Re: [PATCH bpf-next v4 2/8] bpf: Introduce global percpu data

bot+bpf-ci
2026-04-14T14:10:09Z

[-- Attachment #1: Type: text/plain, Size: 2121 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 1757c5720503..8ec24d63a2c4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -6362,7 +6362,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> if (tnum_is_const(reg->var_off) &&
> bpf_map_is_rdonly(map) &&
> map->ops->map_direct_value_addr &&
> - map->map_type != BPF_MAP_TYPE_INSN_ARRAY) {
> + map->map_type != BPF_MAP_TYPE_INSN_ARRAY &&
> + map->map_type != BPF_MAP_TYPE_PERCPU_ARRAY) {

This correctly prevents constant folding of percpu array values in
check_mem_access(). However, should the same exclusion also be
added to const_reg_xfer() in kernel/bpf/const_fold.c?

That function has a parallel constant folding path via
bpf_map_direct_read() that only excludes BPF_MAP_TYPE_INSN_ARRAY:

kernel/bpf/const_fold.c:const_reg_xfer() {
...
case BPF_LDX:
...
if (!bpf_map_is_rdonly(map) ||
!map->ops->map_direct_value_addr ||
map->map_type == BPF_MAP_TYPE_INSN_ARRAY ||
off < 0 || off + size > map->value_size ||
bpf_map_direct_read(map, off, size, &val, is_ldsx)) {
*dst = unknown;
break;
}
...
}

Since percpu_array_map_ops now has map_direct_value_addr set,
bpf_map_direct_read() would dereference the raw percpu base pointer
directly, rather than the actual per-cpu address. For a frozen
read-only percpu array, the constant-folded value could differ from
what the program reads at runtime after the BPF_MOV64_PERCPU_REG
fixup converts the address to the correct per-cpu copy.

In the v3 series, bpf_map_direct_read() itself had a guard
(map->map_type != BPF_MAP_TYPE_ARRAY), which protected all callers.
The v4 moved this to caller-side checks but appears to have missed
const_reg_xfer().

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24401974087