Re: [PATCH bpf-next 1/3] bpf: Support negative offsets and BPF_SUB for linked register tracking

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-01-07 at 17:40 -0800, Eduard Zingerman wrote:
> On Wed, 2026-01-07 at 12:39 -0800, Puranjay Mohan wrote:
> > Extend the linked register tracking to support:
> > 
> > 1. Negative offsets via BPF_ADD (e.g., r1 += -4)
> > 2. BPF_SUB operations (e.g., r1 -= 4), which is treated as r1 += -4
> > 
> > Previously, the verifier only tracked positive constant deltas between
> > linked registers using BPF_ADD. This limitation meant patterns like:
> > 
> >   r1 = r0
> >   r1 += -4
> >   if r1 s>= 0 goto ...   // r1 >= 0 implies r0 >= 4
> >   // verifier couldn't propagate bounds back to r0
> > 
> > With this change, the verifier can now track negative deltas in reg->off
> > (which is already s32), enabling bound propagation for the above pattern.
> > 
> > The changes include:
> > - Accept BPF_SUB in addition to BPF_ADD
> > - Change overflow check from val > (u32)S32_MAX to checking if val fits
> >   in s32 range: (s64)val != (s64)(s32)val
> > - For BPF_SUB, negate the offset with a guard against S32_MIN overflow
> > - Keep !alu32 restriction as 32-bit ALU has known issues with upper bits
> 
> This is because we don't know if other registers with the same id have
> their upper 32-bits as zeroes, right?

Nah, we do know if their upper halves are zeroes or not,
registers with same id are identical up to the ->off field.
So, it appears that this restriction can be partially lifted if we
check if dst_reg upper half is zero before operation.
Wdyt?

> I'm curious how often we hit this limitation in practice, I would
> expect code operating on 32-bit values to hit this from time to time.
> E.g. see example in [1] (but it is mitigated by an LLVM workaround).
> 
> [1] https://github.com/eddyz87/cauldron-25-llvm-workarounds/blob/master/draft.md#bpfadjustoptimplserializeicmpcrossbb
> 
> > 
> > Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
> > ---
> 
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
> 
> [...]