Hi Sasha,
On Tue, Mar 10, 2026 at 07:19:29AM -0400, Sasha Levin wrote:
This is the start of the stable review cycle for the 6.18.17 release. There are 314 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
BPF selftest is failing due to backported commit efc11a667878 ("bpf: Improve bounds when tnum has a single possible value"). The fix is commit 024cea2d647e ("selftests/bpf: Avoid simplification of crafted bounds test"). Can you pick that up for both 6.18 and 6.19?
FWIW this failure does not point to actual issue of the codebase, just that the selftest's expectation not aligning with the kernel.
Full log below:
/var/git/linux-stable-6.18$ vng --user=root --cwd=tools/testing/selftests/bpf/ -- ./test_progs -n 295 #295/1 reg_bounds_crafted/(u64)[0; 4294967295] (u64)<op> 0:OK #295/2 reg_bounds_crafted/(u64)0 (u64)<op> [0; 4294967295]:OK #295/3 reg_bounds_crafted/(u64)[0; 2147483648] (u64)<op> 0:OK #295/4 reg_bounds_crafted/(u64)0 (u64)<op> [0; 2147483648]:OK #295/5 reg_bounds_crafted/(u64)[0x100000000; 0x100000100] (u64)<op> 0:OK #295/6 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000000; 0x100000100]:OK #295/7 reg_bounds_crafted/(u64)[0x100000000; 0x180000000] (u64)<op> 0:OK #295/8 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000000; 0x180000000]:OK #295/9 reg_bounds_crafted/(u64)[0x100000000; 0x1ffffff00] (u64)<op> 0:OK #295/10 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000000; 0x1ffffff00]:OK #295/11 reg_bounds_crafted/(u64)[0x100000000; 0x1ffffff01] (u64)<op> 0:OK #295/12 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000000; 0x1ffffff01]:OK #295/13 reg_bounds_crafted/(u64)[0x100000000; 0x1fffffffe] (u64)<op> 0:OK #295/14 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000000; 0x1fffffffe]:OK #295/15 reg_bounds_crafted/(u64)[0x100000001; 0x1000000ff] (u64)<op> 0:OK #295/16 reg_bounds_crafted/(u64)0 (u64)<op> [0x100000001; 0x1000000ff]:OK #295/17 reg_bounds_crafted/(u64)[0; 1] (u64)<op> [1; 2147483648]:OK #295/18 reg_bounds_crafted/(u64)[1; 2147483648] (u64)<op> [0; 1]:OK #295/19 reg_bounds_crafted/(u64)[0; 1] (s64)<op> [1; 2147483648]:OK #295/20 reg_bounds_crafted/(u64)[1; 2147483648] (s64)<op> [0; 1]:OK #295/21 reg_bounds_crafted/(u64)[0; 1] (u32)<op> [1; 2147483648]:OK #295/22 reg_bounds_crafted/(u64)[1; 2147483648] (u32)<op> [0; 1]:OK #295/23 reg_bounds_crafted/(u64)[0; 1] (s32)<op> [1; 2147483648]:OK #295/24 reg_bounds_crafted/(u64)[1; 2147483648] (s32)<op> [0; 1]:OK #295/25 reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s64)<op> 0:OK #295/26 reg_bounds_crafted/(u64)0 (s64)<op> [0; 0xffffffff00000000]:OK #295/27 reg_bounds_crafted/(u64)[0x7fffffffffffffff; 0xffffffff00000000] (s64)<op> 0:OK #295/28 reg_bounds_crafted/(u64)0 (s64)<op> [0x7fffffffffffffff; 0xffffffff00000000]:OK #295/29 reg_bounds_crafted/(u64)[0x7fffffff00000001; 0xffffffff00000000] (s64)<op> 0:OK #295/30 reg_bounds_crafted/(u64)0 (s64)<op> [0x7fffffff00000001; 0xffffffff00000000]:OK #295/31 reg_bounds_crafted/(u64)[0; 4294967295] (s64)<op> 1:OK #295/32 reg_bounds_crafted/(u64)1 (s64)<op> [0; 4294967295]:OK #295/33 reg_bounds_crafted/(u64)[0; 4294967295] (s64)<op> 2147483647:OK #295/34 reg_bounds_crafted/(u64)2147483647 (s64)<op> [0; 4294967295]:OK #295/35 reg_bounds_crafted/(u64)[0; 0x100000000] (u32)<op> 0:OK #295/36 reg_bounds_crafted/(u64)0 (u32)<op> [0; 