Re: [PATCH bpf-next v4 06/20] bpf: Explore the landing pads no call site reaches

[Yonghong Song <yonghong.song@linux.dev>]

On 9/21/26 4:58 PM, Eduard Zingerman wrote:
> On Mon, 2026-09-21 at 14:01 -0700, Yonghong Song wrote:
>> A cleanup record need not cover a call an exception can unwind out of: a
>> frontend is free to emit a region around a helper or an ordinary kfunc,
>> both nounwind here. Nothing marks a call site then, and that record's
>> landing pad is reached by nothing at all -- leaving bpf_check_cfg() to
>> refuse the program over code its own frontend had no way not to emit:
>>
>>     0: call bpf_preempt_disable
>>     1: call bpf_preempt_enable      record = { begin = 1, end = 2, pad = 4 }
>>     2: r0 = 0
>>     3: exit
>>     4: r1 = pads_ran ll             landing pad
>>     6: r2 = *(u64 *)(r1 + 0)
>>     7: r2 |= RAN_NOUNWIND_REC
>>     8: *(u64 *)(r1 + 0) = r2
>>     9: call bpf_unwind_resume
>>    10: exit
>>
>> The range [1,2) holds one call, and it is a kfunc, so an exception cannot
>> come out of it. cleanup_mark_call_sites() marks nothing, nothing pushes an
>> edge to 4, and 4 through 10 are reachable from nothing: "unreachable insn
>> 4". The pad is dead, which is correct -- no exception can ever arrive at it
>> -- but the program is fine and has to load.
>>
>> Walk every pad the table names that the edges did not reach, the way the
>> walk is already re-seeded at an exception callback. From there the pad is
>> code like any other: do_check() never enters it, because no call site
>> dispatches to it, so the dead code sweep removes it along with everything
>> else that was not reached.
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
> Yonghong, have you observed such dead code being generated by rustc?
> It is a bit surprising, tbh.

The above code is with inline asm. rustc won't be able to generate such 
code.