Re: [PATCH bpf-next 1/2] bpf: reject pointer operands for 32-bit recurrences/latches

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Oct 20, 2026 at 04:47 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> -	if (ra && rb && bpf_same_memory_origin(ra, rb))
> +	if (ra && rb && bpf_same_memory_origin(ra, rb) && !latch->zext32 && !latch->jmp32)
>  		return true;

This covers the latch only. A 32-bit recurrence on a pointer that
is not part of the latch is still widened and clamped, it seems:

     r7 = map_value, r1 = 0
  l: if r7 > 24 goto a
     goto n
  a: r0 = *(u8 *)(r7 + 0)
  n: w7 = w7
     w7 += 8
     r1 += 1
     if r1 != 4 goto l

r7 at the header is (zext32 (linear r7 8)) and is_widenable_reg_type()
is fine with map_value. 'w7 = w7' makes it a scalar. At the backedge
bpf_clamp_scev_regs() takes linear_bounds() of the entry reg, which is
the offset of map_value, and clamps that scalar to 0..24.
Then 'if r7 > 24' is never taken, so 'a:' is verified with
r7 == map_value only. At run time in the 2nd iteration r7 is the low
32 bits of the address + 8 and the prog reads from there.

Should bpf_compute_loop_iters() also have
	(!coefs.zext32 || reg->type == SCALAR_VALUE)
next to is_widenable_reg_type() ?

pls follow up.