* [linux-next:master 3430/4145] kernel/bpf/scev.c:736:33-42: duplicated argument to && or ||
@ 2026-11-07 23:54 kernel test robot
2026-11-08 2:53 ` Alexei Starovoitov
0 siblings, 1 reply; 2+ messages in thread
From: kernel test robot @ 2026-11-07 23:54 UTC (permalink / raw)
To: Alexei Starovoitov; +Cc: oe-kbuild-all
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b
commit: 28a373cb0f6a579049ffe92747575213a442673f [3430/4145] bpf: Fold sums of constants and two shifts by 32 in scalar evolution
config: hexagon-randconfig-r2101-20261107 (https://download.01.org/0day-ci/archive/20261108/202611080024.A0phXMMa-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 0fa861dbbf46e5a75f621406fd91cb015d8754bf)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611080024.A0phXMMa-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> kernel/bpf/scev.c:736:33-42: duplicated argument to && or ||
vim +736 kernel/bpf/scev.c
656
657 static int transfer(struct bpf_verifier_env *env, struct env *e, int idx)
658 {
659 const bool little_endian = htons(0x3412) == 0x1234;
660 struct bpf_insn *insn = &env->prog->insnsi[idx];
661 struct scev *scev = env->scev;
662 u32 *reg2expr = e->reg2expr;
663 u8 class = BPF_CLASS(insn->code);
664 u8 x_or_k = BPF_SRC(insn->code);
665 u8 opcode = BPF_OP(insn->code);
666 u8 mode = BPF_MODE(insn->code);
667 u32 dst = insn->dst_reg;
668 u32 src = insn->src_reg;
669 u32 op, sext, l, r;
670 bool need_bswap;
671 int i, id;
672 s64 imm;
673
674 switch (class) {
675 case BPF_ALU:
676 case BPF_ALU64:
677 switch (opcode) {
678 case BPF_MOV:
679 switch (insn->off) {
680 case 0: sext = 0; break;
681 case 8: sext = SEXT8; break;
682 case 16: sext = SEXT16; break;
683 case 32: sext = SEXT32; break;
684 default:
685 goto mark_dst_unknown;
686 }
687
688 if (x_or_k == BPF_X && insn->imm == 0)
689 id = reg2expr[src];
690 else if (x_or_k == BPF_K && src == 0 && insn->off == 0)
691 id = imm_expr(scev, insn->imm);
692 else
693 goto mark_dst_unknown;
694
695 if (sext)
696 id = expr1(scev, sext, id);
697 if (class == BPF_ALU)
698 id = expr1(scev, ZEXT32, id);
699
700 return replace_reg(scev, e, dst, id);
701
702 case BPF_ADD:
703 case BPF_SUB:
704 case BPF_MUL:
705 case BPF_DIV:
706 case BPF_MOD:
707 case BPF_OR:
708 case BPF_XOR:
709 case BPF_AND:
710 case BPF_LSH:
711 case BPF_RSH:
712 case BPF_ARSH:
713 if (opcode == BPF_DIV && insn->off == 1)
714 op = SDIV;
715 else if (opcode == BPF_MOD && insn->off == 1)
716 op = SMOD;
717 else if (insn->off == 0)
718 op = opcode;
719 else
720 goto mark_dst_unknown;
721
722 if (x_or_k == BPF_X && insn->imm == 0)
723 id = reg2expr[src];
724 else if (x_or_k == BPF_K && src == 0)
725 id = imm_expr(scev, insn->imm);
726 else
727 goto mark_dst_unknown;
728
729 /*
730 * 'r1 <<= 32; r1 >>= 32' is (u32)r1 for cpu v1 and v2. Only here both
731 * shifts are known to be 64-bit ones: the result of a 32-bit shift is
732 * (zext32 ...), and (>> x 32) is 'w1 >>= w2' with 32 in w2 as well,
733 * which shifts by 0.
734 */
735 if (class == BPF_ALU64 && op == BPF_RSH && id >= 0 &&
> 736 is_imm(scev, id, &imm) && imm == 32 &&
737 is_binop(scev, BPF_LSH, reg2expr[dst], &l, &r) &&
738 is_imm(scev, r, &imm) && imm == 32)
739 return replace_reg(scev, e, dst, expr1(scev, ZEXT32, l));
740
741 id = expr2(scev, op, reg2expr[dst], id);
742
743 if (class == BPF_ALU)
744 id = expr1(scev, ZEXT32, id);
745
746 return replace_reg(scev, e, dst, id);
747
748 case BPF_NEG:
749 if (src == 0 && insn->off == 0 && insn->imm == 0)
750 id = expr1(scev, BPF_NEG, reg2expr[dst]);
751 else
752 goto mark_dst_unknown;
753
754 if (class == BPF_ALU)
755 id = expr1(scev, ZEXT32, id);
756
757 return replace_reg(scev, e, dst, id);
758
759 case BPF_END:
760 if (src != 0 || insn->off != 0 || (class == BPF_ALU64 && x_or_k != 0))
761 goto mark_dst_unknown;
762
763 need_bswap = class == BPF_ALU64 || ((x_or_k == BPF_TO_LE) != little_endian);
764 switch (insn->imm) {
765 case 16: op = need_bswap ? BSWAP16 : ZEXT16; break;
766 case 32: op = need_bswap ? BSWAP32 : ZEXT32; break;
767 case 64: op = need_bswap ? BSWAP64 : 0; break;
768 default:
769 goto mark_dst_unknown;
770 }
771
772 id = reg2expr[dst];
773 if (op)
774 id = expr1(scev, op, reg2expr[dst]);
775
776 return replace_reg(scev, e, dst, id);
777 default:
778 goto mark_dst_unknown;
779 }
780 break;
781 case BPF_LDX:
782 switch (mode) {
783 case BPF_MEM:
784 case BPF_MEMSX:
785 /*
786 * for (i = 0; i < nr_cpus; i++) with "const volatile int nr_cpus":
787 * bpf_compute_const_regs() knows what is loaded from a read-only map.
