From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [kkdwivedi:master 5/16] kernel/bpf/diagnostics.c:863 reg_to_target() error: buffer overflow 'state->regs' 11 <= 11
Date: Thu, 13 Aug 2026 19:14:06 +0800 [thread overview]
Message-ID: <202608131943.Ew29HxTJ-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Kumar Kartikeya Dwivedi <memxor@gmail.com>
tree: https://github.com/kkdwivedi/linux master
head: e2bbb4761d332a66c9bc34c07069d862440cf7a7
commit: 20fdb5545829a10d76a8586053a22e7930bf4389 [5/16] bpf: Track verifier register diagnostic events
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: sh-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260813/202608131943.Ew29HxTJ-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 15.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608131943.Ew29HxTJ-lkp@intel.com/
smatch warnings:
kernel/bpf/diagnostics.c:863 reg_to_target() error: buffer overflow 'state->regs' 11 <= 11
vim +863 kernel/bpf/diagnostics.c
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 848
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 849 static bool reg_to_target(struct bpf_verifier_env *env, const struct bpf_reg_state *reg,
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 850 struct bpf_diag_mod_target *target)
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 851 {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 852 struct bpf_verifier_state *vstate = env->cur_state;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 853 unsigned long addr = (unsigned long)reg;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 854 int frame;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 855
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 856 for (frame = 0; frame <= vstate->curframe; frame++) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 857 struct bpf_func_state *state = vstate->frame[frame];
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 858 unsigned long start, end;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 859 u32 nslots = state->allocated_stack / BPF_REG_SIZE;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 860 int spi;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 861
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 862 start = (unsigned long)state->regs;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 @863 end = (unsigned long)(state->regs + MAX_BPF_REG);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 864 if (addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 865 *target = bpf_diag_reg_target(state->frameno, reg - state->regs);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 866 return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 867 }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 868
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 869 start = (unsigned long)state->stack_arg_regs;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 870 end = (unsigned long)(state->stack_arg_regs + state->out_stack_arg_cnt);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 871 if (state->out_stack_arg_cnt && addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 872 *target = bpf_diag_stack_arg_target(state->frameno,
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 873 reg - state->stack_arg_regs);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 874 return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 875 }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 876
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 877 start = (unsigned long)state->stack;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 878 end = (unsigned long)(state->stack + nslots);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 879 if (nslots && addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 880 spi = ((const char *)reg - (const char *)state->stack) /
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 881 sizeof(*state->stack);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 882 *target = bpf_diag_stack_slot_target(state->frameno, spi);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 883 return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 884 }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 885 }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 886 return false;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 887 }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 888
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-08-13 11:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202608131943.Ew29HxTJ-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.