[bug report] bpf: callchain sensitive stack liveness tracking using CFG

[Dan Carpenter <dan.carpenter@linaro.org>]

Hello Eduard Zingerman,

Commit b3698c356ad9 ("bpf: callchain sensitive stack liveness
tracking using CFG") from Sep 18, 2025 (linux-next), leads to the
following Smatch static checker warning:

	kernel/bpf/liveness.c:527 propagate_to_outer_instance()
	error: 'outer_instance' dereferencing possible ERR_PTR()

kernel/bpf/liveness.c
    514 static int propagate_to_outer_instance(struct bpf_verifier_env *env,
    515                                        struct func_instance *instance)
    516 {
    517         struct callchain *callchain = &instance->callchain;
    518         u32 this_subprog_start, callsite, frame;
    519         struct func_instance *outer_instance;
    520         struct per_frame_masks *insn;
    521         int err;
    522 
    523         this_subprog_start = callchain_subprog_start(callchain);
    524         outer_instance = get_outer_instance(env, instance);

This needs if (IS_ERR(outer_instance)) check.

    525         callsite = callchain->callsites[callchain->curframe - 1];
    526 
--> 527         reset_stack_write_marks(env, outer_instance, callsite);
                                             ^^^^^^^^^^^^^^

    528         for (frame = 0; frame < callchain->curframe; frame++) {
    529                 insn = get_frame_masks(instance, frame, this_subprog_start);
    530                 if (!insn)
    531                         continue;
    532                 bpf_mark_stack_write(env, frame, insn->must_write_acc);
    533                 err = mark_stack_read(env, outer_instance, frame, callsite, insn->live_before);
    534                 if (err)
    535                         return err;
    536         }
    537         commit_stack_write_marks(env, outer_instance);
    538         return 0;
    539 }

regards,
dan carpenter