[PATCH bpf-next v3 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

[Emil Tsalapatis <emil@etsalapatis.com>]

From: Emil Tsalapatis <etsal@meta.com>

The compiler sometimes stores the result of a PTR_TO_ARENA + SCALAR
addition into the scalar register rather than the pointer register.
Handle this case by upgrading the destination scalar register to
PTR_TO_ARENA, matching the existing handling when the destination is
already PTR_TO_ARENA.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
---
 kernel/bpf/verifier.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8c1cf2eb6cbb..583121b9aa7e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -16333,6 +16333,24 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
 					bpf_alu_string[opcode >> 4]);
 				return -EACCES;
 			} else {
+				/*
+				 * The compiler sometimes stores the result of
+				 * PTR_TO_ARENA + SCALAR addition to the scalar
+				 * register. Upgrade it to a PTR_TO_ARENA.
+				 */
+				if (src_reg->type == PTR_TO_ARENA && opcode == BPF_ADD) {
+					struct bpf_insn_aux_data *aux = cur_aux(env);
+
+					__mark_reg_unknown(env, dst_reg);
+					dst_reg->type = PTR_TO_ARENA;
+					dst_reg->subreg_def = env->insn_idx + 1;
+
+					if (BPF_CLASS(insn->code) == BPF_ALU64)
+						aux->needs_zext = true;
+
+					return 0;
+				}
+
 				/* scalar += pointer
 				 * This is legal, but we have to reverse our
 				 * src/dest handling in computing the range
-- 
2.53.0