Refactor verifier object relationship tracking

[kernel-patches-daemon-bpf]

Pull request for series with
subject: Refactor verifier object relationship tracking
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054

[kernel-patches-daemon-bpf]

Upstream branch: c8f0ee9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-review-bot]

commit fca4fba40f8c03391f715975d13ebeddd6610f41
Author: Amery Hung <ameryhung@gmail.com>

bpf: Preserve reg->id of pointer objects after null-check

This patch modifies mark_ptr_or_null_reg() to preserve reg->id for all
pointer objects after null-checking, not just spin_lock pointers. This
supports object relationship tracking introduced in a later patch.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 93003a2a96b0..0313b7d5f6c9 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -15886,15 +15886,10 @@ static void mark_ptr_or_null_reg(struct bpf_func_state *state,
>
>  		mark_ptr_not_null_reg(reg);
>
> -		if (!reg_may_point_to_spin_lock(reg)) {
> -			/* For not-NULL ptr, reg->ref_obj_id will be reset
> -			 * in release_reference().
> -			 *
> -			 * reg->id is still used by spin_lock ptr. Other
> -			 * than spin_lock ptr type, reg->id can be reset.
> -			 */
> -			reg->id = 0;
> -		}
> +		/*
> +		 * reg->id is preserved for object relationship tracking
> +		 * and spin_lock lock state tracking
> +		 */

How does preserving reg->id interact with reg_is_init_pkt_pointer()?

In v2 review, Alexei Starovoitov raised this concern: "That pointer has
to have id == 0". Eduard Zingerman responded that dropping the id == 0
check should be fine, but this change was not made in v3.

The function reg_is_init_pkt_pointer() still checks reg->id == 0:

    return reg->type == which &&
           reg->id == 0 &&
           reg->off == 0 &&

With this patch, if a PTR_TO_PACKET register goes through null-checking
in mark_ptr_or_null_reg(), it will now preserve its reg->id instead of
resetting it to 0. Would this cause reg_is_init_pkt_pointer() to
incorrectly return false for init packet pointers?

Reference: https://lore.kernel.org/bpf/CAADnVQLCKi_QL1FeybW+6MH6FAOAoRJyW06UvtX3my3yNSH5eQ@mail.gmail.com/

>  	}
>  }

---

AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: bpf: Preserve reg->id of pointer objects after null-check
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24749741787

[kernel-patches-review-bot]

commit 3a7b7021717b1d5c1192fde7a3dd630dfbcea625
Author: Amery Hung <ameryhung@gmail.com>

bpf: Unify dynptr handling in the verifier

This commit simplifies dynptr checking for helper and kfunc by unifying it.
It saves initialized dynptr information in meta->dynptr, eliminating the need
to call dynptr helpers such as dynptr_id(), dynptr_ref_obj_id() and
dynptr_type() in check_func_arg().

> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> index b148f816f25b..dc0cff59246d 100644
> --- a/include/linux/bpf_verifier.h
> +++ b/include/linux/bpf_verifier.h
> @@ -1319,6 +1319,12 @@ struct bpf_map_desc {
>  	int uid;
>  };
>
> +struct bpf_dynptr_desc {
> +	enum bpf_dynptr_type type;
> +	u32 id;
> +	u32 ref_obj_id;
> +};
> +

This isn't a bug, but as noted by Mykyta Yatsenko in v2 review, the new struct
bpf_dynptr_desc could benefit from a comment explaining what the ref_obj_id
field is for.

While you mentioned in your response that comments for id, ref_obj_id, and
parent_id will be added in a later refactor patch (#6) since these fields
apply to all objects tracked by the verifier, the struct currently lacks this
inline documentation. Could this documentation be added now to help readers
understand the field's purpose?

