Syzbot CI

Subject	bpf: use scalar evolution to widen bounded loops
Author	eddyz87@gmail.com
Date	2026-10-04 13:37:43 +0000 UTC
Version
Cc	andrii@kernel.org ast@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com emil@etsalapatis.com ezingerman@fb.com kernel-team@fb.com yonghong.song@linux.dev

Subject

bpf: use scalar evolution to widen bounded loops

Author

eddyz87@gmail.com

Date

2026-10-04 13:37:43 +0000 UTC

Version

andrii@kernel.org ast@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com emil@etsalapatis.com ezingerman@fb.com kernel-team@fb.com yonghong.song@linux.dev

Name	Content [All]
[PATCH bpf-next v2 01/43] bpf: represent stack access effects with arg_access_info	[Body]
[PATCH bpf-next v2 02/43] bpf: describe helper stack accesses with arg_access_info	[Body]
[PATCH bpf-next v2 03/43] bpf: describe kfunc stack accesses with arg_access_info	[Body]
[PATCH bpf-next v2 04/43] bpf: track may_write flags in liveness	[Body]
[PATCH bpf-next v2 05/43] bpf: summarize may write stack slots in insn_aux_data	[Body]
[PATCH bpf-next v2 06/43] bpf: summarize live stack slots in insn_aux_data	[Body]
[PATCH bpf-next v2 07/43] bpf: summarize regs that may hold a frame pointer in insn_aux_data	[Body]
[PATCH bpf-next v2 08/43] bpf: record write effects for atomic operations in liveness.c	[Body]
[PATCH bpf-next v2 09/43] bpf: add tnum_alignment()	[Body]
[PATCH bpf-next v2 10/43] bpf: add cnum{32,64}_union()	[Body]
[PATCH bpf-next v2 11/43] bpf: add cnum64_intersect_linear()	[Body]
[PATCH bpf-next v2 12/43] bpf: expose comparison opcode transformations	[Body]
[PATCH bpf-next v2 13/43] bpf: allow subrange relations for PTR_TO_STACK in regsafe()	[Body]
[PATCH bpf-next v2 14/43] bpf: representation for intervals with steps	[Body]
[PATCH bpf-next v2 15/43] bpf: varying offset access support for PTR_TO_BTF_ID pointers	[Body]
[PATCH bpf-next v2 16/43] bpf: save DFS postorder numbers for program instructions	[Body]
[PATCH bpf-next v2 17/43] bpf: move the live-register and SCC printout to a standalone function	[Body]
[PATCH bpf-next v2 18/43] bpf: compute immediate dominators	[Body]
[PATCH bpf-next v2 19/43] bpf: compute loop hierarchy	[Body]
[PATCH bpf-next v2 20/43] bpf: add bpf_set_reg_range()	[Body]
[PATCH bpf-next v2 21/43] bpf: add bpf_mark_reg_known_scalar()	[Body]
[PATCH bpf-next v2 22/43] bpf: add bpf_reg_union()	[Body]
[PATCH bpf-next v2 23/43] bpf: add a min-heap for ordered analysis worklists	[Body]
[PATCH bpf-next v2 24/43] bpf: record basic-block ends in insn_aux_data	[Body]
[PATCH bpf-next v2 25/43] bpf: add bpf_split_cur_state()	[Body]
[PATCH bpf-next v2 26/43] bpf: add bpf_same_memory_origin()	[Body]
[PATCH bpf-next v2 27/43] bpf: allow precision backtracking between overlapping checkpoints	[Body]
[PATCH bpf-next v2 28/43] bpf: compute scalar evolution expressions for loops	[Body]
[PATCH bpf-next v2 29/43] bpf: use SCEV to widen bounded loops	[Body]
[PATCH bpf-next v2 30/43] bpf: avoid widening registers that hinder exact stack-slot tracking	[Body]
[PATCH bpf-next v2 31/43] bpf: bpf_func_state size optimization	[Body]
[PATCH bpf-next v2 32/43] selftests/bpf: __msg_next tag for matching messages on consecutive lines	[Body]
[PATCH bpf-next v2 33/43] selftests/bpf: bound UNIX socket path loops by sun_path size	[Body]
[PATCH bpf-next v2 34/43] selftests/bpf: test for stack-pointer subrange pruning	[Body]
[PATCH bpf-next v2 35/43] selftests/bpf: tests for may_write stack-liveness tracking	[Body]
[PATCH bpf-next v2 36/43] selftests/bpf: tests for may_def marks of atomic RMW operations	[Body]
[PATCH bpf-next v2 37/43] selftests/bpf: tests for map special cases in bpf_helper_stack_access_bytes()	[Body]
[PATCH bpf-next v2 38/43] selftests/bpf: tests for register base/step arithmetic	[Body]
[PATCH bpf-next v2 39/43] selftests/bpf: tests for register base/step state pruning	[Body]
[PATCH bpf-next v2 40/43] selftests/bpf: tests for varying offset access to PTR_TO_BTF_ID	[Body]
[PATCH bpf-next v2 41/43] selftests/bpf: tests for loop hierarchy computation	[Body]
[PATCH bpf-next v2 42/43] selftests/bpf: tests for immediate dominator computation	[Body]
[PATCH bpf-next v2 43/43] selftests/bpf: tests for SCEV analysis and loop widening	[Body]

