[bug report] bpf: Refactor object relationship tracking and fix dynptr UAF bug

[bug report] bpf: Refactor object relationship tracking and fix dynptr UAF bug

[Dan Carpenter]

Hello Amery Hung,

Commit 308c7a0ae885 ("bpf: Refactor object relationship tracking and
fix dynptr UAF bug") from May 28, 2026 (linux-next), leads to the
following Smatch static checker warning:

	kernel/bpf/verifier.c:13115 check_kfunc_call()
	warn: error code type promoted to positive: 'id'

kernel/bpf/verifier.c
    12810 static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
    12811                             int *insn_idx_p)
    12812 {
    12813         bool sleepable, rcu_lock, rcu_unlock, preempt_disable, preempt_enable;
    12814         struct bpf_reg_state *regs = cur_regs(env);
    12815         const char *func_name, *ptr_type_name;
    12816         const struct btf_type *t, *ptr_type;
    12817         struct bpf_kfunc_call_arg_meta meta;
    12818         struct bpf_insn_aux_data *insn_aux;
    12819         int err, insn_idx = *insn_idx_p;
    12820         u32 i, nargs, ptr_type_id, id;
                                             ^^
Originally id was int.  It needs to be int for the error handling to
work.

    12821         const struct btf_param *args;
    12822         struct btf *desc_btf;
    12823 
    12824         /* skip for now, but return error when we find this in fixup_kfunc_call */

[ snip ]

    13112                 mark_btf_func_reg_size(env, BPF_REG_0, sizeof(void *));
    13113                 if (is_kfunc_acquire(&meta)) {
    13114                         id = acquire_reference(env, insn_idx, 0);
--> 13115                         if (id < 0)
                                      ^^^^^^

    13116                                 return id;
    13117                         regs[BPF_REG_0].id = id;
    13118                 } else if (is_rbtree_node_type(ptr_type) || is_list_node_type(ptr_type)) {
    13119                         ref_set_non_owning(env, &regs[BPF_REG_0]);

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter

Re: [bug report] bpf: Refactor object relationship tracking and fix dynptr UAF bug

[Amery Hung]

"

On Mon, Jun 8, 2026 at 7:55 AM Dan Carpenter <error27@gmail.com> wrote:
>
> Hello Amery Hung,
>
> Commit 308c7a0ae885 ("bpf: Refactor object relationship tracking and
> fix dynptr UAF bug") from May 28, 2026 (linux-next), leads to the
> following Smatch static checker warning:

Hi Dan,

This is already fixed in bpf-next in commit a3863aa4f55e ("bpf: Fix
dead error check on acquire_reference() in check_kfunc_call")

Thanks,
Amery

>
>         kernel/bpf/verifier.c:13115 check_kfunc_call()
>         warn: error code type promoted to positive: 'id'
>
> kernel/bpf/verifier.c
>     12810 static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>     12811                             int *insn_idx_p)
>     12812 {
>     12813         bool sleepable, rcu_lock, rcu_unlock, preempt_disable, preempt_enable;
>     12814         struct bpf_reg_state *regs = cur_regs(env);
>     12815         const char *func_name, *ptr_type_name;
>     12816         const struct btf_type *t, *ptr_type;
>     12817         struct bpf_kfunc_call_arg_meta meta;
>     12818         struct bpf_insn_aux_data *insn_aux;
>     12819         int err, insn_idx = *insn_idx_p;
>     12820         u32 i, nargs, ptr_type_id, id;
>                                              ^^
> Originally id was int.  It needs to be int for the error handling to
> work.
>
>     12821         const struct btf_param *args;
>     12822         struct btf *desc_btf;
>     12823
>     12824         /* skip for now, but return error when we find this in fixup_kfunc_call */
>
> [ snip ]
>
>     13112                 mark_btf_func_reg_size(env, BPF_REG_0, sizeof(void *));
>     13113                 if (is_kfunc_acquire(&meta)) {
>     13114                         id = acquire_reference(env, insn_idx, 0);
> --> 13115                         if (id < 0)
>                                       ^^^^^^
>
>     13116                                 return id;
>     13117                         regs[BPF_REG_0].id = id;
>     13118                 } else if (is_rbtree_node_type(ptr_type) || is_list_node_type(ptr_type)) {
>     13119                         ref_set_non_owning(env, &regs[BPF_REG_0]);
>
> This email is a free service from the Smatch-CI project [smatch.sf.net].
>
> regards,
> dan carpenter