Re: [PATCH bpf-next 16/37] bpf: Count loops whose first value or bound is a range

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: iv_bounds() leaves bounds->r32 un-narrowed before log_bounds()
--

commit 2f96c458caf20b2679374f41e2e5031f644f1eb1
Author: Alexei Starovoitov <ast@kernel.org>

bpf: Count loops whose first value or bound is a range

This commit extends BPF scalar evolution (SCEV) to compute upper bounds on
loop iteration counts when the initial value or latch bound is a range rather
than a constant, and narrows the induction variable range at the loop header
using iv_bounds().

> diff --git a/kernel/bpf/scev.c b/kernel/bpf/scev.c
> index 8662205a3b594..eac792dc7b103 100644
> --- a/kernel/bpf/scev.c
> +++ b/kernel/bpf/scev.c
[ ... ]
> @@ -2626,6 +2935,14 @@ static void linear_bounds(struct bpf_reg_state *reg, u32 max_header_count,
>  	out->r32 = r32;
>  }
>  
> +static void iv_bounds(struct bounds *bounds, struct cnum64 iv_range)
> +{
> +	struct cnum64 r64 = cnum64_intersect(bounds->r64, iv_range);
> +
> +	if (!cnum64_is_empty(r64))
> +		bounds->r64 = r64;
> +}
> +
[ ... ]
> @@ -2925,6 +3244,8 @@ int bpf_widen_scev_regs(struct bpf_verifier_env *env, struct bpf_verifier_state
>  			if (err)
>  				return err;
>  			linear_bounds(reg, iters->max_header_count, &coefs, &bounds);
> +			if (r == iters->iv_reg)
> +				iv_bounds(&bounds, iters->iv_range);
>  			if (log->level & BPF_LOG_LEVEL2) {
>  				bpf_log(log, "loop header at %d, widening ", insn_idx);
>  				log_reg(env, r);
[ ... ]
> @@ -3005,6 +3328,8 @@ int bpf_clamp_scev_regs(struct bpf_verifier_env *env, struct bpf_func_state *cur
>  			continue;
>  
>  		linear_bounds(entry_reg, max_header_count, &coefs, &bounds);
> +		if (r == entry->iv_reg)
> +			iv_bounds(&bounds, entry->iv_range);
>  		if (log->level & BPF_LOG_LEVEL2) {
>  			bpf_log(log, "loop header at %d, clamping ", insn_idx);
>  			log_reg(env, r);

[Severity: Low]
Should iv_bounds() also narrow bounds->r32 when bounds->r64 is narrowed?

When widening or clamping a 32-bit induction variable (coefs.zext32 is true)
with a range initial value or bound, linear_bounds() populates both
bounds.r64 and bounds.r32 with the wider range computed from
max_header_count (for example, 0..32 when initial is 0..16 and bound is 17).

Calling iv_bounds() then intersects bounds->r64 with iv_range (narrowing
bounds.r64 to 0..16), but leaves bounds->r32 untouched at 0..32.

Although bpf_set_reg_range() later synchronizes reg->r32 from reg->r64 via
reg_bounds_sync(), log_bounds() is called in bpf_widen_scev_regs() and
bpf_clamp_scev_regs() before bpf_set_reg_range(). Because bounds->r32.size
is less than U32_MAX and cnum32_smax(bounds->r32) differs from
cnum64_smax(bounds->r64), log_bounds() at BPF_LOG_LEVEL2 prints the stale
un-narrowed 32-bit subregister range (for example, "0..16 (s32 0..32) step 1").

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103234104.208239-1-alexei.starovoitov@gmail.com?part=16