Re: [PATCH v2 bpf-next 3/6] bpf: Exit early if reg_bounds_sync gets invalid inputs

Eduard Zingerman
2026-03-23T18:47:23Z

On Fri, 2026-03-20 at 17:49 +0100, Paul Chaignon wrote:

[...]

> @@ -2786,8 +2786,13 @@ static void __reg_bound_offset(struct bpf_reg_state *reg)
> reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off);
> }
>
> +static bool range_bounds_violation(struct bpf_reg_state *reg);
> +
> static void reg_bounds_sync(struct bpf_reg_state *reg)
> {
> + /* If the input reg_state is invalid, we can exit early */
> + if (range_bounds_violation(reg))
> + return;
> /* We might have learned new bounds from the var_off. */
> __update_reg_bounds(reg);
> /* We might have learned something about the sign bit. */

Is it possible for the invariants violation to manifest after
__update_reg{32,64}_bounds() calls, once cross domain boundaries are
propagated?