Re: [PATCH bpf-next v3 2/5] bpf: Fix generic __uninit kfunc output buffers

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-09-16 at 21:27 +0200, Kumar Kartikeya Dwivedi wrote:

...

> @@ -8885,6 +8889,16 @@ static int process_map_ptr_arg(struct bpf_verifier_env *env, struct bpf_reg_stat
>  	return 0;
>  }
>  
> +static enum bpf_access_type func_arg_access_type(enum bpf_arg_type arg_type,
> +						 const struct bpf_call_arg_meta *meta)
> +{
> +	if (arg_type & MEM_UNINIT)
> +		return BPF_WRITE;
> +	if (meta->btf)
> +		return BPF_READ | BPF_WRITE;
> +	return arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ;
> +}
> +
>  static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 prev_slot,
>  			  struct bpf_call_arg_meta *meta,
>  			  int insn_idx)
> @@ -9176,15 +9190,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
>  		enum bpf_access_type access_type;
>  		bool known_memory;
>  
> +		if (meta->btf && (arg_type & MEM_UNINIT))
> +			meta->arg_raw_mem.regno = slot + 1;
> +

Let's avoid adding special cases for kfuncs as in two hunks above.
Please consider a rework as in [1], which makes processing of the
arg_raw_mem.regno and MEM_WRITE bit identical for kfuncs and helpers.
The details are in commit messages (partial slop).
Not identified incorrect handling of MEM_WRITE for helpers
(MEM_WRITE should imply MEM_READ).

[1] https://github.com/eddyz87/bpf/tree/kfunc-uninit-tweaks

...