bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Tested-by: Daniel Wade <danjwade95@gmail.com>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9792d6622ffd66fcddfe1f3e875c1ac0c37891bb..cdb61fab843518989da5913091f16ccd33c7bf38 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13743,11 +13743,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                return -EACCES;
        }
 
-       /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
-        * The id may be overwritten later if we create a new variable offset.
+       /* For 'scalar += pointer', dst_reg inherits the complete pointer
+        * register state. Individual fields may be adjusted later by pointer
+        * arithmetic. Callers guarantee that below does not overwrite off_reg.
         */
-       dst_reg->type = ptr_reg->type;
-       dst_reg->id = ptr_reg->id;
+       if (dst_reg != ptr_reg)
+               *dst_reg = *ptr_reg;
 
        if (!check_reg_sane_offset_scalar(env, off_reg, ptr_reg->type) ||
            !check_reg_sane_offset_ptr(env, ptr_reg, ptr_reg->type))
@@ -13790,7 +13791,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                }
                break;
        case BPF_SUB:
-               if (dst_reg == off_reg) {
+               if (dst_reg != ptr_reg) {
                        /* scalar -= pointer.  Creates an unknown scalar */
                        verbose(env, "R%d tried to subtract pointer from scalar\n",
                                dst);
@@ -14808,8 +14809,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                                err = mark_chain_precision(env, insn->dst_reg);
                                if (err)
                                        return err;
-                               return adjust_ptr_min_max_vals(env, insn,
-                                                              src_reg, dst_reg);
+                               off_reg = *dst_reg;
+                               return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg);
                        }
                } else if (ptr_reg) {
                        /* pointer += scalar */