Re: [PATCH bpf-next v1 01/17] bpf: Add verifier diagnostics report helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] High stack consumption in verifier diagnostic helper functions.
- [Low] Premature line wrapping when a word exactly fits the column width.
--

commit aa805d573ef7f7f7b9f1f0f42ddae783a0fb2690
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Add verifier diagnostics report helpers

Add a small diagnostics renderer for verifier reports and wire it into the
BPF build. The initial helpers emit the common text structure: a failure
header plus reusable report sections.

> diff --git a/kernel/bpf/diagnostics.c b/kernel/bpf/diagnostics.c
> new file mode 100644
> index 0000000000000..a6684adc0c313
> --- /dev/null
> +++ b/kernel/bpf/diagnostics.c
[ ... ]
> +static void bpf_diag_print_wrapped_prefixed(struct bpf_verifier_env *env,
> +					    const char *first_prefix,
> +					    const char *next_prefix,
> +					    const char *text)
> +{
[ ... ]
> +		while (line[len] && line[len] != '\n' && len < text_width) {
> +			if (line[len] == ' ')
> +				last_space = len;
> +			len++;
> +		}
> +
> +		if (line[len] && line[len] != '\n' && last_space > 0)
> +			len = last_space;

[Severity: Low]
Does this cause premature line wrapping when a word exactly fits the column
width?

If line[len] is a space where len equals text_width, the condition
line[len] != '\n' evaluates to true, forcing len to revert to last_space.

This prevents the full word from utilizing the available line width.

[ ... ]
> +static void bpf_diag_vprint_indented(struct bpf_verifier_env *env,
> +				     const char *fmt, va_list args)
> +{
> +	char buf[1024];

[Severity: High]
Does this risk a kernel stack overflow?

A 1024-byte local buffer is allocated on the stack here. Coupled with the
512-byte problem_buf in bpf_diag_report_header(), and large allocations in
other diagnostic functions like bpf_diag_report_source() (over 1.3KB) and
bpf_diag_print_source_annotation() (768 bytes), the total stack consumption
in a single call chain can exceed 2KB.

Could these large stack buffers lead to stack overflow panics in the
deeply-nested BPF verifier?

> +
> +	if (!bpf_verifier_log_needed(&env->log))
> +		return;
> +
> +	vscnprintf(buf, sizeof(buf), fmt, args);
> +	bpf_diag_print_wrapped_text(env, buf);
> +}
> +
> +void bpf_diag_report_header(struct bpf_verifier_env *env,
> +			    const char *category, const char *problem)
> +{
> +	char problem_buf[BPF_DIAG_MSG_LEN];

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605063412.974640-1-memxor@gmail.com?part=1