0x100000000]:OK MISMATCH true_reg1.u64: 0x100000000 != [4294967294; 0x100000000] MISMATCH true_reg1.s64: 0x100000000 != [0xfffffffe; 0x100000000] VERIFIER LOG: ======================== func#0 @0 Live regs before insn: 0: .......... (05) goto pc+2 1: .......... (b7) r0 = 0 2: 0......... (95) exit 3: .......... (85) call bpf_get_current_pid_tgid#14 4: 0......... (bf) r6 = r0 5: ......6... (85) call bpf_get_current_pid_tgid#14 6: 0.....6... (bf) r7 = r0 7: ......67.. (18) r1 = 0xfffffffe 9: .1....67.. (18) r2 = 0x100000000 11: .12...67.. (ad) if r6 < r1 goto pc-11 12: ..2...67.. (2d) if r6 > r2 goto pc-12 13: ......67.. (18) r1 = 0x80000000 15: .1....67.. (18) r2 = 0x80000000 17: .12...67.. (ad) if r7 < r1 goto pc-17 18: ..2...67.. (2d) if r7 > r2 goto pc-18 19: ......67.. (bc) w0 = w6 20: ......67.. (bc) w0 = w7 21: ......67.. (ae) if w6 < w7 goto pc+3 22: ......67.. (bc) w0 = w6 23: .......7.. (bc) w0 = w7 24: 0......... (95) exit 25: ......67.. (bc) w0 = w6 26: .......7.. (bc) w0 = w7 27: 0......... (95) exit 0: R1=ctx() R10=fp0 0: (05) goto pc+2 3: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 4: (bf) r6 = r0 ; R0=scalar(id=1) R6=scalar(id=1) 5: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 6: (bf) r7 = r0 ; R0=scalar(id=2) R7=scalar(id=2) 7: (18) r1 = 0xfffffffe ; R1=0xfffffffe 9: (18) r2 = 0x100000000 ; R2=0x100000000 11: (ad) if r6 < r1 goto pc-11 ; R1=0xfffffffe R6=scalar(id=1,umin=0xfffffffe) 12: (2d) if r6 > r2 goto pc-12 ; R2=0x100000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 13: (18) r1 = 0x80000000 ; R1=0x80000000 15: (18) r2 = 0x80000000 ; R2=0x80000000 17: (ad) if r7 < r1 goto pc-17 ; R1=0x80000000 R7=scalar(id=2,umin=0x80000000) 18: (2d) if r7 > r2 goto pc-18 ; R2=0x80000000 R7=0x80000000 19: (bc) w0 = w6 ; R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 20: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 21: (ae) if w6 < w7 goto pc+3 ; R6=scalar(id=1,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R7=0x80000000 22: (bc) w0 = w6 ; R0=scalar(smin=umin=umin32=0xfffffffe,smax=umax=0xffffffff,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x1)) R6=scalar(id=1,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) 23: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 24: (95) exit
from 21 to 25: R0=0x80000000 R1=0x80000000 R2=0x80000000 R6=0x100000000 R7=0x80000000 R10=fp0 25: R0=0x80000000 R1=0x80000000 R2=0x80000000 R6=0x100000000 R7=0x80000000 R10=fp0 25: (bc) w0 = w6 ; R0=0 R6=0x100000000 26: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 27: (95) exit
from 18 to 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,umin=0x80000001) R10=fp0 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,umin=0x80000001) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 17 to 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) R10=fp0 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 12 to 1: safe
