Forwarded: WARNING in reg_bounds_sanity_check (2)

[syzbot <syzbot+c950cc277150935cc0b5@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: WARNING in reg_bounds_sanity_check (2)
Author: kriish.sharma2006@gmail.com

#syz test

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c4f69a9e9af6..4c6000d32f46 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -16299,6 +16299,15 @@ static void regs_refine_cond_op(struct
bpf_reg_state *reg1, struct bpf_reg_state
        }
 }

+static void __maybe_normalize_reg(struct bpf_reg_state *reg)
+{
+    if (reg->umin_value > reg->umax_value ||
+        reg->smin_value > reg->smax_value ||
+        reg->u32_min_value > reg->u32_max_value ||
+        reg->s32_min_value > reg->s32_max_value)
+        __mark_reg_unbounded(reg);
+}
+
 /* Adjusts the register min/max values in the case that the dst_reg and
  * src_reg are both SCALAR_VALUE registers (or we are simply doing a BPF_K
  * check, in which case we have a fake SCALAR_VALUE representing
insn->imm).
@@ -16325,11 +16334,15 @@ static int reg_set_min_max(struct
bpf_verifier_env *env,
        regs_refine_cond_op(false_reg1, false_reg2, rev_opcode(opcode),
is_jmp32);
        reg_bounds_sync(false_reg1);
        reg_bounds_sync(false_reg2);
+       __maybe_normalize_reg(false_reg1);
+    __maybe_normalize_reg(false_reg2);

        /* jump (TRUE) branch */
        regs_refine_cond_op(true_reg1, true_reg2, opcode, is_jmp32);
        reg_bounds_sync(true_reg1);
        reg_bounds_sync(true_reg2);
+       __maybe_normalize_reg(true_reg1);
+    __maybe_normalize_reg(true_reg2);

        err = reg_bounds_sanity_check(env, true_reg1, "true_reg1");
        err = err ?: reg_bounds_sanity_check(env, true_reg2, "true_reg2");
-- 
2.34.1