> On Jun 24, 2025, at 3:14 PM, Eduard Zingerman <eddyz87@xxxxxxxxx> wrote:
>
> On Tue, 2025-06-24 at 15:00 -0700, Song Liu wrote:
>
> [...]
>
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds_deduction.c b/tools/testing/selftests/bpf/progs/verifier_bounds_deduction.c
>> index c506afbdd936..8d886c15fdcc 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_bounds_deduction.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds_deduction.c
>> @@ -151,21 +151,4 @@ l0_%=: r0 -= r1; \
>> " ::: __clobber_all);
>> }
>>
>> -SEC("socket")
>> -__description("check deducing bounds from const, 10")
>> -__failure
>> -__msg("math between ctx pointer and register with unbounded min value is not allowed")
>> -__failure_unpriv
>> -__naked void deducing_bounds_from_const_10(void)
>> -{
>> - asm volatile (" \
>> - r0 = 0; \
>> - if r0 s<= 0 goto l0_%=; \
>> -l0_%=: /* Marks reg as unknown. */ \
>> - r0 = -r0; \
>> - r0 -= r1; \
>
> It looks like rX = -rX was used in a few tests as a source of unbound
> scalar values. It is probably not safe to throw these tests away or
> convert failure->success, unless we are sure the logic is tested
> elsewhere.
>
> One option to keep the tests is to call bpf_get_prandom_u32() and
> obtain an unbound value in r0 as a result.
I thought this test was to verify BPF_NEG turns known const into
unknown, so I removed it. But I guess we still need a test to
trigger "math between ctx pointer and register with unbounded min value"
Let me add it back.
Thanks,
Song
>
>> - exit; \
>> -" ::: __clobber_all);
>> -}
>> -
>> char _license[] SEC("license") = "GPL";
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c b/tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c
>> index fcea9819e359..799eccd181b5 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_value_ptr_arith.c
>> @@ -225,9 +225,7 @@ l2_%=: r0 = 1; \
>>
>> SEC("socket")
>> __description("map access: known scalar += value_ptr unknown vs unknown (lt)")
>> -__success __failure_unpriv
>> -__msg_unpriv("R1 tried to add from different maps, paths or scalars")
>> -__retval(1)
>> +__success __success_unpriv __retval(1)
>> __naked void ptr_unknown_vs_unknown_lt(void)
>> {
>> asm volatile (" \
>> @@ -265,9 +263,7 @@ l2_%=: r0 = 1; \
>>
>> SEC("socket")
>> __description("map access: known scalar += value_ptr unknown vs unknown (gt)")
>> -__success __failure_unpriv
>> -__msg_unpriv("R1 tried to add from different maps, paths or scalars")
>> -__retval(1)
>> +__success __success_unpriv __retval(1)
>> __naked void ptr_unknown_vs_unknown_gt(void)
>> {
>> asm volatile (" \
