[kkdwivedi:master 5/16] kernel/bpf/diagnostics.c:863 reg_to_target() error: buffer overflow 'state->regs' 11 <= 11

[kkdwivedi:master 5/16] kernel/bpf/diagnostics.c:863 reg_to_target() error: buffer overflow 'state->regs' 11 <= 11

[kernel test robot]

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Kumar Kartikeya Dwivedi <memxor@gmail.com>

tree:   https://github.com/kkdwivedi/linux master
head:   e2bbb4761d332a66c9bc34c07069d862440cf7a7
commit: 20fdb5545829a10d76a8586053a22e7930bf4389 [5/16] bpf: Track verifier register diagnostic events
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: sh-randconfig-r071-20260813 (https://download.01.org/0day-ci/archive/20260813/202608131943.Ew29HxTJ-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 15.2.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608131943.Ew29HxTJ-lkp@intel.com/

smatch warnings:
kernel/bpf/diagnostics.c:863 reg_to_target() error: buffer overflow 'state->regs' 11 <= 11

vim +863 kernel/bpf/diagnostics.c

20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  848  
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  849  static bool reg_to_target(struct bpf_verifier_env *env, const struct bpf_reg_state *reg,
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  850  			  struct bpf_diag_mod_target *target)
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  851  {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  852  	struct bpf_verifier_state *vstate = env->cur_state;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  853  	unsigned long addr = (unsigned long)reg;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  854  	int frame;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  855  
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  856  	for (frame = 0; frame <= vstate->curframe; frame++) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  857  		struct bpf_func_state *state = vstate->frame[frame];
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  858  		unsigned long start, end;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  859  		u32 nslots = state->allocated_stack / BPF_REG_SIZE;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  860  		int spi;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  861  
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  862  		start = (unsigned long)state->regs;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13 @863  		end = (unsigned long)(state->regs + MAX_BPF_REG);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  864  		if (addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  865  			*target = bpf_diag_reg_target(state->frameno, reg - state->regs);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  866  			return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  867  		}
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  868  
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  869  		start = (unsigned long)state->stack_arg_regs;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  870  		end = (unsigned long)(state->stack_arg_regs + state->out_stack_arg_cnt);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  871  		if (state->out_stack_arg_cnt && addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  872  			*target = bpf_diag_stack_arg_target(state->frameno,
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  873  							    reg - state->stack_arg_regs);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  874  			return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  875  		}
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  876  
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  877  		start = (unsigned long)state->stack;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  878  		end = (unsigned long)(state->stack + nslots);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  879  		if (nslots && addr >= start && addr < end) {
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  880  			spi = ((const char *)reg - (const char *)state->stack) /
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  881  			      sizeof(*state->stack);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  882  			*target = bpf_diag_stack_slot_target(state->frameno, spi);
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  883  			return true;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  884  		}
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  885  	}
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  886  	return false;
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  887  }
20fdb5545829a1 Kumar Kartikeya Dwivedi 2026-07-13  888  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki