[bug report] bpf: Refactor object relationship tracking and fix dynptr UAF bug

[Dan Carpenter <error27@gmail.com>]

Hello Amery Hung,

Commit 308c7a0ae885 ("bpf: Refactor object relationship tracking and
fix dynptr UAF bug") from May 28, 2026 (linux-next), leads to the
following Smatch static checker warning:

	kernel/bpf/verifier.c:13115 check_kfunc_call()
	warn: error code type promoted to positive: 'id'

kernel/bpf/verifier.c
    12810 static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
    12811                             int *insn_idx_p)
    12812 {
    12813         bool sleepable, rcu_lock, rcu_unlock, preempt_disable, preempt_enable;
    12814         struct bpf_reg_state *regs = cur_regs(env);
    12815         const char *func_name, *ptr_type_name;
    12816         const struct btf_type *t, *ptr_type;
    12817         struct bpf_kfunc_call_arg_meta meta;
    12818         struct bpf_insn_aux_data *insn_aux;
    12819         int err, insn_idx = *insn_idx_p;
    12820         u32 i, nargs, ptr_type_id, id;
                                             ^^
Originally id was int.  It needs to be int for the error handling to
work.

    12821         const struct btf_param *args;
    12822         struct btf *desc_btf;
    12823 
    12824         /* skip for now, but return error when we find this in fixup_kfunc_call */

[ snip ]

    13112                 mark_btf_func_reg_size(env, BPF_REG_0, sizeof(void *));
    13113                 if (is_kfunc_acquire(&meta)) {
    13114                         id = acquire_reference(env, insn_idx, 0);
--> 13115                         if (id < 0)
                                      ^^^^^^

    13116                                 return id;
    13117                         regs[BPF_REG_0].id = id;
    13118                 } else if (is_rbtree_node_type(ptr_type) || is_list_node_type(ptr_type)) {
    13119                         ref_set_non_owning(env, &regs[BPF_REG_0]);

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter