Re: [PATCH bpf-next 2/4] bpf: Merge pointer types also when both are PTR_TO_MEM

On 8/14/26 2:14 AM, Eduard Zingerman wrote:
> On Thu, 2026-08-13 at 22:40 +0200, Daniel Borkmann wrote:
>> save_aux_ptr_type() only reaches the merge when reg_type_mismatch() says
>> the two types are incompatible, and that in turn requires at least one of
>> them to have a base type reg_type_mismatch_ok() rejects. PTR_TO_MEM is
>> not among those, so for two PTR_TO_MEM based types the merge never runs
>> and the recorded type stays the one of whichever path was verified first.
>>
>> That is ok as long as all PTR_TO_MEM variants can be dereferenced with
>> a plain load, which stopped being true with commit f2362a57aeff ("bpf:
>> allow void* cast using bpf_rdonly_cast()") adding PTR_TO_MEM | MEM_RDONLY
>>> PTR_UNTRUSTED. If the other path saved e.g. a PTR_TO_MEM | MEM_RINGBUF
>> first, then bpf_convert_ctx_accesses() does not rewrite the load into a
>> BPF_PROBE_MEM one, and the untrusted path faults on a plain load.
>>
>> Fix by merging the two whenever they differ and both are of PTR_TO_MEM or
>> PTR_TO_BTF_ID base instead of keying it off reg_type_mismatch(), so that
>> merge_ptr_types() gets to normalize the result in this case as well. The
>> rejection of genuinely incompatible types is left untouched.
>>
>> Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()")
>> Signed-off-by: Daniel Borkmann <[email protected]>
>> ---
> 
> Would the following work?
> 
>    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>    index 1e537bc25ef5..a02914af0f5b 100644
>    --- a/kernel/bpf/verifier.c
>    +++ b/kernel/bpf/verifier.c
>    @@ -17022,6 +17022,8 @@ static bool reg_type_mismatch_ok(enum bpf_reg_type type)
>          case PTR_TO_BTF_ID:
>          case PTR_TO_ARENA:
>                  return false;
>    +     case PTR_TO_MEM:
>    +             return !may_fault_on_deref(type);
>          default:
>                  return true;
Yes, that works and looks cleaner. Will integrate, thanks!