[RFC PATCH bpf-next 1/1] bpf: Remove redundant second __reg_deduce_bounds() call in reg_bounds_sync()

[Ömer Mete Kaya]

reg_bounds_sync() calls __reg_deduce_bounds() twice in a row.
With the current cnum implementation, the second call is now redundant.

__reg_deduce_bounds() first intersects r32 with the 32-bit values
representable by r64, then intersects r64 with the values allowed by
r32. After one call, cnum64_cnum32_intersect() guarantees that every
value in r64 has its corresponding u32 value in r32. So, a
second call cannot further restrict either view.

The old tnum + min/max representation could require multiple passes:
tightening one of the 32-bit or 64-bit views could allow the other to
be tightened further. The double call ensured that the bounds reached
a fixpoint. With cnum, the first call already reaches the fixpoint.

Signed-off-by: Ömer Mete Kaya <omermetekaya0@xxxxxxxxx>
---
 kernel/bpf/verifier.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8d8923ad5..1cd923363 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2180,7 +2180,6 @@ static void reg_bounds_sync(struct bpf_reg_state *reg)
 	__update_reg_bounds(reg);
 	/* We might have learned something about the sign bit. */
 	__reg_deduce_bounds(reg);
-	__reg_deduce_bounds(reg);
 	/* We might have learned some bits from the bounds. */
 	__reg_bound_offset(reg);
 	/* Intersecting with the old var_off might have improved our bounds
--
2.55.0