Re: [PATCH bpf-next v1 14/22] bpf: Consolidate runtime argument type resolution

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sat Sep 5, 2026 at 3:01 PM PDT, Amery Hung wrote:
> A function argument type can require call-site refinement before
> register admission. Helpers refine map-value arguments according to the
> recorded map type, while kfuncs reinterpret a pointer to a scalar-only
> BTF struct as fixed-size memory when the register does not carry a
> BTF ID.
>
> Add resolve_func_arg_type() as the common entry point. It delegates
> helper map-value refinement to the existing resolve_map_arg_type(),
> then handles the kfunc BTF-to-memory fallback. It updates the effective
> argument type and size consumed by the subsequent checks.
>
> Preserve PTR_MAYBE_NULL when changing the base type so later
> nullability validation observes the BTF contract. Keep OBJ_RELEASE
> arguments in their original pointer class. The latter is not a bug fix:
> existing kfunc checking already validates ownership before this
> resolver. It preserves release metadata for the later shared checking
> order, where ownership validation follows register admission.
>
> Moving the kfunc fallback before admission lets the resulting
> fixed-size memory argument enter the compatibility check directly.
> This is another step toward routing both call types through
> check_func_arg().
>
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
> ---
>  kernel/bpf/verifier.c | 199 +++++++++++++++++++++++-------------------
>  1 file changed, 110 insertions(+), 89 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2e068c095436..15ed47b90316 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -8151,8 +8151,8 @@ static bool is_kfunc_call(const struct bpf_call_arg_meta *meta, u32 btf_id)
>  }
>  
>  static int resolve_map_arg_type(struct bpf_verifier_env *env,
> -				 const struct bpf_call_arg_meta *meta,
> -				 enum bpf_arg_type *arg_type)
> +				const struct bpf_call_arg_meta *meta,
> +				enum bpf_arg_type *arg_type)
>  {
>  	if (!meta->map.ptr) {
>  		/* kernel subsystem misconfigured verifier */
> @@ -8180,6 +8180,11 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,
>  	return 0;
>  }
>  
> +static int resolve_func_arg_type(struct bpf_verifier_env *env,
> +				 struct bpf_reg_state *reg, u32 arg,
> +				 struct bpf_call_arg_meta *meta, int insn_idx,
> +				 enum bpf_arg_type *arg_type, u32 *arg_size);
> +
>  struct bpf_reg_types {
>  	const enum bpf_reg_type types[10];
>  	u32 *btf_id;
> @@ -8794,6 +8799,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  	int regno = reg_from_argno(argno);
>  	enum bpf_reg_type type = reg->type;
>  	const u32 *arg_btf_id = NULL;
> +	u32 arg_size = arg_type & MEM_FIXED_SIZE ? fn->arg_size[arg] : 0;
>  	u32 key_size;
>  	int err = 0;
>  
> @@ -8823,11 +8829,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  		return -EACCES;
>  	}
>  
> -	if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE) {
> -		err = resolve_map_arg_type(env, meta, &arg_type);
> -		if (err)
> -			return err;
> -	}
> +	err = resolve_func_arg_type(env, reg, arg, meta, insn_idx, &arg_type, &arg_size);
> +	if (err)
> +		return err;
>  
>  	if (bpf_register_is_null(reg) && type_may_be_null(arg_type))
>  		/* A NULL register has a SCALAR_VALUE type, so skip
> @@ -8965,12 +8969,12 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>  		 * next is_mem_size argument below.
>  		 */
>  		if (arg_type & MEM_FIXED_SIZE) {
> -			err = check_mem_reg(env, reg, argno, fn->arg_size[arg],
> +			err = check_mem_reg(env, reg, argno, arg_size,
>  					    arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ, meta, NULL);
>  			if (err)
>  				return err;
>  			if (arg_type & MEM_ALIGNED)
> -				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
> +				err = check_ptr_alignment(env, reg, 0, arg_size, true);
>  		}
>  		break;
>  	case ARG_MEM_SIZE:
> @@ -11814,6 +11818,65 @@ static bool btf_type_is_scalar_struct(struct bpf_verifier_env *env,
>  	return btf_struct_is_composed_of(env, btf, t, BTF_MEMBER_SCALAR);
>  }
>  
> +static int resolve_func_arg_type(struct bpf_verifier_env *env,
> +				 struct bpf_reg_state *reg, u32 arg,
> +				 struct bpf_call_arg_meta *meta, int insn_idx,
> +				 enum bpf_arg_type *arg_type, u32 *arg_size)
> +{
> +	argno_t argno = argno_from_arg(arg + 1);
> +	const struct btf_param *args;
> +	const struct btf_type *ref_t, *resolve_ret;
> +	const struct btf *btf;
> +	const char *ref_tname;
> +	u32 ref_id;
> +
> +	if (base_type(*arg_type) == ARG_PTR_TO_MAP_VALUE)
> +		return resolve_map_arg_type(env, meta, arg_type);
> +
> +	if (base_type(*arg_type) == ARG_PTR_TO_BTF_ID) {

Overall, it all looks great to me.

Here can reduce indent by:
 if (base_type(*arg_type) != ARG_PTR_TO_BTF_ID) 
    return 0;

Pls address AI nits and respin, so we can land asap.