[bug report] bpf: callchain sensitive stack liveness tracking using CFG

[bug report] bpf: callchain sensitive stack liveness tracking using CFG

[Dan Carpenter]

Hello Eduard Zingerman,

Commit b3698c356ad9 ("bpf: callchain sensitive stack liveness
tracking using CFG") from Sep 18, 2025 (linux-next), leads to the
following Smatch static checker warning:

	kernel/bpf/liveness.c:527 propagate_to_outer_instance()
	error: 'outer_instance' dereferencing possible ERR_PTR()

kernel/bpf/liveness.c
    514 static int propagate_to_outer_instance(struct bpf_verifier_env *env,
    515                                        struct func_instance *instance)
    516 {
    517         struct callchain *callchain = &instance->callchain;
    518         u32 this_subprog_start, callsite, frame;
    519         struct func_instance *outer_instance;
    520         struct per_frame_masks *insn;
    521         int err;
    522 
    523         this_subprog_start = callchain_subprog_start(callchain);
    524         outer_instance = get_outer_instance(env, instance);

This needs if (IS_ERR(outer_instance)) check.

    525         callsite = callchain->callsites[callchain->curframe - 1];
    526 
--> 527         reset_stack_write_marks(env, outer_instance, callsite);
                                             ^^^^^^^^^^^^^^

    528         for (frame = 0; frame < callchain->curframe; frame++) {
    529                 insn = get_frame_masks(instance, frame, this_subprog_start);
    530                 if (!insn)
    531                         continue;
    532                 bpf_mark_stack_write(env, frame, insn->must_write_acc);
    533                 err = mark_stack_read(env, outer_instance, frame, callsite, insn->live_before);
    534                 if (err)
    535                         return err;
    536         }
    537         commit_stack_write_marks(env, outer_instance);
    538         return 0;
    539 }

regards,
dan carpenter

Re: [bug report] bpf: callchain sensitive stack liveness tracking using CFG

[Eduard Zingerman]

On Wed, 2025-09-24 at 19:43 +0300, Dan Carpenter wrote:
> Hello Eduard Zingerman,
> 
> Commit b3698c356ad9 ("bpf: callchain sensitive stack liveness
> tracking using CFG") from Sep 18, 2025 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	kernel/bpf/liveness.c:527 propagate_to_outer_instance()
> 	error: 'outer_instance' dereferencing possible ERR_PTR()
> 
> kernel/bpf/liveness.c
>     514 static int propagate_to_outer_instance(struct bpf_verifier_env *env,
>     515                                        struct func_instance *instance)
>     516 {
>     517         struct callchain *callchain = &instance->callchain;
>     518         u32 this_subprog_start, callsite, frame;
>     519         struct func_instance *outer_instance;
>     520         struct per_frame_masks *insn;
>     521         int err;
>     522 
>     523         this_subprog_start = callchain_subprog_start(callchain);
>     524         outer_instance = get_outer_instance(env, instance);
> 
> This needs if (IS_ERR(outer_instance)) check.

Hi Dan,

Thank you for the report. Luckily, this is not a big problem,
because of the program logic, this should not ever happen in practice:
if instance for inner callchain exist, instance for outer callchain
is guaranteed to exist.
But I agree, adding an error check removes the need to think about it.

> 
>     525         callsite = callchain->callsites[callchain->curframe - 1];
>     526 
> --> 527         reset_stack_write_marks(env, outer_instance, callsite);
>                                              ^^^^^^^^^^^^^^
> 
>     528         for (frame = 0; frame < callchain->curframe; frame++) {
>     529                 insn = get_frame_masks(instance, frame, this_subprog_start);
>     530                 if (!insn)
>     531                         continue;
>     532                 bpf_mark_stack_write(env, frame, insn->must_write_acc);
>     533                 err = mark_stack_read(env, outer_instance, frame, callsite, insn->live_before);
>     534                 if (err)
>     535                         return err;
>     536         }
>     537         commit_stack_write_marks(env, outer_instance);
>     538         return 0;
>     539 }
> 
> regards,
> dan carpenter