788 */
789 if (insn->src_reg != BPF_REG_FP && idx + 1 < env->prog->len &&
790 (env->insn_aux_data[idx + 1].const_reg_mask & BIT(dst))) {
791 imm = env->insn_aux_data[idx + 1].const_reg_vals[dst];
792 return replace_reg(scev, e, dst, imm_expr(scev, imm));
793 }
794 return maybe_load_fp(scev, e, insn);
795 default:
796 goto mark_dst_unknown;
797 }
798 case BPF_STX:
799 switch (mode) {
800 case BPF_MEM:
801 return maybe_store_fp(scev, e, insn, reg2expr[src]);
802 case BPF_ATOMIC:
803 if (insn->imm == BPF_LOAD_ACQ)
804 return maybe_load_fp(scev, e, insn);
805 if (insn->imm == BPF_STORE_REL) {
806 return maybe_store_fp(scev, e, insn, reg2expr[src]);
807 }
808 /*
809 * verifier does not track other atomic ops precisely,
810 * hence mark the results as opaque.
811 */
812 if (insn->dst_reg == BPF_REG_FP)
813 mark_opaque(e, insn->off, bpf_size_to_bytes(BPF_SIZE(insn->code)));
814 if (insn->imm == BPF_CMPXCHG)
815 return replace_reg(scev, e, BPF_REG_0, OPAQUE_EXPR_ID);
816 if (insn->imm & BPF_FETCH)
817 return replace_reg(scev, e, src, OPAQUE_EXPR_ID);
818 break;
819 }
820 break;
821 case BPF_ST:
822 if (insn->dst_reg == BPF_REG_FP) {
823 id = imm_expr(scev, insn->imm);
824 if (id < 0)
825 return id;
826 return maybe_store_fp(scev, e, insn, id);
827 }
828 break;
829 case BPF_JMP:
830 case BPF_JMP32:
831 if (opcode == BPF_CALL)
832 forget_call_regs(e);
833 /* for non-CALL there are no changes in register states */
834 break;
835 case BPF_LD:
836 switch (mode) {
837 case BPF_IMM:
838 /* rX = imm ll */
839 if (BPF_SIZE(insn->code) == BPF_DW && insn->src_reg == 0) {
840 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
841 return replace_reg(scev, e, dst, imm_expr(scev, imm));
842 }
843 /* map, map value, BTF id, function */
844 if (BPF_SIZE(insn->code) == BPF_DW)
845 return replace_reg(scev, e, dst, OPAQUE_EXPR_ID);
846 goto mark_dst_unknown;
847 case BPF_ABS:
848 case BPF_IND:
849 forget_call_regs(e);
850 break;
851 default:
852 goto mark_dst_unknown;
853 }
854 break;
855 default:
856 /* unknown instruction, nuke state */
857 for (i = 0; i < REGS_NUM; i++)
858 reg2expr[i] = UNKNOWN_EXPR_ID;
859 break;
860 }
861 return 0;
862
863 mark_dst_unknown:
864 reg2expr[dst] = UNKNOWN_EXPR_ID;
865 return 0;
866 }
867
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [linux-next:master 3430/4145] kernel/bpf/scev.c:736:33-42: duplicated argument to && or ||
2026-11-07 23:54 [linux-next:master 3430/4145] kernel/bpf/scev.c:736:33-42: duplicated argument to && or || kernel test robot
@ 2026-11-08 2:53 ` Alexei Starovoitov
0 siblings, 0 replies; 2+ messages in thread
From: Alexei Starovoitov @ 2026-11-08 2:53 UTC (permalink / raw)
To: kernel test robot, Alexei Starovoitov; +Cc: oe-kbuild-all
On Sat Nov 7, 2026 at 11:54 PM UTC, kernel test robot wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b
> commit: 28a373cb0f6a579049ffe92747575213a442673f [3430/4145] bpf: Fold sums of constants and two shifts by 32 in scalar evolution
> config: hexagon-randconfig-r2101-20261107 (https://download.01.org/0day-ci/archive/20261108/202611080024.A0phXMMa-lkp@intel.com/config)
> compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 0fa861dbbf46e5a75f621406fd91cb015d8754bf)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202611080024.A0phXMMa-lkp@intel.com/
>
> cocci warnings: (new ones prefixed by >>)
>>> kernel/bpf/scev.c:736:33-42: duplicated argument to && or ||
...
> 735 if (class == BPF_ALU64 && op == BPF_RSH && id >= 0 &&
> > 736 is_imm(scev, id, &imm) && imm == 32 &&
> 737 is_binop(scev, BPF_LSH, reg2expr[dst], &l, &r) &&
> 738 is_imm(scev, r, &imm) && imm == 32)
> 739 return replace_reg(scev, e, dst, expr1(scev, ZEXT32, l));
No. they are not duplicated, but yeah the coding style is questionable.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-08 2:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-07 23:54 [linux-next:master 3430/4145] kernel/bpf/scev.c:736:33-42: duplicated argument to && or || kernel test robot
2026-11-08 2:53 ` Alexei Starovoitov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.