[PATCH bpf 1/4] bpf: Check flow_dissector ctx accesses are aligned

[PATCH bpf 1/4] bpf: Check flow_dissector ctx accesses are aligned

[Paul Chaignon]

flow_dissector_is_valid_access doesn't check that the context access is
aligned. As a consequence, an unaligned access within one of the exposed
field is considered valid and later rejected by
flow_dissector_convert_ctx_access when we try to convert it.

The later rejection is problematic because it's reported as a verifier
bug with a kernel warning and doesn't point to the right instruction in
verifier logs.

Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Reported-by: syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 net/core/filter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index c09a85c17496..da391e2b0788 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9458,6 +9458,9 @@ static bool flow_dissector_is_valid_access(int off, int size,
 	if (off < 0 || off >= sizeof(struct __sk_buff))
 		return false;
 
+	if (off % size != 0)
+		return false;
+
 	if (type == BPF_WRITE)
 		return false;
 
-- 
2.43.0

[PATCH bpf 2/4] bpf: Check netfilter ctx accesses are aligned

[Paul Chaignon]

Similarly to the previous patch fixing the flow_dissector ctx accesses,
nf_is_valid_access also doesn't check that ctx accesses are aligned.
Contrary to flow_dissector programs, netfilter programs don't have
context conversion. The unaligned ctx accesses are therefore allowed by
the verifier.

Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework")
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 net/netfilter/nf_bpf_link.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c
index 3e4fb9ddcd36..46e667a50d98 100644
--- a/net/netfilter/nf_bpf_link.c
+++ b/net/netfilter/nf_bpf_link.c
@@ -296,6 +296,9 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type,
 	if (off < 0 || off >= sizeof(struct bpf_nf_ctx))
 		return false;
 
+	if (off % size != 0)
+		return false;
+
 	if (type == BPF_WRITE)
 		return false;
 
-- 
2.43.0

[PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Paul Chaignon]

We've already had two "error during ctx access conversion" warnings
triggered by syzkaller. Let's improve the error message by dumping the
cnt variable so that we can more easily differentiate between the
different error cases.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 399f03e62508..0806295945e4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
 					 &target_size);
 		if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
 		    (ctx_field_size && !target_size)) {
-			verifier_bug(env, "error during ctx access conversion");
+			verifier_bug(env, "error during ctx access conversion (%d)", cnt);
 			return -EFAULT;
 		}
 
-- 
2.43.0

[PATCH bpf 4/4] selftests/bpf: Test for unaligned flow_dissector ctx access

[Paul Chaignon]

This patch adds tests for two context fields where unaligned accesses
were not properly rejected.

Note the new macro is similar to the existing narrow_load macro, but we
need a different description and access offset. Combining the two
macros into one is probably doable but I don't think it would help
readability.

vmlinux.h is included in place of bpf.h so we have the definition of
struct bpf_nf_ctx.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
 .../selftests/bpf/progs/verifier_ctx.c        | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx.c b/tools/testing/selftests/bpf/progs/verifier_ctx.c
index 0450840c92d9..424463094760 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ctx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx.c
@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Converted from tools/testing/selftests/bpf/verifier/ctx.c */
 
-#include <linux/bpf.h>
+#include "vmlinux.h"
 #include <bpf/bpf_helpers.h>
 #include "bpf_misc.h"
 
+#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
+
 SEC("tc")
 __description("context stores via BPF_ATOMIC")
 __failure __msg("BPF_ATOMIC stores into R1 ctx is not allowed")
@@ -243,4 +245,23 @@ narrow_load("sockops", bpf_sock_ops, skb_data);
 narrow_load("sockops", bpf_sock_ops, skb_data_end);
 narrow_load("sockops", bpf_sock_ops, skb_hwtstamp);
 
+#define unaligned_access(type, ctx, field)					\
+	SEC(type)								\
+	__description("unaligned access on field " #field " of " #ctx)		\
+	__failure __msg("invalid bpf_context access")				\
+	__naked void unaligned_ctx_access_##ctx##field(void)			\
+	{									\
+		asm volatile ("							\
+		r1 = *(u%[size] *)(r1 + %[off]);				\
+		r0 = 0;								\
+		exit;"								\
+		:								\
+		: __imm_const(size, sizeof_field(struct ctx, field) * 8),	\
+		  __imm_const(off, offsetof(struct ctx, field) + 1)		\
+		: __clobber_all);						\
+	}
+
+unaligned_access("flow_dissector", __sk_buff, data);
+unaligned_access("netfilter", bpf_nf_ctx, skb);
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0

