Re: [PATCH bpf-next v1 04/17] bpf: Track verifier branch diagnostic history

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Massive memory bloat due to copying diag_history into cached explored_states
--

commit 1c9483e0ca38f0733322ac30906596c49007b4eb
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Track verifier branch diagnostic history

This patch adds bounded diagnostic history to verifier states. It records
conditional branch outcomes to help show the causal path that reached a
verifier error when user-facing diagnostics are printed.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -1624,6 +1626,7 @@ int bpf_copy_verifier_state(struct bpf_verifier_state *dst_state,
>  	if (!dst_state->jmp_history)
>  		return -ENOMEM;
>  	dst_state->jmp_history_cnt = src->jmp_history_cnt;
> +	bpf_diag_copy_history(dst_state, src);
>  
>  	/* if dst has more stack frames then src frame, free them, this is also
>  	 * necessary in case of exceptional exits using bpf_throw.

[Severity: High]
Does this cause massive memory bloat when verifier logging is enabled?

Because is_state_visited() caches states by calling bpf_copy_verifier_state()
and adding them to the explored_states list, the diagnostic history is copied 
for every cached state.

Since the diagnostic history can grow up to 1024 entries per state, caching
this for tens of thousands of explored states could easily lead to gigabytes 
of wasted memory (hitting memcg limits via GFP_KERNEL_ACCOUNT or causing
-ENOMEM) specifically when a user enables logging to debug an issue.

Because cached states are only used for state equivalence checks and precision
propagation, neither of which use the diagnostic history, could we avoid 
copying the diag_history into cached explored states?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605063412.974640-1-memxor@gmail.com?part=4