From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: Eduard Zingerman <eddyz87@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Emil Tsalapatis <emil@etsalapatis.com>,
kkd@meta.com, kernel-team@meta.com
Subject: [PATCH bpf-next v4 06/16] bpf: Track verifier reference diagnostic events
Date: Thu, 13 Aug 2026 01:33:09 +0200 [thread overview]
Message-ID: <20260812233326.3575958-7-memxor@gmail.com> (raw)
In-Reply-To: <20260812233326.3575958-1-memxor@gmail.com>
Add reference acquire and release events to diagnostic history so Resource
Lifetime Safety reports can show the lifetime of a specific reference id along
the path.
Record acquisitions after the verifier assigns the reference id. Record
releases only after release_reference_nomark() succeeds, including the
kptr_xchg RCU conversion path and owning-to-non-owning conversion path that
consume an owning reference.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
kernel/bpf/diagnostics.c | 28 ++++++++++++++++++++++++++++
kernel/bpf/diagnostics.h | 2 ++
kernel/bpf/verifier.c | 32 +++++++++++++++++++++++++-------
3 files changed, 55 insertions(+), 7 deletions(-)
diff --git a/kernel/bpf/diagnostics.c b/kernel/bpf/diagnostics.c
index 460bb83ae33d..0143ffe6fa03 100644
--- a/kernel/bpf/diagnostics.c
+++ b/kernel/bpf/diagnostics.c
@@ -47,6 +47,8 @@ struct bpf_diag_reg_snapshot {
enum bpf_diag_history_kind {
BPF_DIAG_HISTORY_BRANCH,
BPF_DIAG_HISTORY_MOD,
+ BPF_DIAG_HISTORY_REF_ACQUIRE,
+ BPF_DIAG_HISTORY_REF_RELEASE,
};
struct bpf_diag_history_event {
@@ -64,6 +66,9 @@ struct bpf_diag_history_event {
u8 reason;
bool origin_valid;
} mod;
+ struct {
+ u32 ref_id;
+ } ref;
};
};
@@ -939,3 +944,26 @@ void bpf_diag_record_scrub_stack(struct bpf_verifier_env *env, u32 frameno, s16
bpf_diag_stack_range_target(frameno, min_off, max_off), reason,
NULL, NULL, NULL);
}
+
+static void diag_record_ref(struct bpf_verifier_env *env, u32 insn_idx, u8 kind, u32 ref_id)
+{
+ struct bpf_diag_history_event event = {
+ .insn_idx = insn_idx,
+ .kind = kind,
+ .ref = {
+ .ref_id = ref_id,
+ },
+ };
+
+ diag_append_history(env, &event);
+}
+
+void bpf_diag_record_ref_acquire(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id)
+{
+ diag_record_ref(env, insn_idx, BPF_DIAG_HISTORY_REF_ACQUIRE, ref_id);
+}
+
+void bpf_diag_record_ref_release(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id)
+{
+ diag_record_ref(env, insn_idx, BPF_DIAG_HISTORY_REF_RELEASE, ref_id);
+}
diff --git a/kernel/bpf/diagnostics.h b/kernel/bpf/diagnostics.h
index 8785f8d9a9ca..40fe161525b9 100644
--- a/kernel/bpf/diagnostics.h
+++ b/kernel/bpf/diagnostics.h
@@ -103,5 +103,7 @@ void bpf_diag_record_scrub(struct bpf_verifier_env *env, const struct bpf_reg_st
enum bpf_diag_mod_reason reason);
void bpf_diag_record_scrub_stack(struct bpf_verifier_env *env, u32 frameno, s16 min_off,
s16 max_off, enum bpf_diag_mod_reason reason);
+void bpf_diag_record_ref_acquire(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id);
+void bpf_diag_record_ref_release(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id);
#endif /* __BPF_DIAGNOSTICS_H */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ed8a239a964d..4f3416700ad7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -205,7 +205,8 @@ struct bpf_verifier_stack_elem {
#define BPF_PRIV_STACK_MIN_SIZE 64
static int acquire_reference(struct bpf_verifier_env *env, int insn_idx, int parent_id);
-static int release_reference_nomark(struct bpf_verifier_state *state, int id);
+static int __release_reference_nomark(struct bpf_verifier_state *state, int id);
+static int release_reference_nomark(struct bpf_verifier_env *env, int id);
static int release_reference(struct bpf_verifier_env *env, int id);
static void invalidate_non_owning_refs(struct bpf_verifier_env *env);
static void invalidate_rcu_protected_refs(struct bpf_verifier_env *env);
@@ -1419,6 +1420,7 @@ static int acquire_reference(struct bpf_verifier_env *env, int insn_idx, int par
s->type = REF_TYPE_PTR;
s->id = ++env->id_gen;
s->parent_id = parent_id;
+ bpf_diag_record_ref_acquire(env, insn_idx, s->id);
return s->id;
}
@@ -8976,7 +8978,7 @@ static void mark_pkt_end(struct bpf_verifier_state *vstate, int regn, bool range
reg->range = AT_PKT_END;
}
