* [linux-next:master 2782/3950] kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero
@ 2025-08-21 12:53 kernel test robot
2025-08-21 15:24 ` Jakub Sitnicki
0 siblings, 1 reply; 3+ messages in thread
From: kernel test robot @ 2025-08-21 12:53 UTC (permalink / raw)
To: Jakub Sitnicki; +Cc: oe-kbuild-all, Martin KaFai Lau
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 7fa4d8dc380fbd81a9d702a855c50690c9c6442c
commit: 6877cd392baecf816c2ba896a9d42874628004a5 [2782/3950] bpf: Enable read/write access to skb metadata through a dynptr
config: sparc-randconfig-r063-20250821 (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/config)
compiler: sparc-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/
All warnings (new ones prefixed by >>):
kernel/bpf/helpers.c: In function '____bpf_snprintf':
kernel/bpf/helpers.c:1069:9: warning: function '____bpf_snprintf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]
1069 | err = bstr_printf(str, str_size, fmt, data.bin_args);
| ^~~
In function '__bpf_dynptr_read',
inlined from 'bpf_dynptr_copy' at kernel/bpf/helpers.c:2910:9:
>> kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero [-Wnonnull]
1784 | memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/string.h:65,
from include/linux/bitmap.h:13,
from include/linux/cpumask.h:12,
from arch/sparc/include/asm/smp_32.h:15,
from arch/sparc/include/asm/smp.h:7,
from arch/sparc/include/asm/switch_to_32.h:5,
from arch/sparc/include/asm/switch_to.h:7,
from arch/sparc/include/asm/ptrace.h:120,
from arch/sparc/include/asm/thread_info_32.h:19,
from arch/sparc/include/asm/thread_info.h:7,
from include/linux/thread_info.h:60,
from include/asm-generic/preempt.h:5,
from ./arch/sparc/include/generated/asm/preempt.h:1,
from include/linux/preempt.h:79,
from include/linux/alloc_tag.h:11,
from include/linux/workqueue.h:9,
from include/linux/bpf.h:10,
from kernel/bpf/helpers.c:4:
arch/sparc/include/asm/string.h: In function 'bpf_dynptr_copy':
arch/sparc/include/asm/string.h:12:7: note: in a call to function 'memmove' declared 'nonnull_if_nonzero'
12 | void *memmove(void *, const void *, __kernel_size_t);
| ^~~~~~~
In function '__bpf_dynptr_write',
inlined from 'bpf_dynptr_copy' at kernel/bpf/helpers.c:2913:9:
kernel/bpf/helpers.c:1845:17: warning: argument 1 null where non-null expected because argument 3 is nonzero [-Wnonnull]
1845 | memmove(bpf_skb_meta_pointer(dst->data, dst->offset + offset), src, len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/sparc/include/asm/string.h: In function 'bpf_dynptr_copy':
arch/sparc/include/asm/string.h:12:7: note: in a call to function 'memmove' declared 'nonnull_if_nonzero'
12 | void *memmove(void *, const void *, __kernel_size_t);
| ^~~~~~~
vim +1784 kernel/bpf/helpers.c
1754
1755 static int __bpf_dynptr_read(void *dst, u32 len, const struct bpf_dynptr_kern *src,
1756 u32 offset, u64 flags)
1757 {
1758 enum bpf_dynptr_type type;
1759 int err;
1760
1761 if (!src->data || flags)
1762 return -EINVAL;
1763
1764 err = bpf_dynptr_check_off_len(src, offset, len);
1765 if (err)
1766 return err;
1767
1768 type = bpf_dynptr_get_type(src);
1769
1770 switch (type) {
1771 case BPF_DYNPTR_TYPE_LOCAL:
1772 case BPF_DYNPTR_TYPE_RINGBUF:
1773 /* Source and destination may possibly overlap, hence use memmove to
1774 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
1775 * pointing to overlapping PTR_TO_MAP_VALUE regions.