Re: [PATCH bpf 1/4] bpf: Check flow_dissector ctx accesses are aligned

[Yonghong Song]

On 8/1/25 2:47 AM, Paul Chaignon wrote:
> flow_dissector_is_valid_access doesn't check that the context access is
> aligned. As a consequence, an unaligned access within one of the exposed
> field is considered valid and later rejected by
> flow_dissector_convert_ctx_access when we try to convert it.
>
> The later rejection is problematic because it's reported as a verifier
> bug with a kernel warning and doesn't point to the right instruction in
> verifier logs.
>
> Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
> Reported-by: syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>

Re: [PATCH bpf 2/4] bpf: Check netfilter ctx accesses are aligned

[Yonghong Song]

On 8/1/25 2:48 AM, Paul Chaignon wrote:
> Similarly to the previous patch fixing the flow_dissector ctx accesses,
> nf_is_valid_access also doesn't check that ctx accesses are aligned.
> Contrary to flow_dissector programs, netfilter programs don't have
> context conversion. The unaligned ctx accesses are therefore allowed by
> the verifier.
>
> Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework")
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>

Re: [PATCH bpf 1/4] bpf: Check flow_dissector ctx accesses are aligned

[Eduard Zingerman]

On Fri, 2025-08-01 at 11:47 +0200, Paul Chaignon wrote:
> flow_dissector_is_valid_access doesn't check that the context access is
> aligned. As a consequence, an unaligned access within one of the exposed
> field is considered valid and later rejected by
> flow_dissector_convert_ctx_access when we try to convert it.
> 
> The later rejection is problematic because it's reported as a verifier
> bug with a kernel warning and doesn't point to the right instruction in
> verifier logs.
> 
> Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
> Reported-by: syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

Re: [PATCH bpf 2/4] bpf: Check netfilter ctx accesses are aligned

[Eduard Zingerman]

On Fri, 2025-08-01 at 11:48 +0200, Paul Chaignon wrote:
> Similarly to the previous patch fixing the flow_dissector ctx accesses,
> nf_is_valid_access also doesn't check that ctx accesses are aligned.
> Contrary to flow_dissector programs, netfilter programs don't have
> context conversion. The unaligned ctx accesses are therefore allowed by
> the verifier.
> 
> Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework")
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Eduard Zingerman]

On Fri, 2025-08-01 at 11:49 +0200, Paul Chaignon wrote:
> We've already had two "error during ctx access conversion" warnings
> triggered by syzkaller. Let's improve the error message by dumping the
> cnt variable so that we can more easily differentiate between the
> different error cases.
> 
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

>  kernel/bpf/verifier.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 399f03e62508..0806295945e4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
>  					 &target_size);
>  		if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
>  		    (ctx_field_size && !target_size)) {
> -			verifier_bug(env, "error during ctx access conversion");
> +			verifier_bug(env, "error during ctx access conversion (%d)", cnt);

Nit: maybe print the rest of the fields as well?

>  			return -EFAULT;
>  		}
>  

Re: [PATCH bpf 4/4] selftests/bpf: Test for unaligned flow_dissector ctx access

[Eduard Zingerman]

On Fri, 2025-08-01 at 11:49 +0200, Paul Chaignon wrote:
> This patch adds tests for two context fields where unaligned accesses
> were not properly rejected.
> 
> Note the new macro is similar to the existing narrow_load macro, but we
> need a different description and access offset. Combining the two
> macros into one is probably doable but I don't think it would help
> readability.
> 
> vmlinux.h is included in place of bpf.h so we have the definition of
> struct bpf_nf_ctx.
> 
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---

Tested-by: Eduard Zingerman <eddyz87@gmail.com>

[...]

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Paul Chaignon]

On Fri, Aug 01, 2025 at 09:09:33AM -0700, Eduard Zingerman wrote:
> On Fri, 2025-08-01 at 11:49 +0200, Paul Chaignon wrote:
> > We've already had two "error during ctx access conversion" warnings
> > triggered by syzkaller. Let's improve the error message by dumping the
> > cnt variable so that we can more easily differentiate between the
> > different error cases.
> > 
> > Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> > ---
> 
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>

Thanks for the review!

> 
> >  kernel/bpf/verifier.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 399f03e62508..0806295945e4 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
> >  					 &target_size);
> >  		if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
> >  		    (ctx_field_size && !target_size)) {
> > -			verifier_bug(env, "error during ctx access conversion");
> > +			verifier_bug(env, "error during ctx access conversion (%d)", cnt);
> 
> Nit: maybe print the rest of the fields as well?

