Re: [PATCH bpf-next v4 06/20] bpf: Explore the landing pads no call site reaches

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2026-09-21 at 14:01 -0700, Yonghong Song wrote:
> A cleanup record need not cover a call an exception can unwind out of: a
> frontend is free to emit a region around a helper or an ordinary kfunc,
> both nounwind here. Nothing marks a call site then, and that record's
> landing pad is reached by nothing at all -- leaving bpf_check_cfg() to
> refuse the program over code its own frontend had no way not to emit:
> 
>    0: call bpf_preempt_disable
>    1: call bpf_preempt_enable      record = { begin = 1, end = 2, pad = 4 }
>    2: r0 = 0
>    3: exit
>    4: r1 = pads_ran ll             landing pad
>    6: r2 = *(u64 *)(r1 + 0)
>    7: r2 |= RAN_NOUNWIND_REC
>    8: *(u64 *)(r1 + 0) = r2
>    9: call bpf_unwind_resume
>   10: exit
> 
> The range [1,2) holds one call, and it is a kfunc, so an exception cannot
> come out of it. cleanup_mark_call_sites() marks nothing, nothing pushes an
> edge to 4, and 4 through 10 are reachable from nothing: "unreachable insn
> 4". The pad is dead, which is correct -- no exception can ever arrive at it
> -- but the program is fine and has to load.
> 
> Walk every pad the table names that the edges did not reach, the way the
> walk is already re-seeded at an exception callback. From there the pad is
> code like any other: do_check() never enters it, because no call site
> dispatches to it, so the dead code sweep removes it along with everything
> else that was not reached.
> 
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---

Yonghong, have you observed such dead code being generated by rustc?
It is a bit surprising, tbh.