[kkdwivedi:cancellations 31/48] kernel/bpf/frame_desc.c:207 insn_subprog() error: buffer overflow 'env->subprog_info' 1026 <= 1073741823

[kkdwivedi:cancellations 31/48] kernel/bpf/frame_desc.c:207 insn_subprog() error: buffer overflow 'env->subprog_info' 1026 <= 1073741823

[kernel test robot]

Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Kumar Kartikeya Dwivedi <memxor@gmail.com>

tree:   https://github.com/kkdwivedi/linux cancellations
head:   c5378a88f114558f34a5251ecc2e401d1c111548
commit: ec83c9d519f8d4358632039cc2c6f8146f925e70 [31/48] bpf: Keep the descriptors of a site apart by chain of calls
:::::: branch date: 5 hours ago
:::::: commit date: 7 hours ago
config: hexagon-randconfig-2200-20261109 (https://download.01.org/0day-ci/archive/20261109/202611091250.noF1mTAA-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611091250.noF1mTAA-lkp@intel.com/

smatch warnings:
kernel/bpf/frame_desc.c:207 insn_subprog() error: buffer overflow 'env->subprog_info' 1026 <= 1073741823

vim +207 kernel/bpf/frame_desc.c

240b6bc21978f8 Kumar Kartikeya Dwivedi 2026-11-08  197  
ec1e74abdd85c3 Kumar Kartikeya Dwivedi 2026-11-08  198  /* The subprog insn @idx belongs to. */
ec1e74abdd85c3 Kumar Kartikeya Dwivedi 2026-11-08  199  static int insn_subprog(struct bpf_verifier_env *env, u32 idx)
ec1e74abdd85c3 Kumar Kartikeya Dwivedi 2026-11-08  200  {
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  201  	int l = 0, r = env->subprog_cnt, m;
ec1e74abdd85c3 Kumar Kartikeya Dwivedi 2026-11-08  202  
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  203  	if (idx >= env->subprog_info[r].start)
ec1e74abdd85c3 Kumar Kartikeya Dwivedi 2026-11-08  204  		return -1;
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  205  	while (r - l > 1) {
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  206  		m = l + (r - l) / 2;
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08 @207  		if (env->subprog_info[m].start <= idx)
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  208  			l = m;
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  209  		else
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  210  			r = m;
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  211  	}
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  212  	return l;
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  213  }
ec83c9d519f8d4 Kumar Kartikeya Dwivedi 2026-11-08  214  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki