bpf: Track verifier context diagnostic events

Record verifier context transitions in the diagnostic history so later reports can anchor causal paths to the critical section that made an operation invalid. This covers lock, IRQ, RCU, and preempt regions without adding any new verifier error reports. Category-specific commits decide where those recorded events should be rendered. Use context depth when selecting scoped history so nested regions anchor at the outer active region, and fall back to the earliest retained event when the matching entry was pruned.

Kumar Kartikeya Dwivedi committed 2 months ago

Commit 956a66e1 parent 9ecd7033 files · +74 −5Browse files

Showing the changes to kernel (3 of 3 files). Show all

Unified · Split

3 files

kernel/bpf/diagnostics.c +39 −0
kernel/bpf/diagnostics.h +12 −0
kernel/bpf/verifier.c +23 −5

kernel/bpf/diagnostics.c+39−0

@@ -104,6 +104,7 @@ enum bpf_diag_history_kind { · 103 unmodified lines
104	BPF_DIAG_HISTORY_MOD,	104	BPF_DIAG_HISTORY_MOD,
105	BPF_DIAG_HISTORY_REF_ACQUIRE,	105	BPF_DIAG_HISTORY_REF_ACQUIRE,
106	BPF_DIAG_HISTORY_REF_RELEASE,	106	BPF_DIAG_HISTORY_REF_RELEASE,
		107	BPF_DIAG_HISTORY_CONTEXT,
107	};	108	};
108		109
109	struct bpf_diag_history_event {	110	struct bpf_diag_history_event {
@@ -124,6 +125,11 @@ struct bpf_diag_history_event { · 14 unmodified lines
124	struct {	125	struct {
125	u32 ref_id;	126	u32 ref_id;
126	} ref;	127	} ref;
		128	struct {
		129	u32 depth;
		130	u8 kind;
		131	bool enter;
		132	} ctx;
127	};	133	};
128	};	134	};
129		135
@@ -388,6 +394,19 @@ void bpf_diag_event_log_restore(struct bpf_verifier_env *env, u64 log_pos) · 258 unmodified lines
388	log->cnt = log_pos - log->first_seq;	394	log->cnt = log_pos - log->first_seq;
389	}	395	}
390		396
		397	u32 bpf_diag_irq_depth(const struct bpf_verifier_state *state)
		398	{
		399	u32 depth = 0;
		400	int i;
		401
		402	for (i = 0; i < state->acquired_refs; i++) {
		403	if (state->refs[i].type == REF_TYPE_IRQ)
		404	depth++;
		405	}
		406
		407	return depth;
		408	}
		409
391	static void diag_append_history(struct bpf_verifier_env *env,	410	static void diag_append_history(struct bpf_verifier_env *env,
392	const struct bpf_diag_history_event *event)	411	const struct bpf_diag_history_event *event)
393	{	412	{
@@ -1049,3 +1068,23 @@ void bpf_diag_record_ref_release(struct bpf_verifier_env *env, u32 insn_idx, u32 · 655 unmodified lines
1049	{	1068	{
1050	diag_record_ref(env, insn_idx, BPF_DIAG_HISTORY_REF_RELEASE, ref_id);	1069	diag_record_ref(env, insn_idx, BPF_DIAG_HISTORY_REF_RELEASE, ref_id);
1051	}	1070	}
		1071
		1072	void bpf_diag_record_context(struct bpf_verifier_env *env, u32 insn_idx,
		1073	enum bpf_diag_context_kind ctx_kind, bool enter, u32 depth)
		1074	{
		1075	/*
		1076	* Keep leave events so context rendering can stop at a depth-zero exit
		1077	* and show nested-region depth accurately for the active path.
		1078	*/
		1079	struct bpf_diag_history_event event = {
		1080	.insn_idx = insn_idx,
		1081	.kind = BPF_DIAG_HISTORY_CONTEXT,
		1082	.ctx = {
		1083	.kind = ctx_kind,
		1084	.enter = enter,
		1085	.depth = depth,
		1086	},
		1087	};
		1088
		1089	diag_append_history(env, &event);
		1090	}

kernel/bpf/diagnostics.h+12−0

 struct bpf_func_state;
 struct bpf_reg_state;
 struct bpf_verifier_env;
+struct bpf_verifier_state;
 struct btf;
 enum bpf_diag_mod_reason {
 	BPF_DIAG_MOD_CALLER_SAVED,
 };
+enum bpf_diag_context_kind {
+	BPF_DIAG_CONTEXT_NONE,
+	BPF_DIAG_CONTEXT_RCU,
+	BPF_DIAG_CONTEXT_PREEMPT,
+	BPF_DIAG_CONTEXT_IRQ,
+	BPF_DIAG_CONTEXT_LOCK,
+};
 bool bpf_diag_enabled(const struct bpf_verifier_env *env);
 int bpf_diag_init(struct bpf_verifier_env *env);
 void bpf_diag_init_frame(struct bpf_verifier_env *env, struct bpf_func_state *state);
 const char *bpf_diag_fmt_btf_type(struct bpf_verifier_env *env, const struct btf *btf, u32 type_id);
 u64 bpf_diag_event_log_save(struct bpf_verifier_env *env);
 void bpf_diag_event_log_restore(struct bpf_verifier_env *env, u64 log_pos);
+u32 bpf_diag_irq_depth(const struct bpf_verifier_state *state);
 void bpf_diag_free(struct bpf_verifier_env *env);
 void bpf_diag_record_branch(struct bpf_verifier_env *env, u32 insn_idx, bool cond_true);
 void bpf_diag_mod_begin(struct bpf_verifier_env *env, const struct bpf_reg_state *reg,
 				 enum bpf_diag_mod_reason reason);
 void bpf_diag_record_ref_acquire(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id);
 void bpf_diag_record_ref_release(struct bpf_verifier_env *env, u32 insn_idx, u32 ref_id);
+void bpf_diag_record_context(struct bpf_verifier_env *env, u32 insn_idx,
+			     enum bpf_diag_context_kind ctx_kind, bool enter, u32 depth);
 #endif /* __BPF_DIAGNOSTICS_H */

kernel/bpf/verifier.c+23−5

 }
 static int acquire_irq_state(struct bpf_verifier_env *env, int insn_idx);
-static int release_irq_state(struct bpf_verifier_state *state, int id);
+static int release_irq_state(struct bpf_verifier_env *env, int id);
 static int mark_stack_slot_irq_flag(struct bpf_verifier_env *env,
 				     struct bpf_call_arg_meta *meta,
 		return -EINVAL;
 	}
-	err = release_irq_state(env->cur_state, st->id);
+	err = release_irq_state(env, st->id);
 	WARN_ON_ONCE(err && err != -EACCES);
 	if (err) {
 		int insn_idx = 0;
 	state->active_locks++;
 	state->active_lock_id = id;
 	state->active_lock_ptr = ptr;
+	bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_LOCK, true,
+				state->active_locks);
 	return 0;
 }
 	s->id = ++env->id_gen;
 	state->active_irq_id = s->id;
+	bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_IRQ, true,
+				bpf_diag_irq_depth(state));
 	return s->id;
 }
 	return find_reference_state(env->cur_state, reg->id);
 }
-static int release_lock_state(struct bpf_verifier_state *state, int type, int id, void *ptr)
+static int release_lock_state(struct bpf_verifier_env *env, int type, int id, void *ptr)
 {
+	struct bpf_verifier_state *state = env->cur_state;
 	void *prev_ptr = NULL;
 	u32 prev_id = 0;
 	int i;
 			/* Reassign active lock (id, ptr). */
 			state->active_lock_id = prev_id;
 			state->active_lock_ptr = prev_ptr;
+			bpf_diag_record_context(env, env->insn_idx, BPF_DIAG_CONTEXT_LOCK,
+						false, state->active_locks);
 			return 0;
 		}
 		if (state->refs[i].type & REF_TYPE_LOCK_MASK) {
 	return -EINVAL;
 }
-static int release_irq_state(struct bpf_verifier_state *state, int id)
+static int release_irq_state(struct bpf_verifier_env *env, int id)
 {
+	struct bpf_verifier_state *state = env->cur_state;
 	u32 prev_id = 0;
 	int i;
 		if (state->refs[i].id == id) {
 			release_reference_state(state, i);
 			state->active_irq_id = prev_id;
+			bpf_diag_record_context(env, env->insn_idx, BPF_DIAG_CONTEXT_IRQ,
+						false, bpf_diag_irq_depth(state));
 			return 0;
 		} else {
 			prev_id = state->refs[i].id;
 			verbose(env, "%s_unlock cannot be out of order\n", lock_str);
 			return -EINVAL;
 		}
-		if (release_lock_state(cur, type, reg->id, ptr)) {
+		if (release_lock_state(env, type, reg->id, ptr)) {
 			verbose(env, "%s_unlock of different lock\n", lock_str);
 			return -EINVAL;
 		}
 	if (rcu_lock) {
 		env->cur_state->active_rcu_locks++;
+		bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_RCU, true,
+					env->cur_state->active_rcu_locks);
 	} else if (rcu_unlock) {
 		if (env->cur_state->active_rcu_locks == 0) {
 			verbose(env, "unmatched rcu read unlock (kernel function %s)\n", func_name);
 			return -EINVAL;
 		}
 		env->cur_state->active_rcu_locks--;
+		bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_RCU, false,
+					env->cur_state->active_rcu_locks);
 		if (!in_rcu_cs(env))
 			invalidate_rcu_protected_refs(env);
 	} else if (preempt_disable) {
 		env->cur_state->active_preempt_locks++;
+		bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_PREEMPT, true,
+					env->cur_state->active_preempt_locks);
 	} else if (preempt_enable) {
 		if (env->cur_state->active_preempt_locks == 0) {
 			verbose(env, "unmatched attempt to enable preemption (kernel function %s)\n", func_name);
 			return -EINVAL;
 		}
 		env->cur_state->active_preempt_locks--;
+		bpf_diag_record_context(env, insn_idx, BPF_DIAG_CONTEXT_PREEMPT, false,
+					env->cur_state->active_preempt_locks);
 		if (!in_rcu_cs(env))
 			invalidate_rcu_protected_refs(env);
 	}