Merge branch 'bpf-keep-the-valid-bytes-of-a-packet-pointer-in-scalar-evolution'

Alexei Starovoitov says:

====================
bpf: Keep the valid bytes of a packet pointer in scalar evolution

From: Alexei Starovoitov <ast@kernel.org>

Sashiko found a bug in the review of [1]. It is in the tree since scalar
evolution widens packet pointers.

'range - umax' bytes from a packet pointer are in the packet. At the head
of a counted loop scalar evolution sets new bounds, and reg_bounds_sync()
makes umax smaller: 58 becomes 56 when the step is 8. The range does not
change. Then the verifier accepts 2 bytes that are not in the packet.

  prog                                    bpf tree  this fix
  --------------------------------------  --------  --------
  r6 += 8, access in the loop             loads     rejected
  r6 += -8, access in the loop            loads     rejected
  r6 += -8, the offset can be negative    loads     rejected
  access in the second iteration          loads     rejected
  r5 is r6 + 8 or r6                      loads     rejected

veristat shows the same verdicts and the same number of insns for all progs
of 36 weekly builds of Cilium (5032 progs), of sched-ext/scx (563 progs)
and of the selftests. test_progs, test_progs-no_alu32, test_progs-cpuv4,
test_progs-bpf_gcc and test_verifier have no new failure on x86-64.

v1 -> v2:
 - Use smax in place of umax. umax is U64_MAX when the offset can be
   negative. Then v1 did not change the range, or made it larger (Sashiko).
 - Change the range one time, after the last register of a union. v1
   changed it after each register. Then the subsequent register had a
   different range, and a correct prog got "verifier bug: union of
   incompatible registers" (bpf-ci, Sashiko).
 - Add widen_pkt_pointer_negative_offset. Change the prog in
   union_pkt_pointer_var_off_lowers_umax: it loads without the fix now.
 - Patch 1: correct the log. The removal of the mark can change a verdict.
 - v1 was on top of [1], which is in the bpf tree now. BPF CI and the two
   bots applied v1 without [1]. The two tests that failed in CI and the
   comments about bpf_clamp_scev_regs() have this cause.

v1: https://lore.kernel.org/bpf/20261027201436.3192716-1-alexei.starovoitov@gmail.com/
[1] https://lore.kernel.org/bpf/20261027190314.1440199-15-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
====================

Link: https://patch.msgid.link/20261030210950.1904640-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions