BPF List
 help / color / mirror / Atom feed
From: Yonghong Song <yonghong.song@linux.dev>
To: bot+bpf-ci@kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net,
	eddyz87@gmail.com, kernel-team@fb.com, martin.lau@kernel.org,
	clm@meta.com, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis
Date: Wed, 19 Aug 2026 08:58:00 -0700	[thread overview]
Message-ID: <8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev> (raw)
In-Reply-To: <c980dd5e462778928bef54067202b7861ff06e0e6abf6667d7cd8ee79f2431d8@mail.kernel.org>



On 8/18/26 11:32 PM, bot+bpf-ci@kernel.org wrote:
>>      bpf: Account R2 of register-pair returns in live register analysis
>>
>>      A BPF_EXIT of a subprogram returning a value larger than 8 bytes (a
>>      struct/union or an __int128) reads R2 as well as R0, since the second half
>>      of the return value is passed back in R2. compute_insn_live_regs() only
>>      marked R0 used at exit, so a callee's R2 could be considered dead and
>>      cleaned from checkpointed states, which would allow unsound state pruning.
>>
>>      Mark R2 as read at the BPF_EXIT of a subprogram that does return a register
>>      pair. bpf_compute_live_registers() now loops over the subprograms and, for
>>      each, over the [start, end) instruction range from env->subprog_info[], so
>>      the return convention is queried once per subprogram through
>>      bpf_ret_reg_pair() rather than once per instruction.
>>
>>      Marking R2 at every exit instead would be simpler, but R2 would then stay
>>      live backwards across any call that is not followed by a write to R2, which
>>      is nearly every program, and would needlessly hurt state pruning.
>>
>>      Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>>      Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> This commit fixes a bug where R2 was not marked as live at BPF_EXIT for
> subprograms returning register pairs, which could allow unsound state
> pruning. The bug was introduced when register-pair return support was
> added. Should this include:
>
>    Fixes: b176d222c14a ("bpf: Add helpers to describe the R0:R2 return register pair")

No need to have above Fixes in the same series.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32221968339


  reply	other threads:[~2026-08-19 15:58 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-19  5:52 [PATCH bpf-next v7 00/10] bpf: Support aggregate return values up to 16 bytes Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 01/10] bpf: Factor check_global_ret_scalar_reg() out of the global return check Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 02/10] bpf: Add helpers to describe the R0:R2 return register pair Yonghong Song
2026-08-19  6:17   ` sashiko-bot
2026-08-19 15:41     ` Yonghong Song
2026-08-19 15:50     ` Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 03/10] bpf: Wire up JIT support for 16-byte kfunc returns Yonghong Song
2026-08-19  6:49   ` bot+bpf-ci
2026-08-19 15:52     ` Yonghong Song
2026-08-19  5:52 ` [PATCH bpf-next v7 04/10] bpf: Handle R2 as a return register in precision backtracking Yonghong Song
2026-08-19  6:03   ` sashiko-bot
2026-08-19 15:54     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 05/10] bpf: Account R2 of register-pair returns in live register analysis Yonghong Song
2026-08-19  6:20   ` sashiko-bot
2026-08-19 15:57     ` Yonghong Song
2026-08-19  6:32   ` bot+bpf-ci
2026-08-19 15:58     ` Yonghong Song [this message]
2026-08-19  5:53 ` [PATCH bpf-next v7 06/10] bpf: Add verifier support for 16-byte returns in R0:R2 Yonghong Song
2026-08-19  6:14   ` sashiko-bot
2026-08-19 16:01     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 07/10] bpf: Enable aggregate return types up to 16 bytes Yonghong Song
2026-08-19  6:13   ` sashiko-bot
2026-08-19 16:04     ` Yonghong Song
2026-08-19  6:50   ` bot+bpf-ci
2026-08-19 16:12     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 08/10] selftests/bpf: Add C tests for 16-byte returns in R0:R2 Yonghong Song
2026-08-19  6:49   ` bot+bpf-ci
2026-08-19 16:15     ` Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 09/10] selftests/bpf: Add inline-asm and subprog tests for R0:R2 returns Yonghong Song
2026-08-19  5:53 ` [PATCH bpf-next v7 10/10] Documentation/bpf: Document up to 16-byte kfunc return values in R0:R2 Yonghong Song

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8acfeb2f-664b-421c-b98a-58f64387a6eb@linux.dev \
    --to=yonghong.song@linux.dev \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bot+bpf-ci@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=clm@meta.com \
    --cc=daniel@iogearbox.net \
    --cc=eddyz87@gmail.com \
    --cc=ihor.solodrai@linux.dev \
    --cc=kernel-team@fb.com \
    --cc=martin.lau@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox