From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Eduard Zingerman" <eddyz87@gmail.com>, <bpf@vger.kernel.org>
Cc: <daniel@iogearbox.net>, <andrii@kernel.org>, <memxor@gmail.com>
Subject: Re: [PATCH bpf 14/81] bpf: Fix a false verifier bug in the clamp of scalar evolution
Date: Tue, 27 Oct 2026 16:32:18 +0000 [thread overview]
Message-ID: <DMFRJKE5O9OE.3CSUZC83JX864@gmail.com> (raw)
In-Reply-To: <5e87915b1065db0c4ce8f7f4368a8c3109cfe891.camel@gmail.com>
On Mon, Oct 26, 2026 at 04:45 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>> + if (!bpf_reg_range_is_empty(r64, r32, bounds.base, bounds.step)) {
>> + bounds.r64 = r64;
>> + bounds.r32 = r32;
>> }
>
> I'd suggest addressing this as in [1,2]. I'd expect that selective
> clamping would be a subject to counter-examples as well, just a bit
> more convoluted.
fine. applied yours and rebase on top.
next prev parent reply other threads:[~2026-10-27 16:32 UTC|newest]
Thread overview: 145+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-26 2:58 [PATCH bpf 00/81] bpf: Stack in arena and a verifier that joins states Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 01/81] selftests/bpf: Remove tests for global data in arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 02/81] libbpf: Remove .arena.data Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 03/81] libbpf: Keep format strings of bpf_printk() in .rodata Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 04/81] selftests/bpf: Remove tests for arena access through numbers Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 05/81] bpf: Remove BPF_F_ARENA_SCALAR Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 06/81] bpf, x86: Remove r0_on_stack from fetching atomics in arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 07/81] bpf: One time slice of may_goto for a run of a prog Alexei Starovoitov
2026-10-26 12:50 ` kernel test robot
2026-10-26 14:43 ` kernel test robot
2026-10-26 17:35 ` Kumar Kartikeya Dwivedi
2026-10-27 16:39 ` Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 08/81] selftests/bpf: Test may_goto in a loop that calls a subprog that spins Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 09/81] bpf: Clear delta of a register that scalar evolution widens Alexei Starovoitov
2026-10-26 20:09 ` Daniel Borkmann
2026-10-27 21:23 ` Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 10/81] selftests/bpf: Test that a widened register is not linked Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 11/81] selftests/bpf: Wait for the last maps of map_kptr to be freed Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 12/81] bpf: Don't widen a pointer to a buffer in scalar evolution Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 13/81] selftests/bpf: Test a loop that moves a pointer to a buffer Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 14/81] bpf: Fix a false verifier bug in the clamp of scalar evolution Alexei Starovoitov
2026-10-26 23:45 ` Eduard Zingerman
2026-10-27 16:32 ` Alexei Starovoitov [this message]
2026-10-26 2:58 ` [PATCH bpf 15/81] selftests/bpf: Test induction variables that come back out of range Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 16/81] libbpf: Make arena 1 Gbyte when max_entries is not set Alexei Starovoitov
2026-10-26 16:54 ` Andrii Nakryiko
2026-10-26 16:59 ` Kumar Kartikeya Dwivedi
2026-10-27 0:13 ` Alexei Starovoitov
2026-10-27 21:11 ` Kumar Kartikeya Dwivedi
2026-10-27 21:22 ` Alexei Starovoitov
2026-10-27 21:28 ` Andrii Nakryiko
2026-10-27 21:29 ` Kumar Kartikeya Dwivedi
2026-10-26 2:58 ` [PATCH bpf 17/81] selftests/bpf: Test the default size of arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 18/81] bpf: Treat addr_space_cast of a pointer that is not in arena as a move Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 19/81] selftests/bpf: Test addr_space_cast of pointers that are not in arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 20/81] libbpf: Support .bss.addr_space.1 section Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 21/81] libbpf: Relocate pointers that are stored in arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 22/81] selftests/bpf: Test pointers in arena and .bss.addr_space.1 Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 23/81] bpf: Introduce bpf register BPF_REG_ARENA_SP Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 24/81] bpf: Add stacks for programs to arena Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 25/81] bpf, x86: Add BPF_ATOMIC_LOCAL Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 26/81] bpf: Support BPF_REG_ARENA_SP in the verifier Alexei Starovoitov
2026-10-26 17:47 ` Kumar Kartikeya Dwivedi
2026-10-26 23:51 ` Alexei Starovoitov
2026-10-27 0:18 ` Kumar Kartikeya Dwivedi
2026-10-27 18:45 ` Alexei Starovoitov
2026-10-27 20:23 ` Kumar Kartikeya Dwivedi
2026-10-28 4:47 ` Alexei Starovoitov
2026-10-28 11:00 ` Kumar Kartikeya Dwivedi
2026-10-28 19:01 ` Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 27/81] bpf, x86: Support BPF_REG_ARENA_SP Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 28/81] bpf, arm64: " Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 29/81] selftests/bpf: Add tests for BPF_REG_ARENA_SP Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 30/81] bpf: Add bpf_arena_memcmp() and bpf_arena_memcpy() kfuncs Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 31/81] bpf: Add bpf_alloc() and bpf_free() kfuncs Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 32/81] bpf: Count stack arguments of a static subprog from its code Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:58 ` [PATCH bpf 33/81] selftests/bpf: Test static subprogs that don't take what BTF says Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 34/81] bpf: Let scalar evolution see loads from read-only maps Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 35/81] selftests/bpf: Test scalar evolution with a loop bound in .rodata Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 36/81] bpf: Helpers don't write through ARG_ANYTHING Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 37/81] selftests/bpf: Test scalar evolution with stack address as ARG_ANYTHING Alexei Starovoitov
2026-10-26 2:58 ` [PATCH bpf 38/81] bpf: Simplify (zext32 (zext32 x)) in scalar evolution Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 39/81] selftests/bpf: Test scalar evolution with a latch on a 32-bit copy Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 40/81] bpf: Keep the range of a packet pointer when a number >= 0 is added Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 41/81] selftests/bpf: Test range of a packet pointer after a number " Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 42/81] bpf: Allow BPF_MAX_SUBPROGS targets of a read from a table of functions Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 43/81] bpf: Tell user space that a run of a prog was cut short Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 44/81] bpf: Mask the count of a 32-bit shift in scalar evolution Alexei Starovoitov
2026-10-26 3:52 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 45/81] selftests/bpf: Expect the masked count of 32-bit shifts Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 46/81] bpf: Finish the insn in the state that maybe_fork_scalars() splits off Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 47/81] bpf: Add join of verifier states Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 48/81] bpf: Describe loops that scalar evolution cannot count exactly Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 49/81] selftests/bpf: Adjust tests to loops that are counted now Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 50/81] bpf: Add may_goto to the loops that the verifier marks Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 51/81] bpf: Check stack and count calls of recursive subprogs at run time Alexei Starovoitov
2026-10-26 4:09 ` bot+bpf-ci
2026-10-26 12:51 ` kernel test robot
2026-10-26 2:59 ` [PATCH bpf 52/81] bpf: Add the main pass as a fixpoint over the control flow graph Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 53/81] bpf: Verify programs " Alexei Starovoitov
2026-10-26 4:25 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 54/81] bpf: Allow 24 arguments of static subprogs Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 55/81] selftests/bpf: Test a static subprog with 24 arguments Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 56/81] bpf: Bump MAX_CALL_FRAMES to 32 Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 57/81] selftests/bpf: Test 32 and 33 call frames Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 58/81] bpf: Bump BPF_MAX_SUBPROGS to 1024 Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 59/81] selftests/bpf: Make room in veristat for the stats of 1024 subprogs Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 60/81] bpf: Remove is_state_visited() Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 61/81] bpf: Remove precision tracking Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 62/81] bpf: Remove prune points, levels of state comparison and pop_stack() Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 63/81] bpf: Print 0 as the limit in the statistics line Alexei Starovoitov
2026-10-26 3:52 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 64/81] bpf: Remove bpf_compute_scc() Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 65/81] bpf: Update comments about paths, pruning and explored states Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 66/81] bpf: Remove iter.depth Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 67/81] bpf: Remove leftovers of precision tracking and read marks Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 68/81] bpf: Track a pointer to one of a set of functions Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 69/81] bpf, docs: Rewrite verifier.rst Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 70/81] selftests/bpf: Adjust tests of precision tracking Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 71/81] selftests/bpf: Adjust tests of linked registers and spills Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 72/81] selftests/bpf: Adjust tests of pruning Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 73/81] selftests/bpf: Adjust tests of loops Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 74/81] selftests/bpf: Adjust tests of recursion Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 75/81] selftests/bpf: Adjust tests to the order of verification and to the log Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 76/81] selftests/bpf: Adjust tests of unprivileged progs Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 77/81] selftests/bpf: Test states that are not joined Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 78/81] selftests/bpf: Test progs that run out of budget Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 2:59 ` [PATCH bpf 79/81] selftests/bpf: Test 'unwound' in bpf_prog_info Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 80/81] selftests/bpf: Test the stack in arena after recursion ran out of budget Alexei Starovoitov
2026-10-26 2:59 ` [PATCH bpf 81/81] selftests/bpf: Test callx of one of a set of functions Alexei Starovoitov
2026-10-26 3:53 ` bot+bpf-ci
2026-10-26 16:57 ` [PATCH bpf 00/81] bpf: Stack in arena and a verifier that joins states Ihor Solodrai
2026-10-26 23:53 ` Alexei Starovoitov
2026-10-27 0:04 ` Ihor Solodrai
2026-10-27 0:14 ` Alexei Starovoitov
2026-10-27 5:08 ` Ihor Solodrai
2026-10-26 22:28 ` Ihor Solodrai
2026-10-26 23:45 ` Alexei Starovoitov
2026-10-27 0:01 ` Ihor Solodrai
2026-10-27 0:13 ` Ihor Solodrai
2026-10-27 0:16 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMFRJKE5O9OE.3CSUZC83JX864@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox