Re: [PATCH bpf-next 04/12] bpf: Track R2 of register-pair returns in precision backtracking

[Yonghong Song <yonghong.song@linux.dev>]

On 7/8/26 2:10 PM, bot+bpf-ci@kernel.org wrote:
>> A function returning a value larger than 8 bytes (a struct/union, or an
>> __int128) uses R2 as a second return register alongside R0. Previous
>> precision backtracking only treated R0 as a return register at a
>> call/return boundary, so marking the second half of such a return precise
>> would trip the "unexpected regs" checks in backtrack_insn() and reject a
>> valid program with -EFAULT.
>>
>> Handle R2 like R0 in the three boundaries where a call defines the return
>> registers:
>>
>>   - static subprog exit (BPF_EXIT): R2 is a return register, not a leftover
>>     argument; clear it before the args check and propagate its precision
>>     into the callee.
>>   - global subprog call: a global subprog returning >8 bytes also sets R2;
>>     clear it before the args check.
>>   - kfunc call (BPF_CALL): a kfunc returning >8 bytes (model ret_size > 8)
>>     also sets R2; clear it like R0.
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> This looks like a fix for the R0:R2 register-pair return handling that
> went in earlier in this series, where backtrack_insn() was not updated to
> treat R2 as a return register.  Should this carry a Fixes: tag?
>
>    Fixes: ec219322a9a7 ("bpf: Add verifier support for 16-byte returns in R0:R2")

This is still a preparation patch, so Fixes is not necessary. The same
for a few later patches.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28973410219