Re: [PATCH bpf-next v2 06/13] bpf: Reject callbacks returning more than 8 bytes
Yonghong Song <[email protected]>
| Newsgroups | org.kernel.vger.bpf |
|---|---|
| Message-ID | <[email protected]> |
On 8/4/26 2:54 PM, [email protected] wrote: >> commit 9c43eef7a91393c06822d44c361ee806f383cf97 >> Author: Yonghong Song <[email protected]> >> >> bpf: Reject callbacks returning more than 8 bytes >> >> A callback handed to a helper or a kfunc (bpf_loop(), >> bpf_timer_set_callback(), bpf_for_each_map_elem(), ...) is invoked >> through bpf_callback_t, and an exception callback is invoked by >> bpf_throw() through >> >> u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64); >> >> Both prototypes yield a single u64 in R0, and neither caller has any >> notion of a second return register, so a callback returning a value in >> the R0:R2 pair would have the upper half of its return value silently >> dropped. >> >> Reject both at load time: >> >> - check_ld_imm(): a callback is materialized as PTR_TO_FUNC by an >> ld_imm64 pointing at its subprogram, so the subprogram's return >> convention can be checked where the callback pointer is created, >> before it ever reaches a helper or kfunc argument. >> >> - do_check_common(): an exception callback is not referenced by a >> PTR_TO_FUNC, it is named by a BTF decl_tag and verified on its own, >> so check it as its frame is set up, next to the existing "cannot >> return void" and single-argument checks. >> >> Signed-off-by: Yonghong Song <[email protected]> > This looks like a bug fix. Should this include: > > Fixes: 63b5669f8a0d ("bpf: Add helpers to describe the R0:R2 return register pair") There is no need to the bug fix. The actual R2 usage is in later patch Add verifier support for 16-byte returns in R0:R2 > > > --- > AI reviewed your patch. Please fix the bug or email reply why it's not a bug. > See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md > > CI run summary: https://github.com/kernel-patches/bpf/actions/runs/30949310795