On Tue, Feb 3, 2026 at 11:04 AM <[email protected]> wrote: > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > index 2dd860ae12..bb45fa5612 100644 > > --- a/kernel/bpf/verifier.c > > +++ b/kernel/bpf/verifier.c > > @@ -9300,7 +9300,8 @@ static const struct bpf_reg_types timer_types = { > > .types = { PTR_TO_MAP_VALUE } > > static const struct bpf_reg_types kptr_xchg_dest_types = { > > .types = { > > PTR_TO_MAP_VALUE, > > - PTR_TO_BTF_ID | MEM_ALLOC > > + PTR_TO_BTF_ID | MEM_ALLOC, > > + PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF > > } > > }; > > Is the MEM_RCU variant also needed here? > > When ref_set_non_owning() marks a register as NON_OWN_REF, it also adds > MEM_RCU if the node has a bpf_refcount field (refcount_off >= 0): > > reg->type |= NON_OWN_REF; > if (rec->refcount_off >= 0) > reg->type |= MEM_RCU; > > This means rbtree nodes with both a __kptr field and a bpf_refcount field > would have type PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | MEM_RCU, which > won't match any entry in kptr_xchg_dest_types. > > Should this also add: > > PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | MEM_RCU > > to handle that case? > > > @@ -9460,6 +9461,7 @@ static int check_reg_type(struct bpf_verifier_env > > *env, u32 regno, > > } > > case PTR_TO_BTF_ID | MEM_ALLOC: > > case PTR_TO_BTF_ID | MEM_PERCPU | MEM_ALLOC: > > + case PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF: > > if (meta->func_id != BPF_FUNC_spin_lock && meta->func_id != > > BPF_FUNC_spin_unlock && > > meta->func_id != BPF_FUNC_kptr_xchg) { > > Similarly, does this switch need a case for the MEM_RCU variant? > > > --- > AI reviewed your patch. Please fix the bug or email reply why it's not a bug. > See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md > > CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21614799102 > > AI-authorship-score: low > AI-authorship-explanation: The commit addresses a specific practical problem > with minimal targeted changes, showing domain expertise typical of human > kernel developers rather than AI-generated comprehensive solutions. > issues-found: 1 > issue-severity-score: low > issue-severity-explanation: Missing MEM_RCU variant may prevent bpf_kptr_xchg > on refcounted rbtree nodes, but this affects only a subset of use cases and > causes verifier rejection rather than runtime issues.
I will try to add this case. thanks -- Yours, Chengkaitao
