Re: [PATCH bpf-next v3 12/15] bpf: Set up the arena base only in functions that use it

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Fri, Oct 16, 2026 at 01:41 AM Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
> @@ -9919,6 +9933,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p
>  		}
>  		break;
>  	case ARG_PTR_TO_ARENA:
> +		/* the JIT rebases the __arena argument of a kfunc on the arena base */
> +		if (is_kfunc(meta))
> +			mark_uses_arena_insn(env);
>  		break;

This mark is not reached when the prog passes 0.
is_kfunc_arg_nullable() is true for both __arena and __arena__nullable,
so arg_type is ARG_PTR_TO_ARENA | PTR_MAYBE_NULL and
check_func_arg() returns at

	if (bpf_register_is_null(reg) && type_may_be_null(arg_type)) {

before the switch.

  SEC("syscall")
  int prog(void *ctx)
  {
	return bpf_kfunc_arena_cap_test(NULL) != 0;
  }

is not marked, but the func model has BTF_FMODEL_ARENA_ARG, so
emit_kfunc_arena_args() hits
WARN_ON_ONCE(!bpf_prog_uses_arena_insns(bpf_prog))
and the prog is rejected.

v1 was marking the wrong subprog in the same spot.
This spot has a WARN. When a mark is missed for ldx or stx
JIT emits [r12 + reg] with r12 of the caller.

Can bpf_prog_uses_arena_insns() look at the final insns instead?
Like detect_reg_usage() does for callee saved regs.
jit_subprogs() already looks for PROBE_MEM32 and PROBE_ATOMIC
in every func to count exentries.
Then no marks in the verifier.

pw-bot: cr