From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
kkd@meta.com, kernel-team@meta.com
Subject: [PATCH bpf-next v2 7/7] selftests/bpf: Test Program Structure diagnostic context
Date: Thu, 24 Sep 2026 11:29:36 +0200 [thread overview]
Message-ID: <20260924092941.3174809-8-memxor@gmail.com> (raw)
In-Reply-To: <20260924092941.3174809-1-memxor@gmail.com>
Exercise each corrected Program Structure report. Place a
missing-table gotox after another instruction so its attribution
differs from the subprogram start.
Add malformed subprogram layouts for a branch crossing a subprogram
boundary and a subprogram that falls through its end. Both cases carry
BTF line records and assert that their structured reports include the
corresponding source function and file.
Add a raw CO-RE case that targets a truncated final LD_IMM64 and assert
that it is rejected before relocation is applied.
Link: https://lore.kernel.org/bpf/cf2f420c2b21de440a7dc51b1565c0f06d4b539640ee5c03384e5d77bcfb5686@mail.kernel.org/
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
.../selftests/bpf/prog_tests/core_reloc_raw.c | 172 ++++++++++++------
.../selftests/bpf/progs/verifier_cfg.c | 40 ++++
.../selftests/bpf/progs/verifier_gotox.c | 2 +
3 files changed, 156 insertions(+), 58 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
index a18d3680fb16..035a7fe99937 100644
--- a/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
+++ b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
@@ -14,64 +14,44 @@
static char log[16 * 1024];
-/* Check that verifier rejects BPF program containing relocation
- * pointing to non-existent BTF type.
- */
-static void test_bad_local_id(void)
+struct test_btf {
+ struct btf_header hdr;
+ __u32 types[15];
+ char strings[128];
+};
+
+static struct test_btf raw_btf = {
+ .hdr = {
+ .magic = BTF_MAGIC,
+ .version = BTF_VERSION,
+ .hdr_len = sizeof(struct btf_header),
+ .type_off = 0,
+ .type_len = sizeof(raw_btf.types),
+ .str_off = offsetof(struct test_btf, strings) -
+ offsetof(struct test_btf, types),
+ .str_len = sizeof(raw_btf.strings),
+ },
+ .types = {
+ BTF_PTR_ENC(0), /* [1] void* */
+ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [2] int */
+ BTF_FUNC_PROTO_ENC(2, 1), /* [3] int (*)(void*) */
+ BTF_FUNC_PROTO_ARG_ENC(8, 1),
+ BTF_FUNC_ENC(8, 3) /* [4] FUNC 'foo' type_id=2 */
+ },
+ .strings = "\0int\0 0\0foo\0"
+};
+
+static int load_test_btf(void)
{
- struct test_btf {
- struct btf_header hdr;
- __u32 types[15];
- char strings[128];
- } raw_btf = {
- .hdr = {
- .magic = BTF_MAGIC,
- .version = BTF_VERSION,
- .hdr_len = sizeof(struct btf_header),
- .type_off = 0,
- .type_len = sizeof(raw_btf.types),
- .str_off = offsetof(struct test_btf, strings) -
- offsetof(struct test_btf, types),
- .str_len = sizeof(raw_btf.strings),
- },
- .types = {
- BTF_PTR_ENC(0), /* [1] void* */
- BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [2] int */
- BTF_FUNC_PROTO_ENC(2, 1), /* [3] int (*)(void*) */
- BTF_FUNC_PROTO_ARG_ENC(8, 1),
- BTF_FUNC_ENC(8, 3) /* [4] FUNC 'foo' type_id=2 */
- },
- .strings = "\0int\0 0\0foo\0"
- };
__u32 log_level = 1 | 2 | 4;
LIBBPF_OPTS(bpf_btf_load_opts, opts,
.log_buf = log,
.log_size = sizeof(log),
.log_level = log_level,
);
- struct bpf_insn insns[] = {
- BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- struct bpf_func_info funcs[] = {
- {
- .insn_off = 0,
- .type_id = 4,
- }
- };
- struct bpf_core_relo relos[] = {
- {
- .insn_off = 0, /* patch first instruction (r0 = 0) */
- .type_id = 100500, /* !!! this type id does not exist */
- .access_str_off = 6, /* offset of "0" */
- .kind = BPF_CORE_TYPE_ID_LOCAL,
- }
- };
- union bpf_attr attr;
- int saved_errno;
- int prog_fd = -1;
- int btf_fd = -1;
+ int saved_errno, btf_fd;
+ log[0] = 0;
btf_fd = bpf_btf_load(&raw_btf, sizeof(raw_btf), &opts);
saved_errno = errno;
if (btf_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
@@ -79,18 +59,30 @@ static void test_bad_local_id(void)
printf("%s", log);
printf("-------- BTF load log end ----------\n");
}
- if (btf_fd < 0) {
+ if (btf_fd < 0)
PRINT_FAIL("bpf_btf_load() failed, errno=%d\n", saved_errno);
- return;
- }
+ return btf_fd;
+}
+
+static int load_test_prog(int btf_fd, struct bpf_insn *insns, size_t insn_cnt,
+ struct bpf_core_relo *relos, size_t relo_cnt)
+{
+ struct bpf_func_info funcs[] = {
+ {
+ .insn_off = 0,
+ .type_id = 4,
+ }
+ };
+ __u32 log_level = 1 | 2 | 4;
+ union bpf_attr attr = {};
+ int prog_fd;
log[0] = 0;
- memset(&attr, 0, sizeof(attr));
attr.prog_btf_fd = btf_fd;
attr.prog_type = BPF_TRACE_RAW_TP;
attr.license = (__u64)"GPL";
- attr.insns = (__u64)&insns;
- attr.insn_cnt = sizeof(insns) / sizeof(*insns);
+ attr.insns = (__u64)insns;
+ attr.insn_cnt = insn_cnt;
attr.log_buf = (__u64)log;
attr.log_size = sizeof(log);
attr.log_level = log_level;
@@ -98,15 +90,43 @@ static void test_bad_local_id(void)
attr.func_info_cnt = sizeof(funcs) / sizeof(*funcs);
attr.func_info_rec_size = sizeof(*funcs);
attr.core_relos = (__u64)relos;
- attr.core_relo_cnt = sizeof(relos) / sizeof(*relos);
+ attr.core_relo_cnt = relo_cnt;
attr.core_relo_rec_size = sizeof(*relos);
prog_fd = sys_bpf_prog_load(&attr, sizeof(attr), 1);
- saved_errno = errno;
if (prog_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
printf("-------- program load log start --------\n");
printf("%s", log);
printf("-------- program load log end ----------\n");
}
+ return prog_fd;
+}
+
+/* Check that verifier rejects BPF program containing relocation
+ * pointing to non-existent BTF type.
+ */
+static void test_bad_local_id(void)
+{
+ struct bpf_insn insns[] = {
+ BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ struct bpf_core_relo relos[] = {
+ {
+ .insn_off = 0, /* patch first instruction (r0 = 0) */
+ .type_id = 100500, /* !!! this type id does not exist */
+ .access_str_off = 6, /* offset of "0" */
+ .kind = BPF_CORE_TYPE_ID_LOCAL,
+ }
+ };
+ int prog_fd = -1;
+ int btf_fd = -1;
+
+ btf_fd = load_test_btf();
+ if (btf_fd < 0)
+ return;
+
+ prog_fd = load_test_prog(btf_fd, insns, ARRAY_SIZE(insns),
+ relos, ARRAY_SIZE(relos));
if (prog_fd >= 0) {
PRINT_FAIL("sys_bpf_prog_load() expected to fail\n");
goto out;
@@ -118,8 +138,44 @@ static void test_bad_local_id(void)
close(btf_fd);
}
+static void test_truncated_ldimm64(void)
+{
+ struct bpf_insn insns[] = {
+ BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_0, 0, 0, 0),
+ };
+ struct bpf_core_relo relos[] = {
+ {
+ .insn_off = 0,
+ .type_id = 2,
+ .access_str_off = 6,
+ .kind = BPF_CORE_TYPE_ID_LOCAL,
+ }
+ };
+ int prog_fd = -1;
+ int btf_fd = -1;
+
+ btf_fd = load_test_btf();
+ if (btf_fd < 0)
+ return;
+
+ prog_fd = load_test_prog(btf_fd, insns, ARRAY_SIZE(insns),
+ relos, ARRAY_SIZE(relos));
+ if (prog_fd >= 0) {
+ PRINT_FAIL("sys_bpf_prog_load() expected to fail\n");
