[PATCH bpf-next v2 00/23] Unify helper and kfunc argument checks

[Amery Hung <ameryhung@gmail.com>]

Hi,

This is the third and final patchset unifying helper and kfunc checks.

Helper and kfunc calls currently validate arguments through separate
loops despite enforcing many of the same contracts. This duplicates
type admission, nullability, memory, BTF, packet-access, and resource
ownership handling.

This series completes the generation of helper-style argument metadata
for kfuncs and then routes both call kinds through check_func_args().
Call-specific behavior remains selected through call metadata where the
helper and kfunc contracts intentionally differ.

The series is organized as follows:

- Patches 1-8 prepare shared call metadata, argument indexing, and
  argument kinds.

- Patches 9-13 populate kfunc argument flags, BTF IDs, and fixed sizes
  while generating the kfunc prototype.

- Patches 14-18 consolidate runtime type resolution, nullability, BTF
  matching, and register admission.

- Patches 19-22 consolidate packet-access and release validation, with
  coverage for kfunc packet writes and nullable per-CPU kptr identity.

- Patch 23 replaces the duplicate helper and kfunc loops with the
  common check_func_args() path.

[1/3] https://lore.kernel.org/bpf/20260715064047.1793790-1-ameryhung@gmail.com/
[2/3] https://lore.kernel.org/bpf/20260801074633.1595644-1-ameryhung@gmail.com/


Changelog:

v1 -> v2
  - Rebased onto the latest bpf-next
  - Reordered and folded patches for bisectability
  - Fixed kfunc memory admission and nullable per-CPU kptr identity
  - Tweaked style to reduce indent (Alexei)
  - Fixed minor wording error in comments and commit msgs (AI)
  Link: https://lore.kernel.org/bpf/20260905220117.922028-1-ameryhung@gmail.com/

Amery Hung (23):
  bpf: Pass call metadata through shared argument checks
  bpf: Address check_func_arg() arguments by argno
  bpf: Only compare func_id against BPF_FUNC_* for helper calls
  bpf: Only compare func_id against kfunc BTF IDs for kfunc calls
  bpf: Clarify unused and scalar function argument types
  bpf: Unify kfunc argument kinds with enum bpf_arg_type
  bpf: Classify kfunc arguments the verifier ignores
  bpf: Align helper and kfunc ARG_PTR_TO_PROG_AUX handling
  bpf: Set OBJ_RELEASE when generating kfunc argument types
  bpf: Set MEM_UNINIT and dynptr subtypes when generating kfunc arg
    types
  bpf: Set MEM_RCU when generating kfunc argument types
  bpf: Resolve BTF ID of ARG_PTR_TO_BTF_ID in kfunc bpf_func_proto
  bpf: Resolve ARG_PTR_TO_MEM | MEM_FIXED_SIZE size in kfunc
    bpf_func_proto
  bpf: Consolidate runtime argument type resolution
  bpf: Consolidate nullable argument validation
  bpf: Drop redundant BTF pointer helper write rejection
  bpf: Consolidate helper and kfunc PTR_TO_BTF_ID argument matching
  bpf: Admit kfunc argument registers through check_reg_type()
  bpf: Consolidate function call pkt_access validation
  selftests/bpf: Test kfunc packet memory direct writes
  bpf: Consolidate release argument validation
  selftests/bpf: Test nullable per-CPU kptr identity after exchange
  bpf: Check helper and kfunc arguments in one path

 include/linux/bpf.h                           |   30 +-
 include/linux/bpf_verifier.h                  |    3 +-
 kernel/bpf/btf.c                              |    2 +-
 kernel/bpf/diagnostics.c                      |   29 +
 kernel/bpf/diagnostics.h                      |    1 +
 kernel/bpf/fixups.c                           |    5 +-
 kernel/bpf/helpers.c                          |    1 +
 kernel/bpf/verifier.c                         | 2056 ++++++++---------
 .../testing/selftests/bpf/prog_tests/bpf_nf.c |   14 +-
 .../selftests/bpf/prog_tests/cb_refs.c        |    4 +-
 .../selftests/bpf/prog_tests/kfunc_call.c     |    2 +-
 .../selftests/bpf/prog_tests/verifier.c       |    2 +
 .../testing/selftests/bpf/progs/arena_kfunc.c |    2 +-
 .../selftests/bpf/progs/cgrp_kfunc_failure.c  |    8 +-
 .../selftests/bpf/progs/cpumask_failure.c     |    4 +-
 tools/testing/selftests/bpf/progs/irq.c       |    4 +-
 tools/testing/selftests/bpf/progs/iters.c     |    6 +-
 .../selftests/bpf/progs/iters_testmod.c       |    7 +-
 .../selftests/bpf/progs/map_kptr_fail.c       |   10 +-
 .../bpf/progs/mem_rdonly_untrusted.c          |    3 +-
 .../selftests/bpf/progs/percpu_alloc_fail.c   |   35 +
 .../testing/selftests/bpf/progs/rbtree_fail.c |    4 +-
 .../bpf/progs/refcounted_kptr_fail.c          |    9 +-
 .../selftests/bpf/progs/res_spin_lock_fail.c  |    2 +-
 .../testing/selftests/bpf/progs/stream_fail.c |    2 +-
 .../selftests/bpf/progs/task_kfunc_failure.c  |   10 +-
 .../selftests/bpf/progs/task_work_fail.c      |    2 +-
 .../bpf/progs/test_kfunc_dynptr_param.c       |    2 +-
 .../selftests/bpf/progs/verifier_ctx.c        |    2 +-
 .../bpf/progs/verifier_global_ptr_args.c      |    2 +-
 .../progs/verifier_helper_access_var_len.c    |    4 +-
 .../bpf/progs/verifier_helper_packet_access.c |    4 +-
 .../bpf/progs/verifier_kfunc_packet_access.c  |   47 +
 .../selftests/bpf/progs/verifier_live_stack.c |    2 +-
 .../selftests/bpf/progs/verifier_map_in_map.c |    3 +-
 .../bpf/progs/verifier_map_lookup_refine.c    |    2 +-
 .../bpf/progs/verifier_ref_tracking.c         |    6 +-
 .../selftests/bpf/progs/verifier_sock.c       |   10 +-
 .../selftests/bpf/progs/verifier_vfs_reject.c |    6 +-
 .../selftests/bpf/progs/wakeup_source_fail.c  |    2 +-
 .../testing/selftests/bpf/progs/wq_failures.c |    4 +-
 tools/testing/selftests/bpf/verifier/calls.c  |   10 +-
 .../testing/selftests/bpf/verifier/map_kptr.c |    4 +-
 43 files changed, 1182 insertions(+), 1185 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_kfunc_packet_access.c

-- 
2.52.0