Re: [PATCH bpf-next v3 5/6] selftests/bpf: libarena: Directly return arena pointers from functions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Returning `void __arena *` natively from global subprograms causes verifier rejection due to the omission of the `addr_space_cast` instruction.
--

commit cebc1ff5de4bdc037926c8cf353b253eb29e111c
Author: Emil Tsalapatis <emil@etsalapatis.com>

selftests/bpf: libarena: Directly return arena pointers from functions

This commit updates the libarena functions to directly return arena pointers
instead of returning u64 and relying on preprocessor macros for type casting
to hide the conversion from the caller.

> diff --git a/tools/testing/selftests/bpf/libarena/include/libarena/buddy.h b/tools/testing/selftests/bpf/libarena/include/libarena/buddy.h
> index 4d57fc1b5c26f..528c69a1f38e0 100644
> --- a/tools/testing/selftests/bpf/libarena/include/libarena/buddy.h
> +++ b/tools/testing/selftests/bpf/libarena/include/libarena/buddy.h
> @@ -76,7 +76,6 @@ struct buddy {
>  int buddy_init(struct buddy __arena *buddy);
>  int buddy_destroy(struct buddy __arena *buddy);
>  int buddy_free(struct buddy __arena *buddy, void __arena *free);
> -u64 buddy_alloc_internal(struct buddy __arena *buddy, size_t size);
> -#define buddy_alloc(alloc, size) ((void __arena *)buddy_alloc_internal((alloc), (size)))
> +void __arena *buddy_alloc(struct buddy __arena *buddy, size_t size);

[Severity: High]
Does changing the return type to void __arena * break the BPF verifier for
programs calling these functions?

Since this change removes the explicit C-style cast from a u64, Clang will
no longer emit the BPF_ADDR_SPACE_CAST instruction because both sides of
the assignment share the same address space.

However, in kernel/bpf/verifier.c:check_func_call(), the verifier still
forces the return register (R0) of all global subprograms to SCALAR_VALUE:

    if (!subprog_returns_void(env, subprog)) {
        mark_reg_unknown(env, caller->regs, BPF_REG_0);
        caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
    }

Without the addr_space_cast instruction to upgrade the SCALAR_VALUE back
to a PTR_TO_ARENA, will subsequent memory accesses using this returned
pointer be rejected by the verifier with an "invalid mem access 'scalar'"
error?

It appears check_func_call() might need to be updated to populate the caller's
R0 state with PTR_TO_ARENA based on the BTF return type before this test can
safely rely on native arena pointer returns.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602004120.17087-1-emil@etsalapatis.com?part=5