Re: [PATCH 6.12 034/244] bpf: Fix u32/s32 bounds when ranges cross min/max boundary

Paul Chaignon
2026-04-01T16:42:53Z

On Wed, Apr 01, 2026 at 07:32:26AM -0700, Alexei Starovoitov wrote:
> On Wed, Apr 1, 2026 at 4:44 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Apr 01, 2026 at 02:22:58PM +0800, Shung-Hsi Yu wrote:
> > > Cc Eduard and Paul since they know this change better.
> > >
> > > On Tue, Mar 31, 2026 at 06:19:44PM +0200, Greg Kroah-Hartman wrote:
> > > > 6.12-stable review patch. If anyone has any objections, please let me know.
> > > >
> > > > ------------------
> > > >
> > > > From: Eduard Zingerman <eddyz87@gmail.com>
> > > >
> > > > [ Upstream commit fbc7aef517d8765e4c425d2792409bb9bf2e1f13 ]
> > > >
> > > > Same as in __reg64_deduce_bounds(), refine s32/u32 ranges
> > > > in __reg32_deduce_bounds() in the following situations:
> > > ...
> > >
> > > Hi Greg,
> > >
> > > This patch is causing the following BPF selftests to fail
> > >
> > > #222 reg_bounds_crafted
> > > #222/27 reg_bounds_crafted/(u64)[0x7fffffffffffffff; 0xffffffff00000000] (s64)<op> 0
> > > #222/28 reg_bounds_crafted/(u64)0 (s64)<op> [0x7fffffffffffffff; 0xffffffff00000000]
> > > #222/29 reg_bounds_crafted/(u64)[0x7fffffff00000001; 0xffffffff00000000] (s64)<op> 0
> > > #222/30 reg_bounds_crafted/(u64)0 (s64)<op> [0x7fffffff00000001; 0xffffffff00000000]
> > > #222/59 reg_bounds_crafted/(s64)[0xffffffff00000001; 0] (u64)<op> 0xffffffff00000000
> > > #222/60 reg_bounds_crafted/(s64)0xffffffff00000000 (u64)<op> [0xffffffff00000001; 0]
> > > #222/79 reg_bounds_crafted/(s64)[S64_MIN; 0] (u64)<op> 0
> > > #222/80 reg_bounds_crafted/(s64)0 (u64)<op> [S64_MIN; 0]
> > > #262 reg_bounds_rand_consts_s64_u64
> > >
> > > The failure is caused by the selftests' expectation not aligning to the
> > > stable 6.12 behavior. I believe the easier way out is to drop this, then
> > > wait for [1] to land and pick it up in stable (or I'll try to backport
> > > and send). That should address the root cause of what this patch is
> > > trying to workaround.
> > >
> > > 1: https://lore.kernel.org/bpf/d4fe45f8bd5c6a48efd2ba3b66932bf7eb5aa020.1774025082.git.paul.chaignon@gmail.com/
> >
> > Now dropped, thanks.
>
> I suggest ignoring the selftest failures.
> The patch is necessary for stable and backports.
> It's fixing a real issue.

The selftest is failing because we're missing commit 1f8fe377855b
("bpf: Improve bounds when s64 crosses sign boundary") in v6.12. It's
the s64 counterpart to the s32 patch backported here.

In bpf-next, we have both the s64 and the s32 patches. The s32 patch
also updates the reg_bounds_crafted selftest to cover the logic for
both the s64 and s32 patches. If we backport only the s32 patch, the
updated selftest fails.

I can send v6.12 backports for both the s32 and s64 patchsets if that
helps. There are a couple minor conflicts when backporting the new
selftests. Or we can just cherry-pick 1f8fe377855b alone.