* [bpf-next:master 55/94] kernel/bpf/scev.c:3332 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 3320)
@ 2026-11-05 1:48 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-11-05 1:48 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Alexei Starovoitov <ast@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
head: b3b9fd4dda0953e84e9146c0962fbd0a67014a92
commit: 09c5008302ed2928873970013fac5cb677510461 [55/94] bpf: Describe more registers of a counted loop
:::::: branch date: 6 hours ago
:::::: commit date: 7 hours ago
config: arc-randconfig-2200-20261104 (https://download.01.org/0day-ci/archive/20261105/202611050216.7Cy544Mf-lkp@intel.com/config)
compiler: arc-linux-gcc (GCC) 8.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611050216.7Cy544Mf-lkp@intel.com/
smatch warnings:
kernel/bpf/scev.c:3332 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 3320)
vim +/reg +3332 kernel/bpf/scev.c
6ccf49f7932781 Eduard Zingerman 2026-10-09 3287
6ccf49f7932781 Eduard Zingerman 2026-10-09 3288 int bpf_widen_scev_regs(struct bpf_verifier_env *env, struct bpf_verifier_state *st,
6ccf49f7932781 Eduard Zingerman 2026-10-09 3289 struct bpf_verifier_state *loop_entry, struct bpf_loop_iters *iters)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3290 {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3291 struct bpf_func_state *cur_func = st->frame[st->curframe];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3292 struct bpf_func_state *entry_func = loop_entry->frame[loop_entry->curframe];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3293 struct bpf_verifier_log *log = &env->log;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3294 struct scev *scev = env->scev;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3295 struct bpf_reg_state *reg;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3296 struct env *header_env;
32e962577d2d8a Eduard Zingerman 2026-10-20 3297 struct linear_coefs coefs;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3298 struct bounds bounds;
32e962577d2d8a Eduard Zingerman 2026-10-20 3299 u32 r, r_expr, a, b;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3300 int insn_idx = st->insn_idx;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3301 int err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3302
6ccf49f7932781 Eduard Zingerman 2026-10-09 3303 for_each_set_bit(r, iters->precise_regs, REGS_NUM) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3304 if (r < MAX_BPF_REG)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3305 bpf_bt_set_frame_reg(&env->bt, st->curframe, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3306 else
6ccf49f7932781 Eduard Zingerman 2026-10-09 3307 bpf_bt_set_frame_slot(&env->bt, st->curframe, r - MAX_BPF_REG);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3308 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3309 err = bpf_mark_chain_precision(env, st, -1, NULL);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3310 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3311 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3312
6ccf49f7932781 Eduard Zingerman 2026-10-09 3313 header_env = find_header_env(scev, insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3314 for (r = 0; r < REGS_NUM; r++) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3315 if (!scev_reg_alive(env, st, r) || is_unbound_scev_reg(env, cur_func, r) ||
09c5008302ed29 Alexei Starovoitov 2026-11-03 3316 is_const_scev_reg(env, insn_idx, r))
09c5008302ed29 Alexei Starovoitov 2026-11-03 3317 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3318
09c5008302ed29 Alexei Starovoitov 2026-11-03 3319 reg = scev_reg_for_linear(cur_func, r);
09c5008302ed29 Alexei Starovoitov 2026-11-03 @3320 if (reg && reg->type == PTR_TO_ARENA)
09c5008302ed29 Alexei Starovoitov 2026-11-03 3321 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3322
09c5008302ed29 Alexei Starovoitov 2026-11-03 3323 if (test_bit(r, iters->mask_regs)) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3324 /* The range stays. It's no longer equal to the registers with its id. */
09c5008302ed29 Alexei Starovoitov 2026-11-03 3325 err = scev_reg_for_write(env, cur_func, r, ®);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3326 if (err)
09c5008302ed29 Alexei Starovoitov 2026-11-03 3327 return err;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3328 if (log->level & BPF_LOG_LEVEL2) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3329 bpf_log(log, "loop header at %d, ", insn_idx);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3330 log_reg(env, r);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3331 bpf_log(log, " stays in 0..%llu, it loses bits only\n",
09c5008302ed29 Alexei Starovoitov 2026-11-03 @3332 reg_umax(reg));
09c5008302ed29 Alexei Starovoitov 2026-11-03 3333 }
09c5008302ed29 Alexei Starovoitov 2026-11-03 3334 scratch_widened_reg_id(env, reg);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3335 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3336 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3337 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3338
6ccf49f7932781 Eduard Zingerman 2026-10-09 3339 r_expr = header_env->reg2scev[r];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3340 /* If SCEV for r is (linear <reg> <slope>)*/
32e962577d2d8a Eduard Zingerman 2026-10-20 3341 if (is_simple_linear(scev, r_expr, &coefs) && coefs.base_reg == r) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3342 err = scev_reg_for_write(env, cur_func, r, ®);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3343 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3344 return err;
32e962577d2d8a Eduard Zingerman 2026-10-20 3345 linear_bounds(reg, iters->max_header_count, &coefs, &bounds);
1e589fdc85a8f6 Alexei Starovoitov 2026-11-03 3346 if (r == iters->iv_reg)
1e589fdc85a8f6 Alexei Starovoitov 2026-11-03 3347 iv_bounds(&bounds, iters->iv_range);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3348 if (log->level & BPF_LOG_LEVEL2) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3349 bpf_log(log, "loop header at %d, widening ", insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3350 log_reg(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3351 bpf_log(log, " to ");
32e962577d2d8a Eduard Zingerman 2026-10-20 3352 log_bounds(env, &bounds);
32e962577d2d8a Eduard Zingerman 2026-10-20 3353 bpf_log(log, "\n");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3354 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3355 scratch_widened_reg_id(env, reg);
88e2c896d8598a Alexei Starovoitov 2026-10-30 3356 /* "at pkt_end" and "beyond pkt_end" are not valid in all iterations */
88e2c896d8598a Alexei Starovoitov 2026-10-30 3357 if (type_is_pkt_pointer(reg->type))
88e2c896d8598a Alexei Starovoitov 2026-10-30 3358 reg->range = max(reg->range, 0);
32e962577d2d8a Eduard Zingerman 2026-10-20 3359 err = bpf_set_reg_range(env, reg, bounds.r64, bounds.r32,
32e962577d2d8a Eduard Zingerman 2026-10-20 3360 bounds.base, bounds.step);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3361 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3362 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3363 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3364 } else if (is_any(scev, r_expr, &a, &b)) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3365 err = scev_reg_for_write(env, cur_func, r, ®);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3366 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3367 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3368 err = union_any_reg(env, entry_func, reg, r_expr);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3369 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3370 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3371 if (log->level & BPF_LOG_LEVEL2) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3372 bpf_log(log, "loop header at %d, widening ", insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3373 log_reg(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3374 bpf_log(log, " to ");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3375 bpf_verbose_snum(env, reg_smin(reg));
6ccf49f7932781 Eduard Zingerman 2026-10-09 3376 bpf_log(log, "..");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3377 bpf_verbose_snum(env, reg_smax(reg));
6ccf49f7932781 Eduard Zingerman 2026-10-09 3378 bpf_log(log, " step %u\n", reg->step);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3379 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3380 scratch_widened_reg_id(env, reg);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3381 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3382 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3383 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3384 return 1;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3385 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3386
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-05 1:48 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-05 1:48 [bpf-next:master 55/94] kernel/bpf/scev.c:3332 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 3320) kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.