From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [bpf-next:master 55/94] kernel/bpf/scev.c:3332 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 3320)
Date: Thu, 05 Nov 2026 02:48:05 +0100 [thread overview]
Message-ID: <202611050216.7Cy544Mf-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Alexei Starovoitov <ast@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
head: b3b9fd4dda0953e84e9146c0962fbd0a67014a92
commit: 09c5008302ed2928873970013fac5cb677510461 [55/94] bpf: Describe more registers of a counted loop
:::::: branch date: 6 hours ago
:::::: commit date: 7 hours ago
config: arc-randconfig-2200-20261104 (https://download.01.org/0day-ci/archive/20261105/202611050216.7Cy544Mf-lkp@intel.com/config)
compiler: arc-linux-gcc (GCC) 8.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611050216.7Cy544Mf-lkp@intel.com/
smatch warnings:
kernel/bpf/scev.c:3332 bpf_widen_scev_regs() error: we previously assumed 'reg' could be null (see line 3320)
vim +/reg +3332 kernel/bpf/scev.c
6ccf49f7932781 Eduard Zingerman 2026-10-09 3287
6ccf49f7932781 Eduard Zingerman 2026-10-09 3288 int bpf_widen_scev_regs(struct bpf_verifier_env *env, struct bpf_verifier_state *st,
6ccf49f7932781 Eduard Zingerman 2026-10-09 3289 struct bpf_verifier_state *loop_entry, struct bpf_loop_iters *iters)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3290 {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3291 struct bpf_func_state *cur_func = st->frame[st->curframe];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3292 struct bpf_func_state *entry_func = loop_entry->frame[loop_entry->curframe];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3293 struct bpf_verifier_log *log = &env->log;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3294 struct scev *scev = env->scev;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3295 struct bpf_reg_state *reg;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3296 struct env *header_env;
32e962577d2d8a Eduard Zingerman 2026-10-20 3297 struct linear_coefs coefs;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3298 struct bounds bounds;
32e962577d2d8a Eduard Zingerman 2026-10-20 3299 u32 r, r_expr, a, b;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3300 int insn_idx = st->insn_idx;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3301 int err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3302
6ccf49f7932781 Eduard Zingerman 2026-10-09 3303 for_each_set_bit(r, iters->precise_regs, REGS_NUM) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3304 if (r < MAX_BPF_REG)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3305 bpf_bt_set_frame_reg(&env->bt, st->curframe, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3306 else
6ccf49f7932781 Eduard Zingerman 2026-10-09 3307 bpf_bt_set_frame_slot(&env->bt, st->curframe, r - MAX_BPF_REG);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3308 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3309 err = bpf_mark_chain_precision(env, st, -1, NULL);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3310 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3311 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3312
6ccf49f7932781 Eduard Zingerman 2026-10-09 3313 header_env = find_header_env(scev, insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3314 for (r = 0; r < REGS_NUM; r++) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3315 if (!scev_reg_alive(env, st, r) || is_unbound_scev_reg(env, cur_func, r) ||
09c5008302ed29 Alexei Starovoitov 2026-11-03 3316 is_const_scev_reg(env, insn_idx, r))
09c5008302ed29 Alexei Starovoitov 2026-11-03 3317 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3318
09c5008302ed29 Alexei Starovoitov 2026-11-03 3319 reg = scev_reg_for_linear(cur_func, r);
09c5008302ed29 Alexei Starovoitov 2026-11-03 @3320 if (reg && reg->type == PTR_TO_ARENA)
09c5008302ed29 Alexei Starovoitov 2026-11-03 3321 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3322
09c5008302ed29 Alexei Starovoitov 2026-11-03 3323 if (test_bit(r, iters->mask_regs)) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3324 /* The range stays. It's no longer equal to the registers with its id. */
09c5008302ed29 Alexei Starovoitov 2026-11-03 3325 err = scev_reg_for_write(env, cur_func, r, ®);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3326 if (err)
09c5008302ed29 Alexei Starovoitov 2026-11-03 3327 return err;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3328 if (log->level & BPF_LOG_LEVEL2) {
