bpf: Handle multiple variable additions into packet pointers in verifier.

We must accumulate into reg->aux_off rather than use a plain assignment.

Add a test for this situation to test_align.

Reported-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 1 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e74fb1b87855..39f2dcbc4cbc 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1531,7 +1531,7 @@ add_imm:
                 dst_reg->id = ++env->id_gen;
 
                 /* something was added to pkt_ptr, set range to zero */
-                dst_reg->aux_off = dst_reg->off;
+                dst_reg->aux_off += dst_reg->off;
                 dst_reg->off = 0;
                 dst_reg->range = 0;
                 if (had_id)