from 11 to 1: safe processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 0 ===================== ACTUAL FALSE1: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) EXPECTED FALSE1: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) ACTUAL FALSE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED FALSE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL TRUE1: scalar(u64=0x100000000,u32=0,s64=0x100000000,s32=0) EXPECTED TRUE1: scalar(u64=[4294967294; 0x100000000],u32=0,s64=[0xfffffffe; 0x100000000],s32=0) ACTUAL TRUE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED TRUE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) verify_case_opt:FAIL:(u64)[4294967294; 0x100000000] (u32)< 2147483648 unexpected error: -22 (errno 22) #295/37 reg_bounds_crafted/(u64)[4294967294; 0x100000000] (u32)<op> 2147483648:FAIL MISMATCH false_reg2.u64: 0x100000000 != [4294967294; 0x100000000] MISMATCH false_reg2.s64: 0x100000000 != [0xfffffffe; 0x100000000] VERIFIER LOG: ======================== func#0 @0 Live regs before insn: 0: .......... (05) goto pc+2 1: .......... (b7) r0 = 0 2: 0......... (95) exit 3: .......... (85) call bpf_get_current_pid_tgid#14 4: 0......... (bf) r6 = r0 5: ......6... (85) call bpf_get_current_pid_tgid#14 6: 0.....6... (bf) r7 = r0 7: ......67.. (18) r1 = 0x80000000 9: .1....67.. (18) r2 = 0x80000000 11: .12...67.. (ad) if r6 < r1 goto pc-11 12: ..2...67.. (2d) if r6 > r2 goto pc-12 13: ......67.. (18) r1 = 0xfffffffe 15: .1....67.. (18) r2 = 0x100000000 17: .12...67.. (ad) if r7 < r1 goto pc-17 18: ..2...67.. (2d) if r7 > r2 goto pc-18 19: ......67.. (bc) w0 = w6 20: ......67.. (bc) w0 = w7 21: ......67.. (be) if w6 <= w7 goto pc+3 22: ......67.. (bc) w0 = w6 23: .......7.. (bc) w0 = w7 24: 0......... (95) exit 25: ......67.. (bc) w0 = w6 26: .......7.. (bc) w0 = w7 27: 0......... (95) exit 0: R1=ctx() R10=fp0 0: (05) goto pc+2 3: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 4: (bf) r6 = r0 ; R0=scalar(id=1) R6=scalar(id=1) 5: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 6: (bf) r7 = r0 ; R0=scalar(id=2) R7=scalar(id=2) 7: (18) r1 = 0x80000000 ; R1=0x80000000 9: (18) r2 = 0x80000000 ; R2=0x80000000 11: (ad) if r6 < r1 goto pc-11 ; R1=0x80000000 R6=scalar(id=1,umin=0x80000000) 12: (2d) if r6 > r2 goto pc-12 ; R2=0x80000000 R6=0x80000000 13: (18) r1 = 0xfffffffe ; R1=0xfffffffe 15: (18) r2 = 0x100000000 ; R2=0x100000000 17: (ad) if r7 < r1 goto pc-17 ; R1=0xfffffffe R7=scalar(id=2,umin=0xfffffffe) 18: (2d) if r7 > r2 goto pc-18 ; R2=0x100000000 R7=scalar(id=2,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 19: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 20: (bc) w0 = w7 ; R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R7=scalar(id=2,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 21: (be) if w6 <= w7 goto pc+3 ; R6=0x80000000 R7=0x100000000 22: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 23: (bc) w0 = w7 ; R0=0 R7=0x100000000 24: (95) exit
from 21 to 25: R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R10=fp0 25: R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R10=fp0 25: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 26: (bc) w0 = w7 ; R0=scalar(smin=umin=umin32=0xfffffffe,smax=umax=0xffffffff,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x1)) R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) 27: (95) exit
from 18 to 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,umin=0x100000001) R10=fp0 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,umin=0x100000001) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 17 to 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=0,smax=umax=umax32=0xfffffffd,var_off=(0x0; 0xffffffff)) R10=fp0 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=0,smax=umax=umax32=0xfffffffd,var_off=(0x0; 0xffffffff)) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 12 to 1: safe
