Re: [PATCH bpf-next v1 4/4] bpf: Unify helper and kfunc call argument meta

[Eduard Zingerman <eddyz87@gmail.com>]

On Thu, 2026-07-09 at 16:02 -0700, Amery Hung wrote:
> Helper and kfunc argument checking carried two separate meta structs: the
> verifier-local struct bpf_call_arg_meta and bpf_kfunc_call_arg_meta.
> Merge them into a single struct bpf_call_arg_meta. This is groundwork for
> sharing argument checking between helpers and kfuncs.
> 
> While merging, drop the btf_id field from the helper meta since it is
> never used.
> 
> No functional change.
> 
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

>  include/linux/bpf_verifier.h | 40 +++++++++------
>  kernel/bpf/cfg.c             |  2 +-
>  kernel/bpf/verifier.c        | 95 +++++++++++++++---------------------
>  3 files changed, 63 insertions(+), 74 deletions(-)
> 
> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> index 3ed788ec6afc..5fbc3dfe5b19 100644
> --- a/include/linux/bpf_verifier.h
> +++ b/include/linux/bpf_verifier.h
> @@ -1479,18 +1479,24 @@ struct arg_alloc_mem_desc {
>  	bool found;
>  };
>  
> -struct bpf_kfunc_call_arg_meta {
> -	/* In parameters */
> +struct bpf_call_arg_meta {
> +	/* Common */
>  	struct btf *btf;
>  	u32 func_id;
> -	u32 kfunc_flags;
> -	const struct btf_type *func_proto;
> -	const char *func_name;
> -	/* Out parameters */
>  	u8 release_regno;
> -	bool r0_rdonly;
>  	u32 ret_btf_id;
>  	u32 subprogno;
> +	struct bpf_map_desc map;
> +	struct bpf_dynptr_desc dynptr;
> +	struct ref_obj_desc ref_obj;
> +	struct arg_raw_mem_desc arg_raw_mem;
> +	struct arg_alloc_mem_desc arg_alloc_mem;
> +
> +	/* Only set by kfunc */
> +	bool r0_rdonly;
> +	u32 kfunc_flags;
> +	const struct btf_type *func_proto;
> +	const char *func_name;
>  	struct {
>  		u64 value;
>  		bool found;
> @@ -1521,29 +1527,31 @@ struct bpf_kfunc_call_arg_meta {
>  		u8 spi;
>  		u8 frameno;
>  	} iter;
> -	struct bpf_map_desc map;
> -	struct bpf_dynptr_desc dynptr;
> -	struct ref_obj_desc ref_obj;
> -	struct arg_raw_mem_desc arg_raw_mem;
> -	struct arg_alloc_mem_desc arg_alloc_mem;
> +
> +	/* Only set by helper */
> +	bool pkt_access;

It appears this one can be dropped altogether:

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index 5ccb00a8c84c..b1d5a359c78b 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -4654,7 +4654,7 @@ static int check_map_access(struct bpf_verifier_env *env, struct bpf_reg_state *
     }

     static bool may_access_direct_pkt_data(struct bpf_verifier_env *env,
    -                              const struct bpf_call_arg_meta *meta,
    +                              const struct bpf_func_proto *fn,
                                   enum bpf_access_type t)
     {
            enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
    @@ -4678,8 +4678,8 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env,
            case BPF_PROG_TYPE_LWT_XMIT:
            case BPF_PROG_TYPE_SK_SKB:
            case BPF_PROG_TYPE_SK_MSG:
    -               if (meta)
    -                       return meta->pkt_access;
    +               if (fn)
    +                       return fn->pkt_access;

                    env->seen_direct_write = true;
                    return true;
    @@ -8307,7 +8307,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
            }

            if (type_is_pkt_pointer(type) &&
    -           !may_access_direct_pkt_data(env, meta, BPF_READ)) {
    +           !may_access_direct_pkt_data(env, fn, BPF_READ)) {
                    verbose(env, "helper access to the packet is not allowed\n");
                    return -EACCES;
            }

> +	u64 msize_max_value;
> +	s64 const_map_key;
> +	struct btf *ret_btf;
> +	struct btf_field *kptr_field;
>  };

[...]