On Tue, Oct 06, 2026 at 04:06 PM Yiyang Chen <[email protected]> wrote: > Reject the bare pointer while preserving referenced, trusted, and > RCU-protected arguments. The latter is used by sched-ext programs that pass > the result of an RCU-protected kfunc through trusted-and-nullable global > subprogram arguments.
Which programs? veristat-scx failed on v2. The only one I see in scx repo is cake_wake_place() in scx_cake. It takes the result of scx_bpf_cpu_curr() as __arg_trusted __arg_nullable. That arg was added two weeks ago. The last scx release doesn't have it. On kernels without the kfunc cake_wake_place() already reads curr by itself. Pls send a fix to scx instead. rcu_ptr_ is not trusted. The refcount can be zero. The callee sees trusted_ptr_ and can pass it to a kfunc that is not KF_RCU. bpf_cpumask_acquire() does plain refcount_inc(). With rcu_ptr_bpf_cpumask loaded from a map it increments from zero and the prog holds a reference to a cpumask that is freed after GP. Commit e2b3c4ff5d18 says "only PTR_TRUSTED flavor of PTR_TO_BTF_ID is supported". v2 was right to reject it. Add the above to the commit log. > This series targets bpf, which uses separate global-subprogram and kfunc > argument checkers. That's not an answer to Amery: https://lore.kernel.org/bpf/camb2axnny5wxktrd3_thyxbzxyyjjukqrb1unbuquwtj_fl...@mail.gmail.com/ The loop in btf_check_func_arg_match() is gone in bpf-next. See commit 668a51c4ed4b ("bpf: Build argument prototypes for subprog calls"). This patch will conflict when bpf is merged into bpf-next and the fix has to be written again in check_func_arg(). The bug is there since 6.9 and the fix rejects progs that load today. Pls target bpf-next and do what Amery suggested. Also 12 chars of sha in the Fixes tag. pw-bot: cr
