Re: [PATCH bpf-next v1 06/14] bpf: Correct kfunc argument diagnostics

On Sun, 2026-08-16 at 02:45 +0000, [email protected] wrote:
> > diff --git kernel/bpf/verifier.c kernel/bpf/verifier.c
> > index 7ef324e384f4..da2ec0655b17 100644
> > --- kernel/bpf/verifier.c
> > +++ kernel/bpf/verifier.c
> 
> [ ... ]
> 
> > @@ -12653,12 +12653,12 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
> >  		    !type_may_be_null(kf_arg_type)) {
> >  			const char *expected_type;
> > 
> > -			expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
> > +			expected_type = bpf_diag_fmt_btf_type(env, btf, args[i].type);
> >  			verbose(env, "Possibly NULL pointer passed to trusted %s\n",
> >  				reg_arg_name(env, argno));
> >  			bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
> >  					      "Add a NULL check and call the kfunc only on the non-NULL path.",
> > -					      "the pointer may be NULL, but this kfunc requires a non-NULL pointer to %s",
> > +					      "the pointer may be NULL, but this kfunc requires a non-NULL value of type %s",
> >  					      expected_type);
> >  			return -EACCES;
> >  		}
> 
> Switching from ref_id to args[i].type renders function pointer
> parameters incorrectly. For kfuncs like bpf_task_work_schedule_signal()
> that take a bpf_task_work_callback_t (which is itself a typedef to a
> function pointer), btf_show_name() walks TYPEDEF -> PTR -> FUNC_PROTO,
> collects the typedef name and adds one level of pointer indirection,
> producing "bpf_task_work_callback_t *" instead of the correct parameter
> type "bpf_task_work_callback_t".
> 
> For kfuncs like bpf_wq_set_callback() that take an unnamed function
> pointer directly (PTR -> FUNC_PROTO), the FUNC_PROTO has no name, so
> btf_show_name() produces the malformed "( *)".

Let's keep this as a follow-up; current patch is fine.