Re: [PATCH bpf-next v3 3/9] bpf: Preserve reg->id of pointer objects after null-check

Eduard Zingerman
2026-04-22T22:46:40Z

On Tue, 2026-04-21 at 22:52 +0000, bot+bpf-ci@kernel.org wrote:
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 93003a2a96b0..0313b7d5f6c9 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -15886,15 +15886,10 @@ static void mark_ptr_or_null_reg(struct bpf_func_state *state,
> >
> >   mark_ptr_not_null_reg(reg);
> >
> > - if (!reg_may_point_to_spin_lock(reg)) {
> > - /* For not-NULL ptr, reg->ref_obj_id will be reset
> > - * in release_reference().
> > - *
> > - * reg->id is still used by spin_lock ptr. Other
> > - * than spin_lock ptr type, reg->id can be reset.
> > - */
> > - reg->id = 0;
> > - }
> > + /*
> > + * reg->id is preserved for object relationship tracking
> > + * and spin_lock lock state tracking
> > + */
>
> How does preserving reg->id interact with reg_is_init_pkt_pointer()?
>
> In v2 review, Alexei Starovoitov raised this concern: "That pointer has
> to have id == 0". Eduard Zingerman responded that dropping the id == 0
> check should be fine, but this change was not made in v3.
>
> The function reg_is_init_pkt_pointer() still checks reg->id == 0:
>
>     return reg->type == which &&
>            reg->id == 0 &&
>            reg->off == 0 &&
>
> With this patch, if a PTR_TO_PACKET register goes through null-checking
> in mark_ptr_or_null_reg(), it will now preserve its reg->id instead of
> resetting it to 0. Would this cause reg_is_init_pkt_pointer() to
> incorrectly return false for init packet pointers?
>
> Reference: https://lore.kernel.org/bpf/CAADnVQLCKi_QL1FeybW+6MH6FAOAoRJyW06UvtX3my3yNSH5eQ@mail.gmail.com/
>
> >   }
> >  }

Bot concern is bogus here, reg_is_init_pkt_pointer() is called only
for PTR_TO_PACKET. mark_ptr_or_null_reg() checks for
type_may_be_null(reg->type), meaning that for it to trigger one would
need a register of type PTR_TO_PACKET | PTR_MAYBE_NULL.
It appears there is no way to construct such type at the moment.