[PATCH 1/2] bpf: Preserve stack frame number for commuted arithmetic

[Yiyang Chen]

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register has to inherit the pointer register state from the
source pointer. Copying only selected fields is fragile because pointer
provenance is tracked by several bpf_reg_state fields.

For the commuted form, pass a temporary scalar offset register to the
common pointer arithmetic helper and copy the full pointer state before
applying pointer arithmetic. This preserves the frame number for
PTR_TO_STACK registers and keeps parent identity fields consistent.

Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
Signed-off-by: Yiyang Chen <cheny...@mails.tsinghua.edu.cn>
---
 kernel/bpf/verifier.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 52be0a118cce0..3c0af83db4672 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13796,11 +13796,12 @@ static int adjust_ptr_min_max_vals(struct 
bpf_verifier_env *env,
                return -EACCES;
        }
 
-       /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
-        * The id may be overwritten later if we create a new variable offset.
+       /* For 'scalar += pointer', dst_reg inherits the complete pointer
+        * register state. Individual fields may be adjusted later by pointer
+        * arithmetic.
         */
-       dst_reg->type = ptr_reg->type;
-       dst_reg->id = ptr_reg->id;
+       if (ptr_reg != dst_reg)
+               *dst_reg = *ptr_reg;
 
        if (!check_reg_sane_offset_scalar(env, off_reg, ptr_reg->type) ||
            !check_reg_sane_offset_ptr(env, ptr_reg, ptr_reg->type))
@@ -14854,15 +14855,18 @@ static int adjust_reg_min_max_vals(struct 
bpf_verifier_env *env,
                                        bpf_alu_string[opcode >> 4]);
                                return -EACCES;
                        } else {
+                               struct bpf_reg_state off_reg;
+
                                /* scalar += pointer
                                 * This is legal, but we have to reverse our
                                 * src/dest handling in computing the range
                                 */
+                               off_reg = *dst_reg;
                                err = mark_chain_precision(env, insn->dst_reg);
                                if (err)
                                        return err;
                                return adjust_ptr_min_max_vals(env, insn,
-                                                              src_reg, 
dst_reg);
+                                                              src_reg, 
&off_reg);
                        }
                } else if (ptr_reg) {
                        /* pointer += scalar */

base-commit: 0bcca2a42cc50b7d64a95c08dffc6b93661a7ea2
-- 
2.34.1