Re: [PATCH v1 bpf-next 08/11] bpf, x86: add support for indirect jumps

Re: [PATCH v1 bpf-next 08/11] bpf, x86: add support for indirect jumps

[Dan Carpenter]

Hi Anton,

kernel test robot noticed the following build warnings:

url:    https://github.com/intel-lab-lkp/linux/commits/Anton-Protopopov/bpf-fix-the-return-value-of-push_stack/20250817-020411
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20250816180631.952085-9-a.s.protopopov%40gmail.com
patch subject: [PATCH v1 bpf-next 08/11] bpf, x86: add support for indirect jumps
config: x86_64-randconfig-161-20250818 (https://download.01.org/0day-ci/archive/20250818/202508180805.aUCPtTuQ-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202508180805.aUCPtTuQ-lkp@intel.com/

smatch warnings:
kernel/bpf/verifier.c:25013 compute_scc() warn: unsigned 'succ_cnt' is never less than zero.

vim +/w +25013 kernel/bpf/verifier.c
 24891  static int compute_scc(struct bpf_verifier_env *env)
 24892  {
 24893          const u32 NOT_ON_STACK = U32_MAX;
 24894  
 24895          struct bpf_insn_aux_data *aux = env->insn_aux_data;
 24896          const u32 insn_cnt = env->prog->len;
 24897          int stack_sz, dfs_sz, err = 0;
 24898          u32 *stack, *pre, *low, *dfs;
 24899          u32 succ_cnt, i, j, t, w;
                ^^^^^^^^^^^^

 24900          u32 next_preorder_num;
 24901          u32 next_scc_id;
 24902          bool assign_scc;
 24903  
 24904          next_preorder_num = 1;
 24905          next_scc_id = 1;
 24906          /*

[ snip ]

 25008                                  next_preorder_num++;
 25009                                  stack[stack_sz++] = w;
 25010                          }
 25011                          /* Visit 'w' successors */
 25012                          succ_cnt = insn_successors(env, env->prog, w, &succ);
 25013                          if (succ_cnt < 0) {
                                    ^^^^^^^^^^^^
unsigned can't be negative.

 25014                                  err = succ_cnt;
 25015                                  goto exit;
 25016  
 25017                          }
 25018                          for (j = 0; j < succ_cnt; ++j) {
 25019                                  if (pre[succ[j]]) {
 25020                                          low[w] = min(low[w], low[succ[j]]);

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v1 bpf-next 08/11] bpf, x86: add support for indirect jumps

[Anton Protopopov]

On 25/08/18 10:57AM, Dan Carpenter wrote:
> Hi Anton,
> 
> kernel test robot noticed the following build warnings:
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Anton-Protopopov/bpf-fix-the-return-value-of-push_stack/20250817-020411
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
> patch link:    https://lore.kernel.org/r/20250816180631.952085-9-a.s.protopopov%40gmail.com
> patch subject: [PATCH v1 bpf-next 08/11] bpf, x86: add support for indirect jumps
> config: x86_64-randconfig-161-20250818 (https://download.01.org/0day-ci/archive/20250818/202508180805.aUCPtTuQ-lkp@intel.com/config)
> compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> | Closes: https://lore.kernel.org/r/202508180805.aUCPtTuQ-lkp@intel.com/
> 
> smatch warnings:
> kernel/bpf/verifier.c:25013 compute_scc() warn: unsigned 'succ_cnt' is never less than zero.
> 
> vim +/w +25013 kernel/bpf/verifier.c
>  24891  static int compute_scc(struct bpf_verifier_env *env)
>  24892  {
>  24893          const u32 NOT_ON_STACK = U32_MAX;
>  24894  
>  24895          struct bpf_insn_aux_data *aux = env->insn_aux_data;
>  24896          const u32 insn_cnt = env->prog->len;
>  24897          int stack_sz, dfs_sz, err = 0;
>  24898          u32 *stack, *pre, *low, *dfs;
>  24899          u32 succ_cnt, i, j, t, w;
>                 ^^^^^^^^^^^^
> 
>  24900          u32 next_preorder_num;
>  24901          u32 next_scc_id;
>  24902          bool assign_scc;
>  24903  
>  24904          next_preorder_num = 1;
>  24905          next_scc_id = 1;
>  24906          /*
> 
> [ snip ]
> 
>  25008                                  next_preorder_num++;
>  25009                                  stack[stack_sz++] = w;
>  25010                          }
>  25011                          /* Visit 'w' successors */
>  25012                          succ_cnt = insn_successors(env, env->prog, w, &succ);
>  25013                          if (succ_cnt < 0) {
>                                     ^^^^^^^^^^^^
> unsigned can't be negative.

Thanks! Fixed, will squash into v2.

>  25014                                  err = succ_cnt;
>  25015                                  goto exit;
>  25016  
>  25017                          }
>  25018                          for (j = 0; j < succ_cnt; ++j) {
>  25019                                  if (pre[succ[j]]) {
>  25020                                          low[w] = min(low[w], low[succ[j]]);
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>