Re: [PATCH bpf 2/2] selftests/bpf: Add reg-invariants test for speculative pointer arithmetic

[Eduard Zingerman]

On Wed, 2026-08-19 at 20:58 +0800, Jiayuan Chen wrote:
> An unprivileged socket filter does variable pointer arithmetic on a
> PTR_TO_MAP_VALUE whose offset collapses to a constant. The Spectre-v1
> speculative path used to snapshot the pointer with a const offset and an
> unbounded r32, which tripped reg_bounds_sanity_check() on the following
> register move.
> 
> Mark the test __success_unpriv (the speculative path only runs
> unprivileged) and flag it BPF_F_TEST_REG_INVARIANTS so the invariant
> violation becomes a hard load failure. The unprivileged run fails without
> the verifier fix and passes with it:
> 
>   verifier_bounds/spec_ptr_alu_const_offset @unpriv:FAIL   # without fix
>   verifier_bounds/spec_ptr_alu_const_offset @unpriv:OK     # with fix
> 
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> ---

Tested-by: Eduard Zingerman <eddyz87@xxxxxxxxx>

...