Re: [PATCH v2 bpf-next 5/6] selftests/bpf: Cover invariant violation cases from syzbot

[Paul Chaignon <paul.chaignon@gmail.com>]

On Mon, Mar 23, 2026 at 05:46:41PM +0000, Mykyta Yatsenko wrote:
> Paul Chaignon <paul.chaignon@gmail.com> writes:

[...]

> > +/* Last jump can be detected as always taken because the intersection of R5 and
> > + * R7 32bit tnums produces a constant that isn't within R7's s32 bounds.
> > + */
> > +SEC("socket")
> > +__description("dead branch: tnums give impossible constant if equal")
> > +__success
> > +__flag(BPF_F_TEST_REG_INVARIANTS)
> > +__naked void tnums_equal_impossible_constant(void *ctx)
> > +{
> > +	asm volatile("										\
> > +	call %[bpf_get_prandom_u32];								\
> > +	r5 = r0;										\
> > +	r5 &= 0xfffffffffffffffc;	/* var_off32=(0; 0xfffffffc) */				\
> > +	r7 = r0;										\
> > +	r7 &= 0x1;			/* var_off32=(0x0; 0x1) */				\
> > +	r7 += -43;			/* s32=[-43; -42] & var_off32=(0xffffffd4; 0x3) */	\
> > +	if w5 != w7 goto +1;		/* on fallthrough var_off32=-44, not in s32 */		\
> w5 has bits 0,1 zero, rest unknown
> w7 has top bits known as 0xffffffd4, and bits 0,1 unknown
> If w5 == w7, their tnums must intersect to a single
> value = 0xffffffd4(-44). Which is outside of w7's range [-43; 42]. So
> the r10 = 0 branch should be unreachable.
> I guess the comment should be updated to the kernel style as well.

Thanks for the review! We already have a lot of end-of-line comments on
the BPF assembly in selftests (including two tests above) so I assumed
that was fine.

(Unrelated: On some mail clients, your comments are hard to spot. It
might help if you could include a blank line before and after them :) )

> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> > +	r10 = 0;										\
> > +	exit;											\
> > +"	:
> > +	: __imm(bpf_get_prandom_u32)
> > +	: __clobber_all);
> > +}
> > +
> >  char _license[] SEC("license") = "GPL";
> > -- 
> > 2.43.0