This patchset improves the 64bits bounds refinement when the s64 ranges crosses the sign boundary. The first patch explains the small addition to __reg64_deduce_bounds. The third patch adds a selftest with a more complete example of the impact on verification. The second and last patches update the existing selftests to take the new refinement into account. This patchset should reduce the number of kernel warnings hit by syzkaller due to invariant violations [1]. It was also tested with Agni [2] (and Cilium's CI for good measure). Link: https://syzkaller.appspot.com/bug?extid=c711ce17dd78e5d4fdcf [1] Link: https://github.com/bpfverif/agni [2] Changes in v2 (all on Eduard's suggestions): - Added two tests to ensure we cover all cases of u64/s64 overlap. - Improved tests to check deduced ranges with __msg. - Improved code comments. Paul Chaignon (4): bpf: Improve bounds when s64 crosses sign boundary selftests/bpf: Update reg_bound range refinement logic selftests/bpf: Test cross-sign 64bits range refinement selftests/bpf: Test invariants on JSLT crossing sign kernel/bpf/verifier.c | 52 ++++++++ .../selftests/bpf/prog_tests/reg_bounds.c | 14 ++ .../selftests/bpf/progs/verifier_bounds.c | 120 +++++++++++++++++- 3 files changed, 185 insertions(+), 1 deletion(-) -- 2.43.0
