The verifier uses reg->frameno to distinguish stack pointers that have the same offset but refer to different call frames. The scalar += pointer path copies pointer type and id to the destination register, but it also needs to preserve pointer provenance fields such as the stack frame number.
Preserve the full pointer register state for commuted stack pointer arithmetic and add a verifier regression test where a callee derives its frame pointer through scalar += fp before overwriting and reloading the same stack slot. Changes in v2: - Preserve the full pointer register state instead of copying only selected fields, as suggested by Eduard. - Use a temporary scalar offset register for the commuted scalar += fp case, as suggested by Eduard. - Add a Fixes tag to the verifier change. - Drop CAP_SYS_ADMIN handling from the new verifier_basic_stack harness, as requested by Eduard. Yiyang Chen (2): bpf: Preserve stack frame number for commuted arithmetic selftests/bpf: Cover stack frame number after scalar plus fp kernel/bpf/verifier.c | 14 +++++++----- .../selftests/bpf/prog_tests/verifier.c | 2 - .../bpf/prog_tests/verifier_basic_stack.c | 14 ++++++++ .../bpf/progs/verifier_basic_stack.c | 41 +++++++++++++++++++ 4 files changed, 64 insertions(+), 10 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c base-commit: 0bcca2a42cc50b7d64a95c08dffc6b93661a7ea2 -- 2.34.1