from 11 to 1: safe processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 0 ===================== ACTUAL FALSE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED FALSE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL FALSE2: scalar(u64=0x100000000,u32=0,s64=0x100000000,s32=0) EXPECTED FALSE2: scalar(u64=[4294967294; 0x100000000],u32=0,s64=[0xfffffffe; 0x100000000],s32=0) ACTUAL TRUE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED TRUE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL TRUE2: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) EXPECTED TRUE2: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) verify_case_opt:FAIL:(u64)2147483648 (u32)<= [4294967294; 0x100000000] unexpected error: -22 (errno 22) #295/38 reg_bounds_crafted/(u64)2147483648 (u32)<op> [4294967294; 0x100000000]:FAIL #295/39 reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s32)<op> 0:OK #295/40 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0xffffffff00000000]:OK #295/41 reg_bounds_crafted/(u64)[0; 4294967295] (s32)<op> 0:OK #295/42 reg_bounds_crafted/(u64)0 (s32)<op> [0; 4294967295]:OK #295/43 reg_bounds_crafted/(u64)[0; 0x100000000] (s32)<op> 0:OK #295/44 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0x100000000]:OK #295/45 reg_bounds_crafted/(u64)[0; 0x100000001] (s32)<op> 0:OK #295/46 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0x100000001]:OK #295/47 reg_bounds_crafted/(u64)[0; 0x180000000] (s32)<op> 0:OK #295/48 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0x180000000]:OK #295/49 reg_bounds_crafted/(u64)[0; 0x17fffffff] (s32)<op> 0:OK #295/50 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0x17fffffff]:OK #295/51 reg_bounds_crafted/(u64)[0; 0x180000001] (s32)<op> 0:OK #295/52 reg_bounds_crafted/(u64)0 (s32)<op> [0; 0x180000001]:OK #295/53 reg_bounds_crafted/(s64)[0xffffffffffffffff; 0] (s64)<op> 0xffffffff00000000:OK #295/54 reg_bounds_crafted/(s64)0xffffffff00000000 (s64)<op> [0xffffffffffffffff; 0]:OK #295/55 reg_bounds_crafted/(u64)[4294967295; 0x100000000] (u64)<op> 0:OK #295/56 reg_bounds_crafted/(u64)0 (u64)<op> [4294967295; 0x100000000]:OK #295/57 reg_bounds_crafted/(u64)[4294967295; 0x100000001] (u64)<op> 0:OK #295/58 reg_bounds_crafted/(u64)0 (u64)<op> [4294967295; 0x100000001]:OK #295/59 reg_bounds_crafted/(s64)[0xffffffff00000001; 0] (u64)<op> 0xffffffff00000000:OK #295/60 reg_bounds_crafted/(s64)0xffffffff00000000 (u64)<op> [0xffffffff00000001; 0]:OK #295/61 reg_bounds_crafted/(u32)[1; 4294967295] (u32)<op> 0:OK #295/62 reg_bounds_crafted/(u32)0 (u32)<op> [1; 4294967295]:OK #295/63 reg_bounds_crafted/(u32)[0; 4294967295] (s32)<op> 4294967295:OK #295/64 reg_bounds_crafted/(u32)4294967295 (s32)<op> [0; 4294967295]:OK #295/65 reg_bounds_crafted/(s32)S32_MIN (u64)<op> [0xffffff01; 0]:OK #295/66 reg_bounds_crafted/(s32)[0xffffff01; 0] (u64)<op> S32_MIN:OK #295/67 reg_bounds_crafted/(s32)[S32_MIN; 0xffffff01] (s64)<op> [0xfffffffe; 0]:OK #295/68 reg_bounds_crafted/(s32)[0xfffffffe; 0] (s64)<op> [S32_MIN; 0xffffff01]:OK #295/69 reg_bounds_crafted/(s32)[0; 0x1] (s64)<op> S32_MIN:OK #295/70 reg_bounds_crafted/(s32)S32_MIN (s64)<op> [0; 0x1]:OK #295/71 reg_bounds_crafted/(s32)S32_MIN (u32)<op> S32_MIN:OK #295/72 