Re: [PATCH bpf-next v5 03/16] bpf: Refactor to handle memory and size together

Yonghong Song
2026-04-18T16:47:13Z

On 4/17/26 5:52 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 2bedaa193d54..7a7024d94cf0 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -7020,15 +7020,17 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
>> /* verify arguments to helpers or kfuncs consisting of a pointer and an access
>> * size.
>> *
>> - * @regno is the register containing the access size. regno-1 is the register
>> - * containing the pointer.
>> + * @mem_regno is the register containing the pointer, mem_regno+1 is the register
>> + * containing the access size.
>> */
>> static int check_mem_size_reg(struct bpf_verifier_env *env,
>> - struct bpf_reg_state *reg, u32 regno,
>> + struct bpf_reg_state *mem_reg,
>> + struct bpf_reg_state *size_reg, u32 mem_regno,
>> enum bpf_access_type access_type,
>> bool zero_size_allowed,
>> struct bpf_call_arg_meta *meta)
>> {
>> + int size_regno = mem_regno + 1;
>> int err;
>>
>> /* This is used to refine r0 return value bounds for helpers
> The refactoring passes size_reg as a parameter to prepare for stack
> arguments, but this code still hardcodes size_regno as mem_regno + 1.
> Does this assumption hold when stack arguments are used, where the size
> might not be at mem_regno + 1?

When stack arguments are used, the 'mem_regno' will be replaced as
'mem_argno' and the size_regno will be size_argno which represents
either a register or an argument idx (idx starts from 1). See next patch.

>
> Looking at how mark_chain_precision() is called later in this function:
>
>> err = check_helper_mem_access(env, mem_reg, mem_regno, size_reg->umax_value,
>> access_type, zero_size_allowed, meta);
>> if (!err)
>> - err = mark_chain_precision(env, regno);
>> + err = mark_chain_precision(env, size_regno);
> The incorrect size_regno value would cause mark_chain_precision() to mark
> the wrong register for precision tracking. For example, if the memory
> pointer is passed in R5 and the size is in a stack slot, mem_regno would
> be 5, making size_regno 6. This would incorrectly backtrack BPF_REG_6
> instead of the stack slot containing the size argument.

This won't happen. There will be some check in the above if statement.

>
> Could this break verifier state pruning when the commit message's stated
> goal of handling "stack arguments as they may be beyond registers 1-5" is
> implemented?

This will be addressed when stack arguments are supported and we can mark size_argno
precision is true since the size itself will be a constant.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24592562564