Commit 0780f54a authored Aug 20, 2025 by Paul Chaignon Committed by Daniel Borkmann Aug 22, 2025

selftests/bpf: Tests for is_scalar_branch_taken tnum logic

This patch adds tests for the new jeq and jne logic in
is_scalar_branch_taken. The following shows the first test failing
before the previous patch is applied. Once the previous patch is
applied, the verifier can use the tnum values to deduce that instruction
7 is dead code.

0: call bpf_get_prandom_u32#7 ; R0_w=scalar()
1: w0 = w0 ; R0_w=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
2: r0 >>= 30 ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=3,var_off=(0x0; 0x3))
3: r0 <<= 30 ; R0_w=scalar(smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000))
4: r1 = r0 ; R0_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000)) R1_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000))
5: r1 += 1024 ; R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000400,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000))
6: if r1 != r0 goto pc+1 ; R0_w=scalar(id=1,smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000000,var_off=(0x400; 0xc0000000)) R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000))
7: r10 = 0
frame pointer is read only

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/550004f935e2553bdb2fb1f09cbde7d0452112d0.1755694148.git.paul.chaignon@gmail.com

parent f41345f4

tools/testing/selftests/bpf/progs/verifier_bounds.c

+41 −0

Original line number	Diff line number	Diff line
		@@ -1668,4 +1668,45 @@ l0_%=: r0 = 0; \
		: __clobber_all);
		}

		SEC("socket")
		__description("dead jne branch due to disagreeing tnums")
		__success __log_level(2)
		__naked void jne_disagreeing_tnums(void *ctx)
		{
		asm volatile(" \
		call %[bpf_get_prandom_u32]; \
		w0 = w0; \
		r0 >>= 30; \
		r0 <<= 30; \
		r1 = r0; \
		r1 += 1024; \
		if r1 != r0 goto +1; \
		r10 = 0; \
		exit; \
		" :
		: __imm(bpf_get_prandom_u32)
		: __clobber_all);
		}

		SEC("socket")
		__description("dead jeq branch due to disagreeing tnums")
		__success __log_level(2)
		__naked void jeq_disagreeing_tnums(void *ctx)
		{
		asm volatile(" \
		call %[bpf_get_prandom_u32]; \
		w0 = w0; \
		r0 >>= 30; \
		r0 <<= 30; \
		r1 = r0; \
		r1 += 1024; \
		if r1 == r0 goto +1; \
		exit; \
		r10 = 0; \
		exit; \
		" :
		: __imm(bpf_get_prandom_u32)
		: __clobber_all);
		}

		char _license[] SEC("license") = "GPL";