Re: [PATCH bpf-next v1 1/3] bpf: Fix generic __uninit kfunc output buffers

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Wed Sep 16, 2026 at 7:19 AM CEST, Eduard Zingerman wrote:
> On Tue, 2026-09-15 at 16:10 +0200, Kumar Kartikeya Dwivedi wrote:
>
> ...
>
>>  2.3.4 __nullable Annotation
>>  ---------------------------
>> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
>> index cf85141ea167..9ddbb20ec1e9 100644
>> --- a/include/linux/bpf_verifier.h
>> +++ b/include/linux/bpf_verifier.h
>> @@ -1547,12 +1547,13 @@ struct ref_obj_desc {
>>  };
>>  
>>  /*
>> - * A memory argument a call fills in. The verifier allows the stack to be uninitialized if
>> - * the range is a known constant. Stack slots are marked as STACK_MISC by check_mem_access().
>> + * Memory arguments a call fills in, indexed by argument slot. The verifier allows the
>> + * stack to be uninitialized if the range is a known constant. Stack slots are marked as
>> + * STACK_MISC by check_mem_access() after all arguments have been checked.
>>   */
>>  struct arg_raw_mem_desc {
>> -	u8 regno;
>> -	int size;
>> +	u16 mask;
>
> Do we plan to add kfuncs with multiple __uninit parameters?
> If we do plan this, let's separate __uninit fix from the mask conversion.
> Otherwise let's keep regno.
>

I separated the patches. I don't think are any consumers yet but it makes to
support multiple such arguments, so just keeping the separate patch. If you
disagree feel free to drop it when applying.

>> +	int size[MAX_BPF_FUNC_ARGS];
>>  };
>>  
>>  /* Size of PTR_TO_MEM returned, taken from a constant allocation-size argument */
>
> ...
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 6c6b8d8520cd..070ec5daeec3 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -6981,7 +6981,9 @@ static int check_stack_range_initialized(
>>  	 */
>>  	bool allow_poison = access_size < 0 || clobber;
>>  	/* The call will initialize the memory; uninitialized stack allowed */
>> -	bool raw_mode = meta && meta->arg_raw_mem.regno == reg_from_argno(argno);
>> +	u32 arg_slot = abs(argno.argno) - 1;
>> +	bool raw_mode = meta && arg_slot < MAX_BPF_FUNC_ARGS &&
>> +		       (meta->arg_raw_mem.mask & BIT(arg_slot));
>
> Thit BIT(abs(...)) trick is repeated several times, can it be abstracted?
>
> ...

For the other email, I decided to keep __prepare_priv, we need to resolve module
ksym kfuncs but test the unpriv case. It is a bit of a hack and nobody will do
this in practice, but it helps us retain coverage for the other case.

Addressed all other comments and will respin.