+ goto out;
+ }
+ ASSERT_HAS_SUBSTR(log, "core_relo[0] targets truncated bpf_ld_imm64 insn",
+ "program load log");
+
+out:
+ close(prog_fd);
+ close(btf_fd);
+}
+
void test_core_reloc_raw(void)
{
if (test__start_subtest("bad_local_id"))
test_bad_local_id();
+ if (test__start_subtest("truncated_ldimm64"))
+ test_truncated_ldimm64();
}
diff --git a/tools/testing/selftests/bpf/progs/verifier_cfg.c b/tools/testing/selftests/bpf/progs/verifier_cfg.c
index 3c3bb03e8217..a8396d4fd5f3 100644
--- a/tools/testing/selftests/bpf/progs/verifier_cfg.c
+++ b/tools/testing/selftests/bpf/progs/verifier_cfg.c
@@ -56,6 +56,46 @@ __naked void out_of_range_jump2(void)
" ::: __clobber_all);
}
+static __naked __noinline __used int cross_subprog_target(void)
+{
+ asm volatile (" \
+ r0 = 0; \
+ exit; \
+" ::: __clobber_all);
+}
+
+SEC("socket")
+__description("jump across subprogram boundary")
+__failure __msg("jump out of range from insn 1")
+__msg("jump_across_subprog_boundary @ verifier_cfg.c")
+__naked void jump_across_subprog_boundary(void)
+{
+ asm volatile (" \
+ call cross_subprog_target; \
+ goto +1; \
+ exit; \
+" ::: __clobber_all);
+}
+
+static __naked __noinline __used int fallthrough_subprog(void)
+{
+ asm volatile (" \
+ r0 = 0; \
+" ::: __clobber_all);
+}
+
+SEC("socket")
+__description("subprogram fallthrough")
+__failure __msg("last insn is not an exit or jmp")
+__msg("fallthrough_subprog @ verifier_cfg.c")
+__naked void subprog_fallthrough(void)
+{
+ asm volatile (" \
+ call fallthrough_subprog; \
+ exit; \
+" ::: __clobber_all);
+}
+
SEC("socket")
__description("invalid DW LDSX instruction in diagnostics")
__failure __msg("BUG_ldx_99")
diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
index 5b18c9a27717..a835a4871021 100644
--- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
+++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
@@ -53,9 +53,11 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __fa
*/
SEC("socket")
__failure __msg("no jump tables found for subprog starting at 0")
+__msg(">>> 1 | (0d) gotox r0")
__naked void jump_table_no_jump_table(void)
{
asm volatile (" \
+ r0 = 0; \
.8byte %[gotox_r0]; \
r0 = 1; \
exit; \
--
2.53.0
prev parent reply other threads:[~2026-09-24 9:29 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-24 9:29 [PATCH bpf-next v2 0/7] Follow ups for verifier errors set Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 1/7] bpf: Correct verifier diagnostic attribution for stack reads Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 2/7] selftests/bpf: Test verifier stack-read diagnostic attribution Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 3/7] bpf: Drop dead spill diagnostic condition Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 4/7] bpf: Report non-sleepable kfunc programs accurately Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 5/7] selftests/bpf: Test non-sleepable kfunc context Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` [PATCH bpf-next v2 6/7] bpf: Correct Program Structure diagnostic context Kumar Kartikeya Dwivedi
2026-09-24 21:05 ` Alexei Starovoitov
2026-09-25 5:22 ` Kumar Kartikeya Dwivedi
2026-09-24 9:29 ` Kumar Kartikeya Dwivedi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260924092941.3174809-8-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=kkd@meta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.