reg_bounds_crafted/(s32)S32_MIN (u32)<op> S32_MIN:OK #295/73 reg_bounds_crafted/(u64)[0; U64_MAX] (u64)<op> U64_MAX:OK #295/74 reg_bounds_crafted/(u64)U64_MAX (u64)<op> [0; U64_MAX]:OK #295/75 reg_bounds_crafted/(u64)[0; U64_MAX] (u64)<op> 0:OK #295/76 reg_bounds_crafted/(u64)0 (u64)<op> [0; U64_MAX]:OK #295/77 reg_bounds_crafted/(s64)[S64_MIN; 0] (u64)<op> S64_MIN:OK #295/78 reg_bounds_crafted/(s64)S64_MIN (u64)<op> [S64_MIN; 0]:OK #295/79 reg_bounds_crafted/(s64)[S64_MIN; 0] (u64)<op> 0:OK #295/80 reg_bounds_crafted/(s64)0 (u64)<op> [S64_MIN; 0]:OK #295/81 reg_bounds_crafted/(s64)[S64_MIN; S64_MAX] (u64)<op> S64_MAX:OK #295/82 reg_bounds_crafted/(s64)S64_MAX (u64)<op> [S64_MIN; S64_MAX]:OK #295/83 reg_bounds_crafted/(u32)[0; 4294967295] (u32)<op> 0:OK #295/84 reg_bounds_crafted/(u32)0 (u32)<op> [0; 4294967295]:OK #295/85 reg_bounds_crafted/(u32)[0; 4294967295] (u32)<op> 4294967295:OK #295/86 reg_bounds_crafted/(u32)4294967295 (u32)<op> [0; 4294967295]:OK #295/87 reg_bounds_crafted/(s32)[S32_MIN; 0] (u32)<op> 0:OK #295/88 reg_bounds_crafted/(s32)0 (u32)<op> [S32_MIN; 0]:OK #295/89 reg_bounds_crafted/(s32)[S32_MIN; 0] (u32)<op> S32_MIN:OK #295/90 reg_bounds_crafted/(s32)S32_MIN (u32)<op> [S32_MIN; 0]:OK #295/91 reg_bounds_crafted/(s32)[S32_MIN; S32_MAX] (u32)<op> S32_MAX:OK #295/92 reg_bounds_crafted/(s32)S32_MAX (u32)<op> [S32_MIN; S32_MAX]:OK #295/93 reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffff80000000; 0x7fffffff]:OK #295/94 reg_bounds_crafted/(s64)[0xffffffff80000000; 0x7fffffff] (u32)<op> [0; 0x1f]:OK #295/95 reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffffffff8000; 0x7fff]:OK #295/96 reg_bounds_crafted/(s64)[0xffffffffffff8000; 0x7fff] (u32)<op> [0; 0x1f]:OK #295/97 reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffffffffff80; 0x7f]:OK #295/98 reg_bounds_crafted/(s64)[0xffffffffffffff80; 0x7f] (u32)<op> [0; 0x1f]:OK #295 reg_bounds_crafted:FAIL
All error logs: MISMATCH true_reg1.u64: 0x100000000 != [4294967294; 0x100000000] MISMATCH true_reg1.s64: 0x100000000 != [0xfffffffe; 0x100000000] VERIFIER LOG: ======================== func#0 @0 Live regs before insn: 0: .......... (05) goto pc+2 1: .......... (b7) r0 = 0 2: 0......... (95) exit 3: .......... (85) call bpf_get_current_pid_tgid#14 4: 0......... (bf) r6 = r0 5: ......6... (85) call bpf_get_current_pid_tgid#14 6: 0.....6... (bf) r7 = r0 7: ......67.. (18) r1 = 0xfffffffe 9: .1....67.. (18) r2 = 0x100000000 11: .12...67.. (ad) if r6 < r1 goto pc-11 12: ..2...67.. (2d) if r6 > r2 goto pc-12 13: ......67.. (18) r1 = 0x80000000 15: .1....67.. (18) r2 = 0x80000000 17: .12...67.. (ad) if r7 < r1 goto pc-17 18: ..2...67.. (2d) if r7 > r2 goto pc-18 19: ......67.. (bc) w0 = w6 20: ......67.. (bc) w0 = w7 21: ......67.. (ae) if w6 < w7 goto pc+3 22: ......67.. (bc) w0 = w6 23: .......7.. (bc) w0 = w7 24: 0......... (95) exit 25: ......67.. (bc) w0 = w6 26: .......7.. (bc) w0 = w7 27: 0......... (95) exit 0: R1=ctx() R10=fp0 0: (05) goto pc+2 3: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 4: (bf) r6 = r0 ; R0=scalar(id=1) R6=scalar(id=1) 5: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 6: (bf) r7 = r0 ; R0=scalar(id=2) R7=scalar(id=2) 7: (18) r1 = 0xfffffffe ; R1=0xfffffffe 9: (18) r2 = 0x100000000 ; R2=0x100000000 11: (ad) if r6 < r1 goto pc-11 ; R1=0xfffffffe R6=scalar(id=1,umin=0xfffffffe) 