I considered it but didn't want to unnecessarily bloat the message.
Knowing cnt is enough to know which of the three conditions is true. If
the last one is true, then knowing the values of ctx_field_size and
target_size doesn't really help us because the issue is just that one is
set (ctx_field_size in _is_valid_access) while the other wasn't
(target_size in _convert_ctx_accesses). That indicates a mismatch
between the two functions for that particular program type.

> 
> >  			return -EFAULT;
> >  		}
> >  

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Eduard Zingerman]

On Fri, 2025-08-01 at 18:19 +0200, Paul Chaignon wrote:

[...]

> > > @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
> > >  					 &target_size);
> > >  		if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
> > >  		    (ctx_field_size && !target_size)) {
> > > -			verifier_bug(env, "error during ctx access conversion");
> > > +			verifier_bug(env, "error during ctx access conversion (%d)", cnt);
> > 
> > Nit: maybe print the rest of the fields as well?
> 
> I considered it but didn't want to unnecessarily bloat the message.
> Knowing cnt is enough to know which of the three conditions is true. If
> the last one is true, then knowing the values of ctx_field_size and
> target_size doesn't really help us because the issue is just that one is
> set (ctx_field_size in _is_valid_access) while the other wasn't
> (target_size in _convert_ctx_accesses). That indicates a mismatch
> between the two functions for that particular program type.

Ack, makes sense. Thank you for explaining.

Re: [PATCH bpf 1/4] bpf: Check flow_dissector ctx accesses are aligned

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Fri, 1 Aug 2025 11:47:23 +0200 you wrote:
> flow_dissector_is_valid_access doesn't check that the context access is
> aligned. As a consequence, an unaligned access within one of the exposed
> field is considered valid and later rejected by
> flow_dissector_convert_ctx_access when we try to convert it.
> 
> The later rejection is problematic because it's reported as a verifier
> bug with a kernel warning and doesn't point to the right instruction in
> verifier logs.
> 
> [...]

Here is the summary with links:
  - [bpf,1/4] bpf: Check flow_dissector ctx accesses are aligned
    https://git.kernel.org/bpf/bpf/c/ead3d7b2b6af
  - [bpf,2/4] bpf: Check netfilter ctx accesses are aligned
    https://git.kernel.org/bpf/bpf/c/9e6448f7b1ef
  - [bpf,3/4] bpf: Improve ctx access verifier error message
    https://git.kernel.org/bpf/bpf/c/f914876eec9e
  - [bpf,4/4] selftests/bpf: Test for unaligned flow_dissector ctx access
    https://git.kernel.org/bpf/bpf/c/3fea6d121b56

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Yonghong Song]

On 8/1/25 2:49 AM, Paul Chaignon wrote:
> We've already had two "error during ctx access conversion" warnings
> triggered by syzkaller. Let's improve the error message by dumping the
> cnt variable so that we can more easily differentiate between the
> different error cases.
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---
>   kernel/bpf/verifier.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 399f03e62508..0806295945e4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
>   					 &target_size);
>   		if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
>   		    (ctx_field_size && !target_size)) {
> -			verifier_bug(env, "error during ctx access conversion");
> +			verifier_bug(env, "error during ctx access conversion (%d)", cnt);

For the above, users still will not know what '(%d)' mean. So if we want to
provide better verification measure, we should do
	if (cnt == 0 || cnt >= INSN_BUF_SIZE) {
		verifier_bug(env, "error during ctx access conversion (insn cnt %d)", cnt);
		return -EFAULT;
	} else if (ctx_field_size && !target_size) {
		verifier_bug(env, "error during ctx access conversion (ctx_field_size %d, target_size 0)", ctx_field_size);
		return -EFAULT;
	}

Another thing. The current log message is:
	verifier bug: error during ctx access conversion (0)(1)

The '(0)' corresponds to insn cnt. The same one is due to the following:

#define verifier_bug_if(cond, env, fmt, args...)                                                \
         ({                                                                                      \
                 bool __cond = (cond);                                                           \
                 if (unlikely(__cond)) {                                                         \
                         BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args);         \
                         bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args);       \
                 }                                                                               \
                 (__cond);                                                                       \
         })
#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)

Based on the above, the error message '(1)' is always there, esp. for verifier_bug(...) case?
Does this make sense?

