Re: [PATCH bpf-next v3 1/3] bpf: Preserve pointer state for commuted arithmetic

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-07-24 at 11:05 +0800, Shung-Hsi Yu wrote:
> On Thu, Jul 23, 2026 at 02:07:20PM -0700, Eduard Zingerman wrote:
> > On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote:
> > > When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> > > destination register inherits the pointer state from the source pointer.
> > > Copying only selected fields is fragile because pointer provenance is
> > > tracked by several bpf_reg_state fields.
> > > 
> > > Use verifier-env scratch storage to preserve the scalar operand while
> > > replacing the destination with the full pointer state. This preserves the
> > > frame number for PTR_TO_STACK registers and keeps parent identity fields
> > > consistent.
> > > 
> > > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
> > > Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> > > ---
> > > 
> > >  kernel/bpf/verifier.c | 21 ++++++++++++++-------
> > >  1 file changed, 14 insertions(+), 7 deletions(-)
> > > 
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 52be0a118cce0..085cbd5222737 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -13726,11 +13726,14 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
> > 
> > Yiyang,
> > 
> > I noticed there there is a temporary 'off' reg allocated on stack by
> > the caller of this function. So, let's reuse it, ...
> 
> 'off_reg' perhaps?
> 
> +1
> 
> > and also adjust the
> > sanitize_err signature to minimize changes.
> > 
> > Could you please re-spin using the attached patches?
> > 
> > Shung-Hsi, wdyt?
> 
> Refactoring LGTM. Feels like the alias check 'dst_reg != ptr_reg' would
> still bite us later, but perhaps that something for another time.

Might be the case, we can extract it as a boolean at the top of the
function, same way Yiyang had it, or just pass as a boolean to
adjust_ptr_min_max_vals().