Core: Dereference a pointer wherever a number is wanted, not only in operands

return p and p + 1 on a map lookup worked, because they go through
get_typed_operand, which loads through the pointer with a null check.
r.val = p, x = p into an integer local, and c_int64(p) (so also
return c_int64(p)) did not: those three sites call eval_expr directly
and handed the pointer to the integer path, failing with i64* vs i64.

deref_to_value is get_typed_operand's pointer fallback as a helper, used
by it and by the three sites, only when the destination is an integer:
a pointer slot still aliases (q = p), and an opaque pointer, which names
no pointee, is left alone. The descriptor takes the map's declared value
ctype, as the operand path does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: r41k0u

pythonbpf/assign_pass.py

@@ -3,7 +3,7 @@
 from inspect import isclass
 
 from llvmlite import ir
-from pythonbpf.expr import eval_expr, convert
+from pythonbpf.expr import eval_expr, convert, deref_to_value
 from pythonbpf.helper import emit_probe_read_kernel_str_call
 from pythonbpf.type_deducer import ctypes_to_ir
 from pythonbpf.vmlinux_parser.dependency_node import Field
@@ -40,6 +40,11 @@ def handle_struct_field_assignment(
         return
 
     val, val_type = val_result
+    if isinstance(field_type, ir.IntType):
+        # An integer field takes the value a pointer points at (r.val = p).
+        val, val_type = deref_to_value(
+            func, builder, rval, val, val_type, local_sym_tab
+        )
 
     # Special case: i8* string to [N x i8] char array
     if _is_char_array(field_type) and _is_i8_ptr(val_type):
@@ -147,6 +152,12 @@ def handle_variable_assignment(
         return False
 
     val, val_type = val_result
+    if isinstance(var_type, ir.IntType):
+        # An integer slot takes the value a pointer points at (x = p); a
+        # pointer slot keeps the pointer, below.
+        val, val_type = deref_to_value(
+            func, builder, rval, val, val_type, local_sym_tab
+        )
     logger.info(
         f"Evaluated value for {var_name}: {val} of type {val_type}, expected {var_type}"
     )

pythonbpf/expr/__init__.py

@@ -1,4 +1,4 @@
-from .expr_pass import eval_expr, handle_expr, get_typed_operand
+from .expr_pass import eval_expr, handle_expr, get_typed_operand, deref_to_value
 from .type_normalization import (
     convert_to_bool,
     get_base_type_and_depth,
@@ -20,6 +20,7 @@
     "canonicalise",
     "to_promoted",
     "get_typed_operand",
+    "deref_to_value",
     "usual_arithmetic_conversions",
     "get_base_type_and_depth",
     "deref_to_depth",

pythonbpf/expr/expr_pass.py

@@ -222,6 +222,28 @@ def _descriptor(val, ty):
     return None
 
 
+def deref_to_value(func, builder, expr, val, val_ty, local_sym_tab):
+    """Load through a pointer to an integer (a map-lookup result), with the
+    null check every dereference gets, so a consumer that wants a number gets
+    one. Anything else is returned unchanged. The descriptor comes from the
+    map's declared value ctype when expr names a lookup local (a c_uint64 value
+    is unsigned), else from the pointee."""
+    if val is None or not isinstance(val.type, ir.PointerType):
+        return val, val_ty
+    if not hasattr(val.type, "pointee"):
+        return val, val_ty  # an opaque pointer says nothing about a pointee
+    base_type, depth = get_base_type_and_depth(val.type)
+    if not isinstance(base_type, ir.IntType):
+        return val, val_ty  # a struct or char pointer is not a number
+    val = deref_to_depth(func, builder, val, depth)
+    declared = None
+    if isinstance(expr, ast.Name) and expr.id in local_sym_tab:
+        meta = local_sym_tab[expr.id].metadata
+        if isinstance(meta, str) and is_ctypes(meta):
+            declared = ctypes_to_ir(meta)
+    return val, _descriptor(val, declared if declared is not None else base_type)
+
+
 def get_typed_operand(func, compilation_context, operand, builder, local_sym_tab):
     """Evaluate an operand to (value, IntTy). Pointers (map-lookup results) are
     dereferenced to the scalar they point at."""
@@ -270,9 +292,8 @@ def get_typed_operand(func, compilation_context, operand, builder, local_sym_tab
             raise ValueError(f"Failed to evaluate call expression: {operand}")
         val, ty = res
         logger.info(f"Evaluated expr to {val} of type {val.type}")
-        base_type, depth = get_base_type_and_depth(val.type)
-        if depth > 0:
-            val = deref_to_depth(func, builder, val, depth)
+        if isinstance(val.type, ir.PointerType):
+            return deref_to_value(func, builder, operand, val, ty, local_sym_tab)
         return val, _descriptor(val, ty)
     raise TypeError(f"Unsupported operand type: {type(operand)}")
 
@@ -353,6 +374,12 @@ def _handle_ctypes_call(
     # Extract the actual IR value and type
     # val could be (value, ir_type) or (value, Field)
     value, val_type = val
+    if isinstance(expected_type, ir.IntType) and call_type != "c_void_p":
+        # c_int64(p) on a map lookup is the value, as p + 0 already is;
+        # c_void_p(p) keeps the pointer.
+        value, val_type = deref_to_value(
+            func, builder, arg, value, val_type, local_sym_tab
+        )
 
     # If val_type is a Field object (from vmlinux struct), get the actual IR type of the value
     if isinstance(val_type, Field):