[PATCH bpf-next] bpf: Skip redundant destroy_if_dynptr_stack_slot calls in check_stack_write_var_off

[PATCH bpf-next] bpf: Skip redundant destroy_if_dynptr_stack_slot calls in check_stack_write_var_off

[Ömer Mete Kaya]

bpf_get_spi() maps 8 consecutive byte offsets to the same slot index.
When iterating over a variable-offset stack write range byte by byte,
destroy_if_dynptr_stack_slot() can be called up to 8 times for the same
slot, even though it operates per-slot.

Skip iterations where the slot index matches the previous byte's slot
index to avoid the redundant calls.

Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
 kernel/bpf/verifier.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fec5a1ae6a4d..0eeb498db9d3 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3824,9 +3824,13 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
 		writing_zero = true;

 	for (i = min_off; i < max_off; i++) {
-		int spi;
+		int spi = bpf_get_spi(i);

-		spi = bpf_get_spi(i);
+		/* bpf_get_spi() maps 8 consecutive byte offsets to the same
+		 * slot index; skip redundant calls for the same slot.
+		 */
+		if (i != min_off && spi == bpf_get_spi(i - 1))
+			continue;
 		err = destroy_if_dynptr_stack_slot(env, state, spi);
 		if (err)
 			return err;
--
2.55.0

Re: [PATCH bpf-next] bpf: Skip redundant destroy_if_dynptr_stack_slot calls in check_stack_write_var_off

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: multi-line comment style violation in check_stack_write_var_off()
--

commit 2ecbd1f84931126c23d8e648f52879b6e724f3c6
Author: Ömer Mete Kaya <omermetekaya0@gmail.com>

bpf: Skip redundant destroy_if_dynptr_stack_slot calls in check_stack_write_var_off

This commit optimizes check_stack_write_var_off() by skipping redundant calls
to destroy_if_dynptr_stack_slot(). Since bpf_get_spi() maps 8 consecutive byte
offsets to the same slot index, it avoids repeatedly processing the same slot
when iterating over a variable-offset stack write range.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 03dbc0e003986..ba029d8c34f89 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -3824,9 +3824,13 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
>  		writing_zero = true;
>  
>  	for (i = min_off; i < max_off; i++) {
> -		int spi;
> +		int spi = bpf_get_spi(i);
>  
> -		spi = bpf_get_spi(i);
> +		/* bpf_get_spi() maps 8 consecutive byte offsets to the same
> +		 * slot index; skip redundant calls for the same slot.
> +		 */

[Severity: Low]
This isn't a bug, but does this multi-line comment follow the preferred BPF
subsystem style? 

The BPF subsystem explicitly requires multi-line comments to have the opening
'/*' on its own line, with the text starting on the subsequent line.

> +		if (i != min_off && spi == bpf_get_spi(i - 1))
> +			continue;
>  		err = destroy_if_dynptr_stack_slot(env, state, spi);
>  		if (err)
>  			return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927230511.417420-1-omermetekaya0@gmail.com?part=1