From: Yonghong Song <yonghong.song@linux.dev>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
kernel-team@fb.com
Subject: [PATCH bpf-next v4 05/12] bpf: Let a by-value struct nest arrays and structs freely
Date: Fri, 28 Aug 2026 23:15:39 -0700 [thread overview]
Message-ID: <20260829061539.1695015-1-yonghong.song@linux.dev> (raw)
In-Reply-To: <20260829061514.1690730-1-yonghong.song@linux.dev>
Go through nested array types until it reaches a non-array type. Later
code will check such non-array type based on current logic. A
zero-length array is still rejected, at whichever dimension it appears.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
kernel/bpf/verifier.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 90139f1b78d1..a377b1995b51 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11675,6 +11675,17 @@ static bool btf_struct_member_walk(struct bpf_verifier_env *env, const struct bt
const struct btf_array *array;
member_type = btf_type_skip_modifiers(btf, member->type, NULL);
+ /*
+ * Every element of an array is laid out in the value being
+ * returned, so an array counts as its element type however many
+ * dimensions deep that is.
+ */
+ while (btf_type_is_array(member_type)) {
+ array = btf_array(member_type);
+ if (!array->nelems)
+ return false;
+ member_type = btf_type_skip_modifiers(btf, array->type, NULL);
+ }
if (btf_type_is_struct(member_type)) {
if (rec >= 3) {
verbose(env, "max struct nesting depth exceeded\n");
@@ -11684,12 +11695,6 @@ static bool btf_struct_member_walk(struct bpf_verifier_env *env, const struct bt
return false;
continue;
}
- if (btf_type_is_array(member_type)) {
- array = btf_array(member_type);
- if (!array->nelems)
- return false;
- member_type = btf_type_skip_modifiers(btf, array->type, NULL);
- }
if (!btf_member_kind_allowed(btf, member_type, member_kinds))
return false;
}
--
2.53.0-Meta
next prev parent reply other threads:[~2026-08-29 6:15 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-29 6:15 [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 01/12] bpf: Record each half of a paired return value in verifier diagnostics Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 02/12] bpf: Drop the recursion depth argument of btf_type_is_scalar_struct() Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 03/12] bpf: Add btf_type_is_arena_ptr() Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 04/12] bpf: Let the by-value struct walk take the kinds of member it accepts Yonghong Song
2026-08-29 6:15 ` Yonghong Song [this message]
2026-08-29 7:11 ` [PATCH bpf-next v4 05/12] bpf: Let a by-value struct nest arrays and structs freely bot+bpf-ci
2026-08-29 6:15 ` [PATCH bpf-next v4 06/12] bpf: Report which member makes a kfunc return type unsupported Yonghong Song
2026-08-29 7:11 ` bot+bpf-ci
2026-08-29 6:15 ` [PATCH bpf-next v4 07/12] bpf: Allow a global function to return arena pointers by value Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 08/12] bpf: Allow arena pointers in a by-value kfunc return Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 09/12] selftests/bpf: Check the member named for an unsupported kfunc return type Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 10/12] selftests/bpf: Test global functions returning arena pointers by value Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 11/12] selftests/bpf: Test kfuncs " Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 12/12] docs/bpf: Document arena pointers in a by-value return Yonghong Song
2026-08-30 1:33 ` Kumar Kartikeya Dwivedi
2026-08-31 2:42 ` Yonghong Song
2026-08-30 1:20 ` [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260829061539.1695015-1-yonghong.song@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=kernel-team@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox