[PATCH bpf-next] bpf: add a check to make static analysers happy

[PATCH bpf-next] bpf: add a check to make static analysers happy

[Anton Protopopov]

In [1] Dan Carpenter reported that the following code makes the
Smatch static analyser unhappy:

        17904       value = map->ops->map_lookup_elem(map, &i);
        17905       if (!value)
        17906               return -EINVAL;
    --> 17907       items[i - start] = value->xlated_off;

The analyser assumes that the `value` variable may contain an error
and thus it should be properly checked before the dereference.
On practice this will never happen as array maps do not return
error values in map_lookup_elem, but to make the Smatch and other
possible analysers happy this patch adds a formal check.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/bpf/aR2BN1Ix--8tmVrN@stanley.mountain/ [1]
Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
---
 kernel/bpf/verifier.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 098dd7f21c89..93716da57d48 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -17929,7 +17929,13 @@ static int copy_insn_array(struct bpf_map *map, u32 start, u32 end, u32 *items)
 
 	for (i = start; i <= end; i++) {
 		value = map->ops->map_lookup_elem(map, &i);
-		if (!value)
+		/*
+		 * map_lookup_elem of an array map will never return an error,
+		 * but not checking it makes some static analysers to worry
+		 */
+		if (IS_ERR(value))
+			return PTR_ERR(value);
+		else if (!value)
 			return -EINVAL;
 		items[i - start] = value->xlated_off;
 	}
-- 
2.34.1

Re: [PATCH bpf-next] bpf: add a check to make static analysers happy

[Dan Carpenter]

Thanks!

regards,
dan carpenter

Re: [PATCH bpf-next] bpf: add a check to make static analysers happy

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 19 Nov 2025 11:25:17 +0000 you wrote:
> In [1] Dan Carpenter reported that the following code makes the
> Smatch static analyser unhappy:
> 
>         17904       value = map->ops->map_lookup_elem(map, &i);
>         17905       if (!value)
>         17906               return -EINVAL;
>     --> 17907       items[i - start] = value->xlated_off;
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: add a check to make static analysers happy
    https://git.kernel.org/bpf/bpf-next/c/4dd3a48d13a3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html