Re: [PATCH bpf-next v4 08/12] bpf: Unify release handling for helpers and kfuncs

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2026-05-12 at 23:22 +0200, Amery Hung wrote:

[...]

> > > @@ -9870,37 +9928,11 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > >       }
> > > 
> > >       if (meta.release_regno) {
> > > -             err = -EINVAL;
> > > -             if (arg_type_is_dynptr(fn->arg_type[meta.release_regno - BPF_REG_1])) {
> > > -                     err = unmark_stack_slots_dynptr(env, &regs[meta.release_regno]);
> > > -             } else if (func_id == BPF_FUNC_kptr_xchg && meta.ref_obj.ref_obj_id) {
> > > -                     u32 ref_obj_id = meta.ref_obj.ref_obj_id;
> > > -                     bool in_rcu = in_rcu_cs(env);
> > > -                     struct bpf_func_state *state;
> > > -                     struct bpf_reg_state *reg;
> > > -
> > > -                     err = release_reference_nomark(env->cur_state, ref_obj_id);
> > > -                     if (!err) {
> > > -                             bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({
> > > -                                     if (reg->ref_obj_id == ref_obj_id) {
> > > -                                             if (in_rcu && (reg->type & MEM_ALLOC) && (reg->type & MEM_PERCPU)) {
> > > -                                                     reg->ref_obj_id = 0;
> > > -                                                     reg->type &= ~MEM_ALLOC;
> > > -                                                     reg->type |= MEM_RCU;
> > > -                                             } else {
> > > -                                                     mark_reg_invalid(env, reg);
> > 
> > Note: release_reg() does not have this 'else' path, but it seem to be not a problem,
> >       assuming that MEM_ALLOC | MEM_PERCPU registers are generated only from some
> >       other cmp_xchg call. Is that the case?
> 
> AFAIK, percpu allocated objects (i.e., MEM_ALLOC | MEM_PERCPU
> registers) only come from bpf_kptr_xchg() and bpf_percpu_obj_new(). We
> don't have a mechanism to derive registers from percpu allocated
> objects such that we need to mark_reg_invalid when calling
> bpf_kptr_xchg().
> 
> If there is such case in the future, maybe we can do the following in
> release_reg() then
> 
>         if (convert_rcu)
>                 err = ref_convert_alloc_rcu_protected(env, reg->ref_obj_id);
> 
>         if (release_dynptr)
>                 err = unmark_stack_slots_dynptr(env, reg);
>         else if (reg->ref_obj_id)
>                 err = release_reference(env, reg->ref_obj_id);
>         else if (bpf_register_is_null(reg))
>                 err = 0;

Thank you for explaining, in such case I think the code is good as it is.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]