Re: [PATCH bpf-next 04/18] bpf: Extend liveness analysis to track stack argument slots

[Yonghong Song <yonghong.song@linux.dev>]

On 4/29/26 1:22 PM, Eduard Zingerman wrote:
> On Fri, 2026-04-24 at 10:14 -0700, Yonghong Song wrote:
>
> [...]
>
>> diff --git a/kernel/bpf/const_fold.c b/kernel/bpf/const_fold.c
>> index db73c4740b1e..b65285d61efe 100644
>> --- a/kernel/bpf/const_fold.c
>> +++ b/kernel/bpf/const_fold.c
>> @@ -51,13 +51,22 @@ static void const_reg_xfer(struct bpf_verifier_env *env, struct const_arg_info *
>>   			   struct bpf_insn *insn, struct bpf_insn *insns, int idx)
>>   {
>>   	struct const_arg_info unknown = { .state = CONST_ARG_UNKNOWN, .val = 0 };
>> -	struct const_arg_info *dst = &ci_out[insn->dst_reg];
>> -	struct const_arg_info *src = &ci_out[insn->src_reg];
>> +	struct const_arg_info *dst, *src;
> Nit: there is no harm in computing addresses before validating the range.
>
>>   	u8 class = BPF_CLASS(insn->code);
>>   	u8 mode = BPF_MODE(insn->code);
>>   	u8 opcode = BPF_OP(insn->code) | BPF_SRC(insn->code);
>>   	int r;
>>   
>> +	/* Stack arguments use BPF_REG_PARAMS which is outside the tracked register set. */
>> +	if (insn->dst_reg == BPF_REG_PARAMS)
> Nit: I'd add several accessors:
>       - is_stack_arg_st(insn)
>       - is_stack_arg_stx(insn)
>       - is_stack_arg_ldx(insn)
>
>> +		return;
>> +	if (insn->src_reg == BPF_REG_PARAMS) {
>> +		ci_out[insn->dst_reg] = unknown;
>> +		return;
>> +	}
>> +
>> +	dst = &ci_out[insn->dst_reg];
>> +	src = &ci_out[insn->src_reg];
>>   	switch (class) {
>>   	case BPF_ALU:
>>   	case BPF_ALU64:
> [...]
>
>> diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
>> @@ -1560,6 +1603,9 @@ static int compute_subprog_args(struct bpf_verifier_env *env,
>>   	struct arg_track at_out[MAX_BPF_REG];
>>   	struct arg_track (*at_stack_in)[MAX_ARG_SPILL_SLOTS] = NULL;
>>   	struct arg_track *at_stack_out = NULL;
>> +	struct arg_track (*at_stack_arg_in)[MAX_STACK_ARG_SLOTS] = NULL;
>> +	struct arg_track at_stack_arg_out[MAX_STACK_ARG_SLOTS];
>> +	struct arg_track at_stack_arg_entry[MAX_STACK_ARG_SLOTS];
> I think this implementation is correct.  That being said, an
> alternative option would be to track at_stack_arg_{in,out} as a part
> of at_{in,out}, just at indexes >=11. This should avoid duplicating
> the code processing joins in compute_subprog_args(), record_call_access(),
> and memory handling a bit. Wdyt?

Good point. Let me give a try.

>
> [...]