195 static int release_reference(struct bpf_verifier_env *env, int ref_obj_id);
273 	int ref_obj_id;  member
293 	u32 ref_obj_id;  member
327 		u32 ref_obj_id;  member
934 		state->stack[spi].spilled_ptr.ref_obj_id = id;  in mark_stack_slots_dynptr()
935 		state->stack[spi - 1].spilled_ptr.ref_obj_id = id;  in mark_stack_slots_dynptr()
984 	int spi, ref_obj_id, i;  in unmark_stack_slots_dynptr()  local
995 	ref_obj_id = state->stack[spi].spilled_ptr.ref_obj_id;  in unmark_stack_slots_dynptr()
1005 	WARN_ON_ONCE(release_reference(env, ref_obj_id));  in unmark_stack_slots_dynptr()
1009 		if (state->stack[i].spilled_ptr.ref_obj_id != ref_obj_id)  in unmark_stack_slots_dynptr()
1197 		st->ref_obj_id = i == 0 ? id : 0;  in mark_stack_slots_iter()
1227 			WARN_ON_ONCE(release_reference(env, st->ref_obj_id));  in unmark_stack_slots_iter()
1285 		if (i == 0 && !st->ref_obj_id)  in is_iter_reg_valid_init()
1287 		if (i != 0 && st->ref_obj_id)  in is_iter_reg_valid_init()
1386 			if (reg->ref_obj_id)  in print_verifier_state()
1387 				verbose_a("ref_obj_id=%d", reg->ref_obj_id);  in print_verifier_state()
1476 			if (reg->ref_obj_id)  in print_verifier_state()
1477 				verbose(env, "(ref_id=%d)", reg->ref_obj_id);  in print_verifier_state()
1482 			if (!reg->ref_obj_id)  in print_verifier_state()
1489 				reg->ref_obj_id, iter_state_str(reg->iter.state),  in print_verifier_state()
1903 	reg->ref_obj_id = 0;  in __mark_reg_known()
2273 	reg->ref_obj_id = 0;  in __mark_reg_unknown()
5437 	if (reg->ref_obj_id)  in is_trusted_reg()
6210 		    !reg->ref_obj_id) {  in check_ptr_to_btf_access()
7431 	return state->stack[spi].spilled_ptr.ref_obj_id;  in iter_ref_obj_id()
7514 		meta->ref_obj_id = iter_ref_obj_id(env, reg, spi);  in process_iter_arg()
8065 		return reg->ref_obj_id;  in dynptr_ref_obj_id()
8069 	return state->stack[spi].spilled_ptr.ref_obj_id;  in dynptr_ref_obj_id()
8162 				if (spi < 0 || !state->stack[spi].spilled_ptr.ref_obj_id) {  in check_func_arg()
8170 		} else if (!reg->ref_obj_id && !register_is_null(reg)) {  in check_func_arg()
8182 	if (reg->ref_obj_id) {  in check_func_arg()
8183 		if (meta->ref_obj_id) {  in check_func_arg()
8185 				regno, reg->ref_obj_id,  in check_func_arg()
8186 				meta->ref_obj_id);  in check_func_arg()
8189 		meta->ref_obj_id = reg->ref_obj_id;  in check_func_arg()
8803 			     int ref_obj_id)  in release_reference()  argument
8809 	err = release_reference_state(cur_func(env), ref_obj_id);  in release_reference()
8814 		if (reg->ref_obj_id == ref_obj_id)  in release_reference()
9643 		} else if (meta.ref_obj_id) {  in check_helper_call()
9644 			err = release_reference(env, meta.ref_obj_id);  in check_helper_call()
9717 		int id, ref_obj_id;  in check_helper_call()  local
9728 		if (meta.ref_obj_id) {  in check_helper_call()
9739 		ref_obj_id = dynptr_ref_obj_id(env, reg);  in check_helper_call()
9740 		if (ref_obj_id < 0) {  in check_helper_call()
9742 			return ref_obj_id;  in check_helper_call()
9746 		meta.ref_obj_id = ref_obj_id;  in check_helper_call()
9925 		regs[BPF_REG_0].ref_obj_id = meta.ref_obj_id;  in check_helper_call()
9934 		regs[BPF_REG_0].ref_obj_id = id;  in check_helper_call()
10457 	    (is_kfunc_release(meta) && reg->ref_obj_id) ||  in process_kf_arg_ptr_to_btf_id()
10496 static int ref_convert_owning_non_owning(struct bpf_verifier_env *env, u32 ref_obj_id)  in ref_convert_owning_non_owning()  argument
10504 	if (!ref_obj_id) {  in ref_convert_owning_non_owning()
10511 		if (state->refs[i].id != ref_obj_id)  in ref_convert_owning_non_owning()
10518 			if (reg->ref_obj_id == ref_obj_id) {  in ref_convert_owning_non_owning()
10519 				reg->ref_obj_id = 0;  in ref_convert_owning_non_owning()
10926 		if (reg->ref_obj_id) {  in check_kfunc_args()
10927 			if (is_kfunc_release(meta) && meta->ref_obj_id) {  in check_kfunc_args()
10929 					regno, reg->ref_obj_id,  in check_kfunc_args()
10930 					meta->ref_obj_id);  in check_kfunc_args()
10933 			meta->ref_obj_id = reg->ref_obj_id;  in check_kfunc_args()
10984 		if (is_kfunc_release(meta) && reg->ref_obj_id)  in check_kfunc_args()
11009 			if (!reg->ref_obj_id) {  in check_kfunc_args()
11050 				clone_ref_obj_id = meta->initialized_dynptr.ref_obj_id;  in check_kfunc_args()
11070 				meta->initialized_dynptr.ref_obj_id = dynptr_ref_obj_id(env, reg);  in check_kfunc_args()
11086 			if (reg->type == (PTR_TO_BTF_ID | MEM_ALLOC) && !reg->ref_obj_id) {  in check_kfunc_args()
11100 			if (reg->type == (PTR_TO_BTF_ID | MEM_ALLOC) && !reg->ref_obj_id) {  in check_kfunc_args()
11113 			if (!reg->ref_obj_id) {  in check_kfunc_args()
11123 				if (!type_is_non_owning_ref(reg->type) || reg->ref_obj_id) {  in check_kfunc_args()
11136 				if (!reg->ref_obj_id) {  in check_kfunc_args()
11365 		err = release_reference(env, regs[meta.release_regno].ref_obj_id);  in check_kfunc_call()
11376 		release_ref_obj_id = regs[BPF_REG_2].ref_obj_id;  in check_kfunc_call()
11567 			if (meta.ref_obj_id)  in check_kfunc_call()
11568 				regs[BPF_REG_0].ref_obj_id = meta.ref_obj_id;  in check_kfunc_call()
11589 			regs[BPF_REG_0].ref_obj_id = id;  in check_kfunc_call()
13873 			reg->ref_obj_id = 0;  in mark_ptr_or_null_reg()
13900 	u32 ref_obj_id = regs[regno].ref_obj_id;  in mark_ptr_or_null_regs()  local
13903 	if (ref_obj_id && ref_obj_id == id && is_null)  in mark_ptr_or_null_regs()
15521 	       check_ids(rold->ref_obj_id, rcur->ref_obj_id, idmap);  in regs_exact()
15611 		       check_ids(rold->ref_obj_id, rcur->ref_obj_id, idmap);  in regsafe()
15715 			    !check_ids(old_reg->ref_obj_id, cur_reg->ref_obj_id, idmap))  in stacksafe()
15731 			    !check_ids(old_reg->ref_obj_id, cur_reg->ref_obj_id, idmap))  in stacksafe()