bpf: Preserve R0 lineage across helper calls

check_helper_call() clears all caller-saved registers before taking the
diagnostic snapshot of R0. This records NOT_INIT as the old state for every
helper return and loses the lineage of the value held in R0 before the call.
bpf_diag_record_caller_saved() deliberately skips R0 because the paired
modification scope is responsible for it.

Open the R0 modification scope before clearing caller-saved registers,
matching the kfunc, ld_abs, and subprogram call paths.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260815073833.A93A91F000E9@smtp.kernel.org
Link: https://lore.kernel.org/bpf/48e6f021b89562f68850fe21ef8c78719819b04cf9c4e4f50bc791937d37ace8@mail.kernel.org
Link: https://lore.kernel.org/bpf/20260816015746.2632990-4-memxor@gmail.com

0 files changed, 0 insertions, 0 deletions