Re: [PATCH bpf-next v3 10/17] bpf: Report Resource Lifetime reference leaks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Diagnostic functions print `insn 4294967295` due to a hardcoded `-1` instruction index passed to `process_dynptr_func`.
--

--- Patch [10]: [PATCH bpf-next v3 10/17] bpf: Report Resource Lifetime reference leaks ---
commit 11b108e2b9d6802e27c431d5c20ed1b81781c4e6
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Report Resource Lifetime reference leaks

Augment selected Resource Lifetime Safety failures with structured diagnostics
while preserving the existing verifier messages.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index bd233083b4950..84eda5e83f873 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -7625,9 +7695,18 @@ static int process_dynptr_func(struct bpf_verifier_env *env, struct bpf_reg_stat
>  	int spi, err = 0;
>  
>  	if (reg->type != PTR_TO_STACK && reg->type != CONST_PTR_TO_DYNPTR) {
> +		const char *fmt = "A dynptr argument must be a pointer to a dynptr stack slot or a "
> +				  "verifier-provided const struct bpf_dynptr, but %s is %s.";
> +		const char *reason;
> +
>  		verbose(env,
>  			"%s expected pointer to stack or const struct bpf_dynptr\n",
>  			reg_arg_name(env, argno));
> +		reason = bpf_diag_scratch_printf(env, 0, fmt, reg_arg_name(env, argno),
> +						 bpf_diag_reg_type_plain(env, reg->type));
> +		bpf_diag_res(env, insn_idx, "invalid dynptr argument", reason,
> +			     "Pass the address of a stack dynptr object, or use a const dynptr "
> +			     "pointer returned by the verifier-supported path.");
>  		return -EINVAL;
>  	}

[Severity: Low]
Will passing insn_idx directly to bpf_diag_res() cause an integer underflow 
in the diagnostic output?

Looking at btf_check_func_arg_match(), it calls process_dynptr_func() with 
-1 hardcoded as the instruction index:

kernel/bpf/verifier.c:btf_check_func_arg_match() {
    ...
    ret = process_dynptr_func(env, reg, argno, -1, arg->arg_type, 
                              &ref_obj, NULL);
    ...
}

Because bpf_diag_res() expects a u32 for insn_idx, this -1 gets cast to 
4294967295. This results in the verifier log printing "insn 4294967295" 
during validation failures for dynptrs in global subprogram calls.

Could this use env->insn_idx instead, or handle the -1 case explicitly 
before passing it to bpf_diag_res()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713153910.2556007-1-memxor@gmail.com?part=10