Re: [PATCH bpf-next 07/12] bpf: Reject >8 byte return values on return-reading trampoline paths

[Leon Hwang <leon.hwang@linux.dev>]

On 10/7/26 07:08, Eduard Zingerman wrote:
> On Wed, 2026-07-08 at 13:10 -0700, Yonghong Song wrote:
>> btf_distill_func_proto() builds the function model used for kfunc calls,
>> the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. A following
>> patch relaxes it to accept a >8 and <=16 byte return value, which for the
>> BPF target is passed back in the R0:R2 register pair.
>>
>> But the BPF trampoline cannot preserve such a return. It saves and restores
>> only 8 bytes of the return value (RAX on x86, i.e. R0), so the second half
>> (RDX / R2) is not preserved across a program that observes the return
>> value. A program attached to a function returning a 16-byte value (e.g.
>> current_time() or ns_to_timespec64(), which return struct timespec64)
>> would corrupt the value seen by the real caller and read a partial return
>> value itself. struct_ops trampolines have the same limitation.
>>
>> This only matters for the attach types that actually read the target's
>> return value: fexit, fmod_ret and fsession (plus the _multi variants of
>> fexit and fsession). fentry and fentry_multi run before the target returns
>> and never touch the return value, so they can attach to a >8 byte-returning
>> function safely.
>>
>> Reject a >8 byte return value for the return-reading attach types in
>> bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for
>> struct_ops in bpf_struct_ops_desc_init(), ahead of the following patch that
>> would otherwise let such a return through. kfunc and BPF-to-BPF subprogram
>> calls, which the JIT does handle, are unaffected.
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
> 
> Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
> 
> Maybe post this independently from the current patch-set?
> Seem to be a standalone fix.
> 


Agreed.

A Fixes tag should be added.

Thanks,
Leon