On Thu, Jul 23, 2026 at 02:07:20PM -0700, Eduard Zingerman wrote:
> On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote:
> > When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> > destination register inherits the pointer state from the source pointer.
> > Copying only selected fields is fragile because pointer provenance is
> > tracked by several bpf_reg_state fields.
> >
> > Use verifier-env scratch storage to preserve the scalar operand while
> > replacing the destination with the full pointer state. This preserves the
> > frame number for PTR_TO_STACK registers and keeps parent identity fields
> > consistent.
> >
> > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
> > Signed-off-by: Yiyang Chen <[email protected]>
> > ---
> >
> > kernel/bpf/verifier.c | 21 ++++++++++++++-------
> > 1 file changed, 14 insertions(+), 7 deletions(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 52be0a118cce0..085cbd5222737 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -13726,11 +13726,14 @@ static int adjust_ptr_min_max_vals(struct
> > bpf_verifier_env *env,
>
> Yiyang,
>
> I noticed there there is a temporary 'off' reg allocated on stack by
> the caller of this function. So, let's reuse it, ...
'off_reg' perhaps?
+1
> and also adjust the
> sanitize_err signature to minimize changes.
>
> Could you please re-spin using the attached patches?
>
> Shung-Hsi, wdyt?
Refactoring LGTM. Feels like the alias check 'dst_reg != ptr_reg' would
still bite us later, but perhaps that something for another time.
...
