Re: [PATCH bpf 2/4] bpf: Improve bounds when tnum has a single possible value

[Paul Chaignon <paul.chaignon@gmail.com>]

On Fri, Feb 20, 2026 at 01:34:26AM -0500, Harishankar Vishwanathan wrote:
> On Thu, Feb 19, 2026 at 8:29 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> [...]
> > >     tnum_next = tnum_step(reg->var_off, reg->umin_value);
> > >     umin_in_tnum = (reg->umin_value & ~reg->var_off.mask) == reg->var_off.value;
> > >     tmax = reg->var_off.value | reg->var_off.mask;
> > >     if (tnum_next > reg->umax_value) {
> > >         /* The u64 range and the tnum only overlap in umin.
> > >          * u64:  ---[xxxxxx]-----
> > >          * tnum: --xx----------x-
> > >          */        ^
> > >         ___mark_reg_known(reg, reg->umin_value);
> > >     } else if (!umin_in_tnum && tnum_next == tmax) {
> > >         /* The u64 range and the tnum only overlap in the maximum value
> > >          * represented by the tnum, called tmax.
> > >          * u64:  ---[xxxxxx]-----
> > >          * tnum: xx-----x--------
> > >          */
> > >         ___mark_reg_known(reg, tmax);
> > >     } else if (!umin_in_tnum && tnum_next <= reg->umax_value &&
> > >        tnum_step(reg->var_off, tnum_next) > reg->umax_value) {
> > >         /* The u64 range and the tnum only overlap once in between umin
> > >          * (excluded) and umax.
> > >          * u64:  ---[xxxxxx]-----
> > >          * tnum: xx----x-------x-
> > >          */
> > >         ___mark_reg_known(reg, tnum_next);
> > >     }
> > >
> > > Wdyt?
> >
> > This makes sense, I missed this nuance in the original patch.
> > Maybe keep the first check as 'umin_in_tnum && tnum_next > reg->umax_value',
> > then?
> 
> I too think Eduard's suggestion makes sense. We will be explicit in
> the code that
> we want umin to be part of the tnum.

Agree, it helps readability. I've sent the v2 with that change.

Thanks everyone!