Re: [PATCH bpf-next v3 3/9] bpf: Preserve reg->id of pointer objects after null-check

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2026-04-21 at 22:52 +0000, bot+bpf-ci@kernel.org wrote:
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 93003a2a96b0..0313b7d5f6c9 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -15886,15 +15886,10 @@ static void mark_ptr_or_null_reg(struct bpf_func_state *state,
> > 
> >  		mark_ptr_not_null_reg(reg);
> > 
> > -		if (!reg_may_point_to_spin_lock(reg)) {
> > -			/* For not-NULL ptr, reg->ref_obj_id will be reset
> > -			 * in release_reference().
> > -			 *
> > -			 * reg->id is still used by spin_lock ptr. Other
> > -			 * than spin_lock ptr type, reg->id can be reset.
> > -			 */
> > -			reg->id = 0;
> > -		}
> > +		/*
> > +		 * reg->id is preserved for object relationship tracking
> > +		 * and spin_lock lock state tracking
> > +		 */
> 
> How does preserving reg->id interact with reg_is_init_pkt_pointer()?
> 
> In v2 review, Alexei Starovoitov raised this concern: "That pointer has
> to have id == 0". Eduard Zingerman responded that dropping the id == 0
> check should be fine, but this change was not made in v3.
> 
> The function reg_is_init_pkt_pointer() still checks reg->id == 0:
> 
>     return reg->type == which &&
>            reg->id == 0 &&
>            reg->off == 0 &&
> 
> With this patch, if a PTR_TO_PACKET register goes through null-checking
> in mark_ptr_or_null_reg(), it will now preserve its reg->id instead of
> resetting it to 0. Would this cause reg_is_init_pkt_pointer() to
> incorrectly return false for init packet pointers?
> 
> Reference: https://lore.kernel.org/bpf/CAADnVQLCKi_QL1FeybW+6MH6FAOAoRJyW06UvtX3my3yNSH5eQ@mail.gmail.com/
> 
> >  	}
> >  }

Bot concern is bogus here, reg_is_init_pkt_pointer() is called only
for PTR_TO_PACKET. mark_ptr_or_null_reg() checks for
type_may_be_null(reg->type), meaning that for it to trigger one would
need a register of type PTR_TO_PACKET | PTR_MAYBE_NULL.
It appears there is no way to construct such type at the moment.