On Mon, May 18, 2020 at 1:06 PM John Fastabend <john.fastabend@xxxxxxxxx> wrote: > > When we have pointer type that is known to be non-null we only follow > the non-null branch. This adds tests to cover this case for reference > tracking. > > Signed-off-by: John Fastabend <john.fastabend@xxxxxxxxx> > --- > .../testing/selftests/bpf/verifier/ref_tracking.c | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c > index 604b461..d8f7c04 100644 > --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c > +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c > @@ -821,3 +821,19 @@ > .result = REJECT, > .errstr = "invalid mem access", > }, > +{ > + "reference tracking: branch tracking valid pointer null comparison", > + .insns = { > + BPF_SK_LOOKUP(sk_lookup_tcp), > + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), > + BPF_MOV64_IMM(BPF_REG_3, 1), > + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1), > + BPF_MOV64_IMM(BPF_REG_3, 0), > + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2), > + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), > + BPF_EMIT_CALL(BPF_FUNC_sk_release), > + BPF_EXIT_INSN(), > + }, > + .prog_type = BPF_PROG_TYPE_SCHED_CLS, > + .result = ACCEPT, > +}, Can you please add another test where you test against non-zero value to verify that both branches are considered to be taken and verifier actually complaints that sk_release happens only in one of branches. >