[PATCH bpf] bpf: Clear scalar delta on narrowing stack spill

[PATCH bpf] bpf: Clear scalar delta on narrowing stack spill

[Daniel Borkmann]

check_stack_write_fixed_off() breaks the scalar link on a narrowing spill
by zeroing the id of the destination stack slot, but leaves the delta in
place. save_register_state() has just copied the source register verbatim,
so the slot keeps the BPF_ADD_CONST delta of a register it is no longer
linked to. This is the same shape as the case addressed in 1b327732c846
("bpf: Clear delta when clearing reg id for non-{add,sub} ops"). Unlike
the latter, no miscomputation seems reachable, so mainly consistency.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 [ noticed while reviewing clear_scalar_id locations ]

 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 45234e2fbee6..3eb20e54eced 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3582,7 +3582,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
 		save_register_state(env, state, spi, reg, size);
 		/* Break the relation on a narrowing spill. */
 		if (!reg_value_fits)
-			state->stack[spi].spilled_ptr.id = 0;
+			clear_scalar_id(&state->stack[spi].spilled_ptr);
 	} else if (!reg && !(off % BPF_REG_SIZE) && is_bpf_st_mem(insn) &&
 		   env->bpf_capable) {
 		struct bpf_reg_state *tmp_reg = &env->fake_reg[0];
-- 
2.43.0

Re: [PATCH bpf] bpf: Clear scalar delta on narrowing stack spill

[Eduard Zingerman]

On Thu, 2026-09-10 at 20:56 +0200, Daniel Borkmann wrote:
> check_stack_write_fixed_off() breaks the scalar link on a narrowing spill
> by zeroing the id of the destination stack slot, but leaves the delta in
> place. save_register_state() has just copied the source register verbatim,
> so the slot keeps the BPF_ADD_CONST delta of a register it is no longer
> linked to. This is the same shape as the case addressed in 1b327732c846
> ("bpf: Clear delta when clearing reg id for non-{add,sub} ops"). Unlike
> the latter, no miscomputation seems reachable, so mainly consistency.
> 
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

It appears there are no other instances.
Remaining .id = 0 are for non-scalar types.

...

Re: [PATCH bpf] bpf: Clear scalar delta on narrowing stack spill

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 10 Sep 2026 20:56:04 +0200 you wrote:
> check_stack_write_fixed_off() breaks the scalar link on a narrowing spill
> by zeroing the id of the destination stack slot, but leaves the delta in
> place. save_register_state() has just copied the source register verbatim,
> so the slot keeps the BPF_ADD_CONST delta of a register it is no longer
> linked to. This is the same shape as the case addressed in 1b327732c846
> ("bpf: Clear delta when clearing reg id for non-{add,sub} ops"). Unlike
> the latter, no miscomputation seems reachable, so mainly consistency.
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Clear scalar delta on narrowing stack spill
    https://git.kernel.org/bpf/bpf/c/2936aed9b021

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html