Re: [PATCH v2 bpf-next 5/6] selftests/bpf: Cover invariant violation cases from syzbot

Paul Chaignon
2026-03-28T16:20:49Z

On Mon, Mar 23, 2026 at 05:46:41PM +0000, Mykyta Yatsenko wrote:
> Paul Chaignon <paul.chaignon@gmail.com> writes:

[...]

> > +/* Last jump can be detected as always taken because the intersection of R5 and
> > + * R7 32bit tnums produces a constant that isn't within R7's s32 bounds.
> > + */
> > +SEC("socket")
> > +__description("dead branch: tnums give impossible constant if equal")
> > +__success
> > +__flag(BPF_F_TEST_REG_INVARIANTS)
> > +__naked void tnums_equal_impossible_constant(void *ctx)
> > +{
> > + asm volatile(" \
> > + call %[bpf_get_prandom_u32]; \
> > + r5 = r0; \
> > + r5 &= 0xfffffffffffffffc; /* var_off32=(0; 0xfffffffc) */ \
> > + r7 = r0; \
> > + r7 &= 0x1; /* var_off32=(0x0; 0x1) */ \
> > + r7 += -43; /* s32=[-43; -42] & var_off32=(0xffffffd4; 0x3) */ \
> > + if w5 != w7 goto +1; /* on fallthrough var_off32=-44, not in s32 */ \
> w5 has bits 0,1 zero, rest unknown
> w7 has top bits known as 0xffffffd4, and bits 0,1 unknown
> If w5 == w7, their tnums must intersect to a single
> value = 0xffffffd4(-44). Which is outside of w7's range [-43; 42]. So
> the r10 = 0 branch should be unreachable.
> I guess the comment should be updated to the kernel style as well.

Thanks for the review! We already have a lot of end-of-line comments on
the BPF assembly in selftests (including two tests above) so I assumed
that was fine.

(Unrelated: On some mail clients, your comments are hard to spot. It
might help if you could include a blank line before and after them :) )

> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> > + r10 = 0; \
> > + exit; \
> > +" :
> > + : __imm(bpf_get_prandom_u32)
> > + : __clobber_all);
> > +}
> > +
> > char _license[] SEC("license") = "GPL";
> > --
> > 2.43.0