[PATCH bpf-next v5 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

Emil Tsalapatis
2026-04-10T16:30:58Z

The compiler sometimes stores the result of a PTR_TO_ARENA + SCALAR
addition into the scalar register rather than the pointer register.
Handle this case by upgrading the destination scalar register to
PTR_TO_ARENA, matching the existing handling when the destination is
already PTR_TO_ARENA.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Song Liu <song@kernel.org>
---
kernel/bpf/verifier.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 594260c1f382..30c3e26aae96 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -16641,11 +16641,32 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
int err;

dst_reg = &regs[insn->dst_reg];
- src_reg = NULL;
+ if (BPF_SRC(insn->code) == BPF_X)
+ src_reg = &regs[insn->src_reg];
+ else
+ src_reg = NULL;

- if (dst_reg->type == PTR_TO_ARENA) {
+ /* Case where at least one operand is an arena. */
+ if (dst_reg->type == PTR_TO_ARENA || (src_reg && src_reg->type == PTR_TO_ARENA)) {
struct bpf_insn_aux_data *aux = cur_aux(env);

+ if (dst_reg->type != PTR_TO_ARENA) {
+ /* Can't do arena arithmetic with non-scalars. */
+ if (dst_reg->type != SCALAR_VALUE) {
+ verbose(env, "R%d %s R%d: Invalid operation between "
+ "bpf_reg_state types %s and %s\n",
+ insn->dst_reg,
+ bpf_alu_string[opcode >> 4],
+ insn->src_reg,
+ reg_type_str(env, dst_reg->type),
+ reg_type_str(env, src_reg->type));
+ return -EACCES;
+ }
+
+ *dst_reg = *src_reg;
+ dst_reg->subreg_def = env->insn_idx + 1;
+ }
+
if (BPF_CLASS(insn->code) == BPF_ALU64)
/*
* 32-bit operations zero upper bits automatically.
--
2.53.0