Re: [PATCH bpf-next 1/3] bpf: Support negative offsets and BPF_SUB for linked register tracking

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-01-07 at 12:39 -0800, Puranjay Mohan wrote:
> Extend the linked register tracking to support:
> 
> 1. Negative offsets via BPF_ADD (e.g., r1 += -4)
> 2. BPF_SUB operations (e.g., r1 -= 4), which is treated as r1 += -4
> 
> Previously, the verifier only tracked positive constant deltas between
> linked registers using BPF_ADD. This limitation meant patterns like:
> 
>   r1 = r0
>   r1 += -4
>   if r1 s>= 0 goto ...   // r1 >= 0 implies r0 >= 4
>   // verifier couldn't propagate bounds back to r0
> 
> With this change, the verifier can now track negative deltas in reg->off
> (which is already s32), enabling bound propagation for the above pattern.
> 
> The changes include:
> - Accept BPF_SUB in addition to BPF_ADD
> - Change overflow check from val > (u32)S32_MAX to checking if val fits
>   in s32 range: (s64)val != (s64)(s32)val
> - For BPF_SUB, negate the offset with a guard against S32_MIN overflow
> - Keep !alu32 restriction as 32-bit ALU has known issues with upper bits

This is because we don't know if other registers with the same id have
their upper 32-bits as zeroes, right?
I'm curious how often we hit this limitation in practice, I would
expect code operating on 32-bit values to hit this from time to time.
E.g. see example in [1] (but it is mitigated by an LLVM workaround).

[1] https://github.com/eddyz87/cauldron-25-llvm-workarounds/blob/master/draft.md#bpfadjustoptimplserializeicmpcrossbb

> 
> Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]