Re: [PATCH bpf-next 2/2] bpf: Report which member makes a kfunc return type unsupported

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9aa29c367008..c6aecba6437a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -11623,10 +11623,14 @@ static bool is_kfunc_arg_implicit(const struct bpf_call_arg_meta *meta, u32 arg_
>  	return argn <= arg_idx;
>  }
>
> -/* Returns true if struct is composed of scalars, 4 levels of nesting allowed */
> -bool btf_type_is_scalar_struct(struct bpf_verifier_env *env,
> -			       const struct btf *btf,
> -			       const struct btf_type *t, int rec)
> +/*
> + * Returns true if struct is composed of scalars, 4 levels of nesting allowed.
> + * On failure @bad, when given, names the member that made the answer no, so a
> + * diagnostic can point at it rather than at the whole type.
> + */
> +static bool btf_scalar_struct_walk(struct bpf_verifier_env *env, const struct btf *btf,
> +				   const struct btf_type *t, int rec,
> +				   const struct btf_member **bad)
>  {
>  	const struct btf_type *member_type;
>  	const struct btf_member *member;
> @@ -11644,23 +11648,35 @@ bool btf_type_is_scalar_struct(struct bpf_verifier_env *env,
>  				verbose(env, "max struct nesting depth exceeded\n");
>  				return false;
>  			}
> -			if (!btf_type_is_scalar_struct(env, btf, member_type, rec + 1))
> +			if (!btf_scalar_struct_walk(env, btf, member_type, rec + 1, bad))
                                                                              ^^^
>  				return false;
>  			continue;
>  		}

Does btf_scalar_struct_walk() correctly handle nested struct members? When
it recurses through a nested struct, it passes @bad unchanged:

    if (btf_type_is_struct(member_type)) {
        if (!btf_scalar_struct_walk(env, btf, member_type, rec + 1, bad))
            return false;
        continue;
    }

This means *bad ends up naming a member of an inner struct with no record
of the enclosing member.

For example, if a kfunc returns:

    struct outer {
        struct inner {
            void *p;
        } in;
        __u64 tag;
    };

the log would read:

    kernel function foo returns STRUCT outer that is not composed of scalars
    member 'p' has type PTR

but 'p' is not a member of outer — the enclosing member 'in' is never
named. A reader grepping struct outer for 'p' finds nothing.

Since this code walks nested structs up to 4 levels, should @bad capture
the path to the offending member (e.g., "member 'in.p' has type PTR") or
at least name the outermost offending member?

[ ... ]

> @@ -14030,17 +14046,41 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  		    meta.func_id == special_kfunc_list[KF_bpf_res_spin_lock_irqsave]))
>  			__mark_reg_const_zero(env, &regs[BPF_REG_0]);
>  	} else if (btf_type_is_struct(t)) {
> +		const struct btf_member *bad = NULL;
> +
>  		/*
>  		 * The returned struct comes back as raw register bits modeled
>  		 * as an unknown scalar, so it must contain only scalars:
>  		 * otherwise a pointer field would be laundered into a scalar
>  		 * and escape provenance and reference tracking.
>  		 */
> -		if (!btf_type_is_scalar_struct(env, desc_btf, t, 0)) {
> +		if (!btf_scalar_struct_walk(env, desc_btf, t, 0, &bad)) {
> +			const char *member_note = "";
> +
>  			verbose(env,
>  				"kernel function %s returns %s %s that is not composed of scalars\n",
>  				func_name, btf_type_str(t),
>  				btf_name_by_offset(desc_btf, t->name_off));
> +			if (bad) {
> +				const char *bad_name = btf_name_by_offset(desc_btf, bad->name_off);
> +				const struct btf_type *bad_type;
> +
> +				bad_type = btf_type_skip_modifiers(desc_btf, bad->type, NULL);
> +				verbose(env, "member '%s' has type %s\n", bad_name,
> +					btf_type_str(bad_type));
> +				member_note = bpf_diag_fmt(
> +					env, " Its member '%s' is %s, not a scalar.", bad_name,
> +					btf_type_str(bad_type));
> +			}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32742785016