Re: [PATCH bpf-next v5 1/9] bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Apr 10, 2026 at 1:34 PM EDT, bot+bpf-ci wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 9c1135d373e24..6c5721434bc4b 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -16655,11 +16655,32 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
>
> [ ... ]
>
>> +		if (dst_reg->type != PTR_TO_ARENA) {
>> +			/* Can't do arena arithmetic with non-scalars. */
>> +			if (dst_reg->type != SCALAR_VALUE) {
>> +				verbose(env, "R%d %s R%d: Invalid operation between "
>> +						"bpf_reg_state types %s and %s\n",
>> +					insn->dst_reg,
>> +					bpf_alu_string[opcode >> 4],
>> +					insn->src_reg,
>> +					reg_type_str(env, dst_reg->type),
>> +					reg_type_str(env, src_reg->type));
>
> reg_type_str() returns a pointer to the shared buffer env->tmp_str_buf.
> Its own comment in log.c says:
>
>     Note that reg_type_str() can not appear more than once in a
>     single verbose() statement.
>
> Calling it twice in the same verbose() here means both %s arguments
> point to the same buffer, so the error message will display one of the
> two type names twice and the other not at all.
>
> Would it work to split this into two verbose() calls, or save one
> result to a local buffer before printing?
>

Ack. We can just split this into two verbose() statements.

>> +				return -EACCES;
>> +			}
>> +
>> +			*dst_reg = *src_reg;
>> +			dst_reg->subreg_def = env->insn_idx + 1;
>> +		}
>
> [ ... ]
>
> This commit fixes a bug where the verifier rejects valid BPF programs
> when the compiler places the result of a PTR_TO_ARENA + SCALAR addition
> into the scalar register. The bug was introduced by commit 6082b6c328b5
> ("bpf: Recognize addr_space_cast instruction in the verifier.") which
> added the original PTR_TO_ARENA handling in the verifier.
>
> This was also noted during review of the v3 series on lore, and the
> Fixes: tag was acknowledged but appears to be missing from the final
> version. Should this carry:
>
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
>

Not sure actually. The original patch logic was overly restrictive, but
it's not like it was broken. This code is more of an expansion than a
fix imo.

>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24254055723