Re: [PATCH] bpf: fix umin/umax when lower bits fall outside u32 range

[Eduard Zingerman]

On Fri, 2026-03-27 at 16:48 -0300, Helen Koike wrote:

[...]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index a965b2c45bbe..ddac09c8a9e5 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2702,9 +2702,29 @@ static void __reg_deduce_mixed_bounds(struct bpf_reg_state *reg)
>  	__u64 new_umin, new_umax;
>  	__s64 new_smin, new_smax;
>  
> -	/* u32 -> u64 tightening, it's always well-formed */
> -	new_umin = (reg->umin_value & ~0xffffffffULL) | reg->u32_min_value;
> -	new_umax = (reg->umax_value & ~0xffffffffULL) | reg->u32_max_value;
> +	/*
> +	 * If (u32)umin > u32_max, no value in the current upper-32-bit block
> +	 * satisfies [u32_min, u32_max] while being >= umin; advance umin to
> +	 * the next block. Otherwise apply standard u32->u64 tightening.
> +	 */
> +	if ((u32)reg->umin_value > reg->u32_max_value)
> +		new_umin = (reg->umin_value & ~0xffffffffULL) + (1ULL << 32) |
> +			   reg->u32_min_value;
> +	else
> +		new_umin = (reg->umin_value & ~0xffffffffULL) |
> +			   reg->u32_min_value;
> +
> +	/*
> +	 * Symmetrically, if (u32)umax < u32_min, retreat umax to the
> +	 * previous block. Otherwise apply standard u32->u64 tightening.
> +	 */
> +	if ((u32)reg->umax_value < reg->u32_min_value)
> +		new_umax = (reg->umax_value & ~0xffffffffULL) - (1ULL << 32) |
> +			   reg->u32_max_value;
> +	else
> +		new_umax = (reg->umax_value & ~0xffffffffULL) |
> +			   reg->u32_max_value;
> +
>  	reg->umin_value = max_t(u64, reg->umin_value, new_umin);
>  	reg->umax_value = min_t(u64, reg->umax_value, new_umax);
>  	/* u32 -> s64 tightening, u32 range embedded into s64 preserves range validity */

Looks like it is the same case I identified in RFC [1].

[1] https://lore.kernel.org/bpf/20260318-cnum-sync-bounds-v1-4-1f2e455ea711@xxxxxxxxx/