bpf: Fix print_reg_state's constant scalar dump

print_reg_state() should not consider adding reg->off to reg->var_off.value
when dumping scalars. Scalars can be produced with reg->off != 0 through
BPF_ADD_CONST, and thus as-is this can skew the register log dump.

Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.")
Reported-by: Nathaniel Theis <nathaniel.theis@nccgroup.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241016134913.32249-2-daniel@iogearbox.net

diff --git a/kernel/bpf/log.c b/kernel/bpf/log.c
index 5aebfc3051e3a63b84620283a98c6cd73949b56d..4a858fdb6476f894d1259a091477ca5d893f8992 100644 (file)
--- a/kernel/bpf/log.c
+++ b/kernel/bpf/log.c
@@ -688,8 +688,7 @@ static void print_reg_state(struct bpf_verifier_env *env,
        if (t == SCALAR_VALUE && reg->precise)
                verbose(env, "P");
        if (t == SCALAR_VALUE && tnum_is_const(reg->var_off)) {
-               /* reg->off should be 0 for SCALAR_VALUE */
-               verbose_snum(env, reg->var_off.value + reg->off);
+               verbose_snum(env, reg->var_off.value);
                return;
        }