Hi Eduard, kernel test robot noticed the following build warnings: url: https://github.com/intel-lab-lkp/linux/commits/Eduard-Zingerman/bpf-bpf_verifier_state-cleaned-flag-instead-of-REG_LIVE_DONE/20250911-090604 base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master patch link: https://lore.kernel.org/r/20250911010437.2779173-10-eddyz87%40gmail.com patch subject: [PATCH bpf-next v1 09/10] bpf: disable and remove registers chain based liveness config: arm-randconfig-r071-20250911 (https://download.01.org/0day-ci/archive/20250912/202509120205.YfzyI2gp-lkp@xxxxxxxxx/config) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 21857ae337e0892a5522b6e7337899caa61de2a6) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> | Closes: https://lore.kernel.org/r/202509120205.YfzyI2gp-lkp@xxxxxxxxx/ smatch warnings: kernel/bpf/verifier.c:19305 is_state_visited() error: uninitialized symbol 'err'. vim +/err +19305 kernel/bpf/verifier.c 58e2af8b3a6b58 Jakub Kicinski 2016-09-21 19134 static int is_state_visited(struct bpf_verifier_env *env, int insn_idx) f1bca824dabba4 Alexei Starovoitov 2014-09-29 19135 { 58e2af8b3a6b58 Jakub Kicinski 2016-09-21 19136 struct bpf_verifier_state_list *new_sl; 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19137 struct bpf_verifier_state_list *sl; c9e31900b54cad Eduard Zingerman 2025-06-11 19138 struct bpf_verifier_state *cur = env->cur_state, *new; c9e31900b54cad Eduard Zingerman 2025-06-11 19139 bool force_new_state, add_new_state, loop; d5c95ed86213e4 Eduard Zingerman 2025-09-10 19140 int n, err, states_cnt = 0; 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19141 struct list_head *pos, *tmp, *head; aa30eb3260b2de Eduard Zingerman 2024-10-29 19142 aa30eb3260b2de Eduard Zingerman 2024-10-29 19143 force_new_state = env->test_state_freq || is_force_checkpoint(env, insn_idx) || aa30eb3260b2de Eduard Zingerman 2024-10-29 19144 /* Avoid accumulating infinitely long jmp history */ baaebe0928bf32 Eduard Zingerman 2025-06-11 19145 cur->jmp_history_cnt > 40; f1bca824dabba4 Alexei Starovoitov 2014-09-29 19146 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19147 /* bpf progs typically have pruning point every 4 instructions 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19148 * http://vger.kernel.org/bpfconf2019.html#session-1 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19149 * Do not add new state for future pruning if the verifier hasn't seen 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19150 * at least 2 jumps and at least 8 instructions. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19151 * This heuristics helps decrease 'total_states' and 'peak_states' metric. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19152 * In tests that amounts to up to 50% reduction into total verifier 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19153 * memory consumption and 20% verifier time speedup. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19154 */ aa30eb3260b2de Eduard Zingerman 2024-10-29 19155 add_new_state = force_new_state; 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19156 if (env->jmps_processed - env->prev_jmps_processed >= 2 && 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19157 env->insn_processed - env->prev_insn_processed >= 8) 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19158 add_new_state = true; 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19159 9242b5f5615c82 Alexei Starovoitov 2018-12-13 19160 clean_live_states(env, insn_idx, cur); 9242b5f5615c82 Alexei Starovoitov 2018-12-13 19161 c9e31900b54cad Eduard Zingerman 2025-06-11 19162 loop = false; 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19163 head = explored_state(env, insn_idx); 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19164 list_for_each_safe(pos, tmp, head) { 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19165 sl = container_of(pos, struct bpf_verifier_state_list, node); dc2a4ebc0b44a2 Alexei Starovoitov 2019-05-21 19166 states_cnt++; dc2a4ebc0b44a2 Alexei Starovoitov 2019-05-21 19167 if (sl->state.insn_idx != insn_idx) 5564ee3abb2ebe Eduard Zingerman 2025-02-15 19168 continue; bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19169 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19170 if (sl->state.branches) { bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19171 struct bpf_func_state *frame = sl->state.frame[sl->state.curframe]; bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19172 bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19173 if (frame->in_async_callback_fn && bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19174 frame->async_entry_cnt != cur->frame[cur->curframe]->async_entry_cnt) { bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19175 /* Different async_entry_cnt means that the verifier is bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19176 * processing another entry into async callback. bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19177 * Seeing the same state is not an indication of infinite bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19178 * loop or infinite recursion. bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19179 * But finding the same state doesn't mean that it's safe bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19180 * to stop processing the current state. The previous state bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19181 * hasn't yet reached bpf_exit, since state.branches > 0. bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19182 * Checking in_async_callback_fn alone is not enough either. bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19183 * Since the verifier still needs to catch infinite loops bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19184 * inside async callbacks. bfc6bb74e4f16a Alexei Starovoitov 2021-07-14 19185 */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19186 goto skip_inf_loop_check; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19187 } 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19188 /* BPF open-coded iterators loop detection is special. 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19189 * states_maybe_looping() logic is too simplistic in detecting 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19190 * states that *might* be equivalent, because it doesn't know 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19191 * about ID remapping, so don't even perform it. 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19192 * See process_iter_next_call() and iter_active_depths_differ() 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19193 * for overview of the logic. When current and one of parent 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19194 * states are detected as equivalent, it's a good thing: we prove 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19195 * convergence and can stop simulating further iterations. 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19196 * It's safe to assume that iterator loop will finish, taking into 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19197 * account iter_next() contract of eventually returning 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19198 * sticky NULL result. 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19199 * 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19200 * Note, that states have to be compared exactly in this case because 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19201 * read and precision marks might not be finalized inside the loop. 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19202 * E.g. as in the program below: 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19203 * 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19204 * 1. r7 = -16 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19205 * 2. r6 = bpf_get_prandom_u32() 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19206 * 3. while (bpf_iter_num_next(&fp[-8])) { 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19207 * 4. if (r6 != 42) { 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19208 * 5. r7 = -32 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19209 * 6. r6 = bpf_get_prandom_u32() 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19210 * 7. continue 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19211 * 8. } 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19212 * 9. r0 = r10 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19213 * 10. r0 += r7 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19214 * 11. r8 = *(u64 *)(r0 + 0) 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19215 * 12. r6 = bpf_get_prandom_u32() 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19216 * 13. } 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19217 * 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19218 * Here verifier would first visit path 1-3, create a checkpoint at 3 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19219 * with r7=-16, continue to 4-7,3. Existing checkpoint at 3 does 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19220 * not have read or precision mark for r7 yet, thus inexact states 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19221 * comparison would discard current state with r7=-32 2793a8b015f7f1 Eduard Zingerman 2023-10-24 19222 * => unsafe memory access at 11 would not be caught. 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19223 */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19224 if (is_iter_next_insn(env, insn_idx)) { 4f81c16f50baf6 Alexei Starovoitov 2024-03-05 19225 if (states_equal(env, &sl->state, cur, RANGE_WITHIN)) { 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19226 struct bpf_func_state *cur_frame; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19227 struct bpf_reg_state *iter_state, *iter_reg; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19228 int spi; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19229 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19230 cur_frame = cur->frame[cur->curframe]; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19231 /* btf_check_iter_kfuncs() enforces that 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19232 * iter state pointer is always the first arg 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19233 */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19234 iter_reg = &cur_frame->regs[BPF_REG_1]; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19235 /* current state is valid due to states_equal(), 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19236 * so we can assume valid iter and reg state, 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19237 * no need for extra (re-)validations 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19238 */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19239 spi = __get_spi(iter_reg->off + iter_reg->var_off.value); 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19240 iter_state = &func(env, iter_reg)->stack[spi].spilled_ptr; 2a0992829ea386 Eduard Zingerman 2023-10-24 19241 if (iter_state->iter.state == BPF_ITER_STATE_ACTIVE) { c9e31900b54cad Eduard Zingerman 2025-06-11 19242 loop = true; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19243 goto hit; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19244 } 2a0992829ea386 Eduard Zingerman 2023-10-24 19245 } 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19246 goto skip_inf_loop_check; 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19247 } 011832b97b311b Alexei Starovoitov 2024-03-05 19248 if (is_may_goto_insn_at(env, insn_idx)) { 2b2efe1937ca9f Alexei Starovoitov 2024-06-19 19249 if (sl->state.may_goto_depth != cur->may_goto_depth && 2b2efe1937ca9f Alexei Starovoitov 2024-06-19 19250 states_equal(env, &sl->state, cur, RANGE_WITHIN)) { c9e31900b54cad Eduard Zingerman 2025-06-11 19251 loop = true; 011832b97b311b Alexei Starovoitov 2024-03-05 19252 goto hit; 011832b97b311b Alexei Starovoitov 2024-03-05 19253 } 011832b97b311b Alexei Starovoitov 2024-03-05 19254 } 588af0c506ec8e Eduard Zingerman 2025-09-10 19255 if (bpf_calls_callback(env, insn_idx)) { 4f81c16f50baf6 Alexei Starovoitov 2024-03-05 19256 if (states_equal(env, &sl->state, cur, RANGE_WITHIN)) ab5cfac139ab85 Eduard Zingerman 2023-11-21 19257 goto hit; ab5cfac139ab85 Eduard Zingerman 2023-11-21 19258 goto skip_inf_loop_check; ab5cfac139ab85 Eduard Zingerman 2023-11-21 19259 } 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19260 /* attempt to detect infinite loop to avoid unnecessary doomed work */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19261 if (states_maybe_looping(&sl->state, cur) && 4f81c16f50baf6 Alexei Starovoitov 2024-03-05 19262 states_equal(env, &sl->state, cur, EXACT) && ab5cfac139ab85 Eduard Zingerman 2023-11-21 19263 !iter_active_depths_differ(&sl->state, cur) && 011832b97b311b Alexei Starovoitov 2024-03-05 19264 sl->state.may_goto_depth == cur->may_goto_depth && ab5cfac139ab85 Eduard Zingerman 2023-11-21 19265 sl->state.callback_unroll_depth == cur->callback_unroll_depth) { 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19266 verbose_linfo(env, insn_idx, "; "); 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19267 verbose(env, "infinite loop detected at insn %d\n", insn_idx); b4d8239534fddc Eduard Zingerman 2023-10-24 19268 verbose(env, "cur state:"); 1995edc5f9089e Kumar Kartikeya Dwivedi 2024-12-03 19269 print_verifier_state(env, cur, cur->curframe, true); b4d8239534fddc Eduard Zingerman 2023-10-24 19270 verbose(env, "old state:"); 1995edc5f9089e Kumar Kartikeya Dwivedi 2024-12-03 19271 print_verifier_state(env, &sl->state, cur->curframe, true); 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19272 return -EINVAL; 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19273 } 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19274 /* if the verifier is processing a loop, avoid adding new state 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19275 * too often, since different loop iterations have distinct 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19276 * states and may not help future pruning. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19277 * This threshold shouldn't be too low to make sure that 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19278 * a loop with large bound will be rejected quickly. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19279 * The most abusive loop will be: 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19280 * r1 += 1 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19281 * if r1 < 1000000 goto pc-2 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19282 * 1M insn_procssed limit / 100 == 10k peak states. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19283 * This threshold shouldn't be too high either, since states 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19284 * at the end of the loop are likely to be useful in pruning. 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19285 */ 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19286 skip_inf_loop_check: 4b5ce570dbef57 Andrii Nakryiko 2023-03-09 19287 if (!force_new_state && 98ddcf389d1bb7 Andrii Nakryiko 2023-03-02 19288 env->jmps_processed - env->prev_jmps_processed < 20 && 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19289 env->insn_processed - env->prev_insn_processed < 100) 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19290 add_new_state = false; 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19291 goto miss; 2589726d12a1b1 Alexei Starovoitov 2019-06-15 19292 } c9e31900b54cad Eduard Zingerman 2025-06-11 19293 /* See comments for mark_all_regs_read_and_precise() */ c9e31900b54cad Eduard Zingerman 2025-06-11 19294 loop = incomplete_read_marks(env, &sl->state); c9e31900b54cad Eduard Zingerman 2025-06-11 19295 if (states_equal(env, &sl->state, cur, loop ? RANGE_WITHIN : NOT_EXACT)) { 06accc8779c1d5 Andrii Nakryiko 2023-03-08 19296 hit: 9f4686c41bdff0 Alexei Starovoitov 2019-04-01 19297 sl->hit_cnt++; a3ce685dd01a78 Alexei Starovoitov 2019-06-28 19298 a3ce685dd01a78 Alexei Starovoitov 2019-06-28 19299 /* if previous state reached the exit with precision and a7de265cb2d849 Rafael Passos 2024-04-17 19300 * current state is equivalent to it (except precision marks) a3ce685dd01a78 Alexei Starovoitov 2019-06-28 19301 * the precision needs to be propagated back in a3ce685dd01a78 Alexei Starovoitov 2019-06-28 19302 * the current state. a3ce685dd01a78 Alexei Starovoitov 2019-06-28 19303 */ 41f6f64e6999a8 Andrii Nakryiko 2023-12-05 19304 if (is_jmp_point(env, env->insn_idx)) baaebe0928bf32 Eduard Zingerman 2025-06-11 @19305 err = err ? : push_jmp_history(env, cur, 0, 0); ^^^ err needs to be initialized to zero at the start. Btw, I really encourage people to use CONFIG_INIT_STACK_ALL_PATTERN=y in their testing. (In production everyone should use CONFIG_INIT_STACK_ALL_ZERO=y). 23b37d616565c8 Eduard Zingerman 2025-06-11 19306 err = err ? : propagate_precision(env, &sl->state, cur, NULL); f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 19307 if (err) f4d7e40a5b7157 Alexei Starovoitov 2017-12-14 19308 return err; c9e31900b54cad Eduard Zingerman 2025-06-11 19309 /* When processing iterator based loops above propagate_liveness and c9e31900b54cad Eduard Zingerman 2025-06-11 19310 * propagate_precision calls are not sufficient to transfer all relevant c9e31900b54cad Eduard Zingerman 2025-06-11 19311 * read and precision marks. E.g. consider the following case: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
