From: Chengkaitao <chengkaitao@kylinos.cn>

For the following scenario:
struct tree_node {
    struct bpf_rb_node node;
    struct request __kptr *req;
    u64 key;
};
struct bpf_rb_root tree_root __contains(tree_node, node);
struct bpf_spin_lock tree_lock;

If we need to traverse all nodes in the rbtree, retrieve the __kptr
pointer from each node, and read kernel data from the referenced
object, using bpf_kptr_xchg appears unavoidable.

This patch skips the BPF verifier checks for bpf_kptr_xchg when
called while holding a lock.

Signed-off-by: Chengkaitao <chengkaitao@kylinos.cn>
---
 kernel/bpf/verifier.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 3135643d5695..05a6a6606b6c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -20387,7 +20387,8 @@ static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)
 
 			if (env->cur_state->active_locks) {
 				if ((insn->src_reg == BPF_REG_0 &&
-				     insn->imm != BPF_FUNC_spin_unlock) ||
+				     insn->imm != BPF_FUNC_spin_unlock &&
+				     insn->imm != BPF_FUNC_kptr_xchg) ||
 				    (insn->src_reg == BPF_PSEUDO_KFUNC_CALL &&
 				     (insn->off != 0 || !kfunc_spin_allowed(insn->imm)))) {
 					verbose(env,
-- 
2.50.1 (Apple Git-155)

On Mon, Feb 2, 2026 at 1:01 AM Chengkaitao <pilgrimtao@gmail.com> wrote:
>
> From: Chengkaitao <chengkaitao@kylinos.cn>
>
> For the following scenario:
> struct tree_node {
>     struct bpf_rb_node node;
>     struct request __kptr *req;
>     u64 key;
> };
> struct bpf_rb_root tree_root __contains(tree_node, node);
> struct bpf_spin_lock tree_lock;
>
> If we need to traverse all nodes in the rbtree, retrieve the __kptr
> pointer from each node, and read kernel data from the referenced
> object, using bpf_kptr_xchg appears unavoidable.
>
> This patch skips the BPF verifier checks for bpf_kptr_xchg when
> called while holding a lock.
>
> Signed-off-by: Chengkaitao <chengkaitao@kylinos.cn>

You ignored earlier feedback. This is not ok.

pw-bot: cr

On Tue, Feb 3, 2026 at 1:57 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Feb 2, 2026 at 1:01 AM Chengkaitao <pilgrimtao@gmail.com> wrote:
> >
> > From: Chengkaitao <chengkaitao@kylinos.cn>
> >
> > For the following scenario:
> > struct tree_node {
> >     struct bpf_rb_node node;
> >     struct request __kptr *req;
> >     u64 key;
> > };
> > struct bpf_rb_root tree_root __contains(tree_node, node);
> > struct bpf_spin_lock tree_lock;
> >
> > If we need to traverse all nodes in the rbtree, retrieve the __kptr
> > pointer from each node, and read kernel data from the referenced
> > object, using bpf_kptr_xchg appears unavoidable.
> >
> > This patch skips the BPF verifier checks for bpf_kptr_xchg when
> > called while holding a lock.
> >
> > Signed-off-by: Chengkaitao <chengkaitao@kylinos.cn>
>
> You ignored earlier feedback. This is not ok.
>
It's my full name. Every region has its own customs and traditions,
so this isn't an essential change.

-- 
Yours,
Chengkaitao

On Mon, Feb 2, 2026 at 5:14 PM Chengkaitao <pilgrimtao@gmail.com> wrote:
>
> On Tue, Feb 3, 2026 at 1:57 AM Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Mon, Feb 2, 2026 at 1:01 AM Chengkaitao <pilgrimtao@gmail.com> wrote:
> > >
> > > From: Chengkaitao <chengkaitao@kylinos.cn>
> > >
> > > For the following scenario:
> > > struct tree_node {
> > >     struct bpf_rb_node node;
> > >     struct request __kptr *req;
> > >     u64 key;
> > > };
> > > struct bpf_rb_root tree_root __contains(tree_node, node);
> > > struct bpf_spin_lock tree_lock;
> > >
> > > If we need to traverse all nodes in the rbtree, retrieve the __kptr
> > > pointer from each node, and read kernel data from the referenced
> > > object, using bpf_kptr_xchg appears unavoidable.
> > >
> > > This patch skips the BPF verifier checks for bpf_kptr_xchg when
> > > called while holding a lock.
> > >
> > > Signed-off-by: Chengkaitao <chengkaitao@kylinos.cn>
> >
> > You ignored earlier feedback. This is not ok.
> >
> It's my full name. Every region has its own customs and traditions,
> so this isn't an essential change.

We cannot accept your patch then.
SOB has to be "Firstname Lastname"