Re: [PATCH bpf 1/2] bpf: fix REG INVARIANTS VIOLATION on speculative pointer arithmetic

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The multi-line comment introduced in the patch does not follow the preferred BPF subsystem comment style.
--

--- Patch [1]: [PATCH bpf 1/2] bpf: fix REG INVARIANTS VIOLATION on speculative pointer arithmetic ---
commit d06a2ef5d24e558f7ddc1472c5b3c370252aa5c5
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: fix REG INVARIANTS VIOLATION on speculative pointer arithmetic

This patch defers the clearing of r32 for pointer registers until after
sanitize_ptr_alu() has potentially snapshotted the register state. This
prevents an inconsistent state where the speculative path receives a snapshot
with an unbounded r32 but a constant var_off, resolving a verifier warning.

Link: https://lore.kernel.org/bpf/CAGM=xGB1fJ9kT8XTitVo74B0WGqgjkoUHdLwzytwV0AyqeVApw@mail.gmail.com/

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index e421ea2b80c3a..ff83c8ef57be4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14570,6 +14567,14 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, struct bpf_insn
>  			return sanitize_err(env, insn, ret);
>  	}
>  
> +	/* Pointer types do not carry 32-bit bounds at the moment. Blank r32

[Severity: Low]
This isn't a bug, but the multi-line comment here does not follow the
preferred BPF subsystem style. The opening /* should be on its own line.

> +	 * only after sanitize_ptr_alu() may have snapshotted dst_reg into a
> +	 * speculative path: otherwise that snapshot freezes a const offset
> +	 * with an unbounded r32, which later trips reg_bounds_sanity_check().
> +	 * reg_bounds_sync() below re-derives r32 from the updated offset.
> +	 */
> +	__mark_reg32_unbounded(dst_reg);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260819125840.286434-1-jiayuan.chen@linux.dev?part=1