From: Amery Hung <ameryhung@gmail.com>
To: bpf@vger.kernel.org
Cc: alexei.starovoitov@gmail.com, andrii@kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, memxor@gmail.com,
ameryhung@gmail.com, kernel-team@meta.com
Subject: [PATCH bpf-next v2 14/23] bpf: Consolidate runtime argument type resolution
Date: Fri, 11 Sep 2026 15:04:06 -0700 [thread overview]
Message-ID: <20260911220415.1396439-15-ameryhung@gmail.com> (raw)
In-Reply-To: <20260911220415.1396439-1-ameryhung@gmail.com>
A function argument type can require call-site refinement before
register admission. Helpers refine map-value arguments according to the
recorded map type, while kfuncs reinterpret a pointer to a scalar-only
BTF struct as fixed-size memory when the register does not carry a
BTF ID.
Add resolve_func_arg_type() as the common entry point. It delegates
helper map-value refinement to the existing resolve_map_arg_type(),
then handles the kfunc BTF-to-memory fallback. It updates the effective
argument type and size consumed by the subsequent checks.
Preserve PTR_MAYBE_NULL when changing the base type so later
nullability validation observes the BTF contract. Keep OBJ_RELEASE
arguments in their original pointer class. The latter is not a bug fix:
existing kfunc checking already validates ownership before this
resolver. It preserves release metadata for the later shared checking
order, where ownership validation follows register admission.
Moving the kfunc fallback before admission lets the resulting
fixed-size memory argument enter the compatibility check directly.
This is another step toward routing both call types through
check_func_arg().
Signed-off-by: Amery Hung <ameryhung@gmail.com>
---
kernel/bpf/verifier.c | 194 ++++++++++++++++++++++++------------------
1 file changed, 109 insertions(+), 85 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 615a5667e569..4e7230cb5791 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8196,8 +8196,8 @@ static bool is_kfunc_call(const struct bpf_call_arg_meta *meta, u32 btf_id)
}
static int resolve_map_arg_type(struct bpf_verifier_env *env,
- const struct bpf_call_arg_meta *meta,
- enum bpf_arg_type *arg_type)
+ const struct bpf_call_arg_meta *meta,
+ enum bpf_arg_type *arg_type)
{
if (!meta->map.ptr) {
/* kernel subsystem misconfigured verifier */
@@ -8225,6 +8225,11 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,
return 0;
}
+static int resolve_func_arg_type(struct bpf_verifier_env *env,
+ struct bpf_reg_state *reg, u32 arg,
+ struct bpf_call_arg_meta *meta, int insn_idx,
+ enum bpf_arg_type *arg_type, u32 *arg_size);
+
struct bpf_reg_types {
const enum bpf_reg_type types[10];
u32 *btf_id;
@@ -8840,6 +8845,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
int regno = reg_from_argno(argno);
enum bpf_reg_type type = reg->type;
const u32 *arg_btf_id = NULL;
+ u32 arg_size = arg_type & MEM_FIXED_SIZE ? fn->arg_size[arg] : 0;
u32 key_size;
int err = 0;
@@ -8872,11 +8878,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return -EACCES;
}
- if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE) {
- err = resolve_map_arg_type(env, meta, &arg_type);
- if (err)
- return err;
- }
+ err = resolve_func_arg_type(env, reg, arg, meta, insn_idx, &arg_type, &arg_size);
+ if (err)
+ return err;
if (bpf_register_is_null(reg) && type_may_be_null(arg_type)) {
/* A NULL register has a SCALAR_VALUE type, so skip
@@ -9017,12 +9021,12 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
* next is_mem_size argument below.