>   			return -EFAULT;
>   		}
>   

Re: [PATCH bpf 4/4] selftests/bpf: Test for unaligned flow_dissector ctx access

[Yonghong Song]

On 8/1/25 2:49 AM, Paul Chaignon wrote:
> This patch adds tests for two context fields where unaligned accesses
> were not properly rejected.
>
> Note the new macro is similar to the existing narrow_load macro, but we
> need a different description and access offset. Combining the two
> macros into one is probably doable but I don't think it would help
> readability.
>
> vmlinux.h is included in place of bpf.h so we have the definition of
> struct bpf_nf_ctx.
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Alexei Starovoitov]

On Fri, Aug 1, 2025 at 9:31 AM Yonghong Song <yonghong.song@linux.dev> wrote:
>
>
>
> On 8/1/25 2:49 AM, Paul Chaignon wrote:
> > We've already had two "error during ctx access conversion" warnings
> > triggered by syzkaller. Let's improve the error message by dumping the
> > cnt variable so that we can more easily differentiate between the
> > different error cases.
> >
> > Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> > ---
> >   kernel/bpf/verifier.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 399f03e62508..0806295945e4 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
> >                                        &target_size);
> >               if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
> >                   (ctx_field_size && !target_size)) {
> > -                     verifier_bug(env, "error during ctx access conversion");
> > +                     verifier_bug(env, "error during ctx access conversion (%d)", cnt);
>
> For the above, users still will not know what '(%d)' mean. So if we want to

Right, but such verifier_bug reports are mainly for developers,
and we will know what it's about especially after redundant (1) is fixed.

> provide better verification measure, we should do
>         if (cnt == 0 || cnt >= INSN_BUF_SIZE) {
>                 verifier_bug(env, "error during ctx access conversion (insn cnt %d)", cnt);
>                 return -EFAULT;
>         } else if (ctx_field_size && !target_size) {
>                 verifier_bug(env, "error during ctx access conversion (ctx_field_size %d, target_size 0)", ctx_field_size);
>                 return -EFAULT;
>         }

It's nicer, but overkill. As Paul explained if cnt > 0 && < INSN_BUF_SIZE
it must be ctx_field_size/tager_size issue that
needs debugging anyway with a proper reproducer.
So making this particular debug output prettier won't help
analysis much.

>
> Another thing. The current log message is:
>         verifier bug: error during ctx access conversion (0)(1)
>
> The '(0)' corresponds to insn cnt. The same one is due to the following:

...

> Based on the above, the error message '(1)' is always there, esp. for verifier_bug(...) case?

Yeah. That's an issue with verifier_bug() indeed.
Let's fix it separately.

Re: [PATCH bpf 3/4] bpf: Improve ctx access verifier error message

[Yonghong Song]

On 8/1/25 2:47 PM, Alexei Starovoitov wrote:
> On Fri, Aug 1, 2025 at 9:31 AM Yonghong Song <yonghong.song@linux.dev> wrote:
>>
>>
>> On 8/1/25 2:49 AM, Paul Chaignon wrote:
>>> We've already had two "error during ctx access conversion" warnings
>>> triggered by syzkaller. Let's improve the error message by dumping the
>>> cnt variable so that we can more easily differentiate between the
>>> different error cases.
>>>
>>> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
>>> ---
>>>    kernel/bpf/verifier.c | 2 +-
>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>>> index 399f03e62508..0806295945e4 100644
>>> --- a/kernel/bpf/verifier.c
>>> +++ b/kernel/bpf/verifier.c
>>> @@ -21445,7 +21445,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
>>>                                         &target_size);
>>>                if (cnt == 0 || cnt >= INSN_BUF_SIZE ||
>>>                    (ctx_field_size && !target_size)) {
>>> -                     verifier_bug(env, "error during ctx access conversion");
>>> +                     verifier_bug(env, "error during ctx access conversion (%d)", cnt);
>> For the above, users still will not know what '(%d)' mean. So if we want to
> Right, but such verifier_bug reports are mainly for developers,
> and we will know what it's about especially after redundant (1) is fixed.
>
>> provide better verification measure, we should do
>>          if (cnt == 0 || cnt >= INSN_BUF_SIZE) {
>>                  verifier_bug(env, "error during ctx access conversion (insn cnt %d)", cnt);
>>                  return -EFAULT;
>>          } else if (ctx_field_size && !target_size) {
>>                  verifier_bug(env, "error during ctx access conversion (ctx_field_size %d, target_size 0)", ctx_field_size);
>>                  return -EFAULT;
>>          }
> It's nicer, but overkill. As Paul explained if cnt > 0 && < INSN_BUF_SIZE
> it must be ctx_field_size/tager_size issue that
> needs debugging anyway with a proper reproducer.
> So making this particular debug output prettier won't help
> analysis much.

Sure. I am ok with this. Thanks!

[...]