[PATCH bpf-next 0/6] bpf: Add syscall common attrs support for xdp link_create

[PATCH bpf-next 0/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

I'm planning to add syscall common attrs support for LINK_CREATE cmd.

This is the first series for the plan, that adds syscall common attrs
support for xdp LINK_CREATE.

Thereafter, retire the tracepoint bpf_xdp_link_attach_failed, because
the underlying driver's error can be back-propagated to user space via
the syscall common attrs.

Leon Hwang (6):
  bpf: Add syscall common attrs support for link_create
  bpf: Add syscall common attrs support for xdp link_create
  bpf: Retire tracepoint bpf_xdp_link_attach_failed
  libbpf: Factor out __bpf_sys_fd helper
  libbpf: Add bpf_link_create_log API
  selftests/bpf: Add tests to verify link_create logs

 include/linux/netdevice.h                     |   3 +-
 include/trace/events/xdp.h                    |  17 ---
 kernel/bpf/syscall.c                          |  36 +++--
 net/core/dev.c                                |   7 +-
 tools/lib/bpf/bpf.c                           |  59 +++++---
 tools/lib/bpf/bpf.h                           |   5 +
 tools/lib/bpf/libbpf.map                      |   1 +
 .../selftests/bpf/prog_tests/xdp_attach.c     |  65 ---------
 .../selftests/bpf/prog_tests/xdp_link.c       | 132 ++++++++++++++++++
 .../bpf/progs/test_xdp_attach_fail.c          |  54 -------
 10 files changed, 215 insertions(+), 164 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

-- 
2.55.0

[PATCH bpf-next 1/6] bpf: Add syscall common attrs support for link_create

[Leon Hwang]

Similar to the syscall common attrs support for map_create [1], add the
syscall common attrs support for link_create.

Create and finalize the internal verifier log instance.

Then, report the error messages for invalid prog fd and invalid attach
type.

Links:
[1] https://lore.kernel.org/bpf/20260514004634.3DA09C19425@smtp.kernel.org/

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 kernel/bpf/syscall.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0f27604a54aa..252b479937a4 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5839,10 +5839,13 @@ static int bpf_map_do_batch(const union bpf_attr *attr,
 }
 
 #define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.path_fd
-static int link_create(union bpf_attr *attr, bpfptr_t uattr)
+static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_attr *attr_common,
+		       bpfptr_t uattr_common, u32 size_common)
 {
+	struct bpf_verifier_log *log;
+	struct bpf_log_attr attr_log;
 	struct bpf_prog *prog;
-	int ret;
+	int ret, err;
 
 	if (CHECK_ATTR(BPF_LINK_CREATE))
 		return -EINVAL;
@@ -5850,14 +5853,24 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 	if (attr->link_create.attach_type == BPF_STRUCT_OPS)
 		return bpf_struct_ops_link_create(attr);
 
+	log = bpf_log_attr_create_vlog(&attr_log, attr_common, uattr_common, size_common);
+	if (IS_ERR(log))
+		return PTR_ERR(log);
+
 	prog = bpf_prog_get(attr->link_create.prog_fd);
-	if (IS_ERR(prog))
-		return PTR_ERR(prog);
+	if (IS_ERR(prog)) {
+		bpf_log(log, "Invalid prog_fd.\n");
+		ret = PTR_ERR(prog);
+		prog = NULL;
+		goto out;
+	}
 
 	ret = bpf_prog_attach_check_attach_type(prog,
 						attr->link_create.attach_type);
-	if (ret)
+	if (ret) {
+		bpf_log(log, "Invalid attach_type.\n");
 		goto out;
+	}
 
 	switch (prog->type) {
 	case BPF_PROG_TYPE_CGROUP_SKB:
@@ -5940,7 +5953,14 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 	}
 
 out:
-	if (ret < 0)
+	/* preserve original error even if log finalization is successful */
+	err = bpf_log_attr_finalize(&attr_log, log);
+	if (err)
+		ret = err;
+
+	kfree(log);
+
+	if (ret < 0 && prog)
 		bpf_prog_put(prog);
 	return ret;
 }
@@ -6513,7 +6533,7 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size,
 		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_DELETE_BATCH);
 		break;
 	case BPF_LINK_CREATE:
-		err = link_create(&attr, uattr);
+		err = link_create(&attr, uattr, &attr_common, uattr_common, size_common);
 		break;
 	case BPF_LINK_UPDATE:
 		err = link_update(&attr);
-- 
2.55.0

Re: [PATCH bpf-next 1/6] bpf: Add syscall common attrs support for link_create

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf: prog refcount underflow and fd leak in link_create() on log error
--

commit 56fa3f4abf91b9651c1cd02884b19754bd9ebcb5
Author: Leon Hwang <leon.hwang@linux.dev>

bpf: Add syscall common attrs support for link_create

This commit adds syscall common attributes support to link_create(),
creating and finalizing an internal verifier log instance and reporting
error messages for an invalid prog_fd or attach_type.

Link: https://lore.kernel.org/bpf/20260514004634.3DA09C19425@smtp.kernel.org/

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 0f27604a54aae..252b479937a4d 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -5839,10 +5839,13 @@ static int bpf_map_do_batch(const union bpf_attr *attr,
>  }
>  
>  #define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.path_fd
> -static int link_create(union bpf_attr *attr, bpfptr_t uattr)
> +static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_attr *attr_common,
> +		       bpfptr_t uattr_common, u32 size_common)
>  {
> +	struct bpf_verifier_log *log;
> +	struct bpf_log_attr attr_log;
>  	struct bpf_prog *prog;
> -	int ret;
> +	int ret, err;
>  
>  	if (CHECK_ATTR(BPF_LINK_CREATE))
>  		return -EINVAL;
> @@ -5850,14 +5853,24 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
>  	if (attr->link_create.attach_type == BPF_STRUCT_OPS)
>  		return bpf_struct_ops_link_create(attr);
>  
> +	log = bpf_log_attr_create_vlog(&attr_log, attr_common, uattr_common, size_common);
> +	if (IS_ERR(log))
> +		return PTR_ERR(log);
> +
>  	prog = bpf_prog_get(attr->link_create.prog_fd);
> -	if (IS_ERR(prog))
> -		return PTR_ERR(prog);
> +	if (IS_ERR(prog)) {
> +		bpf_log(log, "Invalid prog_fd.\n");
> +		ret = PTR_ERR(prog);
> +		prog = NULL;
> +		goto out;
> +	}
>  
>  	ret = bpf_prog_attach_check_attach_type(prog,
>  						attr->link_create.attach_type);
> -	if (ret)
> +	if (ret) {
> +		bpf_log(log, "Invalid attach_type.\n");
>  		goto out;
> +	}
>  
>  	switch (prog->type) {
>  	case BPF_PROG_TYPE_CGROUP_SKB:
> @@ -5940,7 +5953,14 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
>  	}
>  
>  out:
> -	if (ret < 0)
> +	/* preserve original error even if log finalization is successful */
> +	err = bpf_log_attr_finalize(&attr_log, log);
> +	if (err)
> +		ret = err;
> +
> +	kfree(log);
> +
> +	if (ret < 0 && prog)
>  		bpf_prog_put(prog);
>  	return ret;
>  }

[Severity: Critical]
Can this underflow the refcount on prog and leak the newly installed link
file descriptor if bpf_log_attr_finalize() fails after link attachment
succeeds?

When one of the link attach helpers in switch (prog->type) succeeds, it
transfers ownership of the prog reference acquired by bpf_prog_get() to
link->prog and calls bpf_link_settle() (or bpf_link_new_fd()), which
installs the file descriptor via fd_install() and returns the non-negative
fd in ret.

At the out label, bpf_log_attr_finalize() is then called:

kernel/bpf/log.c:bpf_log_attr_finalize() {
	err = bpf_vlog_finalize(log, &log_true_size);

	if (attr->offsetof_true_size &&
	    copy_to_bpfptr_offset(attr->uattr, attr->offsetof_true_size, &log_true_size,
				  sizeof(log_true_size)))
		return -EFAULT;

	return err;
}

If uattr_common was passed with size_common large enough to include
log_true_size and resides in read-only memory (or is unmapped before
finalization), copy_to_bpfptr_offset() returns -EFAULT even when nothing
was logged.

In link_create(), ret is then overwritten with -EFAULT, causing
if (ret < 0 && prog) to call bpf_prog_put(prog) on the reference that is
now owned by the active bpf_link. When the installed link fd is later
closed, bpf_link_free() -> bpf_link_dealloc() will call
bpf_prog_put(link->prog) a second time:

kernel/bpf/syscall.c:bpf_link_dealloc() {
	if (link->prog)
		bpf_prog_put(link->prog);
	...
}

Should the ret < 0 check for bpf_prog_put(prog) happen before
ret is overwritten by err from bpf_log_attr_finalize(), or should log
finalization be handled before settling the link?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261017142649.51047-1-leon.hwang@linux.dev?part=1

