Re: [PATCH bpf-next v3 1/3] bpf: Preserve pointer state for commuted arithmetic

[Shung-Hsi Yu <shung-hsi.yu@suse.com>]

On Thu, Jul 23, 2026 at 02:07:20PM -0700, Eduard Zingerman wrote:
> On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote:
> > When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> > destination register inherits the pointer state from the source pointer.
> > Copying only selected fields is fragile because pointer provenance is
> > tracked by several bpf_reg_state fields.
> > 
> > Use verifier-env scratch storage to preserve the scalar operand while
> > replacing the destination with the full pointer state. This preserves the
> > frame number for PTR_TO_STACK registers and keeps parent identity fields
> > consistent.
> > 
> > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
> > Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> > ---
> >
> >  kernel/bpf/verifier.c | 21 ++++++++++++++-------
> >  1 file changed, 14 insertions(+), 7 deletions(-)
> > 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 52be0a118cce0..085cbd5222737 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -13726,11 +13726,14 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
> 
> Yiyang,
> 
> I noticed there there is a temporary 'off' reg allocated on stack by
> the caller of this function. So, let's reuse it, ...

'off_reg' perhaps?

+1

> and also adjust the
> sanitize_err signature to minimize changes.
>
> Could you please re-spin using the attached patches?
> 
> Shung-Hsi, wdyt?

Refactoring LGTM. Feels like the alias check 'dst_reg != ptr_reg' would
still bite us later, but perhaps that something for another time.

...