On 2026/1/7 15:11 bot+bpf-ci@kernel.org write:

quoted

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 41228b0add52..95248b0d28ab 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h

@@ -1229,6 +1229,9 @@ enum {
 #endif
 };

+#define BPF_TRAMP_M_NR_ARGS	0
+#define BPF_TRAMP_M_IS_RETURN	8

[ ... ]

quoted

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index bfff3f84fd91..d3709edd0e51 100644

[ ... ]

quoted

@@ -22558,6 +22564,13 @@ static int fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 		   desc->func_id == special_kfunc_list[KF_bpf_rdonly_cast]) {
 		insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_1);
 		*cnt = 1;
+	} else if (desc->func_id == special_kfunc_list[KF_bpf_session_is_return] &&
+		   env->prog->expected_attach_type == BPF_TRACE_FSESSION) {
+		/* Load nr_args from ctx - 8 */
+		insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
+		insn_buf[1] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_0, BPF_TRAMP_M_IS_RETURN);
+		insn_buf[2] = BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1);
+		*cnt = 3;

                ^^^^

This inlined code reads the BPF_TRAMP_M_IS_RETURN bit (bit 8) from ctx[-1]
to determine if the program is running at function exit. However, looking
at arch/x86/net/bpf_jit_comp.c, the trampoline only stores nr_regs to
ctx[-8] at this point in the series:

    emit_mov_imm64(&prog, BPF_REG_0, 0, (u32) nr_regs);
    emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -nregs_off);

The BPF_TRAMP_M_IS_RETURN flag is not being set by the trampoline code.
Is this intentional? The arch code that sets this bit appears to be added
in a later commit in the series (93d4641b9513 "bpf,x86: add fsession
support for x86_64").

At this commit, bpf_session_is_return() for fsession programs will always
return false, even during fexit execution, because bit 8 is never set.

Yeah, this is intentional. The fsession is architecture specific feature.
For the architecture that doesn't support this feature, the "is_return"
flag will never be set.

After the commit (93d4641b9513 "bpf,x86: add fsession support for x86_64"),
x86_64 support this feature, and the flag will be set for fsession.

quoted

+	}

 	if (env->insn_aux_data[insn_idx].arg_prog) {

[ ... ]

quoted

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 736b32cf2195..9d3bf3bbe8f6 100644

[ ... ]

quoted

@@ -3314,6 +3314,12 @@ static u64 bpf_uprobe_multi_entry_ip(struct bpf_run_ctx *ctx)
 }
 #endif /* CONFIG_UPROBES */

+bool bpf_fsession_is_return(void *ctx)
+{
+	/* This helper call is inlined by verifier. */
+	return !!(((u64 *)ctx)[-1] & (1 << BPF_TRAMP_M_IS_RETURN));
+}

The same issue exists here in bpf_fsession_is_return() - it reads bit 8
which is not set by the trampoline at this point in the series. The
comment indicates this is inlined by the verifier, but both code paths
have the same problem.

The logic here is right, as I said above.

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20773233136