*/
if (arg_type & MEM_FIXED_SIZE) {
- err = check_mem_reg(env, reg, argno, fn->arg_size[arg],
+ err = check_mem_reg(env, reg, argno, arg_size,
arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ, meta, NULL);
if (err)
return err;
if (arg_type & MEM_ALIGNED)
- err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
+ err = check_ptr_alignment(env, reg, 0, arg_size, true);
}
break;
case ARG_MEM_SIZE:
@@ -11911,6 +11915,65 @@ static bool btf_type_is_scalar_struct(struct bpf_verifier_env *env,
return btf_struct_is_composed_of(env, btf, t, BTF_MEMBER_SCALAR);
}
+static int resolve_func_arg_type(struct bpf_verifier_env *env,
+ struct bpf_reg_state *reg, u32 arg,
+ struct bpf_call_arg_meta *meta, int insn_idx,
+ enum bpf_arg_type *arg_type, u32 *arg_size)
+{
+ argno_t argno = argno_from_arg(arg + 1);
+ const struct btf_param *args;
+ const struct btf_type *ref_t, *resolve_ret;
+ const struct btf *btf;
+ const char *ref_tname;
+ u32 ref_id;
+
+ if (base_type(*arg_type) == ARG_PTR_TO_MAP_VALUE)
+ return resolve_map_arg_type(env, meta, arg_type);
+
+ if (base_type(*arg_type) != ARG_PTR_TO_BTF_ID)
+ return 0;
+
+ if (!meta->btf || arg_type_is_release(*arg_type) ||
+ base_type(reg->type) == PTR_TO_BTF_ID ||
+ reg2btf_ids[base_type(reg->type)])
+ return 0;
+ args = btf_params(meta->func_proto);
+ ref_id = *meta->fn->arg_btf_id[arg];
+ btf = is_kfunc_arg_map(meta->btf, &args[arg]) ? btf_vmlinux : meta->btf;
+ ref_t = btf_type_skip_modifiers(btf, ref_id, &ref_id);
+ ref_tname = btf_name_by_offset(btf, ref_t->name_off);
+
+ if (!btf_type_is_scalar_struct(env, btf, ref_t)) {
+ enum bpf_reg_type reg2btf_type = lookup_reg2btf_ids(ref_id);
+ const char *expected_type;
+
+ verbose(env, "%s is %s expected %s %s",
+ reg_arg_name(env, argno), reg_type_str(env, reg->type),
+ btf_type_str(ref_t), ref_tname);
+ if (reg2btf_type != NOT_INIT)
+ verbose(env, " or %s", reg_type_str(env, reg2btf_type));
+ verbose(env, "\n");
+ expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
+ bpf_diag_call_arg_fmt(env, insn_idx, argno, meta->func_name,
+ "Pass a verifier-tracked pointer to the expected kernel object type, not a pointer to stack storage or another memory buffer.",
+ "the function expects a pointer to %s, but this argument is %s and cannot be used as that kernel object pointer",
+ expected_type,
+ bpf_diag_reg_type_plain(env, reg->type));
+ return -EINVAL;
+ }
+
+ resolve_ret = btf_resolve_size(btf, ref_t, arg_size);
+ if (IS_ERR(resolve_ret)) {
+ verbose(env, "%s reference type('%s %s') size cannot be determined: %ld\n",
+ reg_arg_name(env, argno), btf_type_str(ref_t), ref_tname,
+ PTR_ERR(resolve_ret));
+ return -EINVAL;
+ }
+ *arg_type = ARG_PTR_TO_MEM | MEM_FIXED_SIZE | (*arg_type & PTR_MAYBE_NULL);
+
+ return 0;
+}
+
static void btf_member_path_str(const struct btf *btf, const struct btf_member_path *path,
char *buf, size_t buf_sz)
{
@@ -12990,7 +13053,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
for (i = 0; i < nargs; i++) {
struct bpf_reg_state *reg = get_func_arg_reg(caller, regs, i);
enum bpf_arg_type arg_type = meta->fn->arg_type[i];
- const struct btf_type *t, *ref_t, *resolve_ret;
+ const struct btf_type *t, *ref_t;
argno_t argno = argno_from_arg(i + 1);
int regno = reg_from_argno(argno);
u32 ref_id = args[i].type;
@@ -13053,11 +13116,9 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
if (base_type(arg_type) == ARG_PTR_TO_BTF_ID)
ref_id = *meta->fn->arg_btf_id[i];
- if (is_kfunc_arg_map(btf, &args[i])) {
- ref_t = btf_type_by_id(btf_vmlinux, ref_id);
- ref_tname = btf_name_by_offset(btf, ref_t->name_off);
- }
-
+ ret = resolve_func_arg_type(env, reg, i, meta, insn_idx, &arg_type, &arg_size);
+ if (ret < 0)
+ return ret;
ret = check_func_arg_reg_off(env, reg, argno, arg_type);
if (ret < 0)
return ret;
@@ -13306,80 +13367,43 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
