Re: [PATCH bpf-next 11/36] bpf: add bpf_reg_union()

[Eduard Zingerman <eddyz87@gmail.com>]

On Sun, 2026-09-27 at 20:42 +0000, bot+bpf-ci@kernel.org wrote:
> > diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> > index 719b7c7fd2f5..706fdefbc07a 100644
> > --- a/include/linux/bpf_verifier.h
> > +++ b/include/linux/bpf_verifier.h
> > @@ -1748,6 +1748,8 @@ s64 bpf_kfunc_stack_access_bytes(struct bpf_verifier_env *env,
> >  int bpf_compute_subprog_arg_access(struct bpf_verifier_env *env);
> >  int bpf_set_reg_range(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
> >  		      struct cnum64 range, u16 step);
> > +int bpf_reg_union(struct bpf_verifier_env *env, struct bpf_reg_state *acc,
> > +		  const struct bpf_reg_state *src);
> >
> >  int bpf_stack_liveness_init(struct bpf_verifier_env *env);
> >  void bpf_stack_liveness_free(struct bpf_verifier_env *env);
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index b5f45cb46f14..1ec44d72a346 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -30,6 +30,7 @@
> >  #include <linux/module.h>
> >  #include <linux/cpumask.h>
> >  #include <linux/cnum.h>
> > +#include <linux/gcd.h>
> >  #include <linux/bpf_mem_alloc.h>
> >  #include <net/xdp.h>
> >  #include <linux/trace_events.h>
>
> [ ... ]
>
> > @@ -16952,6 +16953,33 @@ int bpf_set_reg_range(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
> >  	return reg_bounds_sanity_check(env, reg, "bpf_set_reg_range");
> >  }
> >
> > +/* acc := acc U src, matching types only. Caller must clear acc's scalar ID. */
> > +int bpf_reg_union(struct bpf_verifier_env *env, struct bpf_reg_state *acc,
> > +		  const struct bpf_reg_state *src)
> > +{
> > +	u16 base, step;
> > +
> > +	if (acc->type != src->type) {
> > +		verifier_bug(env, "union of registers with different types");
> > +		return -EFAULT;
> > +	}
> > +	acc->r64 = cnum64_union(acc->r64, src->r64);
> > +	acc->r32 = cnum32_union(acc->r32, src->r32);
> > +	acc->var_off = tnum_union(acc->var_off, src->var_off);
>
> Does this function handle pointer registers correctly? When bpf_reg_union()
> widens a PTR_TO_PACKET's offset (r64/r32/var_off) but keeps its id, it can
> break the id-tracking invariant.
>
> For PTR_TO_PACKET, registers with the same id differ only by a known
> constant. When adjust_ptr_min_max_vals() adds a non-constant to a packet
> pointer, it gives it a fresh id:
>
>   if (!known)
>       dst_reg->id = ++env->id_gen;

The example is an utter hallucinated garbage, but the point is valid.
Here is a valid example that should be rejected:

  r7 = ctx->data;
  r8 = r7
  for (r6 = 0; r6 < 10 && random() != 42; r7++, r6++);
  if (r7 >= ctx->data_end)
    return;
  // at this point the loop executed unknown number of times
  // hence r7 range gives no information about r8
  *(r8 + 4);

There are several other types in is_widenable_reg_type() to consider.
So far I think that it is necessary to reset the ids for the following
types: SCALAR_VALUE, PTR_TO_PACKET, PTR_TO_PACKET_META

> find_good_pkt_pointers() depends on this rule. After a successful
> 'pkt_ptr > pkt_end' test, it uses reg_umax(dst_reg) as the new range
> and sets reg->range = max(reg->range, new_range) on every PTR_TO_PACKET
> with the same id, assuming they all track the same maximum offset.
>
> Once bpf_reg_union() enlarges acc's umax but leaves acc in the same id
> group as registers that were not widened, a comparison on acc can give
> those other registers a range based on the widened umax that nothing at
> runtime backs.
>
> The comment says "Caller must clear acc's scalar ID", but for pointer
> types the id has a different meaning. Later in the series when this is
> called from union_any_reg() (1987b0e52b34), is_widenable_reg_type()
> accepts PTR_TO_PACKET, and scratch_scalar_id() only clears the id when
> reg->type == SCALAR_VALUE.
>
> Here's a concrete example with a similar shape to the
> conditional_stack_pointer_assignment selftest at the series end:
>
>   r2 = *(u32 *)(r1 + 0)   // data: pkt, id=0
>   r3 = *(u32 *)(r1 + 4)   // data_end
>   r9 = r2                 // pkt, id=0, off 0
>   r7 = r2
>   r7 += 1000              // pkt, id=0 (constant add keeps id)
>   r6 = 0
> 1: if r6 >= 3 goto 3f
>   if r2 > r3 goto 3f      // fallthrough: find_good_pkt_pointers(r2)
>   r0 = *(u8 *)(r9 + 999)
>   if r6 != 1 goto 2f
>   r2 = r7                 // r2 = (any r2 r7) at loop entry
> 2: r6 += 1
>   goto 1b
> 3: r0 = 0
>   exit
>
> At loop entry, bpf_reg_union() turns r2 into pkt(id=0, [0,1000]), but r9
> keeps id=0 and [0,0]. On the fallthrough of 'if r2 > r3',
> find_good_pkt_pointers() sets r9->range = reg_umax(r2) = 1000. The load
> from r9 + 999 then passes (0 + 999 + 1 <= 1000).