Re: [PATCH bpf-next v3 04/24] bpf: Set sub->arg_cnt earlier in btf_prepare_func_args()

[Yonghong Song <yonghong.song@linux.dev>]

On 5/11/26 6:29 PM, Yonghong Song wrote:
>
>
> On 5/11/26 8:19 AM, bot+bpf-ci@kernel.org wrote:
>>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>>> index 77af44d8a3ad..a33a5b4122f8 100644
>>> --- a/kernel/bpf/btf.c
>>> +++ b/kernel/bpf/btf.c
>>> @@ -7880,6 +7880,7 @@ int btf_prepare_func_args(struct 
>>> bpf_verifier_env *env, int subprog)
>>>       }
>>>       args = (const struct btf_param *)(t + 1);
>>>       nargs = btf_type_vlen(t);
>>> +    sub->arg_cnt = nargs;
>>>       if (nargs > MAX_BPF_FUNC_REG_ARGS) {
>>>           if (!is_global)
>>>               return -EINVAL;
>>> @@ -8067,7 +8068,6 @@ int btf_prepare_func_args(struct 
>>> bpf_verifier_env *env, int subprog)
>>>           return -EINVAL;
>>>       }
>>>
>>> -    sub->arg_cnt = nargs;
>>>       sub->args_cached = true;
>>>
>>>       return 0;
>>
>> ---
>> AI reviewed your patch. Please fix the bug or email reply why it's 
>> not a bug.
>
> In v3, for the *main* program, we have the following:
>
>                 /* if main BPF program has associated BTF info, 
> validate that
>                  * it's matching expected signature, and otherwise 
> mark BTF
>                  * info for main program as unreliable
>                  */
>                 if (env->prog->aux->func_info_aux) {
>                         ret = btf_prepare_func_args(env, 0);
>                         if (ret || sub->arg_cnt != 1 || 
> sub->args[0].arg_type != ARG_PTR_TO_CTX) {
> env->prog->aux->func_info_aux[0].unreliable = true;
>                                 sub->arg_cnt = 1;
>                                 sub->stack_arg_cnt = 0;
>                         }
>                 }
>
> Since sub->arg_cnt and sub->stack_arg_cnt is set here for the main 
> program,
> patch #4 is not needed any more.

Okay, actually, this patch still needed.

In function btf_check_func_arg_match(), we have

         ret = btf_prepare_func_args(env, subprog);
         if (ret)
                 return ret;

and its caller:

static int btf_check_subprog_call(struct bpf_verifier_env *env, int subprog,
                                   struct bpf_reg_state *regs)
{
         struct bpf_prog *prog = env->prog;
         struct btf *btf = prog->aux->btf;
         u32 btf_id;
         int err;
         
         if (!prog->aux->func_info)
                 return -EINVAL;
         
         btf_id = prog->aux->func_info[subprog].type_id;
         if (!btf_id)
                 return -EFAULT;
         
         if (prog->aux->func_info_aux[subprog].unreliable)
                 return -EINVAL;

         err = btf_check_func_arg_match(env, subprog, btf, regs);
         /* Compiler optimizations can remove arguments from static functions
          * or mismatched type can be passed into a global function.
          * In such cases mark the function as unreliable from BTF point of view.
          */
         if (err)
                 prog->aux->func_info_aux[subprog].unreliable = true;
         return err;
}

static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                               int insn_idx, int subprog,
                               set_callee_state_fn set_callee_state_cb)
{
         struct bpf_verifier_state *state = env->cur_state, *callback_state;
         struct bpf_func_state *caller, *callee;
         int err;

         caller = state->frame[state->curframe];
         err = btf_check_subprog_call(env, subprog, caller->regs);
         if (err == -EFAULT)
                 return err;

         /* set_callee_state is used for direct subprog calls, but we are
          * interested in validating only BPF helpers that can call subprogs as
          * callbacks
          */
         env->subprog_info[subprog].is_cb = true;

	...
}

So in this case, we still need sub->arg_cnt is set earlier so
it can be used to checking incoming argument cnt.


>
>
>> See: 
>> https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>>
>> CI run summary: 
>> https://github.com/kernel-patches/bpf/actions/runs/25652623893
>
>