From: Ihor Solodrai <ihor.solodrai@linux.dev>
To: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Amery Hung <ameryhung@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Nicholas Carlini <npc@anthropic.com>,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@meta.com
Subject: [PATCH bpf-next v2 02/11] bpf: Pass the owning verifier state to callback setters
Date: Fri, 9 Oct 2026 13:27:49 -0700 [thread overview]
Message-ID: <20261009202759.50520-3-ihor.solodrai@linux.dev> (raw)
In-Reply-To: <20261009202759.50520-1-ihor.solodrai@linux.dev>
Callback setters receive the caller and callee frames, but not the
verifier state that owns the callee. Synchronous callbacks use a queued
state and asynchronous callbacks use a separate state, neither of which
is env->cur_state.
Callback-local bookkeeping needs to be recorded in that owning state.
Pass it through the callback setters and the map callback setup hook.
No functional change.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
include/linux/bpf.h | 3 +++
kernel/bpf/verifier.c | 16 +++++++++++++---
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 54144372281c..d5de9d49a168 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -39,6 +39,7 @@
#include <asm/rqspinlock.h>
struct bpf_verifier_env;
+struct bpf_verifier_state;
struct bpf_verifier_log;
struct perf_event;
struct bpf_prog;
@@ -178,6 +179,7 @@ struct bpf_map_ops {
int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee);
long (*map_for_each_callback)(struct bpf_map *map,
@@ -3183,6 +3185,7 @@ int bpf_iter_map_fill_link_info(const struct bpf_iter_aux_info *aux,
struct bpf_link_info *info);
int map_set_for_each_callback_args(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a0310e093880..8d6812fee0c9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10817,6 +10817,7 @@ static void invalidate_outgoing_stack_args(struct bpf_verifier_env *env,
}
typedef int (*set_callee_state_fn)(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx);
@@ -11000,7 +11001,7 @@ static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
callee->async_entry_cnt = state->frame[0]->async_entry_cnt + 1;
/* Convert bpf_timer_set_callback() args into timer callback args */
- err = set_callee_state_cb(env, caller, callee, insn_idx);
+ err = set_callee_state_cb(env, async_cb, caller, callee, insn_idx);
if (err)
return err;
@@ -11027,7 +11028,7 @@ static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
if (IS_ERR(callee))
return PTR_ERR(callee);
- err = set_callee_state_cb(env, caller, callee, insn_idx);
+ err = set_callee_state_cb(env, callback_state, caller, callee, insn_idx);
if (err)
return err;
@@ -11257,6 +11258,7 @@ static int check_func_callx(struct bpf_verifier_env *env, struct bpf_insn *insn,
}
int map_set_for_each_callback_args(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee)
{
@@ -11287,6 +11289,7 @@ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
}
static int set_map_elem_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11303,7 +11306,7 @@ static int set_map_elem_callback_state(struct bpf_verifier_env *env,
return -ENOTSUPP;
}
- err = map->ops->map_set_for_each_callback_args(env, caller, callee);
+ err = map->ops->map_set_for_each_callback_args(env, state, caller, callee);
if (err)
return err;
@@ -11313,6 +11316,7 @@ static int set_map_elem_callback_state(struct bpf_verifier_env *env,
}
static int set_loop_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11335,6 +11339,7 @@ static int set_loop_callback_state(struct bpf_verifier_env *env,
}
static int set_timer_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11370,6 +11375,7 @@ static int set_timer_callback_state(struct bpf_verifier_env *env,
}
static int set_find_vma_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11398,6 +11404,7 @@ static int set_find_vma_callback_state(struct bpf_verifier_env *env,
}
static int set_user_ringbuf_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11421,6 +11428,7 @@ static int set_user_ringbuf_callback_state(struct bpf_verifier_env *env,
}
static int set_rbtree_add_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11454,6 +11462,7 @@ static int set_rbtree_add_callback_state(struct bpf_verifier_env *env,
}
static int set_task_work_schedule_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
@@ -11489,6 +11498,7 @@ static int set_task_work_schedule_callback_state(struct bpf_verifier_env *env,
}
static int set_rcu_callback_state(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *state,
struct bpf_func_state *caller,
struct bpf_func_state *callee,
int insn_idx)
--
2.56.0
next prev parent reply other threads:[~2026-10-09 20:28 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-09 20:27 [PATCH bpf-next v2 00/11] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 01/11] bpf: Set up callee state outside of setup_func_entry() Ihor Solodrai
2026-10-09 20:27 ` Ihor Solodrai [this message]
2026-10-09 20:27 ` [PATCH bpf-next v2 03/11] bpf: Append complete reference states Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 04/11] bpf: Separate reference removal from descendant invalidation Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 05/11] bpf: Share map-backed callback register setup Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 06/11] bpf: Rely on callback frame initialization defaults Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 07/11] bpf: Introduce REF_TYPE_FRAME in the verifier Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 08/11] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 09/11] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 10/11] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-10-09 20:27 ` [PATCH bpf-next v2 11/11] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261009202759.50520-3-ihor.solodrai@linux.dev \
--to=ihor.solodrai@linux.dev \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=npc@anthropic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®