Re: [PATCH bpf] bpf: Fix sanitize_err() register selection for BPF_K

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:
- [Medium] The patch modifies `sanitize_err()` to handle `BPF_K` instructio=
ns, but this code path is mathematically unreachable because BPF_K instruct=
ions bypass ALU sanitation entirely.
--

--- Patch [1]: [PATCH bpf] bpf: Fix sanitize_err() register selection for B=
PF_K ---
commit 08e8e3769c4c795ad93d26ddc7c02599ba8cab32
Author: Yiyang Chen <[email protected]>

bpf: Fix sanitize_err() register selection for BPF_K

This patch modifies sanitize_err() to correctly report the destination
register for BPF_K instructions when generating ALU sanitization errors.
It ensures the source register field, which is zero for immediate
constants, does not interfere with the diagnostic output.

Closes: https://lore.kernel.org/bpf/[email protected]=
.org/

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -13562,6 +13562,7 @@ static int sanitize_err(struct bpf_verifier_env *=
env, const struct bpf_insn *ins
>  	static const char *err =3D "pointer arithmetic with it prohibited for !=
root";
>  	const char *op =3D BPF_OP(insn->code) =3D=3D BPF_ADD ? "add" : "sub";
>  	u32 dst =3D insn->dst_reg, src =3D insn->src_reg;
> +	bool src_is_imm =3D BPF_SRC(insn->code) =3D=3D BPF_K;
>  	struct bpf_reg_state *regs =3D cur_regs(env);
> =20
>  	switch (reason) {
> @@ -13571,7 +13572,7 @@ static int sanitize_err(struct bpf_verifier_env *=
env, const struct bpf_insn *ins
>  		break;
>  	case REASON_TYPE:
>  		verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
> -			regs[src].type =3D=3D SCALAR_VALUE ? dst : src, err);
> +			src_is_imm || regs[src].type =3D=3D SCALAR_VALUE ? dst : src, err);

[Severity: Medium]
Is this code path actually reachable for BPF_K instructions?

Looking at can_skip_alu_sanitation(), it appears to unconditionally return
true when BPF_SRC(insn->code) =3D=3D BPF_K:

kernel/bpf/verifier.c:can_skip_alu_sanitation() {
        return env->bypass_spec_v1 ||
               BPF_SRC(insn->code) =3D=3D BPF_K ||
               cur_aux(env)->nospec;
}

Since sanitize_ptr_alu() and sanitize_val_alu() both check
can_skip_alu_sanitation() first, won't they always return 0 for BPF_K?

If so, this would prevent sanitize_err() from ever being called for these
instructions, making this new logic unreachable.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260803-c3-035-san=
[email protected]?part=3D1