Re: [PATCH bpf-next v1 03/14] bpf: Preserve R0 lineage across helper calls

On Sun, 2026-08-16 at 02:30 +0000, [email protected] wrote:
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 5d0a2d3ef594..7ef324e384f4 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -11024,13 +11024,13 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > 
> >  	/* reset caller saved regs */
> >  	bpf_diag_record_caller_saved(env, regs);
> > +	bpf_diag_mod_begin(env, &regs[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE);
> >  	for (i = 0; i < CALLER_SAVED_REGS; i++) {
> >  		bpf_mark_reg_not_init(env, &regs[caller_saved[i]]);
> >  		check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> >  	}
> >  	invalidate_outgoing_stack_args(env, cur_func(env));
> > 
> > -	bpf_diag_mod_begin(env, &regs[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE);
> >  	/* update return register (already marked as written above) */
> >  	ret_type = fn->ret_type;
> >  	ret_flag = type_flag(ret_type);
> 
> Does this produce the correct diagnostic message for void helpers? The
> new bpf_diag_mod_begin() is now opened unconditionally for all helpers,
> including those with RET_VOID. Because the snapshot is taken before the
> caller-saved clearing loop, a void helper now generates a history event
> with R0's real pre-call value as old and NOT_INIT as new, with reason
> BPF_DIAG_MOD_WRITE.

This is fine.