Re: [PATCH bpf-next 6/6] bpf: Add helper and kfunc stack access size resolution

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2026-03-31 at 19:16 -0700, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> The static stack liveness analysis needs to know how many bytes a
> helper or kfunc accesses through a stack pointer argument, so it can
> precisely mark the affected stack slots as stack 'def' or 'use'.
> 
> Add bpf_helper_stack_access_bytes() and bpf_kfunc_stack_access_bytes()
> which resolve the access size for a given call argument.
> 
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> ---

(Please see below, I think a few cases can be slightly improved).

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

> +s64 bpf_helper_stack_access_bytes(struct bpf_verifier_env *env, struct bpf_insn *insn,
> +				  int arg, int insn_idx)
> +{

[...]

> +	case ARG_PTR_TO_MEM:
> +		if (at & MEM_FIXED_SIZE) {
> +			size = fn->arg_size[arg];
> +			goto out;
> +		}
> +		if (arg + 1 < ARRAY_SIZE(fn->arg_type) &&
> +		    arg_type_is_mem_size(fn->arg_type[arg + 1])) {
> +			int size_reg = BPF_REG_1 + arg + 1;
> +
> +			if (aux->const_reg_mask & BIT(size_reg)) {
> +				size = (s64)aux->const_reg_vals[size_reg];
> +				goto out;

if `at & MEM_WRITE`, I think it would be correct to `return 0;` here.

> +			}
> +			/*
> +			 * Size arg is const on each path but differs across
> +			 * merged paths.  512 is a safe upper bound for reads.
> +			 */
> +			if (at & MEM_UNINIT)
> +				return S64_MIN;
> +			return 512;

Nit: `return MAX_BPF_STACK;`

> +		}
> +		return S64_MIN;
> +	case ARG_PTR_TO_DYNPTR:
> +		return BPF_DYNPTR_SIZE;
> +	case ARG_PTR_TO_STACK:
> +		/*
> +		 * Only used by bpf_calls_callback() helpers. The helper itself
> +		 * doesn't access stack. The callback subprog does and it's
> +		 * analyzed separately.
> +		 */
> +		return 0;
> +	default:
> +		return S64_MIN;
> +	}
> +out:
> +	/*
> +	 * MEM_UNINIT args are write-only: the helper initializes the
> +	 * buffer without reading it.
> +	 */
> +	if (size > 0 && at & MEM_UNINIT)
> +		return -size;

Same question about MEM_WRITE here, might be possible to `return 0` in
some cases.

> +	return size;
> +}

[...]