On Tue, 2026-07-21 at 09:39 +0000, Yiyang Chen wrote:
> When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> destination register has to inherit the pointer register state from the
> source pointer. Copying only selected fields is fragile because pointer
> provenance is tracked by several bpf_reg_state fields.
>
> For the commuted form, pass a temporary scalar offset register to the
> common pointer arithmetic helper and copy the full pointer state before
> applying pointer arithmetic. This preserves the frame number for
> PTR_TO_STACK registers and keeps parent identity fields consistent.
>
> Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
> Signed-off-by: Yiyang Chen <[email protected]>
> ---
> kernel/bpf/verifier.c | 14 +++++++++-----
> 1 file changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 52be0a118cce0..3c0af83db4672 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -13796,11 +13796,12 @@ static int adjust_ptr_min_max_vals(struct
> bpf_verifier_env *env,
> return -EACCES;
> }
>
> - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
> - * The id may be overwritten later if we create a new variable offset.
> + /* For 'scalar += pointer', dst_reg inherits the complete pointer
> + * register state. Individual fields may be adjusted later by pointer
> + * arithmetic.
> */
> - dst_reg->type = ptr_reg->type;
> - dst_reg->id = ptr_reg->id;
> + if (ptr_reg != dst_reg)
> + *dst_reg = *ptr_reg;
Lot's of tests are failing on the CI, please investigate.
>
> if (!check_reg_sane_offset_scalar(env, off_reg, ptr_reg->type) ||
> !check_reg_sane_offset_ptr(env, ptr_reg, ptr_reg->type))
> @@ -14854,15 +14855,18 @@ static int adjust_reg_min_max_vals(struct
> bpf_verifier_env *env,
> bpf_alu_string[opcode >> 4]);
> return -EACCES;
> } else {
> + struct bpf_reg_state off_reg;
> +
We store such temporaries in the bpf_verifier_env to avoid excessive
stack consumption.
> /* scalar += pointer
> * This is legal, but we have to reverse our
> * src/dest handling in computing the range
> */
> + off_reg = *dst_reg;
> err = mark_chain_precision(env, insn->dst_reg);
> if (err)
> return err;
> return adjust_ptr_min_max_vals(env, insn,
> - src_reg,
> dst_reg);
> + src_reg,
> &off_reg);
> }
> } else if (ptr_reg) {
> /* pointer += scalar */
>
> base-commit: 0bcca2a42cc50b7d64a95c08dffc6b93661a7ea2
