Re: [PATCH bpf-next v3 03/13] bpf: Verifier support for KF_IMPLICIT_ARGS

[Ihor Solodrai]

On 1/20/26 4:30 PM, Alexei Starovoitov wrote:
> On Tue, Jan 20, 2026 at 2:27 PM Ihor Solodrai <ihor.solodrai@xxxxxxxxx> wrote:
>>
>> Introduction of KF_IMPLICIT_ARGS revealed an issue with zero-extension
>> tracking, because an explicit rX = 0 in place of the verifier-supplied
>> argument is now absent if the arg is implicit (the BPF prog doesn't
>> pass a dummy NULL anymore). To mitigate this, reset the subreg_def of
>> all caller saved registers in check_kfunc_call() [1].
>>
>> [1] https://lore.kernel.org/bpf/b4a760ef828d40dac7ea6074d39452bb0dc82caa.camel@xxxxxxxxx/
> 
> ...
> 
>> -       for (i = 0; i < CALLER_SAVED_REGS; i++)
>> -               mark_reg_not_init(env, regs, caller_saved[i]);
>> +       for (i = 0; i < CALLER_SAVED_REGS; i++) {
>> +               u32 regno = caller_saved[i];
>> +
>> +               mark_reg_not_init(env, regs, regno);
>> +               regs[regno].subreg_def = DEF_NOT_SUBREG;
>> +       }
> 
> I'm reading that no follow up is necessary anymore and
> the new selftests cover this part automatically.

With respect to this series, the hunk above is good enough.

But we haven't tracked down why doing

	.subreg_def = DEF_NOT_SUBREG

inside mark_reg_not_init() breaks zero-extension tracking.

May be a dormant bug somewhere.