Re: [PATCH bpf-next v3 3/5] bpf: infer zext_dst based on static register liveness analysis

Eduard Zingerman <[email protected]> Sun, 02 Aug 2026 14:14:35 -0700

Newsgroups	org.kernel.vger.bpf,dev.linux.lists.sashiko-reviews
Message-ID	<[email protected]>

On Sun, 2026-08-02 at 21:07 +0000, [email protected] wrote:

...

> > @@ -15026,18 +14941,14 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
> >  				if (insn->imm) {
> >  					/* off == BPF_ADDR_SPACE_CAST */
> >  					mark_reg_unknown(env, regs, insn->dst_reg);
> > -					if (insn->imm == 1) { /* cast from as(1) to as(0) */
> > +					if (insn->imm == 1) /* cast from as(1) to as(0) */
> >  						dst_reg->type = PTR_TO_ARENA;
> > -						/* PTR_TO_ARENA is 32-bit */
> > -						dst_reg->subreg_def = env->insn_idx + 1;
> > -					}
> 
> [Severity: Critical]
> Does this missing zero-extension for BPF_ADDR_SPACE_CAST allow out-of-bounds
> arena access on architectures needing explicit zero-extension?

Nope, in combination with changes to bpf_is_reg64() in the next patch
it does not. bpf_is_reg64() handles BPF_ADDR_SPACE_CAST after that change.
The commit log is not very clear about that, though.

...