Re: [PATCH bpf-next 2/4] bpf: Merge pointer types also when both are PTR_TO_MEM

On Thu, 2026-08-13 at 22:40 +0200, Daniel Borkmann wrote:
> save_aux_ptr_type() only reaches the merge when reg_type_mismatch() says
> the two types are incompatible, and that in turn requires at least one of
> them to have a base type reg_type_mismatch_ok() rejects. PTR_TO_MEM is
> not among those, so for two PTR_TO_MEM based types the merge never runs
> and the recorded type stays the one of whichever path was verified first.
> 
> That is ok as long as all PTR_TO_MEM variants can be dereferenced with
> a plain load, which stopped being true with commit f2362a57aeff ("bpf:
> allow void* cast using bpf_rdonly_cast()") adding PTR_TO_MEM | MEM_RDONLY
> > PTR_UNTRUSTED. If the other path saved e.g. a PTR_TO_MEM | MEM_RINGBUF
> first, then bpf_convert_ctx_accesses() does not rewrite the load into a
> BPF_PROBE_MEM one, and the untrusted path faults on a plain load.
> 
> Fix by merging the two whenever they differ and both are of PTR_TO_MEM or
> PTR_TO_BTF_ID base instead of keying it off reg_type_mismatch(), so that
> merge_ptr_types() gets to normalize the result in this case as well. The
> rejection of genuinely incompatible types is left untouched.
> 
> Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()")
> Signed-off-by: Daniel Borkmann <[email protected]>
> ---

Would the following work?

  diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
  index 1e537bc25ef5..a02914af0f5b 100644
  --- a/kernel/bpf/verifier.c
  +++ b/kernel/bpf/verifier.c
  @@ -17022,6 +17022,8 @@ static bool reg_type_mismatch_ok(enum bpf_reg_type type)
        case PTR_TO_BTF_ID:
        case PTR_TO_ARENA:
                return false;
  +     case PTR_TO_MEM:
  +             return !may_fault_on_deref(type);
        default:
                return true;

?