From: Eduard Zingerman <eddyz87@gmail.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Yazhou Tang <tangyazhou@zju.edu.cn>, bpf <bpf@vger.kernel.org>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
KP Singh <kpsingh@kernel.org>,
Stanislav Fomichev <sdf@fomichev.me>, Hao Luo <haoluo@google.com>,
Jiri Olsa <jolsa@kernel.org>,
Yazhou Tang <tangyazhou518@outlook.com>,
Shenghao Yuan <shenghaoyuan0928@163.com>,
Tianci Cao <ziye@zju.edu.cn>,
syzbot@syzkaller.appspotmail.com
Subject: Re: [PATCH bpf-next v5 1/2] bpf: Add range tracking for BPF_DIV and BPF_MOD
Date: Tue, 20 Jan 2026 13:54:13 -0800 [thread overview]
Message-ID: <acada74ba15f0aaeede2440ff68916f3fbfa7da9.camel@gmail.com> (raw)
In-Reply-To: <CAADnVQ+xyTTweTV3Kud5zPdRtcQkXEv9iYMQXyc_rc8_Jzunbg@mail.gmail.com>
On Tue, 2026-01-20 at 13:03 -0800, Alexei Starovoitov wrote:
> On Tue, Jan 20, 2026 at 10:51 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
> >
> > On Mon, 2026-01-19 at 16:54 +0800, Yazhou Tang wrote:
> >
> > [...]
> >
> > Hi Yazhou, Alexei,
> >
> > Sorry for chiming in late in the series.
> >
> > > diff --git a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> > > index 2129e4353fd9..4d8273c258d5 100644
> > > --- a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> > > +++ b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
> > > @@ -173,14 +173,15 @@ __naked void flow_keys_illegal_variable_offset_alu(void)
> > > asm volatile(" \
> > > r6 = r1; \
> > > r7 = *(u64*)(r6 + %[flow_keys_off]); \
> > > - r8 = 8; \
> > > - r8 /= 1; \
> > > + call %[bpf_get_prandom_u32]; \
> > > + r8 = r0; \
> >
> > I suggest we special case `rX /= 1`.
> > Maybe in the is_safe_to_compute_dst_reg_range().
> > This is an old trick that might be used in the wild.
> > And optimizer should remove any such instructions when compiling from C.
> > So I don't think adding special case here would hinder verifier versatility.
>
> and to standardize now and forever that /=1 makes it unbounded?
> I'd rather not. JITs don't special case the divisor 1 and in runtime
> the /=1 trick is quite costly. Integer division is the slowest instruction
> on any CPU architecture.
> We have few selftests that adopted that trick, but let's not continue
> and not encourage it going forward.
> Let's figure out a different way to tell the verifier that the scalar
> is unbounded.
Fair enough.
> I suspect ^=0; ^=0; will destroy the bounds just as well
> and will be fast to execute.
scalar_min_max_xor() tries to compute min and max,
does not nuke register state.
Andrii suggested adding a kfunc or instruction for this purpose some
time ago. Anyway, that's unrelated if we don't want to keep /= 1.
next prev parent reply other threads:[~2026-01-20 21:54 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-19 8:54 [PATCH bpf-next v5 0/2] bpf: Add range tracking for BPF_DIV and BPF_MOD Yazhou Tang
2026-01-19 8:54 ` [PATCH bpf-next v5 1/2] " Yazhou Tang
2026-01-20 18:51 ` Eduard Zingerman
2026-01-20 21:03 ` Alexei Starovoitov
2026-01-20 21:54 ` Eduard Zingerman [this message]
2026-01-20 22:02 ` Alexei Starovoitov
2026-01-21 0:32 ` Eduard Zingerman
2026-01-19 8:54 ` [PATCH bpf-next v5 2/2] selftests/bpf: Add tests for BPF_DIV and BPF_MOD range tracking Yazhou Tang
2026-01-21 0:50 ` [PATCH bpf-next v5 0/2] bpf: Add range tracking for BPF_DIV and BPF_MOD patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=acada74ba15f0aaeede2440ff68916f3fbfa7da9.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=shenghaoyuan0928@163.com \
--cc=song@kernel.org \
--cc=syzbot@syzkaller.appspotmail.com \
--cc=tangyazhou518@outlook.com \
--cc=tangyazhou@zju.edu.cn \
--cc=yonghong.song@linux.dev \
--cc=ziye@zju.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox