diff mbox series

[v1,bpf-next] bpf: Tidy up verifier checking

Message ID 20230217005451.2438147-1-joannelkoong@gmail.com (mailing list archive)
State Changes Requested
Delegated to: BPF
Headers show
Series [v1,bpf-next] bpf: Tidy up verifier checking | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-7 success Logs for llvm-toolchain
bpf/vmtest-bpf-next-VM_Test-8 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-2 success Logs for build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-3 success Logs for build for aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-5 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-4 success Logs for build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-37 fail Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-10 success Logs for test_maps on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-12 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-14 fail Logs for test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-15 fail Logs for test_progs on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-17 fail Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-18 fail Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-19 fail Logs for test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-20 fail Logs for test_progs_no_alu32 on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-22 fail Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 fail Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-24 success Logs for test_progs_no_alu32_parallel on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for test_progs_no_alu32_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-27 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-28 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-29 success Logs for test_progs_parallel on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-30 success Logs for test_progs_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-32 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-33 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-34 fail Logs for test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-35 fail Logs for test_verifier on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-38 fail Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-36 fail Logs for test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-16 fail Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-21 fail Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for test_progs_no_alu32_parallel on s390x with gcc
netdev/tree_selection success Clearly marked for bpf-next
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix success Link
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 10 this patch: 10
netdev/cc_maintainers warning 8 maintainers not CCed: john.fastabend@gmail.com sdf@google.com jolsa@kernel.org song@kernel.org martin.lau@linux.dev haoluo@google.com yhs@fb.com kpsingh@kernel.org
netdev/build_clang success Errors and warnings before: 1 this patch: 1
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 10 this patch: 10
netdev/checkpatch warning WARNING: else is not generally useful after a break or return WARNING: line length of 85 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-31 success Logs for test_progs_parallel on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for test_maps on s390x with gcc

Commit Message

Joanne Koong Feb. 17, 2023, 12:54 a.m. UTC 
This change refactors check_mem_access() to check against the base type of
the register, and uses switch case checking instead of if / else if
checks. This change also uses the existing clear_called_saved_regs()
function for resetting caller saved regs in check_helper_call().

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
---
 kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
 1 file changed, 46 insertions(+), 21 deletions(-)

Comments

Jiri Olsa Feb. 17, 2023, 9:05 a.m. UTC | #1 
On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> This change refactors check_mem_access() to check against the base type of
> the register, and uses switch case checking instead of if / else if
> checks. This change also uses the existing clear_called_saved_regs()
> function for resetting caller saved regs in check_helper_call().
> 
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
>  1 file changed, 46 insertions(+), 21 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 272563a0b770..b40165be2943 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  	/* for access checks, reg->off is just part of off */
>  	off += reg->off;
>  
> -	if (reg->type == PTR_TO_MAP_KEY) {
> +	switch (base_type(reg->type)) {
> +	case PTR_TO_MAP_KEY:
>  		if (t == BPF_WRITE) {
>  			verbose(env, "write to change key R%d not allowed\n", regno);
>  			return -EACCES;
> @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  			return err;
>  		if (value_regno >= 0)
>  			mark_reg_unknown(env, regs, value_regno);
> -	} else if (reg->type == PTR_TO_MAP_VALUE) {
> +
> +		break;
> +	case PTR_TO_MAP_VALUE:
> +	{

I'm getting failure in this test:
  #92/1    jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL

I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
which we did not do before, so the test won't fail now as expected

>  		struct btf_field *kptr_field = NULL;
>  
>  		if (t == BPF_WRITE && value_regno >= 0 &&
> @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  				mark_reg_unknown(env, regs, value_regno);
>  			}
>  		}
> -	} else if (base_type(reg->type) == PTR_TO_MEM) {
> +		break;
> +	}

SNIP

> @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  
>  		if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
>  			mark_reg_unknown(env, regs, value_regno);
> -	} else {
> +		break;
> +	}
> +	case PTR_TO_BTF_ID:
> +		if (!type_may_be_null(reg->type)) {
> +			err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> +						      value_regno);
> +			break;
> +		} else {
> +			fallthrough;
> +		}

nit, no need for the else branch, just use fallthrough directly

> +	default:
>  		verbose(env, "R%d invalid mem access '%s'\n", regno,
>  			reg_type_str(env, reg->type));
>  		return -EACCES;
> @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>  		return err;
>  
>  	/* reset caller saved regs */

nit, we could remove the comment as well, the function name says it all

jirka

> -	for (i = 0; i < CALLER_SAVED_REGS; i++) {
> -		mark_reg_not_init(env, regs, caller_saved[i]);
> -		check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> -	}
> +	clear_caller_saved_regs(env, regs);
>  
>  	/* helper call returns 64-bit value. */
>  	regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> -- 
> 2.30.2
>
Joanne Koong Feb. 17, 2023, 6:15 p.m. UTC | #2 
On Fri, Feb 17, 2023 at 1:06 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> > This change refactors check_mem_access() to check against the base type of
> > the register, and uses switch case checking instead of if / else if
> > checks. This change also uses the existing clear_called_saved_regs()
> > function for resetting caller saved regs in check_helper_call().
> >
> > Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> > ---
> >  kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
> >  1 file changed, 46 insertions(+), 21 deletions(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 272563a0b770..b40165be2943 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> >       /* for access checks, reg->off is just part of off */
> >       off += reg->off;
> >
> > -     if (reg->type == PTR_TO_MAP_KEY) {
> > +     switch (base_type(reg->type)) {
> > +     case PTR_TO_MAP_KEY:
> >               if (t == BPF_WRITE) {
> >                       verbose(env, "write to change key R%d not allowed\n", regno);
> >                       return -EACCES;
> > @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> >                       return err;
> >               if (value_regno >= 0)
> >                       mark_reg_unknown(env, regs, value_regno);
> > -     } else if (reg->type == PTR_TO_MAP_VALUE) {
> > +
> > +             break;
> > +     case PTR_TO_MAP_VALUE:
> > +     {
>
> I'm getting failure in this test:
>   #92/1    jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL
>
> I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
> which we did not do before, so the test won't fail now as expected

Thanks for reviewing this, I will investigate this test failure!

>
> >               struct btf_field *kptr_field = NULL;
> >
> >               if (t == BPF_WRITE && value_regno >= 0 &&
> > @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> >                               mark_reg_unknown(env, regs, value_regno);
> >                       }
> >               }
> > -     } else if (base_type(reg->type) == PTR_TO_MEM) {
> > +             break;
> > +     }
>
> SNIP
>
> > @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> >
> >               if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
> >                       mark_reg_unknown(env, regs, value_regno);
> > -     } else {
> > +             break;
> > +     }
> > +     case PTR_TO_BTF_ID:
> > +             if (!type_may_be_null(reg->type)) {
> > +                     err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> > +                                                   value_regno);
> > +                     break;
> > +             } else {
> > +                     fallthrough;
> > +             }
>
> nit, no need for the else branch, just use fallthrough directly
>
> > +     default:
> >               verbose(env, "R%d invalid mem access '%s'\n", regno,
> >                       reg_type_str(env, reg->type));
> >               return -EACCES;
> > @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> >               return err;
> >
> >       /* reset caller saved regs */
>
> nit, we could remove the comment as well, the function name says it all
>
> jirka
>
> > -     for (i = 0; i < CALLER_SAVED_REGS; i++) {
> > -             mark_reg_not_init(env, regs, caller_saved[i]);
> > -             check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> > -     }
> > +     clear_caller_saved_regs(env, regs);
> >
> >       /* helper call returns 64-bit value. */
> >       regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> > --
> > 2.30.2
> >
Joanne Koong Feb. 17, 2023, 9:06 p.m. UTC | #3 
On Fri, Feb 17, 2023 at 10:15 AM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> On Fri, Feb 17, 2023 at 1:06 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> > > This change refactors check_mem_access() to check against the base type of
> > > the register, and uses switch case checking instead of if / else if
> > > checks. This change also uses the existing clear_called_saved_regs()
> > > function for resetting caller saved regs in check_helper_call().
> > >
> > > Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> > > ---
> > >  kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
> > >  1 file changed, 46 insertions(+), 21 deletions(-)
> > >
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 272563a0b770..b40165be2943 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > >       /* for access checks, reg->off is just part of off */
> > >       off += reg->off;
> > >
> > > -     if (reg->type == PTR_TO_MAP_KEY) {
> > > +     switch (base_type(reg->type)) {
> > > +     case PTR_TO_MAP_KEY:
> > >               if (t == BPF_WRITE) {
> > >                       verbose(env, "write to change key R%d not allowed\n", regno);
> > >                       return -EACCES;
> > > @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > >                       return err;
> > >               if (value_regno >= 0)
> > >                       mark_reg_unknown(env, regs, value_regno);
> > > -     } else if (reg->type == PTR_TO_MAP_VALUE) {
> > > +
> > > +             break;
> > > +     case PTR_TO_MAP_VALUE:
> > > +     {
> >
> > I'm getting failure in this test:
> >   #92/1    jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL
> >
> > I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
> > which we did not do before, so the test won't fail now as expected
>
> Thanks for reviewing this, I will investigate this test failure!

I'm going to abandon this patch, on a closer look I don't think it's
accurate. For most of these matches, it needs to be a strict match (eg
reg->type should be exactly PTR_TO_MAP_KEY) and any type modifiers
should fail (eg PTR_MAYBE_NULL)

>
> >
> > >               struct btf_field *kptr_field = NULL;
> > >
> > >               if (t == BPF_WRITE && value_regno >= 0 &&
> > > @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > >                               mark_reg_unknown(env, regs, value_regno);
> > >                       }
> > >               }
> > > -     } else if (base_type(reg->type) == PTR_TO_MEM) {
> > > +             break;
> > > +     }
> >
> > SNIP
> >
> > > @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > >
> > >               if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
> > >                       mark_reg_unknown(env, regs, value_regno);
> > > -     } else {
> > > +             break;
> > > +     }
> > > +     case PTR_TO_BTF_ID:
> > > +             if (!type_may_be_null(reg->type)) {
> > > +                     err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> > > +                                                   value_regno);
> > > +                     break;
> > > +             } else {
> > > +                     fallthrough;
> > > +             }
> >
> > nit, no need for the else branch, just use fallthrough directly
> >
> > > +     default:
> > >               verbose(env, "R%d invalid mem access '%s'\n", regno,
> > >                       reg_type_str(env, reg->type));
> > >               return -EACCES;
> > > @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > >               return err;
> > >
> > >       /* reset caller saved regs */
> >
> > nit, we could remove the comment as well, the function name says it all
> >
> > jirka
> >
> > > -     for (i = 0; i < CALLER_SAVED_REGS; i++) {
> > > -             mark_reg_not_init(env, regs, caller_saved[i]);
> > > -             check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> > > -     }
> > > +     clear_caller_saved_regs(env, regs);
> > >
> > >       /* helper call returns 64-bit value. */
> > >       regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> > > --
> > > 2.30.2
> > >
diff mbox series

Patch

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 272563a0b770..b40165be2943 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5317,7 +5317,8 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 	/* for access checks, reg->off is just part of off */
 	off += reg->off;
 
-	if (reg->type == PTR_TO_MAP_KEY) {
+	switch (base_type(reg->type)) {
+	case PTR_TO_MAP_KEY:
 		if (t == BPF_WRITE) {
 			verbose(env, "write to change key R%d not allowed\n", regno);
 			return -EACCES;
@@ -5329,7 +5330,10 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 			return err;
 		if (value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (reg->type == PTR_TO_MAP_VALUE) {
+
+		break;
+	case PTR_TO_MAP_VALUE:
+	{
 		struct btf_field *kptr_field = NULL;
 
 		if (t == BPF_WRITE && value_regno >= 0 &&
@@ -5369,7 +5373,10 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 				mark_reg_unknown(env, regs, value_regno);
 			}
 		}
-	} else if (base_type(reg->type) == PTR_TO_MEM) {
+		break;
+	}
+	case PTR_TO_MEM:
+	{
 		bool rdonly_mem = type_is_rdonly_mem(reg->type);
 
