[SRU][N][PATCH 0/1] noble: bpf verifier loses scalar-ID precision propagation after 2026-09-02 stable patchset (test_verifier "precise" tests fail) (LP: #2169943)

[Edoardo Canepa]

BugLink: https://bugs.launchpad.net/bugs/2169943

[Impact]

The 2026-09-02 upstream stable patchset (LP: #2166192, ported from
v6.6.144/v6.12.95, first released in Ubuntu-6.8.0-147.147) applied

  "bpf: Remove mark_precise_scalar_ids()"
  (825ac9bb8d6d in noble, upstream 842edb5507a1)

but omitted its prerequisite

  "bpf: Track equal scalars history on per-instruction level"
  (upstream 4bf79f9be434, present in v6.6.144 as adapted backport
  0252b9d26222)

As a result the 6.8.0-147 verifier has neither the old
mark_precise_scalar_ids() nor its replacement sync_linked_regs():
precision marks are no longer propagated between scalar registers
linked by the same ID. mark_precise_scalar_ids() was introduced by
904e6ddf4133 ("bpf: Use scalar ids in mark_chain_precision()")
specifically to prevent unsound verifier state pruning.

Visible fallout: ubuntu_bpf test_verifier #493/#494 ("precise: test
1/2") fail since 6.8.0-147.147 (first seen in RT testing on ppc64el,
reproduced on amd64 - the failure is arch-independent).

[Fix]

Apply the missing prerequisite: backport of the linux-6.6.y adaptation
(0252b9d26222, v6.6.144), further adapted to noble's verifier, which
already carries the 6.13 "common instruction history" backport
(96a30e469ca1, LP: #2134640): linked_regs tracking is added to struct
bpf_insn_hist_entry and push_insn_history(), collect_linked_regs()/
sync_linked_regs() replace find_equal_scalars(), and
bt_sync_linked_regs() propagates precision marks in backtrack_insn().
Two selftest expectation updates are part of the same upstream commit.

[Test Plan]

Build tools/testing/selftests/bpf from the noble tree and run
test_verifier on the target kernel with
kernel.unprivileged_bpf_disabled=0 (as the ubuntu_bpf suite does).

On 6.8.0-147.147: #493 "precise: test 1" and #494 "precise: test 2"
FAIL (mark_precise log shows regs=r2 where regs=r2,r9 is expected).
With the fix (verified on an amd64 CBD build): both PASS, the full
test_verifier run shows no new failures, and
test_progs -t verifier_scalar_ids,verifier_subprog_precision,verifier_precision
passes 38/38 subtests - including the per-insn sync_linked_regs()
precision tests added by the same stable patchset (c02fe97f2570),
which exercise the new machinery directly.

[Where problems could occur]

The change is confined to the BPF verifier's precision tracking and
state pruning. A wrong linked_regs collection could change which
registers are marked precise and therefore pruning decisions - worst
case rejecting previously accepted programs, or over-pruning. The code
matches upstream, where it has been in production since v6.11 (and in
6.6.y since v6.6.144). Note that the struct bpf_insn_hist_entry change
alters modversion CRCs of bpf-related exported symbols
(e.g. register_btf_kfunc_id_set, bpf_trace_run*), so out-of-tree
modules using them need a rebuild against the new headers - handled by
the normal ABI bump in the SRU cycle.