Re: [PATCH bpf-next v5 03/16] bpf: Refactor to handle memory and size together

bot+bpf-ci
2026-04-18T00:52:45Z

[-- Attachment #1: Type: text/plain, Size: 2378 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2bedaa193d54..7a7024d94cf0 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -7020,15 +7020,17 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
> /* verify arguments to helpers or kfuncs consisting of a pointer and an access
> * size.
> *
> - * @regno is the register containing the access size. regno-1 is the register
> - * containing the pointer.
> + * @mem_regno is the register containing the pointer, mem_regno+1 is the register
> + * containing the access size.
> */
> static int check_mem_size_reg(struct bpf_verifier_env *env,
> - struct bpf_reg_state *reg, u32 regno,
> + struct bpf_reg_state *mem_reg,
> + struct bpf_reg_state *size_reg, u32 mem_regno,
> enum bpf_access_type access_type,
> bool zero_size_allowed,
> struct bpf_call_arg_meta *meta)
> {
> + int size_regno = mem_regno + 1;
> int err;
>
> /* This is used to refine r0 return value bounds for helpers

The refactoring passes size_reg as a parameter to prepare for stack
arguments, but this code still hardcodes size_regno as mem_regno + 1.
Does this assumption hold when stack arguments are used, where the size
might not be at mem_regno + 1?

Looking at how mark_chain_precision() is called later in this function:

> err = check_helper_mem_access(env, mem_reg, mem_regno, size_reg->umax_value,
> access_type, zero_size_allowed, meta);
> if (!err)
> - err = mark_chain_precision(env, regno);
> + err = mark_chain_precision(env, size_regno);

The incorrect size_regno value would cause mark_chain_precision() to mark
the wrong register for precision tracking. For example, if the memory
pointer is passed in R5 and the size is in a stack slot, mem_regno would
be 5, making size_regno 6. This would incorrectly backtrack BPF_REG_6
instead of the stack slot containing the size argument.

Could this break verifier state pruning when the commit message's stated
goal of handling "stack arguments as they may be beyond registers 1-5" is
implemented?

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24592562564