Re: [PATCH bpf-next v4 1/2] bpf: Destroy callee-local dynptrs on subprog return

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Thu, Sep 17, 2026 at 01:19 PM Xu Yunxiang <xyx2021@mail.ustc.edu.cn> wrote:

>  static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
> -				        struct bpf_func_state *state, int spi)
> +					struct bpf_func_state *state, int spi,
> +					bool on_func_exit)
>  {
>  	int err = 0;
>
> @@ -867,6 +894,15 @@ static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
>  	 */
>  	if (dynptr_type_referenced(state->stack[spi].spilled_ptr.dynptr.type) &&
>  	    dynptr_ref_cnt(env, state->stack[spi].spilled_ptr.parent_id) <= 1) {
> +		if (on_func_exit) {
> +			verbose(env, "cannot return with referenced dynptr in callee stack\n");
> +			bpf_diag_res(env, env->insn_idx,
> +				     "referenced dynptr on function return",
> +				     "The departing stack frame contains the last dynptr that can release a referenced resource.",
> +				     "Release the referenced resource before returning from this function.");
> +			return -EINVAL;
> +		}

Pls
 don't add a bool to destroy_if_dynptr_stack_slot() and touch all of
its callers just to print a different message.

pw-bot: cr