Re: [PATCH bpf-next v2 06/13] bpf: Reject callbacks returning more than 8 bytes

> commit 9c43eef7a91393c06822d44c361ee806f383cf97
> Author: Yonghong Song <[email protected]>
>
>     bpf: Reject callbacks returning more than 8 bytes
>
>     A callback handed to a helper or a kfunc (bpf_loop(),
>     bpf_timer_set_callback(), bpf_for_each_map_elem(), ...) is invoked
>     through bpf_callback_t, and an exception callback is invoked by
>     bpf_throw() through
>
>       u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64);
>
>     Both prototypes yield a single u64 in R0, and neither caller has any
>     notion of a second return register, so a callback returning a value in
>     the R0:R2 pair would have the upper half of its return value silently
>     dropped.
>
>     Reject both at load time:
>
>      - check_ld_imm(): a callback is materialized as PTR_TO_FUNC by an
>        ld_imm64 pointing at its subprogram, so the subprogram's return
>        convention can be checked where the callback pointer is created,
>        before it ever reaches a helper or kfunc argument.
>
>      - do_check_common(): an exception callback is not referenced by a
>        PTR_TO_FUNC, it is named by a BTF decl_tag and verified on its own,
>        so check it as its frame is set up, next to the existing "cannot
>        return void" and single-argument checks.
>
>     Signed-off-by: Yonghong Song <[email protected]>

This looks like a bug fix. Should this include:

  Fixes: 63b5669f8a0d ("bpf: Add helpers to describe the R0:R2 return register pair")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/30949310795