On Wed, 2026-08-19 at 20:58 +0800, Jiayuan Chen wrote:
> Take the following unprivileged program as an example:
>
> r0 = bpf_map_lookup_elem(...) /* PTR_TO_MAP_VALUE, offset 0 */
> ...
> 14: r0 += r1 /* r1 is a bounded scalar */
> 15: r9 = r0
>
> Loading it triggers a verifier warning from reg_bounds_sanity_check():
>
> verifier bug: REG INVARIANTS VIOLATION (alu): const subreg tnum out
> of sync with range bounds r64={.base=0x0, .size=0x0}
> r32={.base=0x0, .size=0xffffffff} var_off=(0x0, 0x0)
>
> What happens:
>
> 1. Processing insn 14 (r0 += r1) in adjust_ptr_min_max_vals(), the new
> offset is computed into dst_reg's var_off and 32/64-bit ranges.
>
> 2. Because pointer registers do not track 32-bit subregister bounds,
> __mark_reg32_unbounded() first sets r32 to the full range; r32 is
> re-derived from the offset at the end of the function by
> reg_bounds_sync().
>
> 3. On the unprivileged path, sanitize_ptr_alu() is called and, via
> sanitize_speculative_path() -> push_stack(), snapshots the current
> register state and schedules the next instruction (insn 15) to be
> verified directly as a speculative path.
>
> 4. That snapshot is taken between step 2 and the final reg_bounds_sync():
> at this point dst_reg's var_off still holds the (const) original
> offset while r32 has just been blanked to the full range, i.e. the two
> are out of sync. When the speculative path later verifies insn 15
> (r9 = r0), the inconsistent state reaches reg_bounds_sanity_check() and
> trips the warning.
>
> var_off and the 32-bit range must always be consistent. There are two
> ways to keep the snapshot consistent:
>
> 1. sync var_off and r32 before the snapshot so they match, or
> 2. leave r32 at its original (already consistent) value and blank it
> only after the snapshot.
>
> The whole point of sanitize_ptr_alu() is to insert a harmless masking
> sequence that keeps the access in bounds under speculation, so the state
> it snapshots should faithfully represent that. Take approach 2: move
> __mark_reg32_unbounded() to after sanitize_ptr_alu(), so the speculative
> snapshot keeps the pointer's original, consistent r32. The non-speculative
> path is unchanged: r32 is still blanked before the offset is applied and
> re-derived by reg_bounds_sync().
>
> Fixes: 5f99f312bd3b ("bpf: add register bounds sanity checks and
> sanitization")
> Reported-by: Hiker Cl <[email protected]>
> Closes:
> https://lore.kernel.org/bpf/CAGM=xgb1fj9kt8xtitvo74b0wgqgjkouhdlwzytwv0ayqev...@mail.gmail.com/
> Signed-off-by: Jiayuan Chen <[email protected]>
> ---
Acked-by: Eduard Zingerman <[email protected]>
> kernel/bpf/verifier.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index d17f14b35b79..d79038a8da10 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14558,9 +14558,6 @@ static int adjust_ptr_min_max_vals(struct
> bpf_verifier_env *env, struct bpf_insn
> return -EINVAL;
> }
>
> - /* pointer types do not carry 32-bit bounds at the moment. */
> - __mark_reg32_unbounded(dst_reg);
> -
> if (sanitize_needed(opcode)) {
> ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
> &info, false);
> @@ -14568,6 +14565,14 @@ static int adjust_ptr_min_max_vals(struct
> bpf_verifier_env *env, struct bpf_insn
> return sanitize_err(env, insn, ret);
> }
>
> + /* Pointer types do not carry 32-bit bounds at the moment. Blank r32
> + * only after sanitize_ptr_alu() may have snapshotted dst_reg into a
> + * speculative path: otherwise that snapshot freezes a const offset
> + * with an unbounded r32, which later trips reg_bounds_sanity_check().
> + * reg_bounds_sync() below re-derives r32 from the updated offset.
> + */
Nit: comment is a bit too verbose. "... otherwise reg_bounds_sanity_check()
might hit some constraints violations" should have been enough.
> + __mark_reg32_unbounded(dst_reg);
> +
> switch (opcode) {
> case BPF_ADD:
> /*
