Re: [PATCH bpf] bpf: Fix sanitize_err() register selection for BPF_K

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch modifies `sanitize_err()` to handle `BPF_K` instructions, but this code path is mathematically unreachable because BPF_K instructions bypass ALU sanitation entirely.
--

--- Patch [1]: [PATCH bpf] bpf: Fix sanitize_err() register selection for BPF_K ---
commit 08e8e3769c4c795ad93d26ddc7c02599ba8cab32
Author: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>

bpf: Fix sanitize_err() register selection for BPF_K

This patch modifies sanitize_err() to correctly report the destination
register for BPF_K instructions when generating ALU sanitization errors.
It ensures the source register field, which is zero for immediate
constants, does not interfere with the diagnostic output.

Closes: https://lore.kernel.org/bpf/20260729153536.F3E2E1F000E9@smtp.kernel.org/

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -13562,6 +13562,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
>  	static const char *err = "pointer arithmetic with it prohibited for !root";
>  	const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";
>  	u32 dst = insn->dst_reg, src = insn->src_reg;
> +	bool src_is_imm = BPF_SRC(insn->code) == BPF_K;
>  	struct bpf_reg_state *regs = cur_regs(env);
>  
>  	switch (reason) {
> @@ -13571,7 +13572,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
>  		break;
>  	case REASON_TYPE:
>  		verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
> -			regs[src].type == SCALAR_VALUE ? dst : src, err);
> +			src_is_imm || regs[src].type == SCALAR_VALUE ? dst : src, err);

[Severity: Medium]
Is this code path actually reachable for BPF_K instructions?

Looking at can_skip_alu_sanitation(), it appears to unconditionally return
true when BPF_SRC(insn->code) == BPF_K:

kernel/bpf/verifier.c:can_skip_alu_sanitation() {
        return env->bypass_spec_v1 ||
               BPF_SRC(insn->code) == BPF_K ||
               cur_aux(env)->nospec;
}

Since sanitize_ptr_alu() and sanitize_val_alu() both check
can_skip_alu_sanitation() first, won't they always return 0 for BPF_K?

If so, this would prevent sanitize_err() from ever being called for these
instructions, making this new logic unreachable.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803-c3-035-sanitize-err-v1-v1-1-93e5ff61731f@mails.tsinghua.edu.cn?part=1