kernel/bpf/verifier.c

4630 	struct bpf_reg_state *ptr_reg = NULL, *value_reg = NULL;
4639 	ptr_reg = &cur->regs[ptr_regno];
4640 	min_off = ptr_reg->smin_value + off;
4641 	max_off = ptr_reg->smax_value + off + size;
12591 static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
12596 	switch (ptr_reg->type) {
12604 		ptr_limit = -(ptr_reg->var_off.value + ptr_reg->off);
12607 		max = ptr_reg->map_ptr->value_size;
12609 			     ptr_reg->smin_value :
12610 			     ptr_reg->umax_value) + ptr_reg->off;
12689 			    const struct bpf_reg_state *ptr_reg,
12699 	bool ptr_is_dst_reg = ptr_reg == dst_reg;
12725 	err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left);
12774 		copy_register_state(dst_reg, ptr_reg);
12908 				   const struct bpf_reg_state *ptr_reg,
12916 	    smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
12918 	    umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
12948 	if (ptr_reg->type & PTR_MAYBE_NULL) {
12950 			dst, reg_type_str(env, ptr_reg->type));
12954 	switch (base_type(ptr_reg->type)) {
12979 			dst, reg_type_str(env, ptr_reg->type));
12986 	dst_reg->type = ptr_reg->type;
12987 	dst_reg->id = ptr_reg->id;
12989 	if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) ||
12990 	    !check_reg_sane_offset(env, ptr_reg, ptr_reg->type))
12997 		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
13008 		if (known && (ptr_reg->off + smin_val ==
13009 			      (s64)(s32)(ptr_reg->off + smin_val))) {
13015 			dst_reg->var_off = ptr_reg->var_off;
13016 			dst_reg->off = ptr_reg->off + smin_val;
13017 			dst_reg->raw = ptr_reg->raw;
13027 		 * from ptr_reg.
13045 		dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);
13046 		dst_reg->off = ptr_reg->off;
13047 		dst_reg->raw = ptr_reg->raw;
13048 		if (reg_is_pkt_pointer(ptr_reg)) {
13065 		if (ptr_reg->type == PTR_TO_STACK) {
13070 		if (known && (ptr_reg->off - smin_val ==
13071 			      (s64)(s32)(ptr_reg->off - smin_val))) {
13077 			dst_reg->var_off = ptr_reg->var_off;
13078 			dst_reg->id = ptr_reg->id;
13079 			dst_reg->off = ptr_reg->off - smin_val;
13080 			dst_reg->raw = ptr_reg->raw;
13104 		dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);
13105 		dst_reg->off = ptr_reg->off;
13106 		dst_reg->raw = ptr_reg->raw;
13107 		if (reg_is_pkt_pointer(ptr_reg)) {
13128 	if (!check_reg_sane_offset(env, dst_reg, ptr_reg->type))
13881 	struct bpf_reg_state *ptr_reg = NULL, off_reg = {0};
13903 		ptr_reg = dst_reg;
13936 		} else if (ptr_reg) {
13956 		if (ptr_reg) /* pointer += K */
13958 						       ptr_reg, src_reg);
13962 	if (WARN_ON_ONCE(ptr_reg)) {
13964 		verbose(env, "verifier internal error: unexpected ptr_reg\n");