Re: [PATCH bpf-next 2/3] bpf: infer packet range for 'if pkt ==/!= pkt_end' comparisons

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2024-01-08 at 16:45 -0800, Andrii Nakryiko wrote:
[...]
> > @@ -14713,6 +14714,13 @@ static bool try_match_pkt_pointers(const struct bpf_insn *insn,
> >                 find_good_pkt_pointers(other_branch, dst_reg, dst_reg->type, opcode == BPF_JLT);
> >                 mark_pkt_end(this_branch, dst_regno, opcode == BPF_JLE);
> >                 break;
> > +       case BPF_JEQ:
> > +       case BPF_JNE:
> > +               /* pkt_data ==/!= pkt_end, pkt_meta ==/!= pkt_data */
> > +               eq_branch = opcode == BPF_JEQ ? other_branch : this_branch;
> > +               find_good_pkt_pointers(eq_branch, dst_reg, dst_reg->type, true);
> > +               mark_pkt_end(eq_branch, dst_regno, false);
> 
> hm... if pkt_data != pkt_end in this_branch, can we really infer
> whether reg->range is BEYOND_PKT_END or AT_PKT_END? What if it's
> IN_FRONT_OF_PKT_END?

pkt_data != pkt_end in this_branch means that there is an instruction:

  ...
  if pkt_data == pkt_end goto <other_branch>
  ... <this_branch> ...

the 'eq_branch' would be set to 'other_branch' and AT_PKT_END would be set
for dst register in 'other_branch'. What's wrong with this?
Or did you mean something else?