]> git.ipfire.org Git - thirdparty/linux.git/commit
bpf: Relax maybe_widen_reg() constraints
authorPuranjay Mohan <puranjay@kernel.org>
Tue, 3 Feb 2026 16:50:59 +0000 (08:50 -0800)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 3 Feb 2026 18:34:01 +0000 (10:34 -0800)
commita24d6f955d4f68a98daa905a7dd090675a50eca8
treeab8b7158a0272a37bbaf7ae96e29904f542a6704
parentb2a0aa3a87396483b468b7c81be2fddb29171d74
bpf: Relax maybe_widen_reg() constraints

The maybe_widen_reg() function widens imprecise scalar registers to
unknown when their values differ between the cached and current states.
Previously, it used regs_exact() which also compared register IDs via
check_ids(), requiring registers to have matching IDs (or mapped IDs) to
be considered exact.

For scalar widening purposes, what matters is whether the value tracking
(bounds, tnum, var_off) is the same, not whether the IDs match. Two
scalars with identical value constraints but different IDs represent the
same abstract value and don't need to be widened.

Introduce scalars_exact_for_widen() that only compares the
value-tracking portion of bpf_reg_state (fields before 'id'). This
allows the verifier to preserve more scalar value information during
state merging when IDs differ but actual tracked values are identical,
reducing unnecessary widening and potentially improving verification
precision.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20260203165102.2302462-4-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c