Re: [PATCH bpf v2 2/2] bpf: Reject untrusted pointers in refcount_acquire

> It will work, you can test it yourself. Reads on PTR_UNTRUSTED is fine, it gets
> handled by the BPF_PROBE_MEM loads, which handle use-after-free safely.

But if we apply the one-line change to type_is_ptr_alloc_obj(), the
read-only test I added will be rejected. SInce the read will hit that
code block and trigger the allocated object must have a referenced
id".
if (type_is_alloc(reg->type) &&
    !type_is_non_owning_ref(reg->type) &&
    !(reg->type & MEM_RCU) &&
    !reg_is_referenced(env, reg)) {
verifier_bug(env, "allocated object must have a referenced id");
return -EFAULT;
}

There are 2 possible solutions:
1. Split the type_is_ptr_alloc_obj into 2 helpers, one is only
checking whether the pointer has PTR_TO_BTF_ID | MEM_ALLOC, the other
one checks if it is also trusted:
static inline bool type_is_any_ptr_alloc_obj(u32 type)
{
return base_type(type) == PTR_TO_BTF_ID &&
       type_flag(type) & MEM_ALLOC;
}
static inline bool type_is_ptr_alloc_obj(u32 type)
{
return type_is_any_ptr_alloc_obj(type) &&
       !(type_flag(type) & PTR_UNTRUSTED);
}
reg_btf_record() will use type_is_any_ptr_alloc_obj since it only
looks up metadata, while bpf_refcount_acquire should use
type_is_ptr_alloc_obj.

3. Keep the untrusted pointer check on top like the current patch.