[kkdwivedi:cancellations 40/71] kernel/bpf/cancel.c:3728 cancel_emit_exit() error: we previously assumed 'site' could be null (see line 3718)

[kkdwivedi:cancellations 40/71] kernel/bpf/cancel.c:3728 cancel_emit_exit() error: we previously assumed 'site' could be null (see line 3718)

[kernel test robot]

Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Kumar Kartikeya Dwivedi <memxor@gmail.com>

tree:   https://github.com/kkdwivedi/linux cancellations
head:   3ad9d6e61351ecac109d90e7eb385f2ac07aca89
commit: 685a972de1419e92f4998eda9954183da49bd167 [40/71] bpf: Let a callee tell at cancel_exit what it released for its caller
:::::: branch date: 5 hours ago
:::::: commit date: 5 hours ago
config: sparc-randconfig-2200-20261114 (https://download.01.org/0day-ci/archive/20261114/202611140205.92cQED00-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 8.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611140205.92cQED00-lkp@intel.com/

smatch warnings:
kernel/bpf/cancel.c:3728 cancel_emit_exit() error: we previously assumed 'site' could be null (see line 3718)

vim +/site +3728 kernel/bpf/cancel.c

77e5ab95100e8d Kumar Kartikeya Dwivedi 2026-11-13  3678  
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3679  /*
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3680   * Leave the frame of subprog @s. cancel_exit returns to the pad of the call that the frame
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3681   * was called by. The kernel entered the main program or an async callback, and nothing else
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3682   * does, see cancel_sub_reason(): all frames are done. The pad tells that the program was
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3683   * cancelled and returns to the kernel like any exit.
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3684   *
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3685   * The pad of a subprog that a call entered tells the pad of that call in R2 which arguments
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3686   * of the frame are released, see bpf_cancel_note_args(). Every such pad does, so that a pad
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3687   * may go by the mask whatever it was called by: 0 says that all is as the call left it.
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3688   * @site is the site of the pad, NULL for the stack check, where the frame did nothing yet:
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3689   * BPF_CANCEL_PAD_EXIT_INSNS at most then. The mask has what the frame gave when it got to
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3690   * the site, and at a call the bit of each argument of the frame that the callee was passed
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3691   * and tells about: the mask of the callee is in the word of the frame, see cancel_emit_pad().
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3692   *
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3693   *	r2 = gave
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3694   *	r1 = *(u32 *)(r10 + mask)
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3695   *	if r1 & BIT(the argument of the callee) goto +1
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3696   *	goto +1
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3697   *	r2 |= BIT(the argument of the frame)
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3698   *	r0 = 0
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3699   *	cancel_exit
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3700   */
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3701  static int cancel_emit_exit(struct bpf_verifier_env *env, int s, const struct cancel_site *site,
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3702  			    struct bpf_insn *buf)
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3703  {
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3704  	u32 fwd = 0;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3705  	s32 val = 0;
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3706  	int n = 0, r;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3707  
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3708  	if (cancel_sub_is_top(env, s)) {
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3709  		/* it didn't refuse in cancel_sub_reason() */
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3710  		if (!s)
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3711  			bpf_prog_cancel_retval(env, &val);
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3712  		buf[n++] = BPF_EMIT_KERNEL_CALL(bpf_prog_report_cancel);
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3713  		buf[n++] = BPF_MOV64_IMM(BPF_REG_0, val);
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3714  		buf[n++] = BPF_EXIT_INSN();
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3715  		return n;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3716  	}
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3717  	buf[n++] = BPF_MOV64_IMM(BPF_REG_2, site ? site->gave : 0);
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13 @3718  	for (r = 1; site && r <= CANCEL_MAX_ARG; r++)
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3719  		if ((site->told & BIT(r)) && site->fwd[r])
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3720  			fwd |= BIT(r);
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3721  	if (fwd)
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3722  		buf[n++] = BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_FP, site->mask);
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3723  	for (r = 1; r <= CANCEL_MAX_ARG; r++) {
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3724  		if (!(fwd & BIT(r)))
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3725  			continue;
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3726  		buf[n++] = BPF_JMP_IMM(BPF_JSET, BPF_REG_1, BIT(r), 1);
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3727  		buf[n++] = BPF_JMP_A(1);
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13 @3728  		buf[n++] = BPF_ALU64_IMM(BPF_OR, BPF_REG_2, BIT(site->fwd[r]));
685a972de1419e Kumar Kartikeya Dwivedi 2026-11-13  3729  	}
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3730  	buf[n++] = BPF_MOV64_IMM(BPF_REG_0, 0);
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3731  	buf[n++] = BPF_RAW_INSN(BPF_JMP | BPF_EXIT, 0, BPF_CANCEL_EXIT, 0, 0);
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3732  	env->subprog_info[s].can_cancel = true;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3733  	env->prog->jit_required = 1;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3734  	return n;
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3735  }
d722e840ee3991 Kumar Kartikeya Dwivedi 2026-11-13  3736  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki