Re: [PATCH bpf-next v3 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Apr 3, 2026 at 4:24 PM EDT, Alexei Starovoitov wrote:
> On Thu, Apr 2, 2026 at 9:27 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
>>
>> From: Emil Tsalapatis <etsal@meta.com>
>>
>> The compiler sometimes stores the result of a PTR_TO_ARENA + SCALAR
>> addition into the scalar register rather than the pointer register.
>> Handle this case by upgrading the destination scalar register to
>> PTR_TO_ARENA, matching the existing handling when the destination is
>> already PTR_TO_ARENA.
>>
>> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
>> ---
>>  kernel/bpf/verifier.c | 18 ++++++++++++++++++
>>  1 file changed, 18 insertions(+)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 8c1cf2eb6cbb..583121b9aa7e 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -16333,6 +16333,24 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
>>                                         bpf_alu_string[opcode >> 4]);
>>                                 return -EACCES;
>>                         } else {
>> +                               /*
>> +                                * The compiler sometimes stores the result of
>> +                                * PTR_TO_ARENA + SCALAR addition to the scalar
>> +                                * register. Upgrade it to a PTR_TO_ARENA.
>> +                                */
>> +                               if (src_reg->type == PTR_TO_ARENA && opcode == BPF_ADD) {
>
> This is too specific and doesn't fully address the issue.
> How about something like this:

Makes sense, and keeps the SCALAR -> PTR_TO_ARENA in a single site. My
initial rationale for doing this just for ADD was that it was the only
two-operand operation that would make sense in this context, but that
is irrelevant to whether the instructions are safe.

>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 84699a428077..457ac555da72 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -16572,11 +16572,16 @@ static int adjust_reg_min_max_vals(struct
> bpf_verifier_env *env,
>         int err;
>
>         dst_reg = &regs[insn->dst_reg];
> -       src_reg = NULL;
> +       if (BPF_SRC(insn->code) == BPF_X)
> +               src_reg = &regs[insn->src_reg];
> +       else
> +               src_reg = NULL;
>
> -       if (dst_reg->type == PTR_TO_ARENA) {
> +       if (dst_reg->type == PTR_TO_ARENA || (src_reg && src_reg->type
> == PTR_TO_ARENA)) {
>                 struct bpf_insn_aux_data *aux = cur_aux(env);
>
> +               if (dst_reg->type != PTR_TO_ARENA)
> +                       *dst_reg = *src_reg;
>                 if (BPF_CLASS(insn->code) == BPF_ALU64)
>                         /*
>                          * 32-bit operations zero upper bits automatically.
> @@ -16592,7 +16597,6 @@ static int adjust_reg_min_max_vals(struct
> bpf_verifier_env *env,
>                 ptr_reg = dst_reg;
>
>         if (BPF_SRC(insn->code) == BPF_X) {
> -               src_reg = &regs[insn->src_reg];
>                 if (src_reg->type != SCALAR_VALUE) {
>                         if (dst_reg->type != SCALAR_VALUE) {
>                                 /* Combining two pointers by any ALU op yields