patch 'bpf/validate: fix BPF_AND min calculations' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/4275aedeaea89e1e6b3f15a77aa95eb203b2eeaa

Thanks.

Luca Boccassi

---
>From 4275aedeaea89e1e6b3f15a77aa95eb203b2eeaa Mon Sep 17 00:00:00 2001
From: Marat Khalili <marat.khalili at huawei.com>
Date: Wed, 24 Jun 2026 13:17:51 +0100
Subject: [PATCH] bpf/validate: fix BPF_AND min calculations

[ upstream commit 9ad7e6d9d43fdf5371472e0c69e04f9b53c77811 ]

Function `eval_and` calculated both signed (if positive) and unsigned
minimum values as bitwise AND between corresponding minimums, which is
incorrect since intermediate values can have zeroes in bits where
minimum values don't.

E.g. consider the following program with the current validation code:

    Tested program:
        0:  mov r0, #0x0
        1:  ldxdw r2, [r1 + 0]
        2:  jlt r2, #0x6, L8
        3:  jgt r2, #0x8, L8
        4:  jslt r2, #0x6, L8
        5:  jsgt r2, #0x8, L8
        6:  and r2, #0x5  ; tested instruction
        7:  mov r0, #0x1
        8:  exit
    Pre-state:
       r2:  6..8
    Post-state:
       r2:  4..7

After the tested instruction validator considers r2 to be equal or
greater than 4, however if 8 was loaded on step 1 it is possible for it
to be zero (0x8 & 0x5 == 0).

Use zero as a new safe lower bound for both signed (if positive) and
unsigned minimum. Add test.

Fixes: 8021917293d0 ("bpf: add extra validation for input BPF program")

Reported-by: Claudia Cauli <claudiacauli at gmail.com>
Signed-off-by: Marat Khalili <marat.khalili at huawei.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev at huawei.com>
---
 lib/bpf/bpf_validate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/bpf/bpf_validate.c b/lib/bpf/bpf_validate.c
index 6d6b651ca7..e7a6324ba5 100644
--- a/lib/bpf/bpf_validate.c
+++ b/lib/bpf/bpf_validate.c
@@ -428,7 +428,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
 		rd->u.max &= rs->u.max;
 	} else {
 		rd->u.max = eval_uand_max(rd->u.max, rs->u.max, opsz);
-		rd->u.min &= rs->u.min;
+		rd->u.min = 0;
 	}
 
 	/* both operands are constants */
@@ -439,7 +439,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
 	} else if (rd->s.min >= 0 || rs->s.min >= 0) {
 		rd->s.max = eval_uand_max(rd->s.max & (msk >> 1),
 			rs->s.max & (msk >> 1), opsz);
-		rd->s.min &= rs->s.min;
+		rd->s.min = 0;
 	} else
 		eval_smax_bound(rd, msk);
 }
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-03 12:55:49.562393761 +0100
+++ 0076-bpf-validate-fix-BPF_AND-min-calculations.patch	2026-07-03 12:55:46.726575450 +0100
@@ -1 +1 @@
-From 9ad7e6d9d43fdf5371472e0c69e04f9b53c77811 Mon Sep 17 00:00:00 2001
+From 4275aedeaea89e1e6b3f15a77aa95eb203b2eeaa Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 9ad7e6d9d43fdf5371472e0c69e04f9b53c77811 ]
+
@@ -36 +37,0 @@
-Cc: stable at dpdk.org
@@ -42,32 +43,3 @@
- app/test/test_bpf_validate.c | 17 +++++++++++++++++
- lib/bpf/bpf_validate.c       |  4 ++--
- 2 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/app/test/test_bpf_validate.c b/app/test/test_bpf_validate.c
-index 2755df1e65..40ed84ca67 100644
---- a/app/test/test_bpf_validate.c
-+++ b/app/test/test_bpf_validate.c
-@@ -1384,6 +1384,23 @@ test_alu64_add_x_scalar_scalar(void)
- REGISTER_FAST_TEST(bpf_validate_alu64_add_x_scalar_scalar_autotest, NOHUGE_OK, ASAN_OK,
- 	test_alu64_add_x_scalar_scalar);
- 
-+/* 64-bit bitwise AND between a scalar range and immediate. */
-+static int
-+test_alu64_and_k(void)
-+{
-+	return verify_instruction((struct verify_instruction_param){
-+		.tested_instruction = {
-+			.code = (EBPF_ALU64 | BPF_AND | BPF_K),
-+			.imm = 5,
-+		},
-+		.pre.dst = make_signed_domain(6, 8),
-+		.post.dst = make_signed_domain(0, 7),
-+	});
-+}
-+
-+REGISTER_FAST_TEST(bpf_validate_alu64_and_k_autotest, NOHUGE_OK, ASAN_OK,
-+	test_alu64_and_k);
-+
- /* 64-bit division and modulo of UINT64_MAX*2/3. */
- static int
- test_alu64_div_mod_big_constant(void)
+ lib/bpf/bpf_validate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
@@ -75 +47 @@
-index af084e36c8..d4d8ec4251 100644
+index 6d6b651ca7..e7a6324ba5 100644
@@ -78 +50 @@
-@@ -848,7 +848,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
+@@ -428,7 +428,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
@@ -87 +59 @@
-@@ -859,7 +859,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
+@@ -439,7 +439,7 @@ eval_and(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,