Re: [PATCH bpf-next v2 12/17] bpf: Report Execution Context Safety errors

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Fri Jun 19, 2026 at 1:59 PM PDT, Kumar Kartikeya Dwivedi wrote:
> Augment selected sleepability and critical-section failures with Execution
> Context Safety reports. Keep the existing verifier messages and add source
> context, path history, and suggestions tied to the active context.
>
> Use the context history recorded earlier to anchor causal paths to lock, IRQ,
> RCU, and preempt regions instead of unrelated register updates.
>
> Cover global calls while holding a lock, sleepable global function calls,
> sleepable helpers, sleepable kfunc calls from disallowed contexts, operations
> that exit while a context is still active, and unmatched context exits.
>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>  kernel/bpf/diagnostics.c | 165 +++++++++++++++++++++++++++++++++++++++
>  kernel/bpf/diagnostics.h |  14 ++++
>  kernel/bpf/verifier.c    | 114 +++++++++++++++++++++++++++
>  3 files changed, 293 insertions(+)
>
> diff --git a/kernel/bpf/diagnostics.c b/kernel/bpf/diagnostics.c
> index 19e72b07afc1..7c903e502973 100644
> --- a/kernel/bpf/diagnostics.c
> +++ b/kernel/bpf/diagnostics.c
> @@ -844,6 +844,7 @@ static u32 bpf_diag_current_frameno(const struct bpf_verifier_env *env)
>  }
>  
>  static int bpf_diag_stack_argno(u8 slot);
> +static const char *bpf_diag_context_name(enum bpf_diag_context_kind kind);
>  
>  void bpf_diag_report_register_type(struct bpf_verifier_env *env,
>  				   u32 insn_idx, int regno,
> @@ -953,6 +954,170 @@ void bpf_diag_report_call_type(struct bpf_verifier_env *env, u32 insn_idx,
>  	bpf_diag_report_suggestion(env, "%s", suggestion);
>  }
>  
> +static const char *bpf_diag_context_constraint(enum bpf_diag_context_kind kind)
> +{
> +	switch (kind) {
> +	case BPF_DIAG_CONTEXT_RCU:
> +		return "RCU read-side critical sections cannot call operations that may sleep";
> +	case BPF_DIAG_CONTEXT_PREEMPT:
> +		return "preemption-disabled code cannot call operations that may sleep";
> +	case BPF_DIAG_CONTEXT_IRQ:
> +		return "IRQ-disabled code cannot call operations that may sleep";
> +	case BPF_DIAG_CONTEXT_LOCK:
> +		return "code holding a BPF spin lock cannot call operations that may sleep";
> +	case BPF_DIAG_CONTEXT_NONE:
> +	default:
> +		return NULL;
> +	}
> +}
> +
> +static void bpf_diag_format_active_context(char *buf, size_t size, u32 depth,
> +					   const char *context)
> +{
> +	if (depth == 1)
> +		scnprintf(buf, size, "an active %s (depth 1)", context);
> +	else
> +		scnprintf(buf, size, "%u active %ss (depth %u)", depth,
> +			  context, depth);
> +}
> +
> +static u32 bpf_diag_context_depth(struct bpf_verifier_env *env,
> +				  enum bpf_diag_context_kind kind)
> +{
> +	switch (kind) {
> +	case BPF_DIAG_CONTEXT_RCU:
> +		return env->cur_state->active_rcu_locks;
> +	case BPF_DIAG_CONTEXT_PREEMPT:
> +		return env->cur_state->active_preempt_locks;
> +	case BPF_DIAG_CONTEXT_IRQ:
> +		return env->cur_state->active_irq_id ? 1 : 0;
> +	case BPF_DIAG_CONTEXT_LOCK:
> +		return env->cur_state->active_locks;
> +	case BPF_DIAG_CONTEXT_NONE:
> +	default:
> +		return 0;
> +	}
> +}
> +
> +void bpf_diag_report_execution_context(struct bpf_verifier_env *env,
> +				       u32 insn_idx, const char *operation,
> +				       enum bpf_diag_context_kind ctx_kind,
> +				       const char *context,
> +				       const char *suggestion)
> +{
> +	u32 depth = bpf_diag_context_depth(env, ctx_kind);
> +	struct bpf_diag_history_opts opts = {
> +		.scope = BPF_DIAG_HISTORY_SCOPE_CONTEXT,
> +		.ctx_kind = ctx_kind,
> +		.ctx_depth = depth,
> +	};
> +	const char *depth_buf;
> +
> +	bpf_diag_report_header(env, BPF_DIAG_CATEGORY_EXECUTION_CONTEXT_SAFETY,
> +			       "operation is not allowed in this context");
> +	if (bpf_diag_context_constraint(ctx_kind)) {
> +		if (depth) {
> +			depth_buf = bpf_diag_scratch_buf(env,
> +							 2,
> +							 NULL);
> +			if (depth_buf)
> +				bpf_diag_format_active_context((char *)depth_buf,
> +							       BPF_DIAG_SCRATCH_STR_LEN,
> +							       depth, context);
> +			else
> +				depth_buf = "";
> +			bpf_diag_report_reason(env,
> +					       "The operation %s cannot be used in %s because %s. This path is still inside %s.",
> +					       operation, context,
> +					       bpf_diag_context_constraint(ctx_kind),
> +					       depth_buf);
> +		} else {
> +			bpf_diag_report_reason(env,
