[PATCH bpf 1/2] bpf: Preserve link info metadata on ENOSPC

[PATCH bpf 1/2] bpf: Preserve link info metadata on ENOSPC

[Sun Jian]

BPF_OBJ_GET_INFO_BY_FD for bpf_link copies struct bpf_link_info back to
userspace only when ->fill_link_info() succeeds. Some link info providers,
however, can return -ENOSPC after computing valid metadata when a nested
userspace output buffer is too small.

For example, perf event tracepoint link info can determine the required
tp_name length before copying the name fails with -ENOSPC. The current
top-level error handling returns immediately in that case, so userspace
observes -ENOSPC but loses the metadata needed to retry with a sufficiently
large buffer.

Allow bpf_link_get_info_by_fd() to copy the top-level bpf_link_info back
on -ENOSPC, while still returning -ENOSPC to userspace. Also let perf
event kprobe, uprobe, and tracepoint link info fill their metadata before
returning -ENOSPC from nested name buffer copying.

Fixes: f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link")
Fixes: 1b715e1b0ec5 ("bpf: Support ->fill_link_info for perf_event")
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 kernel/bpf/syscall.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 6db306d23b47..80ab02b1c813 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4060,7 +4060,7 @@ static int bpf_perf_link_fill_kprobe(const struct perf_event *event,
 	ulen = info->perf_event.kprobe.name_len;
 	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &addr,
 					&type, &missed);
-	if (err)
+	if (err && err != -ENOSPC)
 		return err;
 	if (type == BPF_FD_TYPE_KRETPROBE)
 		info->perf_event.type = BPF_PERF_EVENT_KRETPROBE;
@@ -4073,7 +4073,7 @@ static int bpf_perf_link_fill_kprobe(const struct perf_event *event,
 		addr = 0;
 	info->perf_event.kprobe.addr = addr;
 	info->perf_event.kprobe.cookie = event->bpf_cookie;
-	return 0;
+	return err;
 }
 
 static void bpf_perf_link_fdinfo_kprobe(const struct perf_event *event,
@@ -4116,7 +4116,7 @@ static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
 	ulen = info->perf_event.uprobe.name_len;
 	err = bpf_perf_link_fill_common(event, uname, &ulen, &offset, &ref_ctr_offset,
 					&type, NULL);
-	if (err)
+	if (err && err != -ENOSPC)
 		return err;
 
 	if (type == BPF_FD_TYPE_URETPROBE)
@@ -4127,7 +4127,7 @@ static int bpf_perf_link_fill_uprobe(const struct perf_event *event,
 	info->perf_event.uprobe.offset = offset;
 	info->perf_event.uprobe.cookie = event->bpf_cookie;
 	info->perf_event.uprobe.ref_ctr_offset = ref_ctr_offset;
-	return 0;
+	return err;
 }
 
 static void bpf_perf_link_fdinfo_uprobe(const struct perf_event *event,
@@ -4180,13 +4180,13 @@ static int bpf_perf_link_fill_tracepoint(const struct perf_event *event,
 	uname = u64_to_user_ptr(info->perf_event.tracepoint.tp_name);
 	ulen = info->perf_event.tracepoint.name_len;
 	err = bpf_perf_link_fill_common(event, uname, &ulen, NULL, NULL, NULL, NULL);
-	if (err)
+	if (err && err != -ENOSPC)
 		return err;
 
 	info->perf_event.type = BPF_PERF_EVENT_TRACEPOINT;
 	info->perf_event.tracepoint.name_len = ulen;
 	info->perf_event.tracepoint.cookie = event->bpf_cookie;
-	return 0;
+	return err;
 }
 
 static int bpf_perf_link_fill_perf_event(const struct perf_event *event,
@@ -5536,7 +5536,7 @@ static int bpf_link_get_info_by_fd(struct file *file,
 	struct bpf_link_info __user *uinfo = u64_to_user_ptr(attr->info.info);
 	struct bpf_link_info info;
 	u32 info_len = attr->info.info_len;
-	int err;
+	int err = 0;
 
 	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
 	if (err)
@@ -5554,7 +5554,7 @@ static int bpf_link_get_info_by_fd(struct file *file,
 
 	if (link->ops->fill_link_info) {
 		err = link->ops->fill_link_info(link, &info);
-		if (err)
+		if (err && err != -ENOSPC)
 			return err;
 	}
 
@@ -5562,7 +5562,7 @@ static int bpf_link_get_info_by_fd(struct file *file,
 	    put_user(info_len, &uattr->info.info_len))
 		return -EFAULT;
 
-	return 0;
+	return err;
 }
 
 
-- 
2.43.0

[PATCH bpf 2/2] selftests/bpf: Cover link info metadata on ENOSPC

[Sun Jian]

Add a perf event tracepoint link info check with a one-byte tp_name
buffer. The query is expected to return -ENOSPC because the nested name
buffer is too small, but it should still report the top-level link type,
perf event type, cookie, and real tp_name length.

