Re: [PATCH bpf-next v2 16/18] bpf: Tag nullable kfunc pointer args with PTR_MAYBE_NULL

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Multi-line comments do not follow the BPF subsystem style.
--

--- Patch [16]: [PATCH bpf-next v2 16/18] bpf: Tag nullable kfunc pointer args with PTR_MAYBE_NULL ---
commit 8714272b2414d4acacf57ee10e018ba054ac3e95
Author: Amery Hung <ameryhung@gmail.com>

bpf: Tag nullable kfunc pointer args with PTR_MAYBE_NULL

This commit updates get_kfunc_ptr_arg_type() to classify nullable kfunc
pointer arguments by OR-ing PTR_MAYBE_NULL into the returned type based
on BTF alone. It defers the check of whether the register is actually NULL
until after the classification is complete, matching how helper arguments
are handled.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 76a84574b23e9..3b357007e893b 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -11361,93 +11361,85 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *m
[ ... ]
> +		if (btf_type_is_struct(ref_t) && !arg_mem_size) {
> +			/* A pointer to a struct without a size argument is classified
> +			 * as KF_ARG_PTR_TO_BTF_ID.
> +			 */

[Severity: Low]
This isn't a bug, but does this multi-line comment follow the preferred BPF
subsystem style? Multi-line comments in this subsystem typically require the
opening /* on its own line before the text begins.

> +			arg_type = KF_ARG_PTR_TO_BTF_ID;
> +		} else if (!btf_type_is_scalar(ref_t) &&
> +			   !__btf_type_is_scalar_struct(env, meta->btf, ref_t, 0) &&
> +			   (arg_mem_size ? !btf_type_is_void(ref_t) : 1)) {
> +			verbose(env, "%s pointer type %s %s must point to %sscalar, or struct with scalar\n",
> +				reg_arg_name(env, argno),
> +				btf_type_str(ref_t), ref_tname, arg_mem_size ? "void, " : "");
> +			return -EINVAL;
> +		} else {
> +			/* Otherwise this is a memory buffer supported by
> +			 * check_helper_mem_access(): a pointer to a scalar, or to void
> +			 * when paired with a size argument. The access size is derived
> +			 * from the pointed-to BTF type unless a size argument follows.
> +			 */

[Severity: Low]
This isn't a bug, but this comment has the same style issue where the text
starts on the same line as the opening /*.

> +			arg_type = arg_mem_size ? KF_ARG_PTR_TO_MEM : KF_ARG_PTR_TO_MEM | MEM_FIXED_SIZE;
> +		}
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724190813.1458271-1-ameryhung@gmail.com?part=16