Re: [PATCH bpf-next v5 6/8] selftests/bpf: Adjust bpf_map layout in verifier_map_ptr

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unmodified selftests fail due to removed in-loader signature validation logic.
--

--- Patch [6]: [PATCH bpf-next v5 6/8] selftests/bpf: Adjust bpf_map layout in verifier_map_ptr ---
commit 044ddeab6141689800cc4332d820c23c210957a8
Author: Daniel Borkmann <daniel@iogearbox.net>

selftests/bpf: Adjust bpf_map layout in verifier_map_ptr

This commit updates the expected verifier messages in the verifier_map_ptr
test to account for the removal of the write-only excl member from
struct bpf_map.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_map_ptr.c b/tools/testing/selftests/bpf/progs/verifier_map_ptr.c
> index 1661936598703..e0a65835c861b 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_map_ptr.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_map_ptr.c
[ ... ]
> @@ -97,23 +98,23 @@ __naked void read_non_existent_field_rejected(void)
>  }
>  
>  /*
> - * The u32 excl field spans offsets 32..35 (mend 36). Reading a u32 at offset
> - * 33 starts inside excl but extends past its end, which the verifier rejects
> + * The sha byte array spans offsets 0..31 (mend 32). Reading a u32 at offset
> + * 30 starts inside sha but extends past its end, which the verifier rejects
>   * as an out-of-bounds scalar access.
>   */

[Severity: Medium]
Does this patch series also need to update signed_loader.c to account for the
removal of the excl member and emit_signature_match logic?

It appears that leaving tools/testing/selftests/bpf/prog_tests/signed_loader.c
unmodified causes several tests to fail.

For example, check_sig_match_shape() explicitly looks for
emit_signature_match instructions which are no longer generated:

    for (i = 0; i + 1 < n; i++) {
        if (in[i].code == (BPF_LD | BPF_IMM | BPF_DW) &&
            in[i].src_reg == BPF_PSEUDO_MAP_IDX) {
            a = i;
            break;
        }
    }
    if (!ASSERT_GE(a, 0, "emit_signature_match present"))
        return;

Additionally, metadata_not_exclusive(), metadata_sha_mismatch(), and
metadata_hash_not_computed() test validation failures by passing a NULL
signature. Without a signature, the kernel verifier skips metadata validation
entirely.

Since the runtime check was removed, the loader now successfully executes
and returns 0 instead of -EINVAL, causing these tests to fail:

    r = run_gen_loader(f.gopts.insns, f.gopts.insns_sz, f.blob,
                       f.data_sz, NULL, 0, NULL, 0, true, f.ctx,
                       f.ctx_sz, &ran);
    ASSERT_TRUE(ran, "loader ran");
    ASSERT_EQ(r, -EINVAL, "non-exclusive metadata map rejected");

Are there missing updates to signed_loader.c that should be included here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707193104.350066-1-daniel@iogearbox.net?part=6