[PATCH bpf-next] bpf: Quiet two smatch warnings in the verifier

[PATCH bpf-next] bpf: Quiet two smatch warnings in the verifier

[Alexei Starovoitov]

From: Alexei Starovoitov <ast@kernel.org>

The kernel test robot runs smatch on bpf-next and reports:

  kernel/bpf/flow.c:2758 flow_merge() warn: missing unwind goto?
  kernel/bpf/scev.c:5350 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 5336)

Both are false positives. flow_merge() frees the state and returns. The
label err_free does the same. scev_reg_for_write() returns 0 only when it
has set 'reg'.

Use the label in flow_merge(). Test spill32 instead of its copy in
bpf_widen_scev_regs(). No functional change.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 kernel/bpf/flow.c | 5 ++---
 kernel/bpf/scev.c | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/flow.c b/kernel/bpf/flow.c
index 99abcef86920..5341f95c5072 100644
--- a/kernel/bpf/flow.c
+++ b/kernel/bpf/flow.c
@@ -2755,9 +2755,8 @@ static int flow_merge(struct bpf_verifier_env *env, struct flow_set *set,
 		if (env->log.level & BPF_LOG_LEVEL2)
 			verbose(env, "from %d to %d: within\n", prev, insn_idx);
 		err = flow_cycle_closed(env, &t->st, &s->st) ?:
-		      flow_unite(flow, s->st.flow_entry, t->st.flow_entry);
-		flow_free_state(env, s);
-		return err ?: 1;
+		      flow_unite(flow, s->st.flow_entry, t->st.flow_entry) ?: 1;
+		goto err_free;
 	}
 
 	flow_sweep_trips(env, set, s);
diff --git a/kernel/bpf/scev.c b/kernel/bpf/scev.c
index 733394a21942..5648beca3931 100644
--- a/kernel/bpf/scev.c
+++ b/kernel/bpf/scev.c
@@ -5333,7 +5333,7 @@ int bpf_widen_scev_regs(struct bpf_verifier_env *env, struct bpf_verifier_state
 				continue;
 			/* the other half of the slot stays as it is */
 			reg = spill32;
-			err = reg ? 0 : scev_reg_for_write(env, cur_func, r, &reg);
+			err = spill32 ? 0 : scev_reg_for_write(env, cur_func, r, &reg);
 			if (err)
 				return err;
 			linear_bounds(scalar_of(reg), iters->max_header_count, &coefs, &bounds);
-- 
2.55.0

Re: [PATCH bpf-next] bpf: Quiet two smatch warnings in the verifier

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Sat, 14 Nov 2026 23:25:26 +0000 you wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> The kernel test robot runs smatch on bpf-next and reports:
> 
>   kernel/bpf/flow.c:2758 flow_merge() warn: missing unwind goto?
>   kernel/bpf/scev.c:5350 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 5336)
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Quiet two smatch warnings in the verifier
    https://git.kernel.org/bpf/bpf-next/c/283fb1db0d42

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html