[bpf-next v2 0/2] bpf: Preserve stack frame number for commuted arithmetic

[Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>]

The verifier uses reg->frameno to distinguish stack pointers that have
the same offset but refer to different call frames. The scalar += pointer
path copies pointer type and id to the destination register, but it also
needs to preserve pointer provenance fields such as the stack frame
number.

Preserve the full pointer register state for commuted stack pointer
arithmetic and add a verifier regression test where a callee derives its
frame pointer through scalar += fp before overwriting and reloading the
same stack slot.

Changes in v2:
- Preserve the full pointer register state instead of copying only
  selected fields, as suggested by Eduard.
- Use a temporary scalar offset register for the commuted scalar += fp
  case, as suggested by Eduard.
- Add a Fixes tag to the verifier change.
- Drop CAP_SYS_ADMIN handling from the new verifier_basic_stack harness,
  as requested by Eduard.

Yiyang Chen (2):
  bpf: Preserve stack frame number for commuted arithmetic
  selftests/bpf: Cover stack frame number after scalar plus fp

 kernel/bpf/verifier.c                         | 14 +++++++-----
 .../selftests/bpf/prog_tests/verifier.c       |  2 -
 .../bpf/prog_tests/verifier_basic_stack.c     | 14 ++++++++
 .../bpf/progs/verifier_basic_stack.c          | 41 +++++++++++++++++++
 4 files changed, 64 insertions(+), 10 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c


base-commit: 0bcca2a42cc50b7d64a95c08dffc6b93661a7ea2
--
2.34.1