Re: [PATCH bpf-next v2 06/17] bpf: Track verifier reference diagnostic events

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-06-19 at 22:59 +0200, Kumar Kartikeya Dwivedi wrote:
> Add reference acquire and release events to diagnostic history so Resource
> Lifetime Safety reports can show the lifetime of a specific reference id along
> the path.
> 
> Record acquisitions after the verifier assigns the reference id. Record
> releases only after release_reference_nomark() succeeds, including the
> kptr_xchg RCU conversion path and owning-to-non-owning conversion path that
> consume an owning reference.
> 
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

> @@ -1536,6 +1570,20 @@ static void bpf_diag_print_stack_slot(struct bpf_verifier_env *env,
>  			       off, fmt->old_buf, fmt->new_buf);
>  }
>  
> +static void bpf_diag_print_ref_event(struct bpf_verifier_env *env,
> +				     const struct bpf_diag_history_event *event)
> +{
> +	if (event->kind == BPF_DIAG_HISTORY_REF_ACQUIRE) {
> +		bpf_diag_report_source(env, event->insn_idx, "acquired",
> +				       "owned resource (id=%u)",
> +				       event->ref.ref_id);
> +		return;
> +	}
> +
> +	bpf_diag_report_source(env, event->insn_idx, "released",
> +			       "owned resource (id=%u)", event->ref.ref_id);

Nit:

		char *label = event->kind == BPF_DIAG_HISTORY_REF_ACQUIRE ? "acquired" : "released";

		bpf_diag_report_source(env, event->insn_idx, label,
                		       "owned resource (id=%u)", event->ref.ref_id);


[...]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index fedabb6bb515..93941deb2cd8 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[...]

> @@ -9140,8 +9141,12 @@ static int release_reference(struct bpf_verifier_env *env, int id)
>  	if (err)
>  		return err;
>  
> -	if (find_reference_state(vstate, id))
> -		WARN_ON_ONCE(release_reference_nomark(vstate, id));
> +	if (find_reference_state(vstate, id)) {
> +		err = release_reference_nomark(vstate, id);

I'd say that bpf_diag_record_ref_release() should go inside
release_reference_nomark(), but there is one odd case with
mark_ptr_or_null_regs(). Almost like we want __release_reference_nomark().

> +		WARN_ON_ONCE(err);
> +		if (!err)
> +			bpf_diag_record_ref_release(env, env->insn_idx, id);
> +	}
>  
>  	while ((id = idstack_pop(idstack))) {
>  		/*

[...]