Re: [PATCH bpf-next v1 17/17] bpf: Gate verifier diagnostics on log level

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `push_async_cb()` function fails to initialize `elem->st.diag_enabled`, inadvertently disabling verifier diagnostic history for asynchronous callbacks.
--

commit a1006ba17aa95830cb0240bca35f5e001fb80ed7
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Gate verifier diagnostics on log level

This commit conditionally enables verifier diagnostic collection and
reporting based on the requested log level. It avoids collecting path
history for BPF_LOG_STATS-only loads, saving resources when diagnostics
are not requested.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 3446ee9acaa1b..359c4f4c0d422 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -19238,6 +19238,7 @@ static int do_check_common(struct bpf_verifier_env *env, int subprog)
>  	state->speculative = false;
>  	state->branches = 1;
>  	state->in_sleepable = env->prog->sleepable;
> +	state->diag_enabled = env->log.level & BPF_LOG_LEVEL;
>  	state->frame[0] = kzalloc_obj(struct bpf_func_state, GFP_KERNEL_ACCOUNT);

[Severity: Medium]
Since push_async_cb() also sets up a fresh verifier state without copying the
caller's state, should it initialize elem->st.diag_enabled as well?

Currently, push_async_cb() initializes the state like this:

	/* Unlike push_stack() do not bpf_copy_verifier_state().
	 * The caller state doesn't matter.
	 * This is async callback. It starts in a fresh stack.
	 * Initialize it similar to do_check_common().
	 */
	elem->st.branches = 1;
	elem->st.in_sleepable = is_sleepable;
	frame = kzalloc_obj(*frame, GFP_KERNEL_ACCOUNT);

Because push_async_cb() leaves diag_enabled initialized to false, it seems
diagnostic tracking will be inadvertently disabled for asynchronous callbacks.

If a verification error occurs there, will the verifier misleadingly print
"no recorded diagnostic events on this path"?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605063412.974640-1-memxor@gmail.com?part=17