Re: [PATCH bpf-next v3 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Apr 3, 2026 at 1:04 AM EDT, bot+bpf-ci wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index a431b7d50e1b..a0e6522833ae 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -16354,6 +16354,24 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
>>  				return -EACCES;
>>  			} else {
>> +				/*
>> +				 * The compiler sometimes stores the result of
>> +				 * PTR_TO_ARENA + SCALAR addition to the scalar
>> +				 * register. Upgrade it to a PTR_TO_ARENA.
>> +				 */
>> +				if (src_reg->type == PTR_TO_ARENA && opcode == BPF_ADD) {
>> +					struct bpf_insn_aux_data *aux = cur_aux(env);
>> +
>> +					__mark_reg_unknown(env, dst_reg);
>> +					dst_reg->type = PTR_TO_ARENA;
>> +					dst_reg->subreg_def = env->insn_idx + 1;
>> +
>> +					if (BPF_CLASS(insn->code) == BPF_ALU64)
>> +						aux->needs_zext = true;
>> +
>> +					return 0;
>> +				}
>
> This appears to fix a gap in the original PTR_TO_ARENA support added by
> commit 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the
> verifier."), which handled arithmetic when the destination was already
> PTR_TO_ARENA but missed the commutative case where the scalar register
> is the destination.
>
> Should this carry a Fixes: tag?
>
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
>
Ack, I will add the tag in subsequent versions.

>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/23934176047