[PATCH bpf-next 2/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

With the syscall common attrs support for link_create, add syscall common
attrs support for xdp link_create in order to report the invalid target
ifindex error and the underlying driver's error.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/linux/netdevice.h | 3 ++-
 kernel/bpf/syscall.c      | 2 +-
 net/core/dev.c            | 6 +++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3cff2174dc03..4548b0fd824d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4417,7 +4417,8 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
 				    struct netdev_queue *txq, int *ret);
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			struct bpf_verifier_log *log);
 u8 dev_xdp_prog_count(struct net_device *dev);
 int netif_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
 int dev_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 252b479937a4..e96d5f09486f 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5921,7 +5921,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
 		break;
 #ifdef CONFIG_NET
 	case BPF_PROG_TYPE_XDP:
-		ret = bpf_xdp_link_attach(attr, prog);
+		ret = bpf_xdp_link_attach(attr, prog, log);
 		break;
 	case BPF_PROG_TYPE_SCHED_CLS:
 		if (attr->link_create.attach_type == BPF_TCX_INGRESS ||
diff --git a/net/core/dev.c b/net/core/dev.c
index 18dc88990510..fdc1de21f358 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -97,6 +97,7 @@
 #include <linux/kthread.h>
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
+#include <linux/bpf_verifier.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/busy_poll.h>
@@ -10771,7 +10772,8 @@ static const struct bpf_link_ops bpf_xdp_link_lops = {
 	.update_prog = bpf_xdp_link_update,
 };
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			struct bpf_verifier_log *log)
 {
 	struct net *net = current->nsproxy->net_ns;
 	struct bpf_link_primer link_primer;
@@ -10784,6 +10786,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
 	if (!dev) {
 		rtnl_unlock();
+		bpf_log(log, "Invalid target_ifindex.\n");
 		return -EINVAL;
 	}
 
@@ -10812,6 +10815,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	if (err) {
 		link->dev = NULL;
 		bpf_link_cleanup(&link_primer);
+		bpf_log(log, extack._msg);
 		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
-- 
2.55.0

Re: [PATCH bpf-next 2/6] bpf: Add syscall common attrs support for xdp link_create

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] bpf: NULL deref and format string bug in bpf_xdp_link_attach() via bpf_log()
- [Critical] bpf: prog refcount underflow in link_create() if bpf_log_attr_finalize() fails
- [Low] bpf: link failure in bpf_xdp_link_attach() when !CONFIG_BPF_SYSCALL
--

commit fa16fd00d8499a718392032e57d440248e048afc
Author: Leon Hwang <leon.hwang@linux.dev>

bpf: Add syscall common attrs support for xdp link_create

This commit passes the verifier log to bpf_xdp_link_attach() so that XDP
link creation can report target_ifindex and driver errors through BPF
syscall common attributes.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 252b479937a4d..e96d5f09486f5 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -5921,7 +5921,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
>  		break;
>  #ifdef CONFIG_NET
>  	case BPF_PROG_TYPE_XDP:
> -		ret = bpf_xdp_link_attach(attr, prog);
> +		ret = bpf_xdp_link_attach(attr, prog, log);
>  		break;
>  	case BPF_PROG_TYPE_SCHED_CLS:
>  		if (attr->link_create.attach_type == BPF_TCX_INGRESS ||

[Severity: Critical]
Can the cleanup path in link_create() underflow prog's reference count if
bpf_log_attr_finalize() fails after bpf_xdp_link_attach() succeeds?

When bpf_xdp_link_attach() succeeds, bpf_link_init() transfers ownership of
prog's reference to link->link.prog and bpf_link_settle() installs the link
file descriptor, returning a non-negative fd in ret.

At the out label in link_create(), bpf_log_attr_finalize() writes
log_true_size to uattr_common even when nothing was logged:

kernel/bpf/log.c:bpf_log_attr_finalize() {
	...
	if (attr->offsetof_true_size &&
	    copy_to_bpfptr_offset(attr->uattr, attr->offsetof_true_size, &log_true_size,
				  sizeof(log_true_size)))
		return -EFAULT;
}

If uattr_common points to read-only memory, copy_from_bpfptr() in
__sys_bpf() succeeds, bpf_xdp_link_attach() attaches and settles the link,
and then bpf_log_attr_finalize() returns -EFAULT:

kernel/bpf/syscall.c:link_create() {
out:
	/* preserve original error even if log finalization is successful */
	err = bpf_log_attr_finalize(&attr_log, log);
	if (err)
		ret = err;

	kfree(log);

	if (ret < 0 && prog)
		bpf_prog_put(prog);
	return ret;
}

Overwriting ret with err causes link_create() to call bpf_prog_put(prog) on
a reference that is now owned by the settled bpf_link, leading to a
use-after-free of struct bpf_prog while the link remains attached in the
process fd table.

> diff --git a/net/core/dev.c b/net/core/dev.c
> index 18dc88990510a..fdc1de21f3589 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
[ ... ]
> @@ -10771,7 +10772,8 @@ static const struct bpf_link_ops bpf_xdp_link_lops = {
>  	.update_prog = bpf_xdp_link_update,
>  };
>  
> -int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
> +int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
> +			struct bpf_verifier_log *log)
>  {
>  	struct net *net = current->nsproxy->net_ns;
>  	struct bpf_link_primer link_primer;
> @@ -10784,6 +10786,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
>  	if (!dev) {
>  		rtnl_unlock();
> +		bpf_log(log, "Invalid target_ifindex.\n");
>  		return -EINVAL;
>  	}

[Severity: Low]
Will calling bpf_log() in bpf_xdp_link_attach() break linking when
CONFIG_NET=y and CONFIG_BPF_SYSCALL=n?

net/core/dev.c is compiled whenever CONFIG_NET=y, and bpf_xdp_link_attach()
is not guarded by CONFIG_BPF_SYSCALL. While helpers like bpf_link_init() and
bpf_link_prime() have static inline stubs in include/linux/bpf.h when
!CONFIG_BPF_SYSCALL, bpf_log() is only compiled via kernel/bpf/log.o when
CONFIG_BPF_SYSCALL=y and has no stub in include/linux/bpf_verifier.h.

>  
> @@ -10812,6 +10815,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	if (err) {
>  		link->dev = NULL;
>  		bpf_link_cleanup(&link_primer);
> +		bpf_log(log, extack._msg);
>  		trace_bpf_xdp_link_attach_failed(extack._msg);
>  		goto out_put_dev;
>  	}

[Severity: Critical]
What happens here when dev_xdp_attach_link() fails without setting an extack
message, or when extack._msg contains format specifiers?

In bpf_xdp_link_attach(), extack is zero-initialized on the stack, so
extack._msg starts as NULL. Many failure paths under dev_xdp_attach_link() ->
dev_xdp_attach() -> dev_xdp_install() return an error without calling
NL_SET_ERR_MSG(), such as netif_xdp_propagate() when a device has no ndo_bpf
callback, or driver ndo_bpf callbacks like netkit_xdp() and veth_xdp()
returning -EOPNOTSUPP or -EINVAL.

When a user provides a log buffer via syscall common attributes and
extack._msg is NULL, bpf_log() passes fmt = NULL into
bpf_verifier_vlog() -> vscnprintf() -> vsnprintf(), which dereferences fmt
unconditionally and crashes the kernel.

Additionally, because bpf_log() is a printf-style function, passing
extack._msg directly as the format string rather than using a "%s\n" format
specifier allows any '%' characters in a formatted extack message (for
example from NL_SET_ERR_MSG_FMT() containing an interface name) to be
interpreted as format specifiers by vscnprintf(), and omits the trailing
newline. Should this be guarded with if (extack._msg) and logged with
bpf_log(log, "%s\n", extack._msg)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261017142649.51047-1-leon.hwang@linux.dev?part=2

Re: [PATCH bpf-next 2/6] bpf: Add syscall common attrs support for xdp link_create

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3827 bytes --]

> bpf: Add syscall common attrs support for xdp link_create

TL;DR:
- bpf_log(log, extack._msg) in bpf_xdp_link_attach() may dereference NULL when
  no extack message is set
- bpf_log() may be an undefined reference when CONFIG_BPF_SYSCALL=n

> diff --git a/net/core/dev.c b/net/core/dev.c
> index 18dc88990510..fdc1de21f358 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c

[ ... ]

> @@ -10784,6 +10786,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
>  	if (!dev) {
>  		rtnl_unlock();
> +		bpf_log(log, "Invalid target_ifindex.\n");
>  		return -EINVAL;
>  	}
>

Can this fail to link when CONFIG_BPF_SYSCALL is not set?

bpf_xdp_link_attach() is built whenever CONFIG_NET=y, but bpf_log() lives in
kernel/bpf/log.c, which kernel/bpf/Makefile only builds under
CONFIG_BPF_SYSCALL:

  obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o ... log.o ...

include/linux/bpf_verifier.h declares bpf_log() with no stub for the
!CONFIG_BPF_SYSCALL case, and CONFIG_NET only does "select BPF".  A config
with CONFIG_NET=y and CONFIG_BPF_SYSCALL=n looks like it would end with an
undefined reference to bpf_log from both of the new calls in this function.

include/linux/bpf.h provides static inline stubs for bpf_link_init(),
bpf_link_prime(), bpf_link_settle() and bpf_link_cleanup() so that this
function builds without the bpf() syscall.

Should bpf_log() get a similar stub, or should the calls be guarded with
IS_ENABLED(CONFIG_BPF_SYSCALL)?  None of the later patches in the series add
a stub or change the Makefile.

[ ... ]

> @@ -10812,6 +10815,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	if (err) {
>  		link->dev = NULL;
>  		bpf_link_cleanup(&link_primer);
> +		bpf_log(log, extack._msg);
>  		trace_bpf_xdp_link_attach_failed(extack._msg);
>  		goto out_put_dev;
>  	