From: Eduard Zingerman <eddyz87@gmail.com>
To: Amery Hung <ameryhung@gmail.com>, bpf@vger.kernel.org
Cc: netdev@vger.kernel.org, alexei.starovoitov@gmail.com,
andrii@kernel.org, daniel@iogearbox.net, memxor@gmail.com,
martin.lau@kernel.org, mykyta.yatsenko5@gmail.com,
kernel-team@meta.com
Subject: Re: [PATCH bpf-next v4 07/12] bpf: Unify referenced object tracking in verifier
Date: Tue, 12 May 2026 12:03:29 -0700 [thread overview]
Message-ID: <23140ed4c48babfa8af91f3b67f379773bdc04c1.camel@gmail.com> (raw)
In-Reply-To: <20260506142709.2298255-8-ameryhung@gmail.com>
On Wed, 2026-05-06 at 07:27 -0700, Amery Hung wrote:
LGTM, a nit below.
[...]
> @@ -8028,14 +8024,13 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> }
>
> if (reg->ref_obj_id && base_type(arg_type) != ARG_KPTR_XCHG_DEST) {
> - if (meta->ref_obj_id) {
> - verbose(env, "more than one arg with ref_obj_id R%d %u %u",
> - regno, reg->ref_obj_id,
> - meta->ref_obj_id);
> + if (meta->release_regno && meta->ref_obj.cnt) {
> + verbose(env, "more than one arg with ref_obj_id %s %u %u",
> + reg_arg_name(env, argno), reg->ref_obj_id,
> + meta->ref_obj.ref_obj_id);
I think this should be reported from update_ref_obj() itself,
it is more consistent logically and also avoids reporting code
duplication in check_kfunc_args() and check_kfunc_call().
Also, technically the reg_arg_name() is an independent fix.
> Drop the selftest introduced in 7ec899ac90a2 (“selftests/bpf: Negative
> test case for ref_obj_id in args”) since the verifier no longer
> complains about ambiguous ref_obj if it is not used.
On the other hand, if you think that this property is worth having,
then maybe wrap the check with in some utility function?
> return -EACCES;
> }
> - meta->ref_obj_id = reg->ref_obj_id;
> - meta->id = reg->id;
> + update_ref_obj(&meta->ref_obj, reg);
> }
>
> switch (base_type(arg_type)) {
[...]
next prev parent reply other threads:[~2026-05-12 19:04 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-06 14:26 [PATCH bpf-next v4 00/12] Refactor verifier object relationship tracking Amery Hung
2026-05-06 14:26 ` [PATCH bpf-next v4 01/12] bpf: Simplify mark_stack_slot_obj_read() and callers Amery Hung
2026-05-11 17:17 ` Eduard Zingerman
2026-05-06 14:26 ` [PATCH bpf-next v4 02/12] bpf: Unify dynptr handling in the verifier Amery Hung
2026-05-06 15:27 ` bot+bpf-ci
2026-05-07 12:22 ` Amery Hung
2026-05-06 14:26 ` [PATCH bpf-next v4 03/12] bpf: Assign reg->id when getting referenced kptr from ctx Amery Hung
2026-05-06 15:27 ` bot+bpf-ci
2026-05-07 12:38 ` Amery Hung
2026-05-11 21:31 ` Eduard Zingerman
2026-05-06 14:27 ` [PATCH bpf-next v4 04/12] bpf: Preserve reg->id of pointer objects after null-check Amery Hung
2026-05-11 21:48 ` Eduard Zingerman
2026-05-06 14:27 ` [PATCH bpf-next v4 05/12] bpf: Refactor object relationship tracking and fix dynptr UAF bug Amery Hung
2026-05-06 15:27 ` bot+bpf-ci
2026-05-07 12:20 ` Amery Hung
2026-05-12 2:28 ` Eduard Zingerman
2026-05-06 14:27 ` [PATCH bpf-next v4 06/12] bpf: Remove redundant dynptr arg check for helper Amery Hung
2026-05-12 18:32 ` Eduard Zingerman
2026-05-06 14:27 ` [PATCH bpf-next v4 07/12] bpf: Unify referenced object tracking in verifier Amery Hung
2026-05-12 19:03 ` Eduard Zingerman [this message]
2026-05-06 14:27 ` [PATCH bpf-next v4 08/12] bpf: Unify release handling for helpers and kfuncs Amery Hung
2026-05-06 14:27 ` [PATCH bpf-next v4 09/12] selftests/bpf: Test creating dynptr from dynptr data and slice Amery Hung
2026-05-06 14:27 ` [PATCH bpf-next v4 10/12] selftests/bpf: Test using dynptr after freeing the underlying object Amery Hung
2026-05-06 14:27 ` [PATCH bpf-next v4 11/12] selftests/bpf: Test using slice after invalidating dynptr clone Amery Hung
2026-05-06 14:27 ` [PATCH bpf-next v4 12/12] selftests/bpf: Test using file dynptr after the reference on file is dropped Amery Hung
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=23140ed4c48babfa8af91f3b67f379773bdc04c1.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kernel-team@meta.com \
--cc=martin.lau@kernel.org \
--cc=memxor@gmail.com \
--cc=mykyta.yatsenko5@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox