Re: [PATCH bpf v4 2/4] bpf: Preserve pointer state for commuted arithmetic

[Shung-Hsi Yu]

On Wed, Jul 29, 2026 at 03:18:28PM +0000, Yiyang Chen via B4 Relay wrote:
> From: Yiyang Chen <chenyy23@xxxxxxxxxxxxxxxxxxxxx>
> 
> When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> destination register inherits the pointer state from the source pointer.
> Copying only selected fields is fragile because pointer provenance is
> tracked by several bpf_reg_state fields.
> 
> Use the caller's temporary offset register to preserve the scalar operand
> while replacing the destination with the full pointer state. This preserves
> the frame number for PTR_TO_STACK registers and keeps parent identity
> fields consistent.
> 
> Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
> Signed-off-by: Yiyang Chen <chenyy23@xxxxxxxxxxxxxxxxxxxxx>
> Tested-by: Daniel Wade <danjwade95@xxxxxxxxx>
> Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>

Acked-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>