Re: [PATCH bpf-next 2/2] bpf: Keep one basic block in the level 1 log and print the way to it

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sat, Nov 07, 2026 at 10:02 PM sashiko-bot@kernel.org <sashiko-bot@kernel.org> wrote:
>> @@ -2883,6 +2886,7 @@ static struct flow_state *flow_new_state(struct bpf_verifier_env *env, int prev_
>>  	s->seq = ++flow->seq;
>> +	s->from = flow->from;
>
> [Severity: Medium]
> Does flow_find_state() look up the caller's basic block with a callee sequence
> number after a call to a static subprogram that is verified on its own?
[...]
> If verification later fails in the caller, bpf_flow_print_way() steps back to
> call_idx carrying the callee's seq in from.  When multiple states were kept at
> the caller's basic block, s->seq == seq never matches in flow_find_state(),
> so it falls back to list_last_entry() and prints the wrong state and incoming
> edge for the caller.

Not a bug. It's a limitation.
When the seq is not at that insn flow_find_state() takes the last state
there. With one state at the insn that's the right one.
With several states the way can show the edge of another state.
The way is a help for the reader. Nothing depends on it.
Level 2 has all states.

>> +		if (level1) {
>> +			bpf_vlog_reset(&env->log, log_pos);
>> +			env->prev_linfo = NULL;
>> +		}
>
> [Severity: Low]
> Should this also reset env->prev_log_pos = 0 when rewinding env->log?

No. Not from this patch.
Inside a function every prev_log_pos is larger than log_pos.
The rewind cannot make them equal.
The case that you describe is the first block of a global function.
The log is at log_pos already and this bpf_vlog_reset() does nothing.
prev_log_pos is stale there without the patch too: do_check_common()
does bpf_vlog_reset(&env->log, 0) after the previous function.
The two have to match to the byte, and a newline is all that is lost.