1776 */
1777 memmove(dst, src->data + src->offset + offset, len);
1778 return 0;
1779 case BPF_DYNPTR_TYPE_SKB:
1780 return __bpf_skb_load_bytes(src->data, src->offset + offset, dst, len);
1781 case BPF_DYNPTR_TYPE_XDP:
1782 return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
1783 case BPF_DYNPTR_TYPE_SKB_META:
> 1784 memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
1785 return 0;
1786 default:
1787 WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
1788 return -EFAULT;
1789 }
1790 }
1791
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [linux-next:master 2782/3950] kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero
2025-08-21 12:53 [linux-next:master 2782/3950] kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero kernel test robot
@ 2025-08-21 15:24 ` Jakub Sitnicki
2025-08-21 19:12 ` Jakub Sitnicki
0 siblings, 1 reply; 3+ messages in thread
From: Jakub Sitnicki @ 2025-08-21 15:24 UTC (permalink / raw)
To: kernel test robot; +Cc: oe-kbuild-all, Martin KaFai Lau
On Thu, Aug 21, 2025 at 08:53 PM +08, kernel test robot wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head: 7fa4d8dc380fbd81a9d702a855c50690c9c6442c
> commit: 6877cd392baecf816c2ba896a9d42874628004a5 [2782/3950] bpf: Enable
> read/write access to skb metadata through a dynptr
> config: sparc-randconfig-r063-20250821
> (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/config)
> compiler: sparc-linux-gcc (GCC) 15.1.0
> reproduce (this is a W=1 build):
> (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202508212031.ir9b3B6Q-lkp@intel.com/
>
> All warnings (new ones prefixed by >>):
>
> kernel/bpf/helpers.c: In function '____bpf_snprintf':
> kernel/bpf/helpers.c:1069:9: warning: function '____bpf_snprintf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]
> 1069 | err = bstr_printf(str, str_size, fmt, data.bin_args);
> | ^~~
> In function '__bpf_dynptr_read',
> inlined from 'bpf_dynptr_copy' at kernel/bpf/helpers.c:2910:9:
>>> kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null
>> expected because argument 3 is nonzero [-Wnonnull]
> 1784 | memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset),
> len);
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In file included from include/linux/string.h:65,
> from include/linux/bitmap.h:13,
> from include/linux/cpumask.h:12,
> from arch/sparc/include/asm/smp_32.h:15,
> from arch/sparc/include/asm/smp.h:7,
> from arch/sparc/include/asm/switch_to_32.h:5,
> from arch/sparc/include/asm/switch_to.h:7,
> from arch/sparc/include/asm/ptrace.h:120,
> from arch/sparc/include/asm/thread_info_32.h:19,
> from arch/sparc/include/asm/thread_info.h:7,
> from include/linux/thread_info.h:60,
> from include/asm-generic/preempt.h:5,
> from ./arch/sparc/include/generated/asm/preempt.h:1,
> from include/linux/preempt.h:79,
> from include/linux/alloc_tag.h:11,
> from include/linux/workqueue.h:9,
> from include/linux/bpf.h:10,
> from kernel/bpf/helpers.c:4:
> arch/sparc/include/asm/string.h: In function 'bpf_dynptr_copy':
> arch/sparc/include/asm/string.h:12:7: note: in a call to function 'memmove' declared 'nonnull_if_nonzero'
> 12 | void *memmove(void *, const void *, __kernel_size_t);
> | ^~~~~~~
> In function '__bpf_dynptr_write',
> inlined from 'bpf_dynptr_copy' at kernel/bpf/helpers.c:2913:9:
> kernel/bpf/helpers.c:1845:17: warning: argument 1 null where non-null expected because argument 3 is nonzero [-Wnonnull]
> 1845 | memmove(bpf_skb_meta_pointer(dst->data, dst->offset + offset), src, len);
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> arch/sparc/include/asm/string.h: In function 'bpf_dynptr_copy':
> arch/sparc/include/asm/string.h:12:7: note: in a call to function 'memmove'
> declared 'nonnull_if_nonzero'
> 12 | void *memmove(void *, const void *, __kernel_size_t);
> | ^~~~~~~
>
>
> vim +1784 kernel/bpf/helpers.c
>
> 1754
> 1755 static int __bpf_dynptr_read(void *dst, u32 len, const struct bpf_dynptr_kern *src,
> 1756 u32 offset, u64 flags)
> 1757 {
> 1758 enum bpf_dynptr_type type;
> 1759 int err;
> 1760
> 1761 if (!src->data || flags)
> 1762 return -EINVAL;
> 1763
> 1764 err = bpf_dynptr_check_off_len(src, offset, len);
> 1765 if (err)
> 1766 return err;
> 1767
> 1768 type = bpf_dynptr_get_type(src);
> 1769
> 1770 switch (type) {
> 1771 case BPF_DYNPTR_TYPE_LOCAL:
> 1772 case BPF_DYNPTR_TYPE_RINGBUF:
> 1773 /* Source and destination may possibly overlap, hence use memmove to
> 1774 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
> 1775 * pointing to overlapping PTR_TO_MAP_VALUE regions.
