Re: [RESEND][REGRESSION][SECURITY] bpf, s390: verifier/JIT mismatch allows unprivileged kernel memory access

[Eduard Zingerman <eddyz87@gmail.com>]

On Thu, 2026-07-23 at 17:16 +0900, Min-gyu Kim wrote:

...

> Root cause
> 
> The verifier records an ALU32 definition in subreg_def. A later 64-bit read
> causes mark_insn_zext() to mark that instruction for explicit zero extension.
> Before 107e16979905, a cache hit in is_state_visited() propagated the 64-bit
> read to the alternate path's ALU32 definition.

Hi Min-gyu,

Thank you for the report.

> Commit 107e16979905 removed that propagation when register-chain liveness was
> replaced with static liveness. The static live-register mask does not track
> read width or path-specific subreg_def information. In current states.c,
> regs_exact() compares only fields before id, while subreg_def follows id in
> struct bpf_reg_state.

Hm, the stack is tracked with 32-bit granularity and it should be easy
to adjust compute_live_registers() to track the width. I'll give it a try.

> The SCALAR_VALUE case in regsafe() also does not compare
> subreg_def. States with equal tracked scalar values but different ALU32
> definitions can therefore compare as equal, leaving the pruned path's ALU32
> instruction without a zero-extension mark.

This is orthogonal to liveness mechanism, this is also much older.
I think this is the true root cause and it should be possible to
construct a test case triggering false-pruning on <6.18.

Thanks,
Eduard

...