Re: [RESEND][REGRESSION][SECURITY] bpf, s390: verifier/JIT mismatch allows unprivileged kernel memory access

[Eduard Zingerman]

On Thu, 2026-07-23 at 02:05 -0700, Eduard Zingerman wrote:
> On Thu, 2026-07-23 at 17:16 +0900, Min-gyu Kim wrote:
> 
> ...
> 
> > Root cause
> > 
> > The verifier records an ALU32 definition in subreg_def. A later 64-bit read
> > causes mark_insn_zext() to mark that instruction for explicit zero extension.
> > Before 107e16979905, a cache hit in is_state_visited() propagated the 64-bit
> > read to the alternate path's ALU32 definition.
> 
> Hi Min-gyu,
> 
> Thank you for the report.
> 
> > Commit 107e16979905 removed that propagation when register-chain liveness was
> > replaced with static liveness. The static live-register mask does not track
> > read width or path-specific subreg_def information. In current states.c,
> > regs_exact() compares only fields before id, while subreg_def follows id in
> > struct bpf_reg_state.
> 
> Hm, the stack is tracked with 32-bit granularity and it should be easy
> to adjust compute_live_registers() to track the width. I'll give it a try.

I figured out the repro and am working on the fix.
The plan is to extend compute_live_registers() to statically infer
which upper 32-bit subregisters are alive and use this information
to fixup zero extensions, and drop the reg->subreg_def altogether.

...