Re: [PATCH bpf-next v3 03/17] bpf: Add verifier diagnostic event log

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unbounded growth of diagnostic event log causes `-ENOMEM` verification failures for valid BPF programs due to memory fragmentation.
- [Low] Unused static function `diag_print_history` causes build failure with `-Werror`.
--

--- Patch [3]: [PATCH bpf-next v3 03/17] bpf: Add verifier diagnostic event log ---
commit 84f2d0d4f3731edb22773c28c7395e2076557ddb
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Add verifier diagnostic event log

This commit adds an environment-owned diagnostic history for verifier reports
to track branch events. The event array grows as entries are appended, saving
positions for future truncation when the verifier backtracks.

> diff --git a/kernel/bpf/diagnostics.c b/kernel/bpf/diagnostics.c
> index 49106115621db..ed19220aca9a9 100644
> --- a/kernel/bpf/diagnostics.c
> +++ b/kernel/bpf/diagnostics.c

[ ... ]

> +	cap = log->cap ? log->cap * 2 : 64;
> +	if (cap < log->cap) {
> +		log->error = -EOVERFLOW;
> +		return log->error;
> +	}
> +
> +	events = krealloc_array(log->events, cap, sizeof(*events), GFP_KERNEL_ACCOUNT);

[Severity: High]
The bpf_diag_record_branch function is called for every evaluated conditional
jump without corresponding truncation during verifier backtracking, which
records all explored paths instead of just the active causal path.

For complex programs approaching the one million instruction limit, the log
can grow to several megabytes.

Since krealloc_array requires physically contiguous memory, these large
allocations are highly likely to fail due to memory fragmentation.

Could this unbounded reallocation cause memory allocation failures for valid
BPF programs?

> +	if (!events) {
> +		log->error = -ENOMEM;
> +		return log->error;
> +	}

[ ... ]

> +static void diag_print_history(struct bpf_verifier_env *env)
> +{

[Severity: Low]
It appears this is defined but never called in this patch.

This triggers a compiler warning for an unused function and breaks the build
when the kernel is compiled with warnings as errors.

Is this static function currently used anywhere in the file?

> +	const struct bpf_diag_history_event *event;
> +	const struct bpf_diag_log *log;
> +	bool printed = false;
> +	u32 i;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713153910.2556007-1-memxor@gmail.com?part=3