Re: [PATCH bpf-next v2 0/2] bpf: Preserve scalar zero spills for var-offset stack reads

[Yonghong Song <yonghong.song@linux.dev>]

On 6/13/26 4:16 AM, Woojin Ji wrote:
> Variable-offset stack reads currently lose the known-zero fact when the
> loaded byte comes from a spilled scalar constant zero rather than from a
> STACK_ZERO byte. This series teaches the var-offset stack read path to
> preserve that zero fact while marking the contributing spill slots
> precise, and adds verifier_var_off coverage for the new behaviour and
> the pruning-sensitive negative case.
>
> I don't have a confirmed deployed-program regression, so this is targeted
> at bpf-next. I did confirm the pattern is reachable from normal C codegen
> with a small helper-based BPF C reproducer: clang 22.1.6 -O2/-O3 can
> produce a spilled scalar-zero plus variable-offset stack byte load pattern
> that the unpatched verifier rejects and the patched verifier accepts.

Could you share your C code to desmonstrate patch 1? We can then check
whether the pattern is common and whether the code can be easliy worked
around with source code (e.g. barrier_var() etc.).

>
> Changes in v2:
> - Rebased onto bpf-next.
> - Split verifier and selftests changes into separate patches.
> - Added bpf_bt_set_frame_slot_mask() instead of open-coding a slot loop.
> - Kept the new eager precision marking on the variable-offset read path.
> - Added verifier log assertions for the zero result and mark_precise trail.
> - Added sub-8-byte spill coverage with STACK_ZERO and STACK_MISC neighbours.
> - Cleaned up inline asm formatting and local labels.
>
> Tested with:
> - make O=../../out/kernel olddefconfig
> - make O=../../out/kernel -j$(nproc) kernel/bpf/verifier.o
> - make O=../../out/kernel LLVM=1 -j$(nproc) bzImage
> - ./test_progs -t verifier_var_off -v
>    Summary: 1/30 PASSED, 0 SKIPPED, 0 FAILED
> - ./test_progs -t verifier_spill_fill -t verifier_live_stack \
>    -t verifier_search_pruning -v
>    Summary: 3/127 PASSED, 0 SKIPPED, 0 FAILED
> - veristat -o csv verifier_var_off.bpf.o
>
> Assisted-by: opencode:gpt-5.5
> Signed-off-by: Woojin Ji <random6.xyz@gmail.com>
> ---
> Woojin Ji (2):
>        bpf: Preserve scalar zero spills for var-offset stack reads
>        selftests/bpf: Cover var-offset stack reads from zero spills
>
>   include/linux/bpf_verifier.h                       |   5 +
>   kernel/bpf/verifier.c                              |  55 ++++++--
>   .../testing/selftests/bpf/progs/verifier_var_off.c | 148 +++++++++++++++++++++
>   3 files changed, 198 insertions(+), 10 deletions(-)
> ---
> base-commit: 7bfb93e3475be9de894f1cecd3a727d3e1649b03
> change-id: 20260610-bpf-stack-var-off-zero-v1-34ad1bc3b533
>
> Best regards,
> --
> Woojin Ji <random6.xyz@gmail.com>
>
>