Re: [RESEND][REGRESSION][SECURITY] bpf, s390: verifier/JIT mismatch allows unprivileged kernel memory access

On Thu, 2026-07-23 at 02:05 -0700, Eduard Zingerman wrote:
> On Thu, 2026-07-23 at 17:16 +0900, Min-gyu Kim wrote:
>=20
> ...
>=20
> > Root cause
> >=20
> > The verifier records an ALU32 definition in subreg_def. A later 64-bit =
read
> > causes mark_insn_zext() to mark that instruction for explicit zero exte=
nsion.
> > Before 107e16979905, a cache hit in is_state_visited() propagated the 6=
4-bit
> > read to the alternate path's ALU32 definition.
>=20
> Hi Min-gyu,
>=20
> Thank you for the report.
>=20
> > Commit 107e16979905 removed that propagation when register-chain livene=
ss was
> > replaced with static liveness. The static live-register mask does not t=
rack
> > read width or path-specific subreg_def information. In current states.c=
,
> > regs_exact() compares only fields before id, while subreg_def follows i=
d in
> > struct bpf_reg_state.
>=20
> Hm, the stack is tracked with 32-bit granularity and it should be easy
> to adjust compute_live_registers() to track the width. I'll give it a try=
.

I figured out the repro and am working on the fix.
The plan is to extend compute_live_registers() to statically infer
which upper 32-bit subregisters are alive and use this information
to fixup zero extensions, and drop the reg->subreg_def altogether.

...