12: (2d) if r6 > r2 goto pc-12 ; R2=0x100000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 13: (18) r1 = 0x80000000 ; R1=0x80000000 15: (18) r2 = 0x80000000 ; R2=0x80000000 17: (ad) if r7 < r1 goto pc-17 ; R1=0x80000000 R7=scalar(id=2,umin=0x80000000) 18: (2d) if r7 > r2 goto pc-18 ; R2=0x80000000 R7=0x80000000 19: (bc) w0 = w6 ; R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 20: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 21: (ae) if w6 < w7 goto pc+3 ; R6=scalar(id=1,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R7=0x80000000 22: (bc) w0 = w6 ; R0=scalar(smin=umin=umin32=0xfffffffe,smax=umax=0xffffffff,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x1)) R6=scalar(id=1,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) 23: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 24: (95) exit
from 21 to 25: R0=0x80000000 R1=0x80000000 R2=0x80000000 R6=0x100000000 R7=0x80000000 R10=fp0 25: R0=0x80000000 R1=0x80000000 R2=0x80000000 R6=0x100000000 R7=0x80000000 R10=fp0 25: (bc) w0 = w6 ; R0=0 R6=0x100000000 26: (bc) w0 = w7 ; R0=0x80000000 R7=0x80000000 27: (95) exit
from 18 to 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,umin=0x80000001) R10=fp0 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,umin=0x80000001) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 17 to 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) R10=fp0 1: R0=scalar(id=2) R1=0x80000000 R2=0x80000000 R6=scalar(id=1,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) R7=scalar(id=2,smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 12 to 1: safe
from 11 to 1: safe processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 0 ===================== ACTUAL FALSE1: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) EXPECTED FALSE1: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) ACTUAL FALSE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED FALSE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL TRUE1: scalar(u64=0x100000000,u32=0,s64=0x100000000,s32=0) EXPECTED TRUE1: scalar(u64=[4294967294; 0x100000000],u32=0,s64=[0xfffffffe; 0x100000000],s32=0) ACTUAL TRUE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED TRUE2: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) verify_case_opt:FAIL:(u64)[4294967294; 0x100000000] (u32)< 2147483648 unexpected error: -22 (errno 22) #295/37 reg_bounds_crafted/(u64)[4294967294; 0x100000000] (u32)<op> 2147483648:FAIL MISMATCH false_reg2.u64: 0x100000000 != [4294967294; 0x100000000] MISMATCH false_reg2.s64: 0x100000000 != [0xfffffffe; 0x100000000] VERIFIER LOG: ======================== func#0 @0 Live regs before insn: 0: .......... (05) goto pc+2 1: .......... (b7) r0 = 0 2: 0......... (95) exit 3: .......... (85) call bpf_get_current_pid_tgid#14 4: 0......... (bf) r6 = r0 5: ......6... (85) call bpf_get_current_pid_tgid#14 6: 0.....6... (bf) r7 = r0 7: ......67.. (18) r1 = 0x80000000 9: .1....67.. (18) r2 = 0x80000000 11: .12...67.. (ad) if r6 < r1 goto pc-11 12: ..2...67.. (2d) if r6 > r2 goto pc-12 13: ......67.. (18) r1 = 0xfffffffe 15: .1....67.. (18) r2 = 0x100000000 17: .12...67.. (ad) if r7 < r1 goto pc-17 18: ..2...67.. (2d) if r7 > r2 goto pc-18 19: ......67.. (bc) w0 = w6 20: ......67.. (bc) w0 = w7 21: ......67.. (be) if w6 <= w7 goto pc+3 22: ......67.. (bc) w0 = w6 23: .......7.. (bc) w0 = w7 24: 0......... (95) exit 25: ......67.. (bc) w0 = w6 26: .......7.. (bc) w0 = w7 27: 0......... (95) exit 0: R1=ctx() R10=fp0 0: (05) goto pc+2 3: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 4: (bf) r6 = r0 ; R0=scalar(id=1) R6=scalar(id=1) 5: (85) call bpf_get_current_pid_tgid#14 ; R0=scalar() 6: (bf) r7 = r0 ; R0=scalar(id=2) R7=scalar(id=2) 7: (18) r1 = 0x80000000 ; R1=0x80000000 9: (18) r2 = 0x80000000 ; R2=0x80000000 11: (ad) if r6 < r1 goto pc-11 ; R1=0x80000000 R6=scalar(id=1,umin=0x80000000) 12: (2d) if r6 > r2 goto pc-12 ; R2=0x80000000 R6=0x80000000 13: (18) r1 = 0xfffffffe ; R1=0xfffffffe 15: (18) r2 = 0x100000000 ; R2=0x100000000 17: (ad) if r7 < r1 goto pc-17 ; R1=0xfffffffe R7=scalar(id=2,umin=0xfffffffe) 18: (2d) if r7 > r2 goto pc-18 ; R2=0x100000000 R7=scalar(id=2,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 19: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 20: (bc) w0 = w7 ; R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R7=scalar(id=2,smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 21: (be) if w6 <= w7 goto pc+3 ; R6=0x80000000 R7=0x100000000 22: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 23: (bc) w0 = w7 ; R0=0 R7=0x100000000 24: (95) exit
from 21 to 25: R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R10=fp0 25: R0=scalar(smin=0,smax=umax=0xffffffff,smin32=-2,smax32=0,var_off=(0x0; 0xffffffff)) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) R10=fp0 25: (bc) w0 = w6 ; R0=0x80000000 R6=0x80000000 26: (bc) w0 = w7 ; R0=scalar(smin=umin=umin32=0xfffffffe,smax=umax=0xffffffff,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x1)) R7=scalar(id=2,smin=umin=umin32=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=-1,var_off=(0xfffffffe; 0x100000001)) 27: (95) exit
from 18 to 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,umin=0x100000001) R10=fp0 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,umin=0x100000001) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 17 to 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=0,smax=umax=umax32=0xfffffffd,var_off=(0x0; 0xffffffff)) R10=fp0 1: R0=scalar(id=2) R1=0xfffffffe R2=0x100000000 R6=0x80000000 R7=scalar(id=2,smin=0,smax=umax=umax32=0xfffffffd,var_off=(0x0; 0xffffffff)) R10=fp0 1: (b7) r0 = 0 ; R0=0 2: (95) exit
from 12 to 1: safe
from 11 to 1: safe processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 0 ===================== ACTUAL FALSE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED FALSE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL FALSE2: scalar(u64=0x100000000,u32=0,s64=0x100000000,s32=0) EXPECTED FALSE2: scalar(u64=[4294967294; 0x100000000],u32=0,s64=[0xfffffffe; 0x100000000],s32=0) ACTUAL TRUE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) EXPECTED TRUE1: scalar(u64=2147483648,u32=2147483648,s64=0x80000000,s32=S32_MIN) ACTUAL TRUE2: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) EXPECTED TRUE2: scalar(u64=[4294967294; 0x100000000],u32=[4294967294; 4294967295],s64=[0xfffffffe; 0x100000000],s32=[0xfffffffe; 0xffffffff]) verify_case_opt:FAIL:(u64)2147483648 (u32)<= [4294967294; 0x100000000] unexpected error: -22 (errno 22) #295/38 reg_bounds_crafted/(u64)2147483648 (u32)<op> [4294967294; 0x100000000]:FAIL #295 reg_bounds_crafted:FAIL Summary: 0/96 PASSED, 0 SKIPPED, 1 FAILED