 		if (type_may_be_null(reg->type)) {
@@ -5394,7 +5401,10 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 					      reg->mem_size, false);
 		if (!err && value_regno >= 0 && (t == BPF_READ || rdonly_mem))
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (reg->type == PTR_TO_CTX) {
+		break;
+	}
+	case PTR_TO_CTX:
+	{
 		enum bpf_reg_type reg_type = SCALAR_VALUE;
 		struct btf *btf = NULL;
 		u32 btf_id = 0;
@@ -5438,8 +5448,9 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 			}
 			regs[value_regno].type = reg_type;
 		}
-
-	} else if (reg->type == PTR_TO_STACK) {
+		break;
+	}
+	case PTR_TO_STACK:
 		/* Basic bounds checks. */
 		err = check_stack_access_within_bounds(env, regno, off, size, ACCESS_DIRECT, t);
 		if (err)
@@ -5456,7 +5467,9 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 		else
 			err = check_stack_write(env, regno, off, size,
 						value_regno, insn_idx);
-	} else if (reg_is_pkt_pointer(reg)) {
+		break;
+	case PTR_TO_PACKET:
+	case PTR_TO_PACKET_META:
 		if (t == BPF_WRITE && !may_access_direct_pkt_data(env, NULL, t)) {
 			verbose(env, "cannot write into packet\n");
 			return -EACCES;
@@ -5470,7 +5483,8 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 		err = check_packet_access(env, regno, off, size, false);
 		if (!err && t == BPF_READ && value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (reg->type == PTR_TO_FLOW_KEYS) {
+		break;
+	case PTR_TO_FLOW_KEYS:
 		if (t == BPF_WRITE && value_regno >= 0 &&
 		    is_pointer_value(env, value_regno)) {
 			verbose(env, "R%d leaks addr into flow keys\n",
@@ -5481,7 +5495,11 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 		err = check_flow_keys_access(env, off, size);
 		if (!err && t == BPF_READ && value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (type_is_sk_pointer(reg->type)) {
+		break;
+	case PTR_TO_SOCKET:
+	case PTR_TO_SOCK_COMMON:
+	case PTR_TO_TCP_SOCK:
+	case PTR_TO_XDP_SOCK:
 		if (t == BPF_WRITE) {
 			verbose(env, "R%d cannot write into %s\n",
 				regno, reg_type_str(env, reg->type));
@@ -5490,18 +5508,18 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 		err = check_sock_access(env, insn_idx, regno, off, size, t);
 		if (!err && value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (reg->type == PTR_TO_TP_BUFFER) {
+		break;
+	case PTR_TO_TP_BUFFER:
 		err = check_tp_buffer_access(env, reg, regno, off, size);
 		if (!err && t == BPF_READ && value_regno >= 0)
 			mark_reg_unknown(env, regs, value_regno);
-	} else if (base_type(reg->type) == PTR_TO_BTF_ID &&
-		   !type_may_be_null(reg->type)) {
-		err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
-					      value_regno);
-	} else if (reg->type == CONST_PTR_TO_MAP) {
+		break;
+	case CONST_PTR_TO_MAP:
 		err = check_ptr_to_map_access(env, regs, regno, off, size, t,
 					      value_regno);
-	} else if (base_type(reg->type) == PTR_TO_BUF) {
+		break;
+	case PTR_TO_BUF:
+	{
 		bool rdonly_mem = type_is_rdonly_mem(reg->type);
 		u32 *max_access;
 
@@ -5521,7 +5539,17 @@  static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 
 		if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
 			mark_reg_unknown(env, regs, value_regno);
-	} else {
+		break;
+	}
+	case PTR_TO_BTF_ID:
+		if (!type_may_be_null(reg->type)) {
+			err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
+						      value_regno);
+			break;
+		} else {
+			fallthrough;
+		}
+	default:
 		verbose(env, "R%d invalid mem access '%s'\n", regno,
 			reg_type_str(env, reg->type));
 		return -EACCES;
@@ -8377,10 +8405,7 @@  static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		return err;
 
 	/* reset caller saved regs */
-	for (i = 0; i < CALLER_SAVED_REGS; i++) {
-		mark_reg_not_init(env, regs, caller_saved[i]);
-		check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
-	}
+	clear_caller_saved_regs(env, regs);
 
 	/* helper call returns 64-bit value. */
 	regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;