Skip to content

Missing spillable types#12729

Open
eddyz87 wants to merge 3 commits into
kernel-patches:bpf-next_basefrom
eddyz87:missing-spillable-types
Open

Missing spillable types#12729
eddyz87 wants to merge 3 commits into
kernel-patches:bpf-next_basefrom
eddyz87:missing-spillable-types

Conversation

@eddyz87

@eddyz87 eddyz87 commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

eddyz87 added 2 commits July 7, 2026 17:14
…ling

Track spills for the following register types precisely:
- PTR_TO_TP_BUFFER
- PTR_TO_INSN
- CONST_PTR_TO_DYNPTR

--- b4-submit-tracking ---
{
  "series": {
    "revision": 1,
    "change-id": "20260707-missing-spillable-types-4cd9350dc3d7",
    "prefixes": ["bpf-next"]
  }
}
…ling

The verifier loses precision when simulating stack spills for the
following register types:
- PTR_TO_TP_BUFFER
- PTR_TO_INSN
- CONST_PTR_TO_DYNPTR

These types are not allow-listed in the is_spillable_regtype(),
because of that check_stack_write_fixed_off() takes the branch
that marks the slots STACK_MISC.

There are no technical reasons for this limititation.
This commit replaces an explicit list of pointer types in
is_spillable_regtype() with explicit list of non-pointer types.
The function is renamed to is_pointer_regtype() for clarity.

Reported-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Suggested-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
@eddyz87 eddyz87 force-pushed the missing-spillable-types branch from c167a5e to cf89f5e Compare July 8, 2026 00:15
A few selftests checking that the verifier represents spills for the
following pointer types w/o losing precision:
- PTR_TO_INSN
- PTR_TO_TP_BUFFER
- CONST_PTR_TO_DYNPTR

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
@eddyz87 eddyz87 force-pushed the missing-spillable-types branch from cf89f5e to abd86d0 Compare July 8, 2026 00:16
@kernel-patches-daemon-bpf kernel-patches-daemon-bpf Bot force-pushed the bpf-next_base branch 17 times, most recently from 386cc3c to ded8f8a Compare July 11, 2026 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant