Re: [PATCH bpf-next 08/18] bpf: Support stack arguments for kfunc calls

[Yonghong Song <yonghong.song@linux.dev>]

On 4/24/26 11:00 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 6994536b4e04..43aeb04f488a 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -12304,7 +12314,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>>   					reg_arg_name(env, argno));
>>   				return -EINVAL;
>>   			}
>> -			ret = mark_chain_precision(env, regno);
>> +			if (regno >= 0)
>> +				ret = mark_chain_precision(env, regno);
>> +			else
>> +				ret = mark_stack_arg_precision(env, i);
>>   			if (ret < 0)
>>   				return ret;
>>   			meta->arg_constant.found = true;
> [ ... ]
>
>> @@ -12329,7 +12342,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>>   			}
>>
>>   			meta->r0_size = reg->var_off.value;
>> -			ret = mark_chain_precision(env, regno);
>> +			if (regno >= 0)
>> +				ret = mark_chain_precision(env, regno);
>> +			else
>> +				ret = mark_stack_arg_precision(env, i);
>>   			if (ret)
>>   				return ret;
>>   		}
> In the v6 review, Sashiko AI pointed out that setting reg->precise = true
> without calling mark_chain_precision() breaks data-flow backtracking. The
> concern was that if only the current state's flag is set, parent states and
> source registers that populated the stack argument won't be marked precise,
> potentially allowing incorrect state pruning when execution paths merge before
> the stack store.
>
> The author acknowledged this issue in the v6 discussion with "You are right.
> Let me think how to resolve this." However, the current v7 code still calls
> mark_stack_arg_precision() for stack arguments in check_kfunc_args().
>
> Does mark_stack_arg_precision() properly handle backtracking through parent
> states? Looking at the two locations where stack argument precision is tracked:
>
> check_kfunc_args() for is_kfunc_arg_const_mem_size():
>      if (regno >= 0)
>          ret = mark_chain_precision(env, regno);
>      else
>          ret = mark_stack_arg_precision(env, i);
>
> check_kfunc_args() for KF_ARG_PTR_TO_ALLOC_BTF_ID with is_ret_buf_sz:
>      if (regno >= 0)
>          ret = mark_chain_precision(env, regno);
>      else
>          ret = mark_stack_arg_precision(env, i);
>
> Is mark_stack_arg_precision() correctly marking parent states and the source
> registers that stored values into the stack argument slots, or does it only
> mark the current state as the v6 review suggested?

I think it does proper precision marking and backtracking. There is a test
for this, "selftests/bpf: Add precision backtracking test for stack arguments".
Please take a look.

>
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24902767240