patch 'bpf/validate: fix BPF_MUL ranges minimum' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/78613df1809d861609f987ea1af4ad091242f529

Thanks.

Kevin

---
>From 78613df1809d861609f987ea1af4ad091242f529 Mon Sep 17 00:00:00 2001
From: Marat Khalili <marat.khalili at huawei.com>
Date: Wed, 24 Jun 2026 13:17:46 +0100
Subject: [PATCH] bpf/validate: fix BPF_MUL ranges minimum

[ upstream commit a7ac086145056dcf7bfacb6ba0c3d7ca344ce800 ]

Function `eval_mul` calculated minimum of the both signed and unsigned
ranges as destination square instead of product with source due to a
typo.

E.g. consider the following program with the current validation code:

     Tested program:
         0:  mov r0, #0x0
         1:  ldxdw r2, [r1 + 0]
         2:  jlt r2, #0x11, L8
         3:  jgt r2, #0x1d, L8
         4:  jslt r2, #0x11, L8
         5:  jsgt r2, #0x1d, L8
         6:  mul r2, #0xb  ; tested instruction
         7:  mov r0, #0x1
         8:  exit
     Pre-state:
        r2:  17..29
     Post-state:
        r2:  289..319

After the tested instruction validator considers r2 to be no less than
289, however if 20 was loaded on step 1 it is possible for it after
multiplying by 11 to become 220 which is less than 289.

Fix the typo, add test.

Fixes: 8021917293d0 ("bpf: add extra validation for input BPF program")

Reported-by: Claudia Cauli <claudiacauli at gmail.com>
Signed-off-by: Marat Khalili <marat.khalili at huawei.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev at huawei.com>
---
 lib/bpf/bpf_validate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/bpf/bpf_validate.c b/lib/bpf/bpf_validate.c
index bffc278c60..85aa0807dd 100644
--- a/lib/bpf/bpf_validate.c
+++ b/lib/bpf/bpf_validate.c
@@ -508,5 +508,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
 	} else if (rd->u.max <= msk >> opsz / 2 && rs->u.max <= msk >> opsz) {
 		rd->u.max *= rs->u.max;
-		rd->u.min *= rd->u.min;
+		rd->u.min *= rs->u.min;
 	} else
 		eval_umax_bound(rd, msk);
@@ -519,5 +519,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
 	} else if (rd->s.min >= 0 && rs->s.min >= 0) {
 		rd->s.max *= rs->s.max;
-		rd->s.min *= rd->s.min;
+		rd->s.min *= rs->s.min;
 	} else
 		eval_smax_bound(rd, msk);
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 13:22:52.426752301 +0100
+++ 0006-bpf-validate-fix-BPF_MUL-ranges-minimum.patch	2026-07-30 13:22:52.241920016 +0100
@@ -1 +1 @@
-From a7ac086145056dcf7bfacb6ba0c3d7ca344ce800 Mon Sep 17 00:00:00 2001
+From 78613df1809d861609f987ea1af4ad091242f529 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit a7ac086145056dcf7bfacb6ba0c3d7ca344ce800 ]
+
@@ -34 +35,0 @@
-Cc: stable at dpdk.org
@@ -40,30 +41,3 @@
- app/test/test_bpf_validate.c | 17 +++++++++++++++++
- lib/bpf/bpf_validate.c       |  4 ++--
- 2 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/app/test/test_bpf_validate.c b/app/test/test_bpf_validate.c
-index f2427802eb..e908101192 100644
---- a/app/test/test_bpf_validate.c
-+++ b/app/test/test_bpf_validate.c
-@@ -1290,4 +1290,21 @@ REGISTER_FAST_TEST(bpf_validate_alu64_div_mod_overflow_autotest, NOHUGE_OK, ASAN
- 	test_alu64_div_mod_overflow);
- 
-+/* 64-bit mul of small scalar range and immediate. */
-+static int
-+test_alu64_mul_k_range_small(void)
-+{
-+	return verify_instruction((struct verify_instruction_param){
-+		.tested_instruction = {
-+			.code = (EBPF_ALU64 | BPF_MUL | BPF_K),
-+			.imm = 11,
-+		},
-+		.pre.dst = make_unsigned_domain(17, 29),
-+		.post.dst = make_unsigned_domain(17 * 11, 29 * 11),
-+	});
-+}
-+
-+REGISTER_FAST_TEST(bpf_validate_alu64_mul_k_range_small_autotest, NOHUGE_OK, ASAN_OK,
-+	test_alu64_mul_k_range_small);
-+
- /* 64-bit negation when interval first element is INT64_MIN. */
- static int
+ lib/bpf/bpf_validate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
@@ -71 +45 @@
-index 14a186b7cb..08717671a8 100644
+index bffc278c60..85aa0807dd 100644
@@ -74 +48 @@
-@@ -916,5 +916,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
+@@ -508,5 +508,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
@@ -81 +55 @@
-@@ -927,5 +927,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,
+@@ -519,5 +519,5 @@ eval_mul(struct bpf_reg_val *rd, const struct bpf_reg_val *rs, size_t opsz,