bpf: Simplify sanitize_err() signature

The sanitize_err() function is called when:
- ptr += scalar
- scalar += ptr
- scalar += scalar
ALU operations are processed.

This commit drops offset and pointer registers parameters from its
signature to simplify the follow-up changes for 'scalar += ptr' case.
regs[src].type is safe to access, as it is not mutated by the callers.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-1-8ee297e2346b@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7aa47342dc659cc9b19eb69ae7bc551daed894ba..9792d6622ffd66fcddfe1f3e875c1ac0c37891bb 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13557,23 +13557,21 @@ static void sanitize_mark_insn_seen(struct bpf_verifier_env *env)
                env->insn_aux_data[env->insn_idx].seen = env->pass_cnt;
 }
 
-static int sanitize_err(struct bpf_verifier_env *env,
-                       const struct bpf_insn *insn, int reason,
-                       const struct bpf_reg_state *off_reg,
-                       const struct bpf_reg_state *dst_reg)
+static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *insn, int reason)
 {
        static const char *err = "pointer arithmetic with it prohibited for !root";
        const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";
        u32 dst = insn->dst_reg, src = insn->src_reg;
+       struct bpf_reg_state *regs = cur_regs(env);
 
        switch (reason) {
        case REASON_BOUNDS:
                verbose(env, "R%d has unknown scalar with mixed signed bounds, %s\n",
-                       off_reg == dst_reg ? dst : src, err);
+                       regs[src].type == SCALAR_VALUE ? src : dst, err);
                break;
        case REASON_TYPE:
                verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
-                       off_reg == dst_reg ? src : dst, err);
+                       regs[src].type == SCALAR_VALUE ? dst : src, err);
                break;
        case REASON_PATHS:
                verbose(env, "R%d tried to %s from different maps, paths or scalars, %s\n",
@@ -13762,7 +13760,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
                                       &info, false);
                if (ret < 0)
-                       return sanitize_err(env, insn, ret, off_reg, dst_reg);
+                       return sanitize_err(env, insn, ret);
        }
 
        switch (opcode) {
@@ -13855,7 +13853,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                        return -EFAULT;
                }
                if (ret < 0)
-                       return sanitize_err(env, insn, ret, off_reg, dst_reg);
+                       return sanitize_err(env, insn, ret);
        }
 
        return 0;
@@ -14607,7 +14605,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
        if (sanitize_needed(opcode)) {
                ret = sanitize_val_alu(env, insn);
                if (ret < 0)
-                       return sanitize_err(env, insn, ret, NULL, NULL);
+                       return sanitize_err(env, insn, ret);
        }
 
        /* Calculate sign/unsigned bounds and tnum for alu32 and alu64 bit ops.