From 86d654957d40111ec158aae38d7f7b0bc119533c Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Mon, 26 Oct 2026 16:38:24 -0700 Subject: [PATCH] bpf: Check the iteration count before the predicted exit value The comment before `total_change` computation: /* * compute_backedge_taken_count() guarantees that 'total_change' * does not overflow in 64-bit domain. */ total_change = initial + step * backedge_taken_count; Is not true before the check: if (backedge_taken_count >= U32_MAX - 1) return false; Move the check before `total_change` computation in order to reconcile the code with comments. Old position is not a bug the check was performed either way. Signed-off-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261026-scev-simpler-clamp-v2-4-f373aec9825f@gmail.com --- kernel/bpf/scev.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/kernel/bpf/scev.c b/kernel/bpf/scev.c index d67e793d7a18..e3c2220f89c9 100644 --- a/kernel/bpf/scev.c +++ b/kernel/bpf/scev.c @@ -2307,11 +2307,15 @@ static bool compute_max_iters(struct bpf_verifier_env *env, if (!compute_backedge_taken_count(op, initial, step, bound, &backedge_taken_count)) return false; + /* + * max_header_count is u32 and U32_MAX means "infinite", + * check to avoid overflow below. + */ + if (backedge_taken_count >= U32_MAX - 1) + return false; + if (latch->zext32 || latch->jmp32) { - /* - * compute_backedge_taken_count() guarantees that 'total_change' - * does not overflow in 64-bit domain. - */ + /* total_change is guaranteed not to overflow at this point */ total_change = initial + step * backedge_taken_count; if (latch->jmp32 && is_signed_op(op)) { if ((s64)total_change < S32_MIN || (s64)total_change > S32_MAX) @@ -2322,13 +2326,6 @@ static bool compute_max_iters(struct bpf_verifier_env *env, } } - /* - * max_header_count is u32 and U32_MAX means "infinite", - * check to avoid overflow below. - */ - if (backedge_taken_count >= U32_MAX - 1) - return false; - /* The header executes once on entry and once for each taken backedge, hence +1. */ iters->max_header_count = backedge_taken_count + 1; /*