Re: [PATCH bpf-next v8 08/22] bpf: Require an unwind to leave a frame holding what it entered with

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Thu, Oct 01, 2026 at 06:30 AM Yonghong Song <yonghong.song@linux.dev> wrote:
> frame that dropped it. The rule does refuse a program that could be proved
> safe, a callee releasing its caller's reference and a caller's pad that
> relies on that, but compiled code does not do that. A pad only knows about
> its own frame.

Compiled code does exactly that. It's a move.

  fn consume(rec: Record) { may_panic(); }
  fn foo() { let rec = reserve(); consume(rec); }

consume() owns rec, so the pad of consume() drops it.
foo() has nothing left to drop and rustc emits a plain call with no
record over it.
'call consume' is refused with
"an unwind through this call keeps the reference".
With a record over that call the resume in consume() is refused with
"a resume does not leave the frame's references as it found it".
pad_drops_caller_ref_frame() in patch 19 is what consume() compiles to.
RcuReadGuard passed by value is the same.

[...]

> +	u32 entry_active_locks;
> +	u32 entry_preempt_locks;
> +	u32 entry_rcu_locks;
> +	u32 entry_irq_id;
> +	u32 entry_id_gen;
> +	u32 entry_acquired_refs;

The verifier doesn't need them anymore.
"Unreleased reference id=%d alloc_insn=%d" at exit already points
at the insn that acquired it.
Drop this patch.