On Wed, 2025-08-20 at 13:34 +0200, Paul Chaignon wrote: [...] > I have a patch to potentially fix this, but I'm still testing it and > would prefer to send it separately as it doesn't really relate to my > current patchset. I'd like to bring this point again: this is a cat-and-mouse game. is_scalar_branch_taken() and regs_refine_cond_op() are essentially same operation and should be treated as such: produce register states for both branches and prune those that result in an impossible state. There is nothing wrong with this logically and we haven't got a single real bug from the invariant violations check if I remember correctly. Comparing the two functions, it looks like tricky cases are BPF_JE/JNE and BPF_JSET/JSET|BPF_X. However, given that regs_refine_cond_op() is called for a false branch with opcode reversed it looks like there is no issues with these cases. I'll give this a try. [...]