> +					       "The operation %s cannot be used in %s because %s.",
> +					       operation, context,
> +					       bpf_diag_context_constraint(ctx_kind));
> +		}
> +	} else {
> +		bpf_diag_report_reason(env,
> +				       "The operation %s cannot be used in %s.",
> +				       operation, context);
> +	}
> +
> +	bpf_diag_report_section(env, "At");
> +	bpf_diag_report_source(env, insn_idx, "error",
> +			       "%s is not allowed in %s", operation, context);
> +
> +	if (ctx_kind != BPF_DIAG_CONTEXT_NONE)
> +		bpf_diag_print_history(env, &opts);
> +
> +	bpf_diag_report_suggestion(env, "%s", suggestion);
> +}
> +
> +void bpf_diag_report_context_still_active(struct bpf_verifier_env *env,
> +					  u32 insn_idx, const char *operation,
> +					  enum bpf_diag_context_kind ctx_kind,
> +					  const char *context,
> +					  const char *suggestion)
> +{
> +	u32 depth = bpf_diag_context_depth(env, ctx_kind);
> +	struct bpf_diag_history_opts opts = {
> +		.scope = BPF_DIAG_HISTORY_SCOPE_CONTEXT,
> +		.ctx_kind = ctx_kind,
> +		.ctx_depth = depth,
> +	};
> +	const char *depth_buf;
> +
> +	depth_buf = bpf_diag_scratch_buf(env, 2, NULL);
> +	if (depth_buf)
> +		bpf_diag_format_active_context((char *)depth_buf,
> +					       BPF_DIAG_SCRATCH_STR_LEN, depth,
> +					       context);
> +	else
> +		depth_buf = "";
> +
> +	bpf_diag_report_header(env, BPF_DIAG_CATEGORY_EXECUTION_CONTEXT_SAFETY,
> +			       "operation is not allowed in this context");
> +	bpf_diag_report_reason(env,
> +			       "The operation %s cannot be used while this path is still inside %s. Leave the region before this operation.",
> +			       operation, depth_buf);
> +
> +	bpf_diag_report_section(env, "At");
> +	bpf_diag_report_source(env, insn_idx, "error",
> +			       "%s is not allowed before leaving %s",
> +			       operation, context);
> +
> +	bpf_diag_print_history(env, &opts);
> +
> +	bpf_diag_report_suggestion(env, "%s", suggestion);
> +}
> +
> +void bpf_diag_report_context_underflow(struct bpf_verifier_env *env,
> +				       u32 insn_idx, const char *operation,
> +				       enum bpf_diag_context_kind ctx_kind,
> +				       const char *suggestion)
> +{
> +	struct bpf_diag_history_opts opts = {
> +		.scope = BPF_DIAG_HISTORY_SCOPE_CONTEXT,
> +		.ctx_kind = ctx_kind,
> +	};
> +	const char *context = bpf_diag_context_name(ctx_kind);
> +
> +	bpf_diag_report_header(env, BPF_DIAG_CATEGORY_EXECUTION_CONTEXT_SAFETY,
> +			       "unmatched context exit");
> +	bpf_diag_report_reason(env,
> +			       "The operation %s tries to leave %s, but this path has no active %s to leave. The current depth is 0.",
> +			       operation, context, context);
> +
> +	bpf_diag_report_section(env, "At");
> +	bpf_diag_report_source(env, insn_idx, "error",
> +			       "%s has no matching enter on this path",
> +			       operation);
> +
> +	bpf_diag_print_history(env, &opts);
> +
> +	bpf_diag_report_suggestion(env, "%s", suggestion);
> +}
> +
>  void bpf_diag_report_invalid_deref(struct bpf_verifier_env *env, u32 insn_idx,
>  				   int regno, const char *reg_name,
>  				   const char *type_name,
> diff --git a/kernel/bpf/diagnostics.h b/kernel/bpf/diagnostics.h
> index 07d06d366f22..4611d94e7a18 100644
> --- a/kernel/bpf/diagnostics.h
> +++ b/kernel/bpf/diagnostics.h
> @@ -202,6 +202,20 @@ void bpf_diag_report_call_type(struct bpf_verifier_env *env, u32 insn_idx,
>  			       int argno, int regno, int stack_arg_slot,
>  			       const char *call_name, const char *arg_name,
>  			       const char *reason, const char *suggestion);
> +void bpf_diag_report_execution_context(struct bpf_verifier_env *env,
> +				       u32 insn_idx, const char *operation,
> +				       enum bpf_diag_context_kind ctx_kind,
> +				       const char *context,
> +				       const char *suggestion);
> +void bpf_diag_report_context_still_active(struct bpf_verifier_env *env,
> +					  u32 insn_idx, const char *operation,
> +					  enum bpf_diag_context_kind ctx_kind,
> +					  const char *context,
> +					  const char *suggestion);
> +void bpf_diag_report_context_underflow(struct bpf_verifier_env *env,
> +				       u32 insn_idx, const char *operation,
> +				       enum bpf_diag_context_kind ctx_kind,
> +				       const char *suggestion);

The names are overly long which pushes indent way to far to the right.
Maybe one bpf_diag() helper with enum that multiplexes
"execution context" vs "context still active" vs ...