Re: [PATCH bpf-next v3 11/17] bpf: Report Call Type Safety argument errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incorrect function name reported in NULL pointer diagnostic for global subprograms
--

--- Patch [11]: [PATCH bpf-next v3 11/17] bpf: Report Call Type Safety argument errors ---
commit 42278ddf76eadbac6e7b1b29c475b084fe058a97
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Report Call Type Safety argument errors

Augment selected helper and kfunc argument-contract failures with Call Type
Safety reports. Keep the existing terse verifier messages and add reason,
source context, causal register or stack-argument history, and targeted
suggestions.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 84eda5e83f873..07e2c1ed8fbe6 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -8438,6 +8503,12 @@ static int check_reg_type(struct bpf_verifier_env *env, struct bpf_reg_state *re
>  		    (!type_may_be_null(arg_type) || arg_type_is_release(arg_type))) {
>  			verbose(env, "Possibly NULL pointer passed to helper %s\n",
>  				reg_arg_name(env, argno));
> +			bpf_diag_report_call_arg(env, env->insn_idx, argno,
> +						 func_id_name(meta->func_id),
                                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Severity: Medium]
Will this produce an incorrect diagnostic for global subprograms?

When `check_reg_type()` is called from `btf_check_func_arg_match()` for a global 
subprogram, `meta->func_id` is explicitly zeroed and the subprogram name is 
passed via the `call_name` parameter. By using `func_id_name(meta->func_id)` here 
instead of `call_name`, won't this result in the log message printing "unspec" 
instead of the actual global subprogram name?

> +						 "the pointer may be NULL, but this helper "
> +						 "requires a non-NULL pointer",
> +						 "Add a NULL check and call the helper only on the "
> +						 "non-NULL path.");
>  			return -EACCES;
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713153910.2556007-1-memxor@gmail.com?part=11