From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-128.mta0.migadu.com [91.218.175.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CEC33C4176 for ; Tue, 22 Sep 2026 03:32:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.128 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790047963; cv=none; b=QDxH6p0KZ7yKbukzV22juU43DNXR5YaVqVOBuscFeTcG+FkyLolAz2BZ4tGzviHWEob5wZZ/MoQoJCwhveRvMakB+sjnDAKbIQrNTJ6XcYO46CEvQrHFlhCUahp4rQyGZw3S1dHLtJaXEHMYX0dPLAhRagYEE2ne2hBNLVEYupM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790047963; c=relaxed/simple; bh=TaNM4TjHbeg106Qb5CxF/zlhHcAB/XZrLDYs87bIYjE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=lXqgw8RZFW6elHYPH6aRDsxRpsNMy1YvPJFmPxpiVxFtap1n6lLpqOtMG6+5u6tZPxO9Ew6w/y4gGsd94TXqpM1x/OMWE59ubJtdk2IkQcf/V/cXI9rjtfOf/+tXZ7OmlVne8WMcqNlyXbEd9UWV8miqPcvU7FLZDAtJ9OZHbIo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SaUJBEr7; arc=none smtp.client-ip=91.218.175.128 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SaUJBEr7" X-Envelope-To: bpf@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=TaNM4TjHbeg106Qb5CxF/zlhHcAB/XZrLDYs87bIYjE=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790047954; v=1; x=1790652754; b=SaUJBEr7lT0DgZV2C8uBqw6PSk+4mtGbPRcreo3hdXMQ9+L9K9zQww/zRHUiZ7Zn5BZyBMtr bsfJusgQqG0s2airjtngSG8dRl7BeqJOFV25LHi/K2sqaM28iOZRjvn5ktUTZaIdkoqVZBb5Z4g ZlselTc0daT/3OflAxXYIRBA= X-Envelope-To: bpf@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 395a06e1c64c2332; Tue, 22 Sep 2026 03:32:34 +0000 X-Mizu-Trace-ID: 395a06e1c64c2332 X-Migadu-Flow: FLOW_OUT Message-ID: Date: Mon, 21 Sep 2026 20:32:31 -0700 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH bpf-next v4 06/20] bpf: Explore the landing pads no call site reaches Content-Language: en-GB To: Eduard Zingerman , bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , kernel-team@fb.com References: <20260921210033.1715000-1-yonghong.song@linux.dev> <20260921210104.1718697-1-yonghong.song@linux.dev> From: Yonghong Song In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 9/21/26 4:58 PM, Eduard Zingerman wrote: > On Mon, 2026-09-21 at 14:01 -0700, Yonghong Song wrote: >> A cleanup record need not cover a call an exception can unwind out of: a >> frontend is free to emit a region around a helper or an ordinary kfunc, >> both nounwind here. Nothing marks a call site then, and that record's >> landing pad is reached by nothing at all -- leaving bpf_check_cfg() to >> refuse the program over code its own frontend had no way not to emit: >> >> 0: call bpf_preempt_disable >> 1: call bpf_preempt_enable record = { begin = 1, end = 2, pad = 4 } >> 2: r0 = 0 >> 3: exit >> 4: r1 = pads_ran ll landing pad >> 6: r2 = *(u64 *)(r1 + 0) >> 7: r2 |= RAN_NOUNWIND_REC >> 8: *(u64 *)(r1 + 0) = r2 >> 9: call bpf_unwind_resume >> 10: exit >> >> The range [1,2) holds one call, and it is a kfunc, so an exception cannot >> come out of it. cleanup_mark_call_sites() marks nothing, nothing pushes an >> edge to 4, and 4 through 10 are reachable from nothing: "unreachable insn >> 4". The pad is dead, which is correct -- no exception can ever arrive at it >> -- but the program is fine and has to load. >> >> Walk every pad the table names that the edges did not reach, the way the >> walk is already re-seeded at an exception callback. From there the pad is >> code like any other: do_check() never enters it, because no call site >> dispatches to it, so the dead code sweep removes it along with everything >> else that was not reached. >> >> Signed-off-by: Yonghong Song >> --- > Yonghong, have you observed such dead code being generated by rustc? > It is a bit surprising, tbh. The above code is with inline asm. rustc won't be able to generate such code.