Re: [PATCH bpf-next v3 06/11] bpf: Allow a global function to return arena pointers by value

[Yonghong Song <yonghong.song@linux.dev>]

On 8/26/26 11:33 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Low] The verifier error message for unsupported return types incorrectly claims that arena pointers are supported for the main BPF program, when they are actually rejected.
> --
>
> commit 518fd93d71684c317540966a4f0aa467d524c25b
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> bpf: Allow a global function to return arena pointers by value
>
> This patch allows global functions to return a struct by value that contains
> arena pointers. It updates btf_validate_return_type() to allow arena pointers
> and adjusts the corresponding error message in btf_prepare_func_args().
>
>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> index b1f4ef614d4c4..f6d82a8fd617b 100644
>> --- a/kernel/bpf/btf.c
>> +++ b/kernel/bpf/btf.c
>> @@ -7973,13 +7973,22 @@ static int btf_validate_return_type(struct bpf_verifier_env *env, struct btf *bt
>>   	if (btf_type_is_struct(t) && t->size <= 16) {
>>   		/*
>>   		 * A global function's caller models the return as an opaque
> [ ... ]
>> +		u32 member_kinds = BTF_MEMBER_SCALAR;
>>   
>> -		if (local_func || btf_struct_is_composed_of(env, btf, t, BTF_MEMBER_SCALAR))
>> +		if (subprog)
>> +			member_kinds |= BTF_MEMBER_ARENA_PTR;
>> +
>> +		if (local_func || btf_struct_is_composed_of(env, btf, t, member_kinds))
>>   			return 0;
>>   	}
>>   
>> @@ -8075,7 +8084,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
>>   		if (is_global) {
>>   			bpf_log(log,
>>   				"Global function %s() has unsupported return type. "
>> -				"Only void, scalar, or a scalar-only struct/union up to 16 bytes is supported.\n",
>> +				"Only void, a scalar, an arena pointer, or a struct/union of "
>> +				"scalars and arena pointers up to 16 bytes is supported.\n",
>>   				tname);
>>   		}
>>   		return err;
> [Severity: Low]
> Does this new error message in btf_prepare_func_args() incorrectly claim that
> arena pointers are supported for the main BPF program?
>
> In btf_validate_return_type(), arena pointers are only added to member_kinds
> if subprog is non-zero:
>
>      if (subprog)
>          member_kinds |= BTF_MEMBER_ARENA_PTR;
>
> However, if a user attempts to load a main BPF program (subprog == 0) with a
> global linkage (like BPF_PROG_TYPE_EXT) that returns a struct containing an
> arena pointer, it will be rejected by btf_validate_return_type() but then print
> this error message incorrectly implying that arena pointers are supported.
>
> Should the error message be adjusted, or should the subprog check be changed so
> they match?

Okay, I will have a separate message for main prog (subprog == 0) vs. none main prog.