return ret;
break;
case ARG_PTR_TO_BTF_ID:
- /* Only base_type is checked, further checks are done here */
- if (base_type(reg->type) == PTR_TO_BTF_ID ||
- reg2btf_ids[base_type(reg->type)]) {
- if (!is_trusted_reg(env, reg) ||
- bpf_type_has_unsafe_modifiers(reg->type)) {
- if (!(arg_type & MEM_RCU)) {
- const char *expected_type;
-
- expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
- verbose(env, "%s must be referenced or trusted\n",
- reg_arg_name(env, argno));
- bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
- "Pass a pointer acquired from a verifier-tracked source, or call this kfunc only inside the required protection if it accepts RCU pointers.",
- "the kfunc requires a trusted or resource-owning pointer to %s, but %s is %s",
- expected_type,
- reg_arg_name(env, argno),
- bpf_diag_reg_type_plain(env, reg->type));
- return -EINVAL;
- }
- if (!is_rcu_reg(reg)) {
- const char *expected_type;
-
- expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
- verbose(env, "%s must be a rcu pointer\n",
- reg_arg_name(env, argno));
- bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
- "Use this kfunc with a pointer that is valid in an RCU read lock region.",
- "the kfunc requires an RCU-protected pointer to %s, but %s is %s",
- expected_type,
- reg_arg_name(env, argno),
- bpf_diag_reg_type_plain(env, reg->type));
- return -EINVAL;
- }
- }
+ if (!is_trusted_reg(env, reg) ||
+ bpf_type_has_unsafe_modifiers(reg->type)) {
+ if (!(arg_type & MEM_RCU)) {
+ const char *actual_type, *arg_name, *expected_type;
- ret = process_kf_arg_ptr_to_btf_id(env, reg, ref_t, ref_tname, ref_id, meta, i, argno);
- if (ret < 0)
- return ret;
- break;
- }
+ expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
+ verbose(env, "%s must be referenced or trusted\n",
+ reg_arg_name(env, argno));
+ arg_name = reg_arg_name(env, argno);
+ actual_type = bpf_diag_reg_type_plain(env, reg->type);
+ bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
+ "Pass a pointer acquired from a verifier-tracked source, or call this kfunc only inside the required protection if it accepts RCU pointers.",
+ "the kfunc requires a trusted or resource-owning pointer to %s, but %s is %s",
+ expected_type, arg_name, actual_type);
+ return -EINVAL;
+ }
+ if (!is_rcu_reg(reg)) {
+ const char *actual_type, *arg_name, *expected_type;
- if (!btf_type_is_scalar_struct(env, meta->btf, ref_t)) {
- enum bpf_reg_type reg2btf_type = lookup_reg2btf_ids(ref_id);
- const char *expected_type;
-
- verbose(env, "%s is %s expected %s %s",
- reg_arg_name(env, argno), reg_type_str(env, reg->type),
- btf_type_str(ref_t), ref_tname);
- if (reg2btf_type != NOT_INIT)
- verbose(env, " or %s", reg_type_str(env, reg2btf_type));
- verbose(env, "\n");
- expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
- bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
- "Pass a verifier-tracked pointer to the expected kernel object type, not a pointer to stack storage or another memory buffer.",
- "the kfunc expects a pointer to %s, but this argument is %s and cannot be used as that kernel object pointer",
- expected_type,
- bpf_diag_reg_type_plain(env, reg->type));
- return -EINVAL;
+ expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
+ verbose(env, "%s must be a rcu pointer\n",
+ reg_arg_name(env, argno));
+ arg_name = reg_arg_name(env, argno);
+ actual_type = bpf_diag_reg_type_plain(env, reg->type);
+ bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
+ "Use this kfunc with a pointer that is valid in an RCU read lock region.",
+ "the kfunc requires an RCU-protected pointer to %s, but %s is %s",
+ expected_type, arg_name, actual_type);
+ return -EINVAL;
+ }
}
- /*
- * If the register does not contain btf id but the argument type is a pointer to
- * scalar-only struct, allow verifying it as a fixed size memory.
