Re: [PATCH bpf-next v5 03/16] bpf: Refactor to handle memory and size together

[Yonghong Song <yonghong.song@linux.dev>]

On 4/17/26 5:52 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 2bedaa193d54..7a7024d94cf0 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -7020,15 +7020,17 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
>>   /* verify arguments to helpers or kfuncs consisting of a pointer and an access
>>    * size.
>>    *
>> - * @regno is the register containing the access size. regno-1 is the register
>> - * containing the pointer.
>> + * @mem_regno is the register containing the pointer, mem_regno+1 is the register
>> + * containing the access size.
>>    */
>>   static int check_mem_size_reg(struct bpf_verifier_env *env,
>> -			      struct bpf_reg_state *reg, u32 regno,
>> +			      struct bpf_reg_state *mem_reg,
>> +			      struct bpf_reg_state *size_reg, u32 mem_regno,
>>   			      enum bpf_access_type access_type,
>>   			      bool zero_size_allowed,
>>   			      struct bpf_call_arg_meta *meta)
>>   {
>> +	int size_regno = mem_regno + 1;
>>   	int err;
>>
>>   	/* This is used to refine r0 return value bounds for helpers
> The refactoring passes size_reg as a parameter to prepare for stack
> arguments, but this code still hardcodes size_regno as mem_regno + 1.
> Does this assumption hold when stack arguments are used, where the size
> might not be at mem_regno + 1?

When stack arguments are used, the 'mem_regno' will be replaced as
'mem_argno' and the size_regno will be size_argno which represents
either a register or an argument idx (idx starts from 1). See next patch.

>
> Looking at how mark_chain_precision() is called later in this function:
>
>>   	err = check_helper_mem_access(env, mem_reg, mem_regno, size_reg->umax_value,
>>   				      access_type, zero_size_allowed, meta);
>>   	if (!err)
>> -		err = mark_chain_precision(env, regno);
>> +		err = mark_chain_precision(env, size_regno);
> The incorrect size_regno value would cause mark_chain_precision() to mark
> the wrong register for precision tracking. For example, if the memory
> pointer is passed in R5 and the size is in a stack slot, mem_regno would
> be 5, making size_regno 6. This would incorrectly backtrack BPF_REG_6
> instead of the stack slot containing the size argument.

This won't happen. There will be some check in the above if statement.

>
> Could this break verifier state pruning when the commit message's stated
> goal of handling "stack arguments as they may be beyond registers 1-5" is
> implemented?

This will be addressed when stack arguments are supported and we can mark size_argno
precision is true since the size itself will be a constant.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24592562564