Re: [Bug Report] bpf: incorrectly pruning runtime execution path

[Andrii Nakryiko]

On Wed, Dec 13, 2023 at 3:47 PM Eduard Zingerman <eddyz87@xxxxxxxxx> wrote:
>
> On Wed, 2023-12-13 at 15:40 -0800, Andrii Nakryiko wrote:
> [...]
> > >     24: (18) r2 = 0x4                     ; R2_w=4
> > >     26: (7e) if w8 s>= w0 goto pc+5
> > >     mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> > >     mark_precise: frame0: regs=r5,r8 stack= before 24: (18) r2 = 0x4
> > >     ...                   ^^^^^^^^^^
> > >                           ^^^^^^^^^^
> > > Here w8 == 15, w0 in range [0, 2], so the jump is being predicted,
> > > but for some reason R0 is not among the registers that would be marked precise.
> >
> > It is, as a second step. There are two concatenated precision logs:
> >
> > mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> > mark_precise: frame0: regs=r0 stack= before 24: (18) r2 = 0x4
> > mark_precise: frame0: regs=r0 stack= before 23: (bf) r5 = r8
> > mark_precise: frame0: regs=r0 stack= before 22: (67) r4 <<= 2
> >
> >
> > The issue is elsewhere, see my last email.
>
> Oh, right, there are two calls to mark_chain_precision in a row, thanks

We should probably combine those two steps, though, backtrack_state
allows us that now (see how propagate_precision() is doing that in one
go). It used to be very hard to mark two registers at the same time,
but now it's trivial. So not a bad idea to improve this and remove
confusion, especially in big real-world programs.