Re: [PATCH bpf-next v5 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

bot+bpf-ci
2026-04-10T17:34:53Z

[-- Attachment #1: Type: text/plain, Size: 2140 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9c1135d373e24..6c5721434bc4b 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -16655,11 +16655,32 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,

[ ... ]

> + if (dst_reg->type != PTR_TO_ARENA) {
> + /* Can't do arena arithmetic with non-scalars. */
> + if (dst_reg->type != SCALAR_VALUE) {
> + verbose(env, "R%d %s R%d: Invalid operation between "
> + "bpf_reg_state types %s and %s\n",
> + insn->dst_reg,
> + bpf_alu_string[opcode >> 4],
> + insn->src_reg,
> + reg_type_str(env, dst_reg->type),
> + reg_type_str(env, src_reg->type));

reg_type_str() returns a pointer to the shared buffer env->tmp_str_buf.
Its own comment in log.c says:

Note that reg_type_str() can not appear more than once in a
single verbose() statement.

Calling it twice in the same verbose() here means both %s arguments
point to the same buffer, so the error message will display one of the
two type names twice and the other not at all.

Would it work to split this into two verbose() calls, or save one
result to a local buffer before printing?

> + return -EACCES;
> + }
> +
> + *dst_reg = *src_reg;
> + dst_reg->subreg_def = env->insn_idx + 1;
> + }

[ ... ]

This commit fixes a bug where the verifier rejects valid BPF programs
when the compiler places the result of a PTR_TO_ARENA + SCALAR addition
into the scalar register. The bug was introduced by commit 6082b6c328b5
("bpf: Recognize addr_space_cast instruction in the verifier.") which
added the original PTR_TO_ARENA handling in the verifier.

This was also noted during review of the v3 series on lore, and the
Fixes: tag was acknowledged but appears to be missing from the final
version. Should this carry:

Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24254055723