Re: [PATCH bpf-next 2/3] bpf: use reg->var_off instead of reg->off for pointers

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-02-11 at 18:23 -0800, Alexei Starovoitov wrote:
> On Wed, Feb 11, 2026 at 2:32 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> > 
> > - In mark_ptr_or_null_reg() WARN_ON_ONCE() checks were removed
> >   because in some cases helpers that return local kptrs can now
> >   return pointers with non-zero '.var_off' (e.g., a pointer to
> >   a spin lock inside a map entry).
> 
> ...
> 
> > @@ -17129,29 +17074,13 @@ static void mark_ptr_or_null_reg(struct bpf_func_state *state,
> >  {
> >         if (type_may_be_null(reg->type) && reg->id == id &&
> >             (is_rcu_reg(reg) || !WARN_ON_ONCE(!reg->id))) {
> > -               /* Old offset (both fixed and variable parts) should have been
> > -                * known-zero, because we don't allow pointer arithmetic on
> > -                * pointers that might be NULL. If we see this happening, don't
> > -                * convert the register.
> > -                *
> > -                * But in some cases, some helpers that return local kptrs
> > -                * advance offset for the returned pointer. In those cases, it
> > -                * is fine to expect to see reg->off.
> > -                */
> > -               if (WARN_ON_ONCE(reg->smin_value || reg->smax_value || !tnum_equals_const(reg-
> > >var_off, 0)))
> > -                       return;
> > -               if (!(type_is_ptr_alloc_obj(reg->type) || type_is_non_owning_ref(reg->type)) &&
> > -                   WARN_ON_ONCE(reg->off))
> > -                       return;
> > -
> 
> This part looks overly aggressive to me.
> I don't remember seeing these warns, so any known code or syzbot
> is not triggering it, but can we keep them?
> The first warn can stay as-is, no?
> And the 2nd can be converted to tnum_equals_const() too ?

I think it can be preserved as one warning:

               if (!(type_is_ptr_alloc_obj(reg->type) || type_is_non_owning_ref(reg->type)) &&
                   WARN_ON_ONCE(!tnum_equals_const(reg->var_off, 0)))
                       return;

I'll add this in v2.