- */
- resolve_ret = btf_resolve_size(btf, ref_t, &arg_size);
- if (IS_ERR(resolve_ret)) {
- verbose(env,
- "%s reference type('%s %s') size cannot be determined: %ld\n",
- reg_arg_name(env, argno), btf_type_str(ref_t),
- ref_tname, PTR_ERR(resolve_ret));
- return -EINVAL;
- }
- arg_type = ARG_PTR_TO_MEM | MEM_FIXED_SIZE;
- fallthrough;
+ ret = process_kf_arg_ptr_to_btf_id(env, reg, ref_t, ref_tname,
+ ref_id, meta, i, argno);
+ if (ret < 0)
+ return ret;
+ break;
case ARG_PTR_TO_MEM:
if (arg_type & MEM_FIXED_SIZE) {
bool known_memory;
--
2.52.0
next prev parent reply other threads:[~2026-09-11 22:04 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-11 22:03 [PATCH bpf-next v2 00/23] Unify helper and kfunc argument checks Amery Hung
2026-09-11 22:03 ` [PATCH bpf-next v2 01/23] bpf: Pass call metadata through shared " Amery Hung
2026-09-11 22:03 ` [PATCH bpf-next v2 02/23] bpf: Address check_func_arg() arguments by argno Amery Hung
2026-09-11 22:03 ` [PATCH bpf-next v2 03/23] bpf: Only compare func_id against BPF_FUNC_* for helper calls Amery Hung
2026-09-11 22:03 ` [PATCH bpf-next v2 04/23] bpf: Only compare func_id against kfunc BTF IDs for kfunc calls Amery Hung
2026-09-11 22:03 ` [PATCH bpf-next v2 05/23] bpf: Clarify unused and scalar function argument types Amery Hung
2026-09-11 22:19 ` sashiko-bot
2026-09-11 22:03 ` [PATCH bpf-next v2 06/23] bpf: Unify kfunc argument kinds with enum bpf_arg_type Amery Hung
2026-09-11 22:26 ` sashiko-bot
2026-09-11 22:03 ` [PATCH bpf-next v2 07/23] bpf: Classify kfunc arguments the verifier ignores Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 08/23] bpf: Align helper and kfunc ARG_PTR_TO_PROG_AUX handling Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 09/23] bpf: Set OBJ_RELEASE when generating kfunc argument types Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 10/23] bpf: Set MEM_UNINIT and dynptr subtypes when generating kfunc arg types Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 11/23] bpf: Set MEM_RCU when generating kfunc argument types Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 12/23] bpf: Resolve BTF ID of ARG_PTR_TO_BTF_ID in kfunc bpf_func_proto Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 13/23] bpf: Resolve ARG_PTR_TO_MEM | MEM_FIXED_SIZE size " Amery Hung
2026-09-11 22:04 ` Amery Hung [this message]
2026-09-11 22:04 ` [PATCH bpf-next v2 15/23] bpf: Consolidate nullable argument validation Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 16/23] bpf: Drop redundant BTF pointer helper write rejection Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 17/23] bpf: Consolidate helper and kfunc PTR_TO_BTF_ID argument matching Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 18/23] bpf: Admit kfunc argument registers through check_reg_type() Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 19/23] bpf: Consolidate function call pkt_access validation Amery Hung
2026-09-15 10:44 ` Mahe Tardy
2026-09-11 22:04 ` [PATCH bpf-next v2 20/23] selftests/bpf: Test kfunc packet memory direct writes Amery Hung
2026-09-11 22:36 ` sashiko-bot
2026-09-11 22:04 ` [PATCH bpf-next v2 21/23] bpf: Consolidate release argument validation Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 22/23] selftests/bpf: Test nullable per-CPU kptr identity after exchange Amery Hung
2026-09-11 22:04 ` [PATCH bpf-next v2 23/23] bpf: Check helper and kfunc arguments in one path Amery Hung
2026-09-12 3:20 ` [PATCH bpf-next v2 00/23] Unify helper and kfunc argument checks patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260911220415.1396439-15-ameryhung@gmail.com \
--to=ameryhung@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=kernel-team@meta.com \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).