Re: [PATCH bpf-next 2/4] bpf: Simulate branches to prune based on range violations

[Paul Chaignon <paul.chaignon@gmail.com>]

On Mon, Mar 16, 2026 at 10:09:07AM -0700, Eduard Zingerman wrote:
> On Sat, 2026-03-14 at 01:01 -0400, Harishankar Vishwanathan wrote:
> 
> [...]
> 
> > > > +     /* Fallthrough (FALSE) branch */
> > > > +     regs_refine_cond_op(&false_reg1_c, &false_reg2_c, rev_opcode(opcode), is_jmp32);
> > > > +     /* If there is a range bounds violation in *any* of the abstract values in either
> > > > +      * reg_states in the FALSE branch (i.e. false_reg1, false_reg2), the FALSE branch must be
> > > > +      * dead. Only TRUE branch will be taken.
> > > > +      */
> > > > +     if (range_bounds_violation(&false_reg1_c) || range_bounds_violation(&false_reg2_c))
> > > > +             return 1;
> > > 
> > > How hard would it be to modify reg_bounds_sync() such that it
> > > preserves invariant violation? Thus avoiding the first round of
> > > range_bounds_violation() checks.
> > 
> > We can exit early in reg_bounds_sync by detecting ill-formed inputs
> > (using reg_bounds_violation itself), and have reg_bounds_sync preserve
> > the invalid bounds.
> > Unsure if preserving invalid inputs is a good idea for
> > reg_bounds_sync. Or if we should be
> > calling __mark_reg_unbounded on invalid inputs.
> 
> Agree, early exit is a good option.

Thanks for the review!

We're preparing a v2 with this change and the temporary registers inside
bpf_verifier_env.