On Thu, 2026-07-23 at 10:35 -0700, Eduard Zingerman wrote: > On Thu, 2026-07-23 at 12:25 +0800, Shung-Hsi Yu wrote: > > ... > > > The sole purpose of having orig_off_reg seem to be for satisfying the > > 'off_reg == dst_reg' conditional in sanitize_err(). If that's the case, > > maybe it is better to change sanitize_err to accept an ptr_is_dst_reg > > argument too. > > > > And given now that we are starting to make more use of scratch register > > states, it seems better to get rid the likes of 'off_reg == dst_reg' all > > together, and simply have ptr_is_dst_reg passed down by > > adjust_scalar_min_max_vals(). > > > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > index 52be0a118cce..72d49f2a57a3 100644 > > --- a/kernel/bpf/verifier.c > > +++ b/kernel/bpf/verifier.c > > @@ -13505,13 +13505,13 @@ static int sanitize_ptr_alu(struct > > bpf_verifier_env *env, > > const struct bpf_reg_state *off_reg, > > struct bpf_reg_state *dst_reg, > > struct bpf_sanitize_info *info, > > - const bool commit_window) > > + const bool commit_window, > > + const bool ptr_is_dst_reg) > > That's a bit invasive. I think the simplest thing to do is to drop > off_reg and dst_reg parameters from sanitize_err() and re-derive the > information about which one is a pointer.
Scratch that, dst type is gone when sanitize_err() called.
