Re: [PATCH bpf-next v4 06/18] bpf: Use argument index instead of register index in kfunc verifier logs

[Yonghong Song <yonghong.song@linux.dev>]

On 4/11/26 10:43 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 54296d818d35..01df990f841a 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -8592,12 +8609,12 @@ static int check_helper_mem_access(...)
>>    */
>>   static int check_mem_size_reg(struct bpf_verifier_env *env,
>>   			      struct bpf_reg_state *mem_reg,
>> -			      struct bpf_reg_state *size_reg, int mem_regno,
>> +			      struct bpf_reg_state *size_reg, int reg_or_arg,
>>   			      enum bpf_access_type access_type,
>>   			      bool zero_size_allowed,
>>   			      struct bpf_call_arg_meta *meta)
>>   {
>> -	int size_regno = mem_regno + 1;
>> +	int size_reg_or_arg = (reg_or_arg >= 0) ? reg_or_arg + 1 : reg_or_arg - 1;
> [ ... ]
>
>> -	err = check_helper_mem_access(env, mem_reg, mem_regno, size_reg->umax_value,
>> +	err = check_helper_mem_access(env, mem_reg, reg_or_arg, size_reg->umax_value,
>>   				      access_type, zero_size_allowed, meta);
>> -	if (!err)
>> -		err = mark_chain_precision(env, size_regno);
>> +	if (!err && size_reg_or_arg > 0)
>> +		err = mark_chain_precision(env, size_reg_or_arg);
>>   	return err;
>>   }
> When called from the kfunc path via check_kfunc_mem_size_reg(),
> reg_or_arg is always negative (-(mem_argno + 1)), which makes
> size_reg_or_arg also negative (reg_or_arg - 1). The condition
> "size_reg_or_arg > 0" is then always false, so mark_chain_precision()
> is never called for kfunc mem+size argument pairs.
>
> The old code unconditionally called mark_chain_precision(env,
> size_regno) with the actual register number. With the new encoding,
> precision tracking is skipped entirely on the kfunc path.
>
> For reference, check_kfunc_mem_size_reg() constructs the negative
> encoding:
>
>> @@ -8674,14 +8691,15 @@ static int check_mem_reg(...)
>>   static int check_kfunc_mem_size_reg(struct bpf_verifier_env *env,
>>                                      struct bpf_reg_state *mem_reg,
>> 				    struct bpf_reg_state *size_reg,
>> -				    u32 mem_regno)
>> +				    u32 mem_argno)
>>   {
>> +	int reg_or_arg = -(int)(mem_argno + 1);
> [ ... ]
>
>> -	err = check_mem_size_reg(env, mem_reg, size_reg, mem_regno, BPF_READ, true, &meta);
>> -	err = err ?: check_mem_size_reg(env, mem_reg, size_reg, mem_regno, BPF_WRITE, true, &meta);
>> +	err = check_mem_size_reg(env, mem_reg, size_reg, reg_or_arg, BPF_READ, true, &meta);
>> +	err = err ?: check_mem_size_reg(env, mem_reg, size_reg, reg_or_arg, BPF_WRITE, true, &meta);
> Should check_mem_size_reg() still call mark_chain_precision() with
> the actual register number for the kfunc path? It looks like the
> precision marking was unintentionally dropped rather than being
> intentionally skipped. The later commit 2d66a554f1b5 ("bpf: Support
> stack arguments for kfunc calls") adds "if (regno > 0)" guards for
> mark_chain_precision in check_kfunc_args() but does not address
> this case in check_mem_size_reg().

Ack, yes. mark_chain_precision() should be done for -2 to -5 as well.
Alexei suggested to use argno which should avoid such an issue.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24299298635