On Fri, 2026-07-24 at 11:05 +0800, Shung-Hsi Yu wrote:
> On Thu, Jul 23, 2026 at 02:07:20PM -0700, Eduard Zingerman wrote:
> > On Wed, 2026-07-22 at 05:27 +0000, Yiyang Chen wrote:
> > > When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> > > destination register inherits the pointer state from the source pointer.
> > > Copying only selected fields is fragile because pointer provenance is
> > > tracked by several bpf_reg_state fields.
> > >
> > > Use verifier-env scratch storage to preserve the scalar operand while
> > > replacing the destination with the full pointer state. This preserves the
> > > frame number for PTR_TO_STACK registers and keeps parent identity fields
> > > consistent.
> > >
> > > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
> > > Signed-off-by: Yiyang Chen <[email protected]>
> > > ---
> > >
> > > kernel/bpf/verifier.c | 21 ++++++++++++++-------
> > > 1 file changed, 14 insertions(+), 7 deletions(-)
> > >
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 52be0a118cce0..085cbd5222737 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -13726,11 +13726,14 @@ static int adjust_ptr_min_max_vals(struct
> > > bpf_verifier_env *env,
> >
> > Yiyang,
> >
> > I noticed there there is a temporary 'off' reg allocated on stack by
> > the caller of this function. So, let's reuse it, ...
>
> 'off_reg' perhaps?
>
> +1
>
> > and also adjust the
> > sanitize_err signature to minimize changes.
> >
> > Could you please re-spin using the attached patches?
> >
> > Shung-Hsi, wdyt?
>
> Refactoring LGTM. Feels like the alias check 'dst_reg != ptr_reg' would
> still bite us later, but perhaps that something for another time.
Might be the case, we can extract it as a boolean at the top of the
function, same way Yiyang had it, or just pass as a boolean to
adjust_ptr_min_max_vals().
