Re: [PATCH bpf-next v5 13/14] bpf: Report Program Structure CFG errors

On Sat, 2026-08-15 at 07:34 +0000, [email protected] wrote:

...

> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> 
> [ ... ]
> 
> > @@ -3020,6 +3020,12 @@ static int check_subprogs(struct bpf_verifier_env *env)
> >  		off = i + bpf_jmp_offset(&insn[i]) + 1;
> >  		if (off < subprog_start || off >= subprog_end) {
> >  			verbose(env, "jump out of range from insn %d to %d\n", i, off);
> > +			bpf_diag_program_structure(
> > +				env, i, "jump out of range",
> > +				"Keep branch targets within the same subprogram, or use an explicit subprogram call.",
> > +				"Instruction %d jumps to instruction %d, but subprogram %d only contains instructions %d through %d. "
> > +				"A branch target must stay inside the same subprogram.",
> > +				i, off, cur_subprog, subprog_start, subprog_end - 1);
> >  			return -EINVAL;
> >  		}
> 
> Can these two bpf_diag_program_structure() calls in check_subprogs()
> produce the source context that the patch advertises?
> 
> Looking at the verifier initialization in bpf_check():
> 
>     ret = bpf_prepare_btf_info(env, attr, uattr);
>     ret = add_subprogs(env);
>     ret = check_subprogs(env);
>     ret = bpf_check_btf_info(env, attr, uattr);
> 
> check_subprogs() runs before bpf_check_btf_info(). Inside
> bpf_check_btf_info(), check_btf_line() sets prog->aux->linfo and
> prog->aux->nr_linfo. Before that, both are zero.
> 
> In bpf_diag_source():
> 
>     linfo = bpf_find_linfo(env->prog, insn_idx);
>     if (btf && linfo)
>         bpf_get_linfo_source(btf, linfo, &src);
>     if (!src.file || !*src.file || !src.line || !*src.line) {
>         diag_write(env, "  insn %u\n", insn_idx);
>         ...
>         goto out_restore;
>     }
> 
> bpf_find_linfo() needs nr_linfo to be nonzero. Since check_subprogs()
> runs before check_btf_line(), nr_linfo is still zero, so bpf_find_linfo()
> returns NULL and bpf_diag_source() takes the degraded branch: bare
> "insn %u" plus an instruction dump, with no source file:line:col and no
> subprogram name.
> 
> The other 8 new report sites in this patch (push_insn, create_jt,
> jt_from_subprog, visit_gotox_insn, bpf_check_cfg, sort_subprogs_topo)
> all run after bpf_check_btf_info(), so they do get source context.
> 
> Should these two reports move to a later point where line info is
> available, or should the commit message acknowledge that source context
> isn't available yet for these early checks?

This would be nice to have but requires some ordering rework,
bpf_check_btf_info() requires subprog_info[] to be filled.

Other two flagged items are non-issues.