[PATCH bpf] bpf: Fix sanitize_err() register selection for BPF_K

sanitize_err() determines whether the source or destination register holds
the pointer by inspecting regs[insn->src_reg]. For BPF_K instructions,
src_reg is zero because the offset is encoded as an immediate. R0 must
therefore not influence the register reported for REASON_TYPE.

Treat BPF_K as an immediate scalar source and select the destination
register for the diagnostic.

Fixes: a15970d916b3 ("bpf: Simplify sanitize_err() signature")
Reported-by: Sashiko AI review <[email protected]>
Closes: https://lore.kernel.org/bpf/[email protected]/
Suggested-by: Eduard Zingerman <[email protected]>
Signed-off-by: Yiyang Chen <[email protected]>
---
This follows up on Eduard's request to special-case BPF_K when selecting
the register reported by sanitize_err():
https://lore.kernel.org/bpf/[email protected]/
---
 kernel/bpf/verifier.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fdc5fbb1f78ca..e5a8547ad7231 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13562,6 +13562,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
 	static const char *err = "pointer arithmetic with it prohibited for !root";
 	const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";
 	u32 dst = insn->dst_reg, src = insn->src_reg;
+	bool src_is_imm = BPF_SRC(insn->code) == BPF_K;
 	struct bpf_reg_state *regs = cur_regs(env);
 
 	switch (reason) {
@@ -13571,7 +13572,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
 		break;
 	case REASON_TYPE:
 		verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
-			regs[src].type == SCALAR_VALUE ? dst : src, err);
+			src_is_imm || regs[src].type == SCALAR_VALUE ? dst : src, err);
 		break;
 	case REASON_PATHS:
 		verbose(env, "R%d tried to %s from different maps, paths or scalars, %s\n",

---
base-commit: e5fd3f514e27db1f05fbd72ba615d74941e23c51
change-id: 20260803-c3-035-sanitize-err-v1-3aef2bf838bf
-- 
2.43.0