On Wed, Aug 20, 2025 at 12:37:46PM -0700, Eduard Zingerman wrote: > On Wed, 2025-08-20 at 13:34 +0200, Paul Chaignon wrote: > > [...] > > > I have a patch to potentially fix this, but I'm still testing it and > > would prefer to send it separately as it doesn't really relate to my > > current patchset. > > I'd like to bring this point again: this is a cat-and-mouse game. > is_scalar_branch_taken() and regs_refine_cond_op() are essentially > same operation and should be treated as such: produce register states > for both branches and prune those that result in an impossible state. > There is nothing wrong with this logically and we haven't got a single > real bug from the invariant violations check if I remember correctly. > > Comparing the two functions, it looks like tricky cases are BPF_JE/JNE > and BPF_JSET/JSET|BPF_X. However, given that regs_refine_cond_op() is > called for a false branch with opcode reversed it looks like there is > no issues with these cases. > > I'll give this a try. Hi Eduard, Did you get a chance to look into this? syzkaller came back (finally) complaining about the remaining invariant violations: https://lore.kernel.org/bpf/68bacb3e.050a0220.192772.018d.GAE@xxxxxxxxxx/ If not, I can have a look at the end of the week. Paul > > [...]
