Re: [PATCH bpf-next v5 09/14] bpf: Fold ref_obj_id into id and introduce virtual references

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] check_reference_leak() incorrectly rejects valid struct_ops programs that return a pointer derived from a virtual reference (e.g., a casted pointer).
--

commit 4171c91972499af3939593f911ee11b4fbbe778d
Author: Amery Hung <ameryhung@gmail.com>

bpf: Fold ref_obj_id into id and introduce virtual references

This commit unifies pointer identity and lifetime tracking by replacing
ref_obj_id with id. It introduces virtual references to serve as lifetime
anchors for objects that share the same lifetime but need distinct identities,
such as pointer casts and referenced dynptr clones.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -9854,7 +9920,7 @@ static int check_reference_leak(struct bpf_verifier_env *env, bool exception_exi
>  		 * kernel. Type checks are performed later in check_return_code.
>  		 */
>  		if (type == BPF_PROG_TYPE_STRUCT_OPS && !exception_exit &&
> -		    reg->ref_obj_id == state->refs[i].id)
> +		    reg->id == state->refs[i].id)
>  			continue;

[Severity: High]
Will this correctly handle struct_ops programs that return a pointer derived
from a virtual reference, such as a casted pointer?

Since a casted pointer in R0 receives a distinct non-reference id while the
virtual reference ID is stored in its parent_id, checking reg->id against
state->refs[i].id might fail here. 

Could this cause the verifier to incorrectly flag an "Unreleased reference"
and reject valid struct_ops programs? Should this check also consider
reg->parent_id when the reference is virtual?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260519181314.2731658-1-ameryhung@gmail.com?part=9