kernel/bpf/verifier.c

12875 			    const struct bpf_reg_state *off_reg,
12882 	bool off_is_imm = tnum_is_const(off_reg->var_off);
12883 	bool off_is_neg = off_reg->smin_value < 0;
12902 		if (!tnum_is_const(off_reg->var_off) &&
12903 		    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
12983 			const struct bpf_reg_state *off_reg,
12993 			off_reg == dst_reg ? dst : src, err);
12997 			off_reg == dst_reg ? src : dst, err);
13094 				   const struct bpf_reg_state *off_reg)
13099 	bool known = tnum_is_const(off_reg->var_off);
13100 	s64 smin_val = off_reg->smin_value, smax_val = off_reg->smax_value,
13102 	u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
13174 	if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) ||
13182 		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
13185 			return sanitize_err(env, insn, ret, off_reg, dst_reg);
13205 		/* A new variable offset is created.  Note that off_reg->off
13210 		 * this creates a new 'base' pointer, off_reg (variable) gets
13230 		dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);
13240 		if (dst_reg == off_reg) {
13289 		dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);
13319 		ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,
13322 			return sanitize_err(env, insn, ret, off_reg, dst_reg);
14028 	struct bpf_reg_state *ptr_reg = NULL, off_reg = {0};
14100 		off_reg.type = SCALAR_VALUE;
14101 		__mark_reg_known(&off_reg, insn->imm);
14102 		src_reg = &off_reg;
19941 			u32 off_reg;
19953 			off_reg = issrc ? insn->src_reg : insn->dst_reg;
19958 					*patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
19960 				*patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
19961 				*patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
19964 				*patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
19974 				*patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);