Re: [PATCH bpf-next 2/2] selftests/bpf: Range analysis test case for JSET

[Yonghong Song <yonghong.song@linux.dev>]

On 7/9/25 3:27 PM, Paul Chaignon wrote:
> This patch adds coverage for the warning detected by syzkaller and fixed
> in the previous patch. Without the previous patch, this test fails with:
>
>    verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds
>    violation u64=[0x0, 0x0] s64=[0x0, 0x0] u32=[0x1, 0x0] s32=[0x0, 0x0]
>    var_off=(0x0, 0x0)(1)
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---
>   .../selftests/bpf/progs/verifier_bounds.c     | 19 +++++++++++++++++++
>   1 file changed, 19 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> index 6f986ae5085e..2232bce1bdce 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> @@ -2,6 +2,7 @@
>   /* Converted from tools/testing/selftests/bpf/verifier/bounds.c */
>   
>   #include <linux/bpf.h>
> +#include <../../../include/linux/filter.h>
>   #include <bpf/bpf_helpers.h>
>   #include "bpf_misc.h"
>   
> @@ -1532,4 +1533,22 @@ __naked void sub32_partial_overflow(void)
>   	: __clobber_all);
>   }
>   
> +SEC("socket")
> +__description("dead branch on jset, does not result in invariants violation error")
> +__success __log_level(2)
> +__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__naked void jset_range_analysis(void)
> +{
> +	asm volatile ("						\
> +	call %[bpf_get_netns_cookie];				\
> +	if r0 == 0 goto l0_%=;					\
> +	.8byte %[jset]; /* if r0 & 0xffffffff goto +0 */	\

why not just use 'if r0 & 0xffffffff goto +0'? It will be equivelant to
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 0xffffffff, 0).

> +l0_%=:	r0 = 0;							\
> +	exit;							\
> +"	:
> +	: __imm(bpf_get_netns_cookie),
> +	  __imm_insn(jset, BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 0xffffffff, 0))
> +	: __clobber_all);
> +}
> +
>   char _license[] SEC("license") = "GPL";