Re: [PATCH bpf-next v2 05/17] bpf: Track verifier register diagnostic events

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Fri Jun 19, 2026 at 1:59 PM PDT, Kumar Kartikeya Dwivedi wrote:
> @@ -10179,6 +10403,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>  	const struct bpf_func_proto *fn = NULL;
>  	enum bpf_return_type ret_type;
>  	enum bpf_type_flag ret_flag;
> +	struct bpf_reg_state old_r0;
>  	struct bpf_reg_state *regs;
>  	struct bpf_call_arg_meta meta;
>  	int insn_idx = *insn_idx_p;
> @@ -10253,6 +10478,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>  		return err;
>  
>  	regs = cur_regs(env);
> +	old_r0 = regs[BPF_REG_0];

This adds extra 120 bytes to stack.
Please use scratch reg in env.

>  
>  	/* Mark slots with STACK_MISC in case of raw mode, stack offset
>  	 * is inferred from register state.
> @@ -10603,6 +10829,10 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>  	if (err)
>  		return err;
>  
> +	bpf_diag_record_reg_mod(env, insn_idx, env->cur_state->curframe,
> +				BPF_REG_0, false, 0, 0, &old_r0,
> +				&regs[BPF_REG_0]);
> +
>  	err = check_map_func_compatibility(env, meta.map.ptr, func_id);
>  	if (err)
>  		return err;
> @@ -12918,6 +13148,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  	const struct btf_type *t, *ptr_type;
>  	struct bpf_kfunc_call_arg_meta meta;
>  	struct bpf_insn_aux_data *insn_aux;
> +	struct bpf_reg_state old_r0;

same thing. Let's avoid stack increase.

>  	int err, insn_idx = *insn_idx_p;
>  	const struct btf_param *args;
>  	u32 i, nargs, ptr_type_id;
> @@ -13114,6 +13345,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  		}
>  	}
>  
> +	old_r0 = regs[BPF_REG_0];
>  	for (i = 0; i < CALLER_SAVED_REGS; i++) {
>  		u32 regno = caller_saved[i];
>  
> @@ -13282,6 +13514,10 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  			return err;
>  	}
>  
> +	bpf_diag_record_reg_mod(env, insn_idx, env->cur_state->curframe,
> +				BPF_REG_0, false, 0, 0, &old_r0,
> +				&regs[BPF_REG_0]);
> +
>  	if (meta.func_id == special_kfunc_list[KF_bpf_session_cookie])
>  		env->prog->call_session_cookie = true;
>  
> @@ -14915,10 +15151,17 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
>  /* check validity of 32-bit and 64-bit arithmetic operations */
>  static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
>  {
> +	struct bpf_func_state *state = cur_func(env);
>  	struct bpf_reg_state *regs = cur_regs(env);
> +	struct bpf_reg_state old_dst = {};

and here

>  	u8 opcode = BPF_OP(insn->code);
> +	bool have_old_dst;
>  	int err;
>  
> +	have_old_dst = insn->dst_reg < MAX_BPF_REG;
> +	if (have_old_dst)
> +		old_dst = regs[insn->dst_reg];
> +