Re: [PATCH bpf-next 04/18] bpf: Extend liveness analysis to track stack argument slots

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-04-24 at 10:14 -0700, Yonghong Song wrote:

[...]

> diff --git a/kernel/bpf/const_fold.c b/kernel/bpf/const_fold.c
> index db73c4740b1e..b65285d61efe 100644
> --- a/kernel/bpf/const_fold.c
> +++ b/kernel/bpf/const_fold.c
> @@ -51,13 +51,22 @@ static void const_reg_xfer(struct bpf_verifier_env *env, struct const_arg_info *
>  			   struct bpf_insn *insn, struct bpf_insn *insns, int idx)
>  {
>  	struct const_arg_info unknown = { .state = CONST_ARG_UNKNOWN, .val = 0 };
> -	struct const_arg_info *dst = &ci_out[insn->dst_reg];
> -	struct const_arg_info *src = &ci_out[insn->src_reg];
> +	struct const_arg_info *dst, *src;

Nit: there is no harm in computing addresses before validating the range.

>  	u8 class = BPF_CLASS(insn->code);
>  	u8 mode = BPF_MODE(insn->code);
>  	u8 opcode = BPF_OP(insn->code) | BPF_SRC(insn->code);
>  	int r;
>  
> +	/* Stack arguments use BPF_REG_PARAMS which is outside the tracked register set. */
> +	if (insn->dst_reg == BPF_REG_PARAMS)

Nit: I'd add several accessors:
     - is_stack_arg_st(insn)
     - is_stack_arg_stx(insn)
     - is_stack_arg_ldx(insn)

> +		return;
> +	if (insn->src_reg == BPF_REG_PARAMS) {
> +		ci_out[insn->dst_reg] = unknown;
> +		return;
> +	}
> +
> +	dst = &ci_out[insn->dst_reg];
> +	src = &ci_out[insn->src_reg];
>  	switch (class) {
>  	case BPF_ALU:
>  	case BPF_ALU64:

[...]

> diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
> @@ -1560,6 +1603,9 @@ static int compute_subprog_args(struct bpf_verifier_env *env,
>  	struct arg_track at_out[MAX_BPF_REG];
>  	struct arg_track (*at_stack_in)[MAX_ARG_SPILL_SLOTS] = NULL;
>  	struct arg_track *at_stack_out = NULL;
> +	struct arg_track (*at_stack_arg_in)[MAX_STACK_ARG_SLOTS] = NULL;
> +	struct arg_track at_stack_arg_out[MAX_STACK_ARG_SLOTS];
> +	struct arg_track at_stack_arg_entry[MAX_STACK_ARG_SLOTS];

I think this implementation is correct.  That being said, an
alternative option would be to track at_stack_arg_{in,out} as a part
of at_{in,out}, just at indexes >=11. This should avoid duplicating
the code processing joins in compute_subprog_args(), record_call_access(),
and memory handling a bit. Wdyt?

[...]