Re: [PATCH bpf-next v2 14/18] bpf: Check helper mem+size in ARG_PTR_TO_MEM case

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-07-24 at 12:08 -0700, Amery Hung wrote:

...

>  kernel/bpf/verifier.c | 16 +++++++---------
>  1 file changed, 7 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 144c2d8aa492..2326b12a1531 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -8505,9 +8505,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  		meta->subprogno = reg->subprogno;
>  		break;
>  	case ARG_PTR_TO_MEM:
> -		/* The access to this pointer is only checked when we hit the
> -		 * next is_mem_size argument below.
> -		 */
>  		if (arg_type & MEM_FIXED_SIZE) {
>  			err = check_mem_reg(env, reg, argno_from_reg(regno), fn->arg_size[arg],
>  					    arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ, meta);
> @@ -8515,14 +8512,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  				return err;
>  			if (arg_type & MEM_ALIGNED)
>  				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
> +		} else {
> +			struct bpf_reg_state *size_reg = reg_state(env, regno + 1);
> +
> +			err = check_mem_size_reg(env, reg, size_reg, argno,
> +						 argno_from_reg(regno + 1),
> +						 arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,
> +						 fn->arg_type[arg + 1] & SCALAR_MAYBE_ZERO, meta);
>  		}
>  		break;
> -	case ARG_MEM_SIZE:

Nit:
The ARG_MEM_SIZE would be ignored by this switch after the change, right?
This is a correct thing to do, but I'd be a little bit more defensive.
Let's modify this switch to:
- explicitly skip ARG_MEM_SIZE
- have default clause signalling a verifier error in case of unknown arg type.

> -		err = check_mem_size_reg(env, reg_state(env, regno - 1), reg,
> -					 argno_from_reg(regno - 1), argno,
> -					 fn->arg_type[arg - 1] & MEM_WRITE ? BPF_WRITE : BPF_READ,
> -					 arg_type & SCALAR_MAYBE_ZERO, meta);
> -		break;
>  	case ARG_PTR_TO_DYNPTR:
>  		err = process_dynptr_func(env, reg, argno, insn_idx, arg_type, &meta->ref_obj,
>  					  &meta->dynptr);