Re: [PATCH bpf-next v5 1/2] bpf: Add range tracking for BPF_DIV and BPF_MOD

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2026-01-19 at 16:54 +0800, Yazhou Tang wrote:

[...]

Hi Yazhou, Alexei,

Sorry for chiming in late in the series.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> index 2129e4353fd9..4d8273c258d5 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> @@ -173,14 +173,15 @@ __naked void flow_keys_illegal_variable_offset_alu(void)
>  	asm volatile("					\
>  	r6 = r1;					\
>  	r7 = *(u64*)(r6 + %[flow_keys_off]);		\
> -	r8 = 8;						\
> -	r8 /= 1;					\
> +	call %[bpf_get_prandom_u32];			\
> +	r8 = r0;					\

I suggest we special case `rX /= 1`.
Maybe in the is_safe_to_compute_dst_reg_range().
This is an old trick that might be used in the wild.
And optimizer should remove any such instructions when compiling from C.
So I don't think adding special case here would hinder verifier versatility.

>  	r8 &= 8;					\
>  	r7 += r8;					\
>  	r0 = *(u64*)(r7 + 0);				\
>  	exit;						\
>  "	:
> -	: __imm_const(flow_keys_off, offsetof(struct __sk_buff, flow_keys))
> +	: __imm_const(flow_keys_off, offsetof(struct __sk_buff, flow_keys)),
> +	  __imm(bpf_get_prandom_u32)
>  	: __clobber_all);
>  }