Re: [PATCH RFC bpf-next 3/7] selftests/bpf: Fix reg_bounds to prune on range violations

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Medium] The early return in `reg_state_cond` silently discards updates, incorrectly preventing mathematically impossible branches from being pruned.
--

commit 9c1398626b454db27a318d8fb3f946b257c46b99
Author: Paul Chaignon <paul.chaignon@gmail.com>

selftests/bpf: Fix reg_bounds to prune on range violations

This patch updates the reg_bounds selftest to correctly detect and prune
dead branches by checking for ill-formed ranges. It marks branches as
invalid if their ranges become ill-formed, matching the verifier logic.

> diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
> index 71f5240cc5b7e..c0b3a357a0f4c 100644
> --- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
> +++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
[ ... ]
> @@ -837,6 +850,8 @@ static void reg_state_cond(enum num_t t, struct reg_state *x, struct reg_state *
>  		z2 = y->r[t];
>  
>  		range_cond(t, z1, z2, op, &z1, &z2);
> +		if (!is_valid_range(t, z1) || !is_valid_range(t, z2))
> +			return;

Does this early return prevent the invalid ranges from being written back
to newx and newy?

If range_cond() produces an invalid range, the function returns immediately
and bypasses the write-back of xx and yy at the end of the function:

	if (newx)
		*newx = xx;
	if (newy)
		*newy = yy;

This leaves the output registers with their previous valid state.

When sim_case() later checks if the branch is valid:

	reg_state_cond(cond_t, tr1, tr2, op, tr1, tr2, "TRUE");
	if (is_valid_reg(tr1) && is_valid_reg(tr2))
		tr1->valid = tr2->valid = true;

won't it incorrectly evaluate the old valid state and mark the impossible
branch as valid, defeating the pruning logic?

>  
>  		if (newx) {
>  			snprintf(buf, sizeof(buf), "%s R1", ctx);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1776344897.git.paul.chaignon@gmail.com?part=3