[PATCH bpf-next v1 00/22] bpf: Unify helper and kfunc argument checks

[Amery Hung <ameryhung@gmail.com>]

Hi,

This is the 3rd and final patchset unifying helepr and kfunc checks.

Helper and kfunc calls currently validate arguments through separate
loops despite enforcing many of the same contracts. This duplicates
type admission, nullability, memory, BTF, packet-access, and resource
ownership handling.

This series complete the generation of helper-style argument metadata
for kfuncs and then routes both call kinds through check_func_args().
Call-specific behavior remains selected through call metadata where the
helper and kfunc contracts intentionally differ.

The series is organized as follows:

- Patches 1-8 prepare shared call metadata, argument indexing, and
  argument kinds.

- Patches 9-13 populate kfunc argument flags, BTF IDs, and fixed sizes
  while generating the kfunc prototype.

- Patches 14-18 consolidate runtime type resolution, nullability, BTF
  matching, and register admission.

- Patches 19-21 consolidate packet-access and release validation, with
  coverage for kfunc packet writes.

- Patch 22 replaces the duplicate helper and kfunc loops with the
  common check_func_args() path.

[1/3] https://lore.kernel.org/bpf/20260715064047.1793790-1-ameryhung@gmail.com/
[2/3] https://lore.kernel.org/bpf/20260801074633.1595644-1-ameryhung@gmail.com/


Amery Hung (22):
  bpf: Pass call metadata through shared argument checks
  bpf: Address check_func_arg() arguments by argno
  bpf: Only compare func_id against BPF_FUNC_* for helper calls
  bpf: Only compare func_id against kfunc BTF IDs for kfunc calls
  bpf: Rename ambiguous function argument types
  bpf: Unify kfunc argument kinds with enum bpf_arg_type
  bpf: Align helper and kfunc ARG_PTR_TO_PROG_AUX handling
  bpf: Classify kfunc arguments the verifier ignores
  bpf: Set OBJ_RELEASE when generating kfunc argument types
  bpf: Set MEM_UNINIT and dynptr subtypes when generating kfunc arg
    types
  bpf: Set MEM_RCU when generating kfunc argument types
  bpf: Resolve BTF ID of ARG_PTR_TO_BTF_ID in kfunc bpf_func_proto
  bpf: Resolve ARG_PTR_TO_MEM | MEM_FIXED_SIZE size in kfunc
    bpf_func_proto
  bpf: Consolidate runtime argument type resolution
  bpf: Consolidate nullable argument validation
  bpf: Drop redundant BTF pointer helper write rejection
  bpf: Consolidate helper and kfunc PTR_TO_BTF_ID argument matching
  bpf: Admit kfunc argument registers through check_reg_type()
  selftests/bpf: Test kfunc packet memory direct writes
  bpf: Consolidate function call pkt_access validation
  bpf: Consolidate release argument validation
  bpf: Check helper and kfunc arguments in one path

 drivers/media/rc/bpf-lirc.c                   |   10 +-
 include/linux/bpf.h                           |   32 +-
 include/linux/bpf_verifier.h                  |    1 -
 kernel/bpf/backtrack.c                        |    2 +-
 kernel/bpf/bpf_cgrp_storage.c                 |    2 +-
 kernel/bpf/bpf_inode_storage.c                |    2 +-
 kernel/bpf/bpf_iter.c                         |    6 +-
 kernel/bpf/bpf_lsm.c                          |    2 +-
 kernel/bpf/bpf_task_storage.c                 |    2 +-
 kernel/bpf/btf.c                              |    6 +-
 kernel/bpf/cgroup.c                           |    6 +-
 kernel/bpf/core.c                             |    2 +-
 kernel/bpf/diagnostics.c                      |   29 +
 kernel/bpf/diagnostics.h                      |    1 +
 kernel/bpf/fixups.c                           |    5 +-
 kernel/bpf/helpers.c                          |   47 +-
 kernel/bpf/ringbuf.c                          |   20 +-
 kernel/bpf/stackmap.c                         |   14 +-
 kernel/bpf/syscall.c                          |    6 +-
 kernel/bpf/task_iter.c                        |    4 +-
 kernel/bpf/verifier.c                         | 2032 ++++++++---------
 kernel/trace/bpf_trace.c                      |   46 +-
 net/core/bpf_sk_storage.c                     |    6 +-
 net/core/filter.c                             |  302 +--
 net/core/sock_map.c                           |   16 +-
 net/ipv4/bpf_tcp_ca.c                         |    2 +-
 .../testing/selftests/bpf/prog_tests/bpf_nf.c |   14 +-
 .../selftests/bpf/prog_tests/cb_refs.c        |    4 +-
 .../selftests/bpf/prog_tests/kfunc_call.c     |    2 +-
 .../selftests/bpf/prog_tests/verifier.c       |    2 +
 .../testing/selftests/bpf/progs/arena_kfunc.c |    2 +-
 .../selftests/bpf/progs/cgrp_kfunc_failure.c  |    8 +-
 .../selftests/bpf/progs/cpumask_failure.c     |    4 +-
 tools/testing/selftests/bpf/progs/irq.c       |    4 +-
 tools/testing/selftests/bpf/progs/iters.c     |    6 +-
 .../selftests/bpf/progs/iters_testmod.c       |    7 +-
 .../selftests/bpf/progs/map_kptr_fail.c       |   10 +-
 .../bpf/progs/mem_rdonly_untrusted.c          |    3 +-
 .../testing/selftests/bpf/progs/rbtree_fail.c |    4 +-
 .../bpf/progs/refcounted_kptr_fail.c          |    4 +-
 .../selftests/bpf/progs/res_spin_lock_fail.c  |    2 +-
 .../testing/selftests/bpf/progs/stream_fail.c |    2 +-
 .../selftests/bpf/progs/task_kfunc_failure.c  |   10 +-
 .../selftests/bpf/progs/task_work_fail.c      |    2 +-
 .../bpf/progs/test_kfunc_dynptr_param.c       |    2 +-
 .../selftests/bpf/progs/verifier_ctx.c        |    2 +-
 .../bpf/progs/verifier_global_ptr_args.c      |    2 +-
 .../progs/verifier_helper_access_var_len.c    |    4 +-
 .../bpf/progs/verifier_helper_packet_access.c |    4 +-
 .../bpf/progs/verifier_kfunc_packet_access.c  |   47 +
 .../selftests/bpf/progs/verifier_live_stack.c |    2 +-
 .../selftests/bpf/progs/verifier_map_in_map.c |    3 +-
 .../bpf/progs/verifier_map_lookup_refine.c    |    2 +-
 .../bpf/progs/verifier_ref_tracking.c         |    6 +-
 .../selftests/bpf/progs/verifier_sock.c       |   10 +-
 .../selftests/bpf/progs/verifier_vfs_reject.c |    6 +-
 .../selftests/bpf/progs/wakeup_source_fail.c  |    2 +-
 .../testing/selftests/bpf/progs/wq_failures.c |    4 +-
 tools/testing/selftests/bpf/verifier/calls.c  |    4 +-
 .../testing/selftests/bpf/verifier/map_kptr.c |    4 +-
 60 files changed, 1380 insertions(+), 1417 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_kfunc_packet_access.c

-- 
2.52.0