Re: [PATCH bpf 2/2] selftests/bpf: test fork on zero comparison with wrapping ranges

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri May 29, 2026 at 4:13 AM EDT, Eduard Zingerman wrote:
> Add tests verifying that the verifier correctly narrows a
> sign-boundary-crossing range after comparing with zero.
> - fork_on_zero_cmp_k - BPF_K conditional instruction;
> - fork_on_zero_cmp_x -
>   BPF_X conditional instruction with src being zero.
> - fork_on_zero_cmp_x_swapped -
>   BPF_X conditional instruction with dst being zero.
>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
> ---
>  .../testing/selftests/bpf/progs/verifier_bounds.c  | 68 ++++++++++++++++++++++
>  1 file changed, 68 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> index bc038ac2df98..f97b0e109326 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> @@ -2294,4 +2294,72 @@ __naked void range_within_cnum_cross_both_boundaries(void)
>  	: __clobber_all);
>  }
>  
> +SEC("socket")
> +__success
> +__naked void fork_on_zero_cmp_k(void)
> +{
> +	asm volatile ("							\
> +	call %[bpf_get_prandom_u32];					\
> +	r0 &= 0xff;			/* r0 ∈ [0, 255] */		\
> +	r1 = 8;								\
> +	r1 -= r0;			/* r1 ∈ [-247, 8] */		\
> +	if r1 == 0 goto 1f;						\
> +	if r1 > 8 goto 1f;		/* r1 ∈ [1, 8] */		\
> +	if r1 < 1 goto 2f;		/* must be dead */		\
> +	if r1 > 8 goto 2f;		/* must be dead */		\
> +	goto 1f;							\
> +2:	r0 /= 0;			/* unreachable */		\
> +1:	r0 = 0;								\
> +	exit;								\
> +	"
> +	:: __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
> +SEC("socket")
> +__success
> +__naked void fork_on_zero_cmp_x(void)
> +{
> +	asm volatile ("							\
> +	call %[bpf_get_prandom_u32];					\
> +	r0 &= 0xff;			/* r0 ∈ [0, 255] */		\
> +	r1 = 8;								\
> +	r1 -= r0;			/* r1 ∈ [-247, 8] */		\
> +	r2 = 0;								\
> +	if r1 == r2 goto 1f;						\
> +	if r1 > 8 goto 1f;		/* r1 ∈ [1, 8] */		\
> +	if r1 < 1 goto 2f;		/* must be dead */		\
> +	if r1 > 8 goto 2f;		/* must be dead */		\
> +	goto 1f;							\
> +2:	r0 /= 0;			/* unreachable */		\
> +1:	r0 = 0;								\
> +	exit;								\
> +	"
> +	:: __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
> +SEC("socket")
> +__success
> +__naked void fork_on_zero_cmp_x_swapped(void)
> +{
> +	asm volatile ("							\
> +	call %[bpf_get_prandom_u32];					\
> +	r0 &= 0xff;			/* r0 ∈ [0, 255] */		\
> +	r1 = 8;								\
> +	r1 -= r0;			/* r1 ∈ [-247, 8] */		\
> +	r2 = 0;								\
> +	if r2 == r1 goto 1f;						\
> +	if r1 > 8 goto 1f;		/* r1 ∈ [1, 8] */		\
> +	if r1 < 1 goto 2f;		/* must be dead */		\
> +	if r1 > 8 goto 2f;		/* must be dead */		\
> +	goto 1f;							\
> +2:	r0 /= 0;			/* unreachable */		\
> +1:	r0 = 0;								\
> +	exit;								\
> +	"
> +	:: __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
>  char _license[] SEC("license") = "GPL";