Re: [PATCH] bpf: normalize arg_track state construction

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The helper `arg_track_imprecise()` leaves union bytes uninitialized, failing to fully resolve the KMSAN uninit-value bug.
--

--- Patch [1]: [PATCH] bpf: normalize arg_track state construction ---
commit 66a3cf2cd9455714944be22e6ff4f7ab5a037e76
Author: Tao Yu <tao1.yu@intel.com>

bpf: normalize arg_track state construction

This commit introduces explicit helper functions to normalize arg_track
state construction and address a KMSAN uninitialized-value bug during
liveness analysis.

> diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
> index 0aadfbae0acc5..58b979c17c3e4 100644
> --- a/kernel/bpf/liveness.c
> +++ b/kernel/bpf/liveness.c

[ ... ]

> +static struct arg_track arg_track_imprecise(u16 mask)
> +{
> +	return (struct arg_track){ .mask = mask, .frame = ARG_IMPRECISE };
> +}

[Severity: Medium]
Does this compound literal leave the remaining 6 bytes of the anonymous union
uninitialized?

Since the union contains both an 8-byte offset array and a 2-byte mask,
explicitly initializing only the mask member leaves the remaining bytes of
the union unspecified. 

When this state is returned, such as from fill_from_stack(), and propagated
via arg_track_join() during liveness analysis, won't KMSAN continue to
trigger warnings when the structure is copied by value?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723055508.1403247-1-tao1.yu@intel.com?part=1