Re: [PATCH bpf-next v1 09/17] bpf: Report Memory Safety bounds errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Diagnostic message for `BPF_DIAG_MEM_NEGATIVE_MIN` prints a large positive number instead of a negative number when `reg_smin(reg)` is `S64_MIN` and `off` is negative, due to signed 64-bit integer wrap-around.
--

commit 176ba692cb9724623bf456ca5401c93a61c5ea8d
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Report Memory Safety bounds errors

This commit augments check_mem_region_access() range-proof failures with Memory
Safety reports. The existing terse verifier messages remain in place for
compatibility while the new report adds the failed proof, source context,
causal path, and guidance.

> diff --git a/kernel/bpf/diagnostics.c b/kernel/bpf/diagnostics.c
> index 920ac17758c20..0abe1ab19d252 100644
> --- a/kernel/bpf/diagnostics.c
> +++ b/kernel/bpf/diagnostics.c

[ ... ]

> +void bpf_diag_report_mem_bounds(struct bpf_verifier_env *env, u32 insn_idx,
> +				int regno, const char *reg_name,
> +				const char *type_name,
> +				enum bpf_diag_mem_bounds_kind kind,
> +				int off, int size, u32 mem_size,
> +				const struct bpf_reg_state *reg)
> +{

[ ... ]

> +	switch (kind) {
> +	case BPF_DIAG_MEM_NEGATIVE_MIN:
> +		scnprintf(proof, sizeof(proof),
> +			  "The smallest possible offset is %lld, below 0",
> +			  reg_smin(reg) + off);
> +		break;

[Severity: Medium]
Will this print a contradictory positive number instead of a negative one when
reg_smin(reg) is S64_MIN and off is negative?

Looking at the caller in check_mem_region_access(), it triggers the
BPF_DIAG_MEM_NEGATIVE_MIN diagnostic if reg_smin(reg) == S64_MIN:

kernel/bpf/verifier.c:check_mem_region_access() {
    if (reg_smin(reg) < 0 &&
        (reg_smin(reg) == S64_MIN ||
         ...)) {
        bpf_diag_report_mem_bounds(..., BPF_DIAG_MEM_NEGATIVE_MIN, ...);
    }
}

If off is negative, reg_smin(reg) + off will underflow S64_MIN and wrap around
to a huge positive number like 9223372036854775807. The diagnostic output might
then read something confusing like:
"The smallest possible offset is 9223372036854775807, below 0"

Unlike the max bounds case which correctly handles wrapping, the min bounds
case appears to evaluate this unconditionally.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605063412.974640-1-memxor@gmail.com?part=9