Re: [PATCH bpf-next v5 10/14] bpf: Fix dynptr ref counting to scan all call frames

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2026-05-19 at 11:13 -0700, Amery Hung wrote:
> When checking whether a referenced dynptr can be overwritten,
> destroy_if_dynptr_stack_slot only counted sibling dynptrs in the
> current call frame. If a clone sharing the same virtual ref parent
> existed in a different frame (e.g., passed to a subprog), it would
> not be counted, causing the verifier to incorrectly reject the
> overwrite with "cannot overwrite referenced dynptr".
> 
> Fix by extracting the counting into dynptr_ref_cnt() which uses
> bpf_for_each_reg_in_vstate_mask() to scan dynptr stack slots across
> all call frames.
> 
> Fixes: 017f5c4ef73c ("bpf: Allow overwriting referenced dynptr when refcnt > 1")
> Reported-by: Eduard Zingerman <eddyz87@gmail.com>
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

> diff --git a/tools/testing/selftests/bpf/progs/wakeup_source_fail.c b/tools/testing/selftests/bpf/progs/wakeup_source_fail.c
> index b8bbb61d4d4e..d4d0f1610853 100644
> --- a/tools/testing/selftests/bpf/progs/wakeup_source_fail.c
> +++ b/tools/testing/selftests/bpf/progs/wakeup_source_fail.c
> @@ -42,7 +42,7 @@ int wakeup_source_access_lock_fields(void *ctx)
>  }
>  
>  SEC("syscall")
> -__failure __msg("type=scalar expected=fp")
> +__failure __msg("release kfunc bpf_wakeup_sources_read_unlock expects referenced PTR_TO_BTF_ID passed to R1")

Nit: this change seem unrelated.

>  int wakeup_source_unlock_no_lock(void *ctx)
>  {
>  	struct bpf_ws_lock *lock = (void *)0x1;