Re: [PATCH bpf-next v3 1/3] bpf: Preserve pointer state for commuted arithmetic

[Eduard Zingerman <eddyz87@gmail.com>]

On Thu, 2026-07-23 at 10:35 -0700, Eduard Zingerman wrote:
> On Thu, 2026-07-23 at 12:25 +0800, Shung-Hsi Yu wrote:
> 
> ...
> 
> > The sole purpose of having orig_off_reg seem to be for satisfying the
> > 'off_reg == dst_reg' conditional in sanitize_err(). If that's the case,
> > maybe it is better to change sanitize_err to accept an ptr_is_dst_reg
> > argument too.
> > 
> > And given now that we are starting to make more use of scratch register
> > states, it seems better to get rid the likes of 'off_reg == dst_reg' all
> > together, and simply have ptr_is_dst_reg passed down by
> > adjust_scalar_min_max_vals().
> > 
> > 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 52be0a118cce..72d49f2a57a3 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -13505,13 +13505,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
> >  			    const struct bpf_reg_state *off_reg,
> >  			    struct bpf_reg_state *dst_reg,
> >  			    struct bpf_sanitize_info *info,
> > -			    const bool commit_window)
> > +			    const bool commit_window,
> > +			    const bool ptr_is_dst_reg)
> 
> That's a bit invasive. I think the simplest thing to do is to drop
> off_reg and dst_reg parameters from sanitize_err() and re-derive the
> information about which one is a pointer.

Scratch that, dst type is gone when sanitize_err() called.