Before the fix, bpf_link_get_info_by_fd() returned -ENOSPC but did not
copy the top-level bpf_link_info back to userspace, leaving info.type as
zero.

Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 .../selftests/bpf/prog_tests/fill_link_info.c | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
index f589eefbf9fb..95132c80b3b9 100644
--- a/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
+++ b/tools/testing/selftests/bpf/prog_tests/fill_link_info.c
@@ -126,6 +126,37 @@ static int verify_perf_link_info(int fd, enum bpf_perf_event_type type, long add
 	return err;
 }
 
+static int verify_perf_tp_link_info_enospc(int fd)
+{
+	struct bpf_link_info info;
+	__u32 len = sizeof(info);
+	char buf[1] = {};
+	int err;
+
+	memset(&info, 0, sizeof(info));
+	info.perf_event.tracepoint.tp_name = ptr_to_u64(buf);
+	info.perf_event.tracepoint.name_len = sizeof(buf);
+
+	err = bpf_link_get_info_by_fd(fd, &info, &len);
+	if (!ASSERT_EQ(err, -ENOSPC, "get_link_info_enospc"))
+		return -1;
+
+	if (!ASSERT_EQ(info.type, BPF_LINK_TYPE_PERF_EVENT, "link_type_enospc"))
+		return -1;
+	if (!ASSERT_EQ(info.perf_event.type, BPF_PERF_EVENT_TRACEPOINT, "perf_type_enospc"))
+		return -1;
+	if (!ASSERT_EQ(info.perf_event.tracepoint.name_len, strlen(TP_NAME) + 1,
+		       "tp_name_len_enospc"))
+		return -1;
+	if (!ASSERT_EQ(info.perf_event.tracepoint.cookie, PERF_EVENT_COOKIE,
+		       "tp_cookie_enospc"))
+		return -1;
+	if (!ASSERT_EQ(buf[0], '\0', "short_tp_name_nul"))
+		return -1;
+
+	return 0;
+}
+
 static void kprobe_fill_invalid_user_buffer(int fd)
 {
 	struct bpf_link_info info;
@@ -200,6 +231,10 @@ static void test_tp_fill_link_info(struct test_fill_link_info *skel)
 	link_fd = bpf_link__fd(link);
 	err = verify_perf_link_info(link_fd, BPF_PERF_EVENT_TRACEPOINT, 0, 0, 0);
 	ASSERT_OK(err, "verify_perf_link_info");
+
+	err = verify_perf_tp_link_info_enospc(link_fd);
+	ASSERT_OK(err, "verify_perf_tp_link_info_enospc");
+
 	bpf_link__destroy(link);
 }
 
-- 
2.43.0

Re: [PATCH bpf 2/2] selftests/bpf: Cover link info metadata on ENOSPC

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1313 bytes --]

> selftests/bpf: Cover link info metadata on ENOSPC
>
> Add a perf event tracepoint link info check with a one-byte tp_name
> buffer. The query is expected to return -ENOSPC because the nested name
> buffer is too small, but it should still report the top-level link type,
> perf event type, cookie, and real tp_name length.
>
> Before the fix, bpf_link_get_info_by_fd() returned -ENOSPC but did not
> copy the top-level bpf_link_info back to userspace, leaving info.type as
> zero.
>
> Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>

The commit message refers to "the fix" that changed bpf_link_get_info_by_fd()
behavior, but there is no Fixes: tag. Should this carry a Fixes: tag for
the commit that first returned -ENOSPC without copying the top-level
bpf_link_info?

  Fixes: f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link")

Since the test exercises the perf-event nested fill path specifically, a
second tag for the perf_event fill_link_info support may also apply:

  Fixes: 1b715e1b0ec5 ("bpf: Support ->fill_link_info for perf_event")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28095789600