09c5008302ed29 Alexei Starovoitov 2026-11-03 3329 bpf_log(log, "loop header at %d, ", insn_idx);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3330 log_reg(env, r);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3331 bpf_log(log, " stays in 0..%llu, it loses bits only\n",
09c5008302ed29 Alexei Starovoitov 2026-11-03 @3332 reg_umax(reg));
09c5008302ed29 Alexei Starovoitov 2026-11-03 3333 }
09c5008302ed29 Alexei Starovoitov 2026-11-03 3334 scratch_widened_reg_id(env, reg);
09c5008302ed29 Alexei Starovoitov 2026-11-03 3335 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3336 continue;
09c5008302ed29 Alexei Starovoitov 2026-11-03 3337 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3338
6ccf49f7932781 Eduard Zingerman 2026-10-09 3339 r_expr = header_env->reg2scev[r];
6ccf49f7932781 Eduard Zingerman 2026-10-09 3340 /* If SCEV for r is (linear <reg> <slope>)*/
32e962577d2d8a Eduard Zingerman 2026-10-20 3341 if (is_simple_linear(scev, r_expr, &coefs) && coefs.base_reg == r) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3342 err = scev_reg_for_write(env, cur_func, r, ®);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3343 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3344 return err;
32e962577d2d8a Eduard Zingerman 2026-10-20 3345 linear_bounds(reg, iters->max_header_count, &coefs, &bounds);
1e589fdc85a8f6 Alexei Starovoitov 2026-11-03 3346 if (r == iters->iv_reg)
1e589fdc85a8f6 Alexei Starovoitov 2026-11-03 3347 iv_bounds(&bounds, iters->iv_range);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3348 if (log->level & BPF_LOG_LEVEL2) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3349 bpf_log(log, "loop header at %d, widening ", insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3350 log_reg(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3351 bpf_log(log, " to ");
32e962577d2d8a Eduard Zingerman 2026-10-20 3352 log_bounds(env, &bounds);
32e962577d2d8a Eduard Zingerman 2026-10-20 3353 bpf_log(log, "\n");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3354 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3355 scratch_widened_reg_id(env, reg);
88e2c896d8598a Alexei Starovoitov 2026-10-30 3356 /* "at pkt_end" and "beyond pkt_end" are not valid in all iterations */
88e2c896d8598a Alexei Starovoitov 2026-10-30 3357 if (type_is_pkt_pointer(reg->type))
88e2c896d8598a Alexei Starovoitov 2026-10-30 3358 reg->range = max(reg->range, 0);
32e962577d2d8a Eduard Zingerman 2026-10-20 3359 err = bpf_set_reg_range(env, reg, bounds.r64, bounds.r32,
32e962577d2d8a Eduard Zingerman 2026-10-20 3360 bounds.base, bounds.step);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3361 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3362 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3363 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3364 } else if (is_any(scev, r_expr, &a, &b)) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3365 err = scev_reg_for_write(env, cur_func, r, ®);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3366 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3367 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3368 err = union_any_reg(env, entry_func, reg, r_expr);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3369 if (err)
6ccf49f7932781 Eduard Zingerman 2026-10-09 3370 return err;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3371 if (log->level & BPF_LOG_LEVEL2) {
6ccf49f7932781 Eduard Zingerman 2026-10-09 3372 bpf_log(log, "loop header at %d, widening ", insn_idx);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3373 log_reg(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3374 bpf_log(log, " to ");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3375 bpf_verbose_snum(env, reg_smin(reg));
6ccf49f7932781 Eduard Zingerman 2026-10-09 3376 bpf_log(log, "..");
6ccf49f7932781 Eduard Zingerman 2026-10-09 3377 bpf_verbose_snum(env, reg_smax(reg));
6ccf49f7932781 Eduard Zingerman 2026-10-09 3378 bpf_log(log, " step %u\n", reg->step);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3379 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3380 scratch_widened_reg_id(env, reg);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3381 mark_scev_reg_scratched(env, r);
6ccf49f7932781 Eduard Zingerman 2026-10-09 3382 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3383 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3384 return 1;
6ccf49f7932781 Eduard Zingerman 2026-10-09 3385 }
6ccf49f7932781 Eduard Zingerman 2026-10-09 3386
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-11-05 1:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611050216.7Cy544Mf-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox