Re: [PATCH bpf] bpf: Fix sanitize_err() register selection for BPF_K

On Mon, 2026-08-03 at 15:25 +0000, [email protected] wrote:
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index fdc5fbb1f78c..e5a8547ad723 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -13562,6 +13562,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
> >  	static const char *err = "pointer arithmetic with it prohibited for !root";
> >  	const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";
> >  	u32 dst = insn->dst_reg, src = insn->src_reg;
> > +	bool src_is_imm = BPF_SRC(insn->code) == BPF_K;
> >  	struct bpf_reg_state *regs = cur_regs(env);
> > 
> >  	switch (reason) {
> > @@ -13571,7 +13572,7 @@ static int sanitize_err(struct bpf_verifier_env *env, const struct bpf_insn *ins
> >  		break;
> >  	case REASON_TYPE:
> >  		verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
> > -			regs[src].type == SCALAR_VALUE ? dst : src, err);
> > +			src_is_imm || regs[src].type == SCALAR_VALUE ? dst : src, err);
> >  		break;
> >  	case REASON_PATHS:
> >  		verbose(env, "R%d tried to %s from different maps, paths or scalars, %s\n",
> 
> Can this code path be reached for BPF_K instructions? The new src_is_imm
> check appears to be unreachable.
>
> All three call sites of sanitize_err() (at verifier.c:13765, :13858 and
> :14610) fire only when sanitize_ptr_alu() or sanitize_val_alu() return a
> negative REASON_* code. Both of those functions begin with:
> 
> static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
>                                     const struct bpf_insn *insn)
> {
>         return env->bypass_spec_v1 ||
>                 BPF_SRC(insn->code) == BPF_K ||
>                 cur_aux(env)->nospec;
> }
> 
> and check this at their entry:
> 
>   sanitize_val_alu()  verifier.c:13415:  if (can_skip_alu_sanitation(env, insn)) return 0;
>   sanitize_ptr_alu()  verifier.c:13469:  if (can_skip_alu_sanitation(env, insn)) return 0;

Hi Yiyang,

Thank you for the follow-up. I double-checked what bot is saying,
and it correct. The original report from Sashiko was a false positive.
Given this, let's keep the code as-is for now.

...