ACK: [SRU][N][PATCH 0/1] noble: bpf verifier loses scalar-ID precision propagation after 2026-09-02 stable patchset (test_verifier "precise" tests fail) (LP: #2169943)

[Chia-Lin Kao (AceLan)]

On Thu, Oct 08, 2026 at 10:14:57AM +0200, Edoardo Canepa via kernel-team wrote:
> BugLink: https://bugs.launchpad.net/bugs/2169943
>
> [Impact]
>
> The 2026-09-02 upstream stable patchset (LP: #2166192, ported from
> v6.6.144/v6.12.95, first released in Ubuntu-6.8.0-147.147) applied
>
>   "bpf: Remove mark_precise_scalar_ids()"
>   (825ac9bb8d6d in noble, upstream 842edb5507a1)
>
> but omitted its prerequisite
>
>   "bpf: Track equal scalars history on per-instruction level"
>   (upstream 4bf79f9be434, present in v6.6.144 as adapted backport
>   0252b9d26222)
>
> As a result the 6.8.0-147 verifier has neither the old
> mark_precise_scalar_ids() nor its replacement sync_linked_regs():
> precision marks are no longer propagated between scalar registers
> linked by the same ID. mark_precise_scalar_ids() was introduced by
> 904e6ddf4133 ("bpf: Use scalar ids in mark_chain_precision()")
> specifically to prevent unsound verifier state pruning.
>
> Visible fallout: ubuntu_bpf test_verifier #493/#494 ("precise: test
> 1/2") fail since 6.8.0-147.147 (first seen in RT testing on ppc64el,
> reproduced on amd64 - the failure is arch-independent).
>
> [Fix]
>
> Apply the missing prerequisite: backport of the linux-6.6.y adaptation
> (0252b9d26222, v6.6.144), further adapted to noble's verifier, which
> already carries the 6.13 "common instruction history" backport
> (96a30e469ca1, LP: #2134640): linked_regs tracking is added to struct
> bpf_insn_hist_entry and push_insn_history(), collect_linked_regs()/
> sync_linked_regs() replace find_equal_scalars(), and
> bt_sync_linked_regs() propagates precision marks in backtrack_insn().
> Two selftest expectation updates are part of the same upstream commit.
>
> [Test Plan]
>
> Build tools/testing/selftests/bpf from the noble tree and run
> test_verifier on the target kernel with
> kernel.unprivileged_bpf_disabled=0 (as the ubuntu_bpf suite does).
>
> On 6.8.0-147.147: #493 "precise: test 1" and #494 "precise: test 2"
> FAIL (mark_precise log shows regs=r2 where regs=r2,r9 is expected).
> With the fix (verified on an amd64 CBD build): both PASS, the full
> test_verifier run shows no new failures, and
> test_progs -t verifier_scalar_ids,verifier_subprog_precision,verifier_precision
> passes 38/38 subtests - including the per-insn sync_linked_regs()
> precision tests added by the same stable patchset (c02fe97f2570),
> which exercise the new machinery directly.
>
> [Where problems could occur]
>
> The change is confined to the BPF verifier's precision tracking and
> state pruning. A wrong linked_regs collection could change which
> registers are marked precise and therefore pruning decisions - worst
> case rejecting previously accepted programs, or over-pruning. The code
> matches upstream, where it has been in production since v6.11 (and in
> 6.6.y since v6.6.144). Note that the struct bpf_insn_hist_entry change
> alters modversion CRCs of bpf-related exported symbols
> (e.g. register_btf_kfunc_id_set, bpf_trace_run*), so out-of-tree
> modules using them need a rebuild against the new headers - handled by
> the normal ABI bump in the SRU cycle.
Acked-by: Chia-Lin Kao (AceLan) <acelan.kao at canonical.com>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team