[PATCH bpf v4 2/4] bpf: Preserve pointer state for commuted arithmetic

[Yiyang Chen via B4 Relay]

From: Yiyang Chen <cheny...@mails.tsinghua.edu.cn>

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
Signed-off-by: Yiyang Chen <cheny...@mails.tsinghua.edu.cn>
Tested-by: Daniel Wade <danjwad...@gmail.com>
Signed-off-by: Eduard Zingerman <eddy...@gmail.com>
---
 kernel/bpf/verifier.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9792d6622ffd6..cdb61fab84351 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13743,11 +13743,12 @@ static int adjust_ptr_min_max_vals(struct 
bpf_verifier_env *env,
                return -EACCES;
        }
 
-       /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
-        * The id may be overwritten later if we create a new variable offset.
+       /* For 'scalar += pointer', dst_reg inherits the complete pointer
+        * register state. Individual fields may be adjusted later by pointer
+        * arithmetic. Callers guarantee that below does not overwrite off_reg.
         */
-       dst_reg->type = ptr_reg->type;
-       dst_reg->id = ptr_reg->id;
+       if (dst_reg != ptr_reg)
+               *dst_reg = *ptr_reg;
 
        if (!check_reg_sane_offset_scalar(env, off_reg, ptr_reg->type) ||
            !check_reg_sane_offset_ptr(env, ptr_reg, ptr_reg->type))
@@ -13790,7 +13791,7 @@ static int adjust_ptr_min_max_vals(struct 
bpf_verifier_env *env,
                }
                break;
        case BPF_SUB:
-               if (dst_reg == off_reg) {
+               if (dst_reg != ptr_reg) {
                        /* scalar -= pointer.  Creates an unknown scalar */
                        verbose(env, "R%d tried to subtract pointer from 
scalar\n",
                                dst);
@@ -14808,8 +14809,8 @@ static int adjust_reg_min_max_vals(struct 
bpf_verifier_env *env,
                                err = mark_chain_precision(env, insn->dst_reg);
                                if (err)
                                        return err;
-                               return adjust_ptr_min_max_vals(env, insn,
-                                                              src_reg, 
dst_reg);
+                               off_reg = *dst_reg;
+                               return adjust_ptr_min_max_vals(env, insn, 
src_reg, &off_reg);
                        }
                } else if (ptr_reg) {
                        /* pointer += scalar */

-- 
2.43.0