Name

Content [All]

[PATCH bpf-next v2 01/43] bpf: represent stack access effects with arg_access_info

[PATCH bpf-next v2 02/43] bpf: describe helper stack accesses with arg_access_info

[PATCH bpf-next v2 03/43] bpf: describe kfunc stack accesses with arg_access_info

[PATCH bpf-next v2 04/43] bpf: track may_write flags in liveness

[PATCH bpf-next v2 05/43] bpf: summarize may write stack slots in insn_aux_data

[PATCH bpf-next v2 06/43] bpf: summarize live stack slots in insn_aux_data

[PATCH bpf-next v2 07/43] bpf: summarize regs that may hold a frame pointer in insn_aux_data

[PATCH bpf-next v2 08/43] bpf: record write effects for atomic operations in liveness.c

[PATCH bpf-next v2 09/43] bpf: add tnum_alignment()

[PATCH bpf-next v2 10/43] bpf: add cnum{32,64}_union()

[PATCH bpf-next v2 11/43] bpf: add cnum64_intersect_linear()

[PATCH bpf-next v2 12/43] bpf: expose comparison opcode transformations

[PATCH bpf-next v2 13/43] bpf: allow subrange relations for PTR_TO_STACK in regsafe()

[PATCH bpf-next v2 14/43] bpf: representation for intervals with steps

[PATCH bpf-next v2 15/43] bpf: varying offset access support for PTR_TO_BTF_ID pointers

[PATCH bpf-next v2 16/43] bpf: save DFS postorder numbers for program instructions

[PATCH bpf-next v2 17/43] bpf: move the live-register and SCC printout to a standalone function

[PATCH bpf-next v2 18/43] bpf: compute immediate dominators

[PATCH bpf-next v2 19/43] bpf: compute loop hierarchy

[PATCH bpf-next v2 20/43] bpf: add bpf_set_reg_range()

[PATCH bpf-next v2 21/43] bpf: add bpf_mark_reg_known_scalar()

[PATCH bpf-next v2 22/43] bpf: add bpf_reg_union()

[PATCH bpf-next v2 23/43] bpf: add a min-heap for ordered analysis worklists

[PATCH bpf-next v2 24/43] bpf: record basic-block ends in insn_aux_data

[PATCH bpf-next v2 25/43] bpf: add bpf_split_cur_state()

[PATCH bpf-next v2 26/43] bpf: add bpf_same_memory_origin()

[PATCH bpf-next v2 27/43] bpf: allow precision backtracking between overlapping checkpoints

[PATCH bpf-next v2 28/43] bpf: compute scalar evolution expressions for loops

[PATCH bpf-next v2 29/43] bpf: use SCEV to widen bounded loops

[PATCH bpf-next v2 30/43] bpf: avoid widening registers that hinder exact stack-slot tracking

[PATCH bpf-next v2 31/43] bpf: bpf_func_state size optimization

[PATCH bpf-next v2 32/43] selftests/bpf: __msg_next tag for matching messages on consecutive lines

[PATCH bpf-next v2 33/43] selftests/bpf: bound UNIX socket path loops by sun_path size

[PATCH bpf-next v2 34/43] selftests/bpf: test for stack-pointer subrange pruning

[PATCH bpf-next v2 35/43] selftests/bpf: tests for may_write stack-liveness tracking

[PATCH bpf-next v2 36/43] selftests/bpf: tests for may_def marks of atomic RMW operations

[PATCH bpf-next v2 37/43] selftests/bpf: tests for map special cases in bpf_helper_stack_access_bytes()

[PATCH bpf-next v2 38/43] selftests/bpf: tests for register base/step arithmetic

[PATCH bpf-next v2 39/43] selftests/bpf: tests for register base/step state pruning

[PATCH bpf-next v2 40/43] selftests/bpf: tests for varying offset access to PTR_TO_BTF_ID

[PATCH bpf-next v2 41/43] selftests/bpf: tests for loop hierarchy computation

[PATCH bpf-next v2 42/43] selftests/bpf: tests for immediate dominator computation

[PATCH bpf-next v2 43/43] selftests/bpf: tests for SCEV analysis and loop widening

Session 2026-10-04

1 Findings

ID (for dev)	c54f5978-5cd3-4267-a749-69d726fb4696
Status	finished
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	99dc1ba542420db6b8df209744f55cc52466ad91 [Config]		passed [Log]
[KASAN] Boot test: Base	99dc1ba542420db6b8df209744f55cc52466ad91 [Config]		passed [Log]
[KASAN] Build Patched		99dc1ba542420db6b8df209744f55cc52466ad91 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		99dc1ba542420db6b8df209744f55cc52466ad91 [Config] [patched]	passed [Log]
[KASAN] Fuzz	99dc1ba542420db6b8df209744f55cc52466ad91 [Config]	99dc1ba542420db6b8df209744f55cc52466ad91 [Config] [patched]	passed [Log] [Artifacts]
finding general protection fault in bpf_compute_scev Log Syz Repro

Patches (43)

Series Summary

Sessions

Session 2026-10-04