-static int release_reference_nomark(struct bpf_verifier_state *state, int id)
+static int __release_reference_nomark(struct bpf_verifier_state *state, int id)
{
int i;
@@ -8991,6 +8993,16 @@ static int release_reference_nomark(struct bpf_verifier_state *state, int id)
return -EINVAL;
}
+static int release_reference_nomark(struct bpf_verifier_env *env, int id)
+{
+ int err;
+
+ err = __release_reference_nomark(env->cur_state, id);
+ if (!err)
+ bpf_diag_record_ref_release(env, env->insn_idx, id);
+ return err;
+}
+
static int idstack_push(struct bpf_idmap *idmap, u32 id)
{
int i;
@@ -9033,8 +9045,10 @@ static int release_reference(struct bpf_verifier_env *env, int id)
if (err)
return err;
- if (find_reference_state(vstate, id))
- WARN_ON_ONCE(release_reference_nomark(vstate, id));
+ if (find_reference_state(vstate, id)) {
+ err = release_reference_nomark(env, id);
+ WARN_ON_ONCE(err);
+ }
while ((id = idstack_pop(idstack))) {
/*
@@ -9126,7 +9140,9 @@ static int ref_convert_alloc_rcu_protected(struct bpf_verifier_env *env, u32 id)
struct bpf_reg_state *reg;
int err;
- err = release_reference_nomark(env->cur_state, id);
+ err = release_reference_nomark(env, id);
+ if (err)
+ return err;
bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({
if (reg->id != id)
@@ -11670,8 +11686,10 @@ static void ref_convert_owning_non_owning(struct bpf_verifier_env *env, u32 id)
{
struct bpf_func_state *unused;
struct bpf_reg_state *reg;
+ int err;
- WARN_ON_ONCE(release_reference_nomark(env->cur_state, id));
+ err = release_reference_nomark(env, id);
+ WARN_ON_ONCE(err);
bpf_for_each_reg_in_vstate(env->cur_state, unused, reg, ({
if (reg->id == id) {
@@ -15803,7 +15821,7 @@ static void mark_ptr_or_null_regs(struct bpf_verifier_state *vstate, u32 regno,
* No one could have freed the reference state before
* doing the NULL check.
*/
- WARN_ON_ONCE(release_reference_nomark(vstate, id));
+ WARN_ON_ONCE(__release_reference_nomark(vstate, id));
bpf_for_each_reg_in_vstate(vstate, state, reg, ({
mark_ptr_or_null_reg(state, reg, id, is_null);
--
2.53.0
next prev parent reply other threads:[~2026-08-12 23:33 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 23:33 [PATCH bpf-next v4 00/16] Redesign Verification Errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 01/16] bpf: Add verifier diagnostics report helpers Kumar Kartikeya Dwivedi
2026-08-12 23:41 ` sashiko-bot
2026-08-12 23:33 ` [PATCH bpf-next v4 02/16] bpf: Add source and instruction diagnostic context Kumar Kartikeya Dwivedi
2026-08-13 0:15 ` sashiko-bot
2026-08-12 23:33 ` [PATCH bpf-next v4 03/16] bpf: Add verifier diagnostic event log Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 04/16] bpf: Prune verifier diagnostics when switching paths Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 05/16] bpf: Track verifier register diagnostic events Kumar Kartikeya Dwivedi
2026-08-12 23:53 ` sashiko-bot
2026-08-12 23:33 ` Kumar Kartikeya Dwivedi [this message]
2026-08-12 23:33 ` [PATCH bpf-next v4 07/16] bpf: Track verifier context " Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 08/16] bpf: Report Register Type Safety errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 09/16] bpf: Report Memory Safety bounds errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 10/16] bpf: Report Resource Lifetime reference leaks Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 11/16] bpf: Report Call Type Safety argument errors Kumar Kartikeya Dwivedi
2026-08-12 23:58 ` sashiko-bot
2026-08-12 23:33 ` [PATCH bpf-next v4 12/16] bpf: Report Execution Context Safety errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 13/16] bpf: Report Program Structure CFG errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 14/16] bpf: Report Policy helper and kfunc errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 15/16] bpf: Report Verifier Limit errors Kumar Kartikeya Dwivedi
2026-08-12 23:33 ` [PATCH bpf-next v4 16/16] bpf: Gate verifier diagnostics on log level Kumar Kartikeya Dwivedi
2026-08-13 1:38 ` [PATCH bpf-next v4 00/16] Redesign Verification Errors Eduard Zingerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260812233326.3575958-7-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=kkd@meta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.