Re: [PATCH bpf-next v3 05/24] bpf: Support stack arguments for bpf functions

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Mon May 11, 2026 at 9:17 PM PDT, Yonghong Song wrote:
>
>
> The insn 12 (r0 = *(u64 *)(r11 +8)) is considered safe
> and the verification succeeded.
>
> But this is not correct. The verification should fail due to insn 11.

makes sense.

> If we add the following in states.c:
>
> diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c
> index 45d86bfe3b68..877338136009 100644
> --- a/kernel/bpf/states.c
> +++ b/kernel/bpf/states.c
> @@ -941,6 +941,9 @@ static bool func_states_equal(struct bpf_verifier_env *env, struct bpf_func_stat
>          if (old->callback_depth > cur->callback_depth)
>                  return false;
>   
> +       if (!old->no_stack_arg_load && cur->no_stack_arg_load)
> +               return false;
> +

...

> With the above states.c change, old no_stack_arg_load is false and
> cur no_stack_arg_load is true, func_states_equal returns false to
> allow further for cur verification, which enters insn 12 which will
> fail the verification.
>
> What do you think about the above states.c change?

also makes sense to me.