Re: [PATCH bpf-next v4 06/18] bpf: Use argument index instead of register index in kfunc verifier logs

bot+bpf-ci
2026-04-12T05:43:20Z

[-- Attachment #1: Type: text/plain, Size: 3085 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 54296d818d35..01df990f841a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -8592,12 +8609,12 @@ static int check_helper_mem_access(...)
> */
> static int check_mem_size_reg(struct bpf_verifier_env *env,
> struct bpf_reg_state *mem_reg,
> - struct bpf_reg_state *size_reg, int mem_regno,
> + struct bpf_reg_state *size_reg, int reg_or_arg,
> enum bpf_access_type access_type,
> bool zero_size_allowed,
> struct bpf_call_arg_meta *meta)
> {
> - int size_regno = mem_regno + 1;
> + int size_reg_or_arg = (reg_or_arg >= 0) ? reg_or_arg + 1 : reg_or_arg - 1;

[ ... ]

> - err = check_helper_mem_access(env, mem_reg, mem_regno, size_reg->umax_value,
> + err = check_helper_mem_access(env, mem_reg, reg_or_arg, size_reg->umax_value,
> access_type, zero_size_allowed, meta);
> - if (!err)
> - err = mark_chain_precision(env, size_regno);
> + if (!err && size_reg_or_arg > 0)
> + err = mark_chain_precision(env, size_reg_or_arg);
> return err;
> }

When called from the kfunc path via check_kfunc_mem_size_reg(),
reg_or_arg is always negative (-(mem_argno + 1)), which makes
size_reg_or_arg also negative (reg_or_arg - 1). The condition
"size_reg_or_arg > 0" is then always false, so mark_chain_precision()
is never called for kfunc mem+size argument pairs.

The old code unconditionally called mark_chain_precision(env,
size_regno) with the actual register number. With the new encoding,
precision tracking is skipped entirely on the kfunc path.

For reference, check_kfunc_mem_size_reg() constructs the negative
encoding:

> @@ -8674,14 +8691,15 @@ static int check_mem_reg(...)
> static int check_kfunc_mem_size_reg(struct bpf_verifier_env *env,
> struct bpf_reg_state *mem_reg,
> struct bpf_reg_state *size_reg,
> - u32 mem_regno)
> + u32 mem_argno)
> {
> + int reg_or_arg = -(int)(mem_argno + 1);

[ ... ]

> - err = check_mem_size_reg(env, mem_reg, size_reg, mem_regno, BPF_READ, true, &meta);
> - err = err ?: check_mem_size_reg(env, mem_reg, size_reg, mem_regno, BPF_WRITE, true, &meta);
> + err = check_mem_size_reg(env, mem_reg, size_reg, reg_or_arg, BPF_READ, true, &meta);
> + err = err ?: check_mem_size_reg(env, mem_reg, size_reg, reg_or_arg, BPF_WRITE, true, &meta);

Should check_mem_size_reg() still call mark_chain_precision() with
the actual register number for the kfunc path? It looks like the
precision marking was unintentionally dropped rather than being
intentionally skipped. The later commit 2d66a554f1b5 ("bpf: Support
stack arguments for kfunc calls") adds "if (regno > 0)" guards for
mark_chain_precision in check_kfunc_args() but does not address
this case in check_mem_size_reg().

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24299298635