Re: [PATCH bpf 0/2] bpf: fork state when comparing sign crossing ranges with zero

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 5/29/26 3:44 PM, Eduard Zingerman wrote:
> On Fri, 2026-05-29 at 01:13 -0700, Eduard Zingerman wrote:
>> YiFei Zhu reported [1] the verifier regression after switch to cnum
>> based scalars representation. When the following sequence of
>> instructions is processed:
>>
>>     1: ... rX setup with [negative, positive] bounds ...
>>     2: if rX == 0 goto ...
>>     3: if rX > C  goto ...
>>     4: ... code relying on rX being in range [1, C] ...
>>
>> The cnum-based implementation only infers that rX range is [0, C]
>> at instruction (4). The pre-cnum signed/unsigned ranges based
>> representation could always deduct from 'rX != 0' that
>> umin bound is 1.
>>
>> This patch introduces a workaround forking the verifier state when a
>> register with sign-crossing range is compared to zero.
>>
>> [1] https://lore.kernel.org/bpf/96c4a1aa4333d10b882a9b5093d2d982f9f106e3.camel@gmail.com/T/
>>
>> ---
>> Eduard Zingerman (2):
>>       bpf: fork state when comparing sign crossing ranges with zero
>>       selftests/bpf: test fork on zero comparison with wrapping ranges
>>
>>  kernel/bpf/verifier.c                              | 71 ++++++++++++++++++++++
>>  .../testing/selftests/bpf/progs/verifier_bounds.c  | 68 +++++++++++++++++++++
>>  2 files changed, 139 insertions(+)
>> ---
>> base-commit: e42e53ae23b7d41df22ccd7788192bf578f24da2
>> change-id: 20260529-cnum-split-at-zero-3c03db9234d3
> 
> I don't know why CI misses it:
> 
> https://github.com/kernel-patches/bpf/pull/12235
> 
> But I see two libarena tests failures with this series locally:
> 
> File                 Program                    Verdict  Duration (us)   Insns  States  Program size  Jited size
> -------------------  -------------------------  -------  -------------  ------  ------  ------------  ----------
> ...
> libarena_asan.bpf.o  asan_test_buddy_oob        failure         879905  209739    4158          3931           0
> ...
> libarena_asan.bpf.o  test_buddy_alloc_multiple  failure         269851  110341    2774          3897           0
> ...
> -------------------  -------------------------  -------  -------------  ------  ------  ------------  ----------
> 
> Investigating.

Hi everyone,

Apparently libarena_asan tests are currently skipped on BPF CI,
because they require clang 22 [1], which is not yet enabled there.

I'll work on adding clang 22 to CI, but in the meanwhile please make
sure to test libarena locally with clang 22 if your changes are relevant.

[1] https://lore.kernel.org/bpf/20260426190338.4615-6-emil@etsalapatis.com/

cc: Emil