> 1776 */
> 1777 memmove(dst, src->data + src->offset + offset, len);
> 1778 return 0;
> 1779 case BPF_DYNPTR_TYPE_SKB:
> 1780 return __bpf_skb_load_bytes(src->data, src->offset + offset, dst, len);
> 1781 case BPF_DYNPTR_TYPE_XDP:
> 1782 return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
> 1783 case BPF_DYNPTR_TYPE_SKB_META:
>> 1784 memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
> 1785 return 0;
> 1786 default:
> 1787 WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
> 1788 return -EFAULT;
> 1789 }
> 1790 }
> 1791
Right. This happens with CONFIG_NET=n.
I think in the end we need a simple wrapper around memmove to stub it
out with -EOPNOTSUPP when CONFIG_NET is disabled.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [linux-next:master 2782/3950] kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero
2025-08-21 15:24 ` Jakub Sitnicki
@ 2025-08-21 19:12 ` Jakub Sitnicki
0 siblings, 0 replies; 3+ messages in thread
From: Jakub Sitnicki @ 2025-08-21 19:12 UTC (permalink / raw)
To: kernel test robot; +Cc: oe-kbuild-all, Martin KaFai Lau
On Thu, Aug 21, 2025 at 05:24 PM +02, Jakub Sitnicki wrote:
> On Thu, Aug 21, 2025 at 08:53 PM +08, kernel test robot wrote:
>> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
>> head: 7fa4d8dc380fbd81a9d702a855c50690c9c6442c
>> commit: 6877cd392baecf816c2ba896a9d42874628004a5 [2782/3950] bpf: Enable
>> read/write access to skb metadata through a dynptr
>> config: sparc-randconfig-r063-20250821
>> (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/config)
>> compiler: sparc-linux-gcc (GCC) 15.1.0
>> reproduce (this is a W=1 build):
>> (https://download.01.org/0day-ci/archive/20250821/202508212031.ir9b3B6Q-lkp@intel.com/reproduce)
>>
[...]
>> vim +1784 kernel/bpf/helpers.c
>>
>> 1754
>> 1755 static int __bpf_dynptr_read(void *dst, u32 len, const struct bpf_dynptr_kern *src,
>> 1756 u32 offset, u64 flags)
>> 1757 {
>> 1758 enum bpf_dynptr_type type;
>> 1759 int err;
>> 1760
>> 1761 if (!src->data || flags)
>> 1762 return -EINVAL;
>> 1763
>> 1764 err = bpf_dynptr_check_off_len(src, offset, len);
>> 1765 if (err)
>> 1766 return err;
>> 1767
>> 1768 type = bpf_dynptr_get_type(src);
>> 1769
>> 1770 switch (type) {
>> 1771 case BPF_DYNPTR_TYPE_LOCAL:
>> 1772 case BPF_DYNPTR_TYPE_RINGBUF:
>> 1773 /* Source and destination may possibly overlap, hence use memmove to
>> 1774 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
>> 1775 * pointing to overlapping PTR_TO_MAP_VALUE regions.
>> 1776 */
>> 1777 memmove(dst, src->data + src->offset + offset, len);
>> 1778 return 0;
>> 1779 case BPF_DYNPTR_TYPE_SKB:
>> 1780 return __bpf_skb_load_bytes(src->data, src->offset + offset, dst, len);
>> 1781 case BPF_DYNPTR_TYPE_XDP:
>> 1782 return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
>> 1783 case BPF_DYNPTR_TYPE_SKB_META:
>>> 1784 memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
>> 1785 return 0;
>> 1786 default:
>> 1787 WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
>> 1788 return -EFAULT;
>> 1789 }
>> 1790 }
>> 1791
>
> Right. This happens with CONFIG_NET=n.
>
> I think in the end we need a simple wrapper around memmove to stub it
> out with -EOPNOTSUPP when CONFIG_NET is disabled.
Forgot to mention that this null-ptr-deref is not triggerable because
the bpf_dynptr_from_skb_meta kfunc is present only with CONFIG_NET=y.
So a fix is needed just for the sake of silencing compiler diagnostics.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-08-21 19:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-21 12:53 [linux-next:master 2782/3950] kernel/bpf/helpers.c:1784:17: warning: argument 2 null where non-null expected because argument 3 is nonzero kernel test robot
2025-08-21 15:24 ` Jakub Sitnicki
2025-08-21 19:12 ` Jakub Sitnicki
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.