Re: [syzbot ci] Re: bpf: Use tnums for JEQ/JNE is_branch_taken logic

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2025-09-08 at 19:49 +0200, Paul Chaignon wrote:
> On Wed, Aug 20, 2025 at 12:37:46PM -0700, Eduard Zingerman wrote:
> > On Wed, 2025-08-20 at 13:34 +0200, Paul Chaignon wrote:
> > 
> > [...]
> > 
> > > I have a patch to potentially fix this, but I'm still testing it and
> > > would prefer to send it separately as it doesn't really relate to my
> > > current patchset.
> > 
> > I'd like to bring this point again: this is a cat-and-mouse game.
> > is_scalar_branch_taken() and regs_refine_cond_op() are essentially
> > same operation and should be treated as such: produce register states
> > for both branches and prune those that result in an impossible state.
> > There is nothing wrong with this logically and we haven't got a single
> > real bug from the invariant violations check if I remember correctly.
> > 
> > Comparing the two functions, it looks like tricky cases are BPF_JE/JNE
> > and BPF_JSET/JSET|BPF_X. However, given that regs_refine_cond_op() is
> > called for a false branch with opcode reversed it looks like there is
> > no issues with these cases.
> > 
> > I'll give this a try.
> 
> Hi Eduard,
> 
> Did you get a chance to look into this? syzkaller came back (finally)
> complaining about the remaining invariant violations:
> https://lore.kernel.org/bpf/68bacb3e.050a0220.192772.018d.GAE@google.com/
> If not, I can have a look at the end of the week.
> 
> Paul

Hi Paul,

I have an unfinished branch here:
https://github.com/kernel-patches/bpf/commit/ef2e080a58206e23e3a521d2942f9b4d58a8627c
Don't like how it looks though. Planned on getting back to it this week.
Please ping me if you'd start working on a fix.

Thanks,
Eduard