From: "Kumar Kartikeya Dwivedi" <memxor@gmail.com>
To: <sashiko-reviews@lists.linux.dev>
Cc: <bpf@vger.kernel.org>
Subject: Re: [PATCH bpf-next v1 08/18] bpf: Grow the verifier id scratch on demand
Date: Wed, 23 Sep 2026 21:29:27 +0200 [thread overview]
Message-ID: <DLMY0OLDC2E9.20RXZ8ZAY73PG@gmail.com> (raw)
In-Reply-To: <20260923192404.EE7E21F000FF@smtp.kernel.org>
On Wed Sep 23, 2026 at 9:24 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] bpf: OOM in release_reference() triggers WARN_ON_ONCE and is improperly ignored in unmark_stack_slots_iter()
> --
>
> commit bdefbd593b54c82f98de0288f1f6f5e793ee9fbb
> Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
> bpf: Grow the verifier id scratch on demand
>
> The id map used to compare the ids of two states, which also serves as
> the id stack of release_reference() and as the id set of
> bpf_clear_singular_ids(), is a fixed array embedded in struct
> bpf_verifier_env and sized for the most registers and stack slots a
> state can possibly hold. Turn the map and the set into arrays grown on
> demand, starting at 64 entries and doubling, and free them with the env.
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index d8f43f3a89912..8641f1a8d017d 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -10136,8 +10136,9 @@ static int idstack_push(struct bpf_idmap *idmap, u32 id)
>> if (idmap->map[i].old == id)
>> return 0;
>>
>> - if (WARN_ON_ONCE(idmap->cnt >= BPF_ID_MAP_SIZE))
>> - return -EFAULT;
>> + if (!bpf_id_scratch_reserve((void **)&idmap->map, &idmap->cap, idmap->cnt,
>> + sizeof(*idmap->map)))
>> + return -ENOMEM;
>
> [Severity: Medium]
> With this change, idstack_push() can return -ENOMEM on a normal allocation
> failure, which propagates up through release_reference().
>
> However, in kernel/bpf/verifier.c:unmark_stack_slots_iter(), we have:
>
> for (i = 0; i < nr_slots; i++) {
> struct bpf_stack_state *slot = bpf_stack_slot(state, spi - i);
> struct bpf_reg_state *st = &slot->spilled_ptr;
>
> if (i == 0)
> WARN_ON_ONCE(release_reference(env, st->id));
>
> Does this mean a simple -ENOMEM during verification will trigger this
> WARN_ON_ONCE splat? Since release_reference() can now legitimately fail under
> memory pressure, should this warning be removed, and should the -ENOMEM error
> be properly propagated here instead of discarded?
This one is legit, probably needs more graceful handling.
next prev parent reply other threads:[~2026-09-23 19:29 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-23 19:11 [PATCH bpf-next v1 00/18] Raise BPF program stack size to 2KiB Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 01/18] bpf: Add accessors for verifier stack slots Kumar Kartikeya Dwivedi
2026-09-23 19:57 ` bot+bpf-ci
2026-09-23 20:04 ` Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 02/18] bpf: Widen the stack slot index in the jump history Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 03/18] bpf: Store linked registers in the jump history as an array Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 04/18] bpf: Track backtracking stack slots with bitmaps Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 05/18] bpf: Track scratched stack slots with a bitmap Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 06/18] bpf: Treat unknown-size stack reads as reaching the frame top Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 07/18] bpf: Size liveness stack masks by the stack each frame uses Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 08/18] bpf: Grow the verifier id scratch on demand Kumar Kartikeya Dwivedi
2026-09-23 19:24 ` sashiko-bot
2026-09-23 19:29 ` Kumar Kartikeya Dwivedi [this message]
2026-09-23 19:11 ` [PATCH bpf-next v1 09/18] selftests/bpf: Cover the tail call caller stack depth limit Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 10/18] selftests/bpf: Check that narrow stack stores define no slot Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 11/18] selftests/bpf: Check liveness merge of masks with different widths Kumar Kartikeya Dwivedi
2026-09-23 19:26 ` sashiko-bot
2026-09-23 19:29 ` Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 12/18] bpf: Size the per-frame verifier structures for a 2 KiB stack Kumar Kartikeya Dwivedi
2026-09-23 20:12 ` bot+bpf-ci
2026-09-23 20:27 ` Kumar Kartikeya Dwivedi
2026-09-23 22:55 ` Alexei Starovoitov
2026-09-23 19:11 ` [PATCH bpf-next v1 13/18] bpf: Bound program stack use by a per-program limit Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 14/18] selftests/bpf: Add load conditions on the program stack limit Kumar Kartikeya Dwivedi
2026-09-23 20:12 ` bot+bpf-ci
2026-09-23 20:27 ` Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 15/18] selftests/bpf: Give the 512-byte stack boundary tests a 2 KiB twin Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 16/18] bpf, x86: Allow programs 2 KiB of stack Kumar Kartikeya Dwivedi
2026-09-23 20:12 ` bot+bpf-ci
2026-09-23 20:28 ` Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 17/18] bpf, arm64: " Kumar Kartikeya Dwivedi
2026-09-23 19:11 ` [PATCH bpf-next v1 18/18] selftests/bpf: Test the 2 KiB stack budget Kumar Kartikeya Dwivedi
2026-09-23 20:12 ` bot+bpf-ci
2026-09-23 20:28 ` Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLMY0OLDC2E9.20RXZ8ZAY73PG@gmail.com \
--to=memxor@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox