]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: verifier improvement in 32bit shift sign extension pattern
authorCupertino Miranda <cupertino.miranda@oracle.com>
Tue, 2 Dec 2025 18:02:19 +0000 (18:02 +0000)
committerAlexei Starovoitov <ast@kernel.org>
Wed, 10 Dec 2025 08:12:09 +0000 (00:12 -0800)
commitd18dec4b8990048ce75f0ece32bb96b3fbd3f422
tree2f5e98991eca7a83d2211f3c771623d5ed074d85
parentc93c1246003d5f102b0921e1c7747e72922fb537
bpf: verifier improvement in 32bit shift sign extension pattern

This patch improves the verifier to correctly compute bounds for
sign extension compiler pattern composed of left shift by 32bits
followed by a sign right shift by 32bits.  Pattern in the verifier was
limitted to positive value bounds and would reset bound computation for
negative values.  New code allows both positive and negative values for
sign extension without compromising bound computation and verifier to
pass.

This change is required by GCC which generate such pattern, and was
detected in the context of systemd, as described in the following GCC
bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731

Three new tests were added in verifier_subreg.c.

Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Cc: David Faust <david.faust@oracle.com>
Cc: Jose Marchesi <jose.marchesi@oracle.com>
Cc: Elena Zannoni <elena.zannoni@oracle.com>
Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c