In the verifier there is no such semantics where registers with PTR_TO_MAP_VALUE type have an id assigned to them. This is only used in PTR_TO_MAP_VALUE_OR_NULL and later on nullified once the test against NULL has been pattern matched and type transformed into PTR_TO_MAP_VALUE.
Unified · Split
| @@ -2852,10 +2852,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn · 2851 unmodified lines | ||
| 2852 | 2852 | regs[BPF_REG_0].type = NOT_INIT; |
| 2853 | 2853 | } else if (fn->ret_type == RET_PTR_TO_MAP_VALUE_OR_NULL || |
| 2854 | 2854 | fn->ret_type == RET_PTR_TO_MAP_VALUE) { |
| 2855 | − if (fn->ret_type == RET_PTR_TO_MAP_VALUE) | |
| 2856 | − regs[BPF_REG_0].type = PTR_TO_MAP_VALUE; | |
| 2857 | − else | |
| 2858 | − regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; | |
| 2859 | 2855 | /* There is no offset yet applied, variable or fixed */ |
| 2860 | 2856 | mark_reg_known_zero(env, regs, BPF_REG_0); |
| 2861 | 2857 | /* remember map_ptr, so that check_map_access() |
| @@ -2868,7 +2864,12 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn · 6 unmodified lines | ||
| 2868 | 2864 | return -EINVAL; |
| 2869 | 2865 | } |
| 2870 | 2866 | regs[BPF_REG_0].map_ptr = meta.map_ptr; |
| 2871 | − regs[BPF_REG_0].id = ++env->id_gen; | |
| 2867 | + if (fn->ret_type == RET_PTR_TO_MAP_VALUE) { | |
| 2868 | + regs[BPF_REG_0].type = PTR_TO_MAP_VALUE; | |
| 2869 | + } else { | |
| 2870 | + regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; | |
| 2871 | + regs[BPF_REG_0].id = ++env->id_gen; | |
| 2872 | + } | |
| 2872 | 2873 | } else if (fn->ret_type == RET_PTR_TO_SOCKET_OR_NULL) { |
| 2873 | 2874 | int id = acquire_reference_state(env, insn_idx); |
| 2874 | 2875 | if (id < 0) |