10] bpf: Wire up JIT support for 16-byte kfunc returns Yonghong Song
2026-08-19 6:49 ` bot+bpf-ci
2026-08-19 15:52 ` Yonghong Song
2026-08-19 5:52 ` [PATCH bpf-next v7 04/10] bpf: Handle R2 as a return register in precision backtracking Yonghong Song
2026-08-19 6:03 ` sashiko-bot
2026-08-19 15:54 ` Yonghong Song
2026-08-19 5:53 ` [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis Yonghong Song
2026-08-19 6:20 ` sashiko-bot
2026-08-19 15:57 ` Yonghong Song
2026-08-19 6:32 ` bot+bpf-ci
2026-08-19 15:58 ` Yonghong Song [this message]
2026-08-19 5:53 ` [PATCH bpf-next v7 06/10] bpf: Add verifier support for 16-byte returns in R0:R2 Yonghong Song
2026-08-19 6:14 ` sashiko-bot
2026-08-19 16:01 ` Yonghong Song
2026-08-19 5:53 ` [PATCH bpf-next v7 07/10] bpf: Enable aggregate return types up to 16 bytes Yonghong Song
2026-08-19 6:13 ` sashiko-bot
2026-08-19 16:04 ` Yonghong Song
2026-08-19 6:50 ` bot+bpf-ci
2026-08-19 16:12 ` Yonghong Song
2026-08-19 5:53 ` [PATCH bpf-next v7 08/10] selftests/bpf: Add C tests for 16-byte returns in R0:R2 Yonghong Song
2026-08-19 6:49 ` bot+bpf-ci
2026-08-19 16:15 ` Yonghong Song
2026-08-19 5:53 ` [PATCH bpf-next v7 09/10] selftests/bpf: Add inline-asm and subprog tests for R0:R2 returns Yonghong Song
2026-08-19 5:53 ` [PATCH bpf-next v7 10/10] Documentation/bpf: Document up to 16-byte kfunc return values in R0:R2 Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=ihor.solodrai@linux.dev \
--cc=kernel-team@fb.com \
--cc=martin.lau@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox