Re: [PATCH bpf-next v4 07/14] bpf: introduce forward arg-tracking dataflow analysis

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-04-10 at 21:44 +0000, bot+bpf-ci@kernel.org wrote:
> > diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> > index 7b31d8024c61..49b19118c326 100644
> > --- a/include/linux/bpf_verifier.h
> > +++ b/include/linux/bpf_verifier.h
> 
> [ ... ]
> 
> > @@ -886,6 +887,8 @@ struct bpf_verifier_env {
> >  	} cfg;
> >  	struct backtrack_state bt;
> >  	struct bpf_jmp_history_entry *cur_hist_ent;
> > +	/* Per-callsite copy of parent's converged at_stack_in for cross-frame fills. */
> > +	struct arg_track **callsite_at_stack;
> >  	u32 pass_cnt; /* number of times do_check() was called */
> 
> [ ... ]
> 
> > diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
> > index a3af5972520f..c5d6760454d6 100644
> > --- a/kernel/bpf/liveness.c
> > +++ b/kernel/bpf/liveness.c
> 
> [ ... ]
> 
> > +static struct arg_track fill_from_stack(struct bpf_insn *insn,
> > +					struct arg_track *at_out, int reg,
> > +					struct arg_track *at_stack_out,
> > +					int depth)
> > +{
> 
> [ ... ]
> 
> > +	cnt = at_out[reg].off_cnt;
> > +	if (cnt == 0)
> > +		return imp;
> > +
> > +	for (i = 0; i < cnt; i++) {
> > +		s16 fp_off = arg_add(at_out[reg].off[i], insn->off);
> > +		int slot = fp_off_to_slot(fp_off);
> > +
> > +		if (slot < 0)
> > +			return imp;
> > +		result = __arg_track_join(result, at_stack_out[slot]);
> > +	}
> > +	return result;
> > +}
> 
> [ ... ]
> 
> > +	} else if (class == BPF_LDX) {
> > +		u32 sz = bpf_size_to_bytes(BPF_SIZE(insn->code));
> > +		bool src_is_local_fp = insn->src_reg == BPF_REG_FP || src->frame == depth ||
> > +				       (src->frame == ARG_IMPRECISE && (src->mask & BIT(depth)));
> > +
> 
> [ ... ]
> 
> > +		} else if (src->frame >= 0 && src->frame < depth &&
> > +			   BPF_MODE(insn->code) == BPF_MEM && sz == 8) {
> > +			struct arg_track *parent_stack =
> > +				env->callsite_at_stack[callsites[src->frame]];
> > +
> > +			*dst = fill_from_stack(insn, at_out, insn->src_reg,
> > +					       parent_stack, src->frame);
> 
> Can parent_stack be NULL here? bpf_compute_subprog_arg_access()
> allocates callsite_at_stack with kvzalloc_objs (zero-filled), but
> nothing in this commit ever writes to individual callsite_at_stack[]
> entries. They all remain NULL.
> 
> When a callee receives a parent-frame FP-derived pointer (e.g. r1 with
> frame=0 at depth 1) and does an 8-byte load from it, this path is
> taken. fill_from_stack() then dereferences the NULL at_stack_out:
> 
>   fill_from_stack()
>     cnt = at_out[reg].off_cnt;   /* > 0 for precise args */
>     ...
>     result = __arg_track_join(result, at_stack_out[slot]);
>                                       ^^^^^^^^^^^^^^^^
>                                       NULL dereference
> 
> This appears to be a bisection hazard. The next commit in the series,
> 0458daba63a9 ("bpf: record arg tracking results in bpf_liveness
> masks"), adds the code that populates these entries:
> 
>   if (bpf_pseudo_call(insn) || bpf_calls_callback(env, idx)) {
>       env->callsite_at_stack[idx] = kvmalloc_objs(...);
>       memcpy(env->callsite_at_stack[idx], at_stack_in[i], ...);
>   }
> 
> Would it make sense to either defer wiring up the
> bpf_compute_subprog_arg_access() call into compute_live_registers()
> until the next patch, or move the callsite_at_stack population into
> this commit?

Yeap, should be moved.

> 
> > +		} else if (src->frame == ARG_IMPRECISE &&
> 
> [ ... ]
> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24264407165