Re: [PATCH bpf 1/2] bpf: Reject >8 byte return values on return-reading trampoline paths

[Yonghong Song <yonghong.song@linux.dev>]

On 7/10/26 8:45 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
>> index 51b16e5f5534..bbb44ef8f87a 100644
>> --- a/kernel/bpf/bpf_struct_ops.c
>> +++ b/kernel/bpf/bpf_struct_ops.c
>> @@ -445,6 +445,18 @@ int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
>>   		goto errout;
>>   	}
>>
>> +	/*
>> +	 * A >8 byte return value is passed back in the R0:R2 register
>                                                                    ^^^^
>
> Does this comment have the correct register pair? Looking at the commit
> message, it states the second half of the return value is "RDX / R3", and
> in arch/x86/net/bpf_jit_comp.c reg2hex[] shows BPF_REG_0 = RAX and
> BPF_REG_3 = RDX, while BPF_REG_2 = RSI (an argument register).
>
> Should this be R0:R3 instead of R0:R2 to match the x86-64 ABI return pair?

It should be R0:R3. My commit message is correct, but I forgot to update
the comments. Will fix the comment.

>
>> +	 * pair, which the struct_ops trampoline does not preserve (only
>> +	 * 8 bytes of the return value are saved and restored).
>> +	 */
>> +	if (st_ops->func_models[i].ret_size > 8) {
>> +		pr_warn("func ptr %s in struct %s has a >8 byte return value, which is not supported\n",
>> +			mname, st_ops->name);
>> +		err = -EOPNOTSUPP;
>> +		goto errout;
>> +	}
>> +
>>   	stub_func_addr = *(void **)(st_ops->cfi_stubs + moff);
>>   	err = prepare_arg_info(btf, st_ops->name, mname,
>>   			       func_proto, stub_func_addr,
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29101893933