From: Alexei Starovoitov Date: Sat, 7 Mar 2026 02:11:03 +0000 (-0800) Subject: Merge branch 'bpf-fix-u32-s32-bounds-when-ranges-cross-min-max-boundary' X-Git-Tag: v7.0-rc3~10^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6895e1d7c3171dc29097393749a6f4ebfb316860;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'bpf-fix-u32-s32-bounds-when-ranges-cross-min-max-boundary' Eduard Zingerman says: ==================== bpf: Fix u32/s32 bounds when ranges cross min/max boundary Cover the following cases in range refinement logic for 32-bit ranges: - s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range. - s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range. These cases are already handled for 64-bit range refinement. Without the fix the test in patch 2 is rejected by the verifier. The test was reduced from sched-ext program. Changelog: - v2 -> v3: - Reverted da653de268d3 (Paul) - Removed !BPF_F_TEST_REG_INVARIANTS flag from crossing_32_bit_signed_boundary_2() (Paul) - v1 -> v2: - Extended commit message and comments (Emil) - Targeting 'bpf' tree instead of bpf-next (Alexei) v1: https://lore.kernel.org/bpf/9a23fbacdc6d33ec8fcb3f6988395b5129f75369.camel@gmail.com/T v2: https://lore.kernel.org/bpf/20260305-bpf-32-bit-range-overflow-v2-0-7169206a3041@gmail.com/ --- ==================== Link: https://patch.msgid.link/20260306-bpf-32-bit-range-overflow-v3-0-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov --- 6895e1d7c3171dc29097393749a6f4ebfb316860