Reference: https://lore.kernel.org/bpf/87ikb2tkta.fsf@gmail.com/

[ ... ]

---

AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: bpf: Unify dynptr handling in the verifier
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24749741787

[kernel-patches-daemon-bpf]

Forwarding comment 4292336140 via email
In-Reply-To: 20260421221016.2967924-4-ameryhung@gmail.com
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/20260421221016.2967924-4-ameryhung@gmail.com/

[kernel-patches-daemon-bpf]

Forwarding comment 4292348511 via email
In-Reply-To: 20260421221016.2967924-2-ameryhung@gmail.com
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/20260421221016.2967924-2-ameryhung@gmail.com/

[kernel-patches-daemon-bpf]

Upstream branch: 9012cf2
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-daemon-bpf]

Upstream branch: e85115f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-daemon-bpf]

Upstream branch: 1980023
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-daemon-bpf]

Upstream branch: 7f843c0
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-daemon-bpf]

Upstream branch: 7f843c0
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

[kernel-patches-daemon-bpf]

Upstream branch: fd30cf8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
version: 3

Pull request is NOT updated. Failed to apply https://patchwork.kernel.org/project/netdevbpf/list/?series=1084054
error message:

Cmd('git') failed due to: exit code(128)
  cmdline: git am --3way
  stdout: 'Applying: bpf: Unify dynptr handling in the verifier
Using index info to reconstruct a base tree...
M	include/linux/bpf_verifier.h
M	kernel/bpf/verifier.c
Falling back to patching base and 3-way merge...
Auto-merging include/linux/bpf_verifier.h
Auto-merging kernel/bpf/verifier.c
CONFLICT (content): Merge conflict in kernel/bpf/verifier.c
Patch failed at 0001 bpf: Unify dynptr handling in the verifier'
  stderr: 'error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"'

conflict:

diff --cc kernel/bpf/verifier.c
index ff6ff1c27517,41e4ea41c72e..000000000000
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@@ -7457,9 -7425,11 +7450,15 @@@ static int process_kptr_func(struct bpf
   * use case. The second level is tracked using the upper bit of bpf_dynptr->size
   * and checked dynamically during runtime.
   */
++<<<<<<< HEAD
 +static int process_dynptr_func(struct bpf_verifier_env *env, struct bpf_reg_state *reg, argno_t argno, int insn_idx,
 +			       enum bpf_arg_type arg_type, int clone_ref_obj_id)
++=======
+ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn_idx,
+ 			       enum bpf_arg_type arg_type, int clone_ref_obj_id,
+ 			       struct bpf_dynptr_desc *dynptr)
++>>>>>>> bpf: Unify dynptr handling in the verifier
  {
 -	struct bpf_reg_state *reg = reg_state(env, regno);
  	int err;
  
  	if (reg->type != PTR_TO_STACK && reg->type != CONST_PTR_TO_DYNPTR) {
@@@ -8293,74 -8271,8 +8306,79 @@@ static int check_func_arg_reg_off(struc
  	}
  }
  
++<<<<<<< HEAD
 +static struct bpf_reg_state *get_dynptr_arg_reg(struct bpf_verifier_env *env,
 +						const struct bpf_func_proto *fn,
 +						struct bpf_reg_state *regs)
 +{
 +	struct bpf_reg_state *state = NULL;
 +	int i;
 +
 +	for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++)
 +		if (arg_type_is_dynptr(fn->arg_type[i])) {
 +			if (state) {
 +				verbose(env, "verifier internal error: multiple dynptr args\n");
 +				return NULL;
 +			}
 +			state = &regs[BPF_REG_1 + i];
 +		}
 +
 +	if (!state)
 +		verbose(env, "verifier internal error: no dynptr arg found\n");
 +
 +	return state;
 +}
 +
 +static int dynptr_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
 +{
 +	struct bpf_func_state *state = bpf_func(env, reg);
 +	int spi;
 +
 +	if (reg->type == CONST_PTR_TO_DYNPTR)
 +		return reg->id;
 +	spi = dynptr_get_spi(env, reg);
 +	if (spi < 0)
 +		return spi;
 +	return state->stack[spi].spilled_ptr.id;
 +}
 +
 +static int dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
 +{
 +	struct bpf_func_state *state = bpf_func(env, reg);
 +	int spi;
 +
 +	if (reg->type == CONST_PTR_TO_DYNPTR)
 +		return reg->ref_obj_id;
 +	spi = dynptr_get_spi(env, reg);
 +	if (spi < 0)
 +		return spi;
 +	return state->stack[spi].spilled_ptr.ref_obj_id;
 +}
 +
 +static enum bpf_dynptr_type dynptr_get_type(struct bpf_verifier_env *env,
 +					    struct bpf_reg_state *reg)
 +{
 +	struct bpf_func_state *state = bpf_func(env, reg);
 +	int spi;
 +
 +	if (reg->type == CONST_PTR_TO_DYNPTR)
 +		return reg->dynptr.type;
 +
 +	spi = bpf_get_spi(reg->var_off.value);
 +	if (spi < 0) {
 +		verbose(env, "verifier internal error: invalid spi when querying dynptr type\n");
 +		return BPF_DYNPTR_TYPE_INVALID;
 +	}
 +
 +	return state->stack[spi].spilled_ptr.dynptr.type;
 +}
 +
 +static int check_arg_const_str(struct bpf_verifier_env *env,
 +			       struct bpf_reg_state *reg, argno_t argno)
++=======
+ static int check_reg_const_str(struct bpf_verifier_env *env,
+ 			       struct bpf_reg_state *reg, u32 regno)
++>>>>>>> bpf: Unify dynptr handling in the verifier
  {
  	struct bpf_map *map = reg->map_ptr;
  	int err;
@@@ -8716,7 -8625,7 +8734,11 @@@ skip_type_check
  					 true, meta);
  		break;
  	case ARG_PTR_TO_DYNPTR:
++<<<<<<< HEAD
 +		err = process_dynptr_func(env, reg, argno_from_reg(regno), insn_idx, arg_type, 0);
++=======
+ 		err = process_dynptr_func(env, regno, insn_idx, arg_type, 0, &meta->dynptr);
++>>>>>>> bpf: Unify dynptr handling in the verifier
  		if (err)
  			return err;
  		break;
@@@ -9379,7 -9284,7 +9401,11 @@@ static int btf_check_func_arg_match(str
  			if (ret)
  				return ret;
  
++<<<<<<< HEAD
 +			ret = process_dynptr_func(env, reg, argno, -1, arg->arg_type, 0);
++=======
+ 			ret = process_dynptr_func(env, regno, -1, arg->arg_type, 0, NULL);
++>>>>>>> bpf: Unify dynptr handling in the verifier
  			if (ret)
  				return ret;
  		} else if (base_type(arg->arg_type) == ARG_PTR_TO_BTF_ID) {
@@@ -12328,23 -12177,10 +12314,15 @@@ static int check_kfunc_args(struct bpf_
  				}
  			}
  
++<<<<<<< HEAD
 +			ret = process_dynptr_func(env, reg, argno, insn_idx,
 +						  dynptr_arg_type, clone_ref_obj_id);
++=======
+ 			ret = process_dynptr_func(env, regno, insn_idx, dynptr_arg_type, clone_ref_obj_id,
+ 						  &meta->dynptr);
++>>>>>>> bpf: Unify dynptr handling in the verifier
  			if (ret < 0)
  				return ret;
- 
- 			if (!(dynptr_arg_type & MEM_UNINIT)) {
- 				int id = dynptr_id(env, reg);
- 
- 				if (id < 0) {
- 					verifier_bug(env, "failed to obtain dynptr id");
- 					return id;
- 				}
- 				meta->initialized_dynptr.id = id;
- 				meta->initialized_dynptr.type = dynptr_get_type(env, reg);
- 				meta->initialized_dynptr.ref_obj_id = dynptr_ref_obj_id(env, reg);
- 			}
- 
  			break;
  		}
  		case KF_ARG_PTR_TO_ITER: