From b26c0b2dd5195f3397e7f64fefc9c190ebba7204 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Sun, 16 Aug 2026 03:57:31 +0200 Subject: [PATCH] bpf: Preserve R0 lineage across helper calls check_helper_call() clears all caller-saved registers before taking the diagnostic snapshot of R0. This records NOT_INIT as the old state for every helper return and loses the lineage of the value held in R0 before the call. bpf_diag_record_caller_saved() deliberately skips R0 because the paired modification scope is responsible for it. Open the R0 modification scope before clearing caller-saved registers, matching the kfunc, ld_abs, and subprogram call paths. Reported-by: Sashiko Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20260815073833.A93A91F000E9@smtp.kernel.org Link: https://lore.kernel.org/bpf/48e6f021b89562f68850fe21ef8c78719819b04cf9c4e4f50bc791937d37ace8@mail.kernel.org Link: https://lore.kernel.org/bpf/20260816015746.2632990-4-memxor@gmail.com --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9f833e913e43..4adc13584818 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -10987,13 +10987,13 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn /* reset caller saved regs */ bpf_diag_record_caller_saved(env, regs); + bpf_diag_mod_begin(env, ®s[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE); for (i = 0; i < CALLER_SAVED_REGS; i++) { bpf_mark_reg_not_init(env, ®s[caller_saved[i]]); check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK); } invalidate_outgoing_stack_args(env, cur_func(env)); - bpf_diag_mod_begin(env, ®s[BPF_REG_0], NULL, BPF_DIAG_MOD_WRITE); /* update return register (already marked as written above) */ ret_type = fn->ret_type; ret_flag = type_flag(ret_type);