Re: [PATCH v2 bpf-next 5/6] selftests/bpf: Cover invariant violation cases from syzbot

Alexei Starovoitov
2026-03-28T17:31:36Z

On Sat, Mar 28, 2026 at 9:20 AM Paul Chaignon <paul.chaignon@gmail.com> wrote:
>
> On Mon, Mar 23, 2026 at 05:46:41PM +0000, Mykyta Yatsenko wrote:
> > Paul Chaignon <paul.chaignon@gmail.com> writes:
>
> [...]
>
> > > +/* Last jump can be detected as always taken because the intersection of R5 and
> > > + * R7 32bit tnums produces a constant that isn't within R7's s32 bounds.
> > > + */
> > > +SEC("socket")
> > > +__description("dead branch: tnums give impossible constant if equal")
> > > +__success
> > > +__flag(BPF_F_TEST_REG_INVARIANTS)
> > > +__naked void tnums_equal_impossible_constant(void *ctx)
> > > +{
> > > + asm volatile(" \
> > > + call %[bpf_get_prandom_u32]; \
> > > + r5 = r0; \
> > > + r5 &= 0xfffffffffffffffc; /* var_off32=(0; 0xfffffffc) */ \
> > > + r7 = r0; \
> > > + r7 &= 0x1; /* var_off32=(0x0; 0x1) */ \
> > > + r7 += -43; /* s32=[-43; -42] & var_off32=(0xffffffd4; 0x3) */ \
> > > + if w5 != w7 goto +1; /* on fallthrough var_off32=-44, not in s32 */ \
> > w5 has bits 0,1 zero, rest unknown
> > w7 has top bits known as 0xffffffd4, and bits 0,1 unknown
> > If w5 == w7, their tnums must intersect to a single
> > value = 0xffffffd4(-44). Which is outside of w7's range [-43; 42]. So
> > the r10 = 0 branch should be unreachable.
> > I guess the comment should be updated to the kernel style as well.
>
> Thanks for the review! We already have a lot of end-of-line comments on
> the BPF assembly in selftests (including two tests above) so I assumed
> that was fine.

btw we have two comment styles in bpf progs.
I personally prefer this one:
/*
* Checkpoint at function entry should not fire, as caller
* stack fp[0]-8 is alive at this point.
*/
"r6 = r2;"
"r1 = *(u64 *)(r6 + 0);"
"*(u64*)(r10 - 8) = 7;"
"r2 = r10;"

because of color highlighting.
But some prefer the other one:

asm volatile (" \
/* spill R1(ctx) into stack */ \
*(u64*)(r10 - 8) = r1; \
/* fill it back into R2 */ \
r2 = *(u64*)(r10 - 8); \

The comments have the same color as asm, but
no " " marks.

> (Unrelated: On some mail clients, your comments are hard to spot. It
> might help if you could include a blank line before and after them :) )

+1