Re: [PATCH bpf-next v3 0/6] Fix invariant violations and improve branch detection

Eduard Zingerman
2026-04-03T01:08:20Z

On Thu, 2026-04-02 at 17:07 +0200, Paul Chaignon wrote:
> This patchset fixes invariant violations on register bounds. These
> invariant violations cause a warning and happen when reg_bounds_sync is
> trying to refine register bounds while walking an impossible branch.
>
> This patchset takes this situation as an opportunity to improve
> verification performance. That is, the verifier will use the invariant
> violations as a signal that a branch cannot be taken and process it as
> dead code.
>
> This patchset implements this approach and covers it in selftests with
> a new invariant violation case. Some of the logic in reg_bounds_sync
> likely acts as a duplicate with logic from is_scalar_branch_taken. This
> patchset does not attempt to remove superfluous logic from
> is_scalar_branch_taken and leaves it to a future patchset (ex. once
> syzbot has confirmed that all invariant violations are fixed).
>
> In the future, there is also a potential opportunity to simplify
> existing logic by merging reg_bounds_sync and range_bounds_violation
> (have reg_bounds_sync error out on invariant violation). That is
> however not needed to fix invariant violation, which we focus on in
> this patchset.
>
> Changes in v3:
> - Rename and refactor the helper functions checking for tnum-related
> invariant violations (Mykyta).
> - Small changes to comment style in verifier changes and new selftest
> (Mykyta).
> - Rebased.
> Changes in v2:
> - Moved tmp registers to env in preparatory commit (Eduard).
> - Updated reg_bounds_sync to bail out in case of ill-formed
> registers, thus avoiding one set of invariant violation checks in
> simulate_both_branches_taken (Eduard).
> - Drop the Fixes tag to avoid misleading backporters (Shung-Hsi).
> - Improve wording of commit descriptions (Shung-Hsi, Hari).
> - Fix error in code comments (AI bot).
> - Rebased.

Thank you for addressing this issue, let's land this.
Please proceed with the followup covering tnum checks,
so that we can be finally sure that there are no
more invariant violations possible.