Re: [PATCH bpf-next v3 3/5] bpf: infer zext_dst based on static register liveness analysis

On Sun, 2026-08-02 at 21:07 +0000, [email protected] wrote:

...

> > @@ -15026,18 +14941,14 @@ static int check_alu_op(struct bpf_verifier_e=
nv *env, struct bpf_insn *insn)
> > =C2=A0				if (insn->imm) {
> > =C2=A0					/* off =3D=3D BPF_ADDR_SPACE_CAST */
> > =C2=A0					mark_reg_unknown(env, regs, insn->dst_reg);
> > -					if (insn->imm =3D=3D 1) { /* cast from as(1) to as(0) */
> > +					if (insn->imm =3D=3D 1) /* cast from as(1) to as(0) */
> > =C2=A0						dst_reg->type =3D PTR_TO_ARENA;
> > -						/* PTR_TO_ARENA is 32-bit */
> > -						dst_reg->subreg_def =3D env->insn_idx + 1;
> > -					}
>=20
> [Severity: Critical]
> Does this missing zero-extension for BPF_ADDR_SPACE_CAST allow out-of-bou=
nds
> arena access on architectures needing explicit zero-extension?

Nope, in combination with changes to bpf_is_reg64() in the next patch
it does not. bpf_is_reg64() handles BPF_ADDR_SPACE_CAST after that change.
The commit log is not very clear about that, though.

...