[PATCH bpf-next 0/2] bpf: Preserve stack frame number for commuted stack arithmetic

[Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>]

The verifier uses reg->frameno to distinguish stack pointers that have the
same offset but refer to different call frames. The scalar += pointer path
copies pointer type and id to the destination register, but it also needs to
preserve frameno when the source pointer is PTR_TO_STACK.

Preserve the frame number for commuted stack pointer arithmetic and add a
verifier regression test where a callee derives its frame pointer through
scalar += fp before overwriting and reloading the same stack slot.

Yiyang Chen (2):
  bpf: Preserve stack frame number for commuted arithmetic
  selftests/bpf: Cover stack frame number after scalar plus fp

 kernel/bpf/verifier.c                         |  7 +++-
 .../selftests/bpf/prog_tests/verifier.c       |  2 -
 .../bpf/prog_tests/verifier_basic_stack.c     | 28 +++++++++++++
 .../bpf/progs/verifier_basic_stack.c          | 41 +++++++++++++++++++
 4 files changed, 74 insertions(+), 4 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/verifier_basic_stack.c


base-commit: cfce77b63375dac81d53f2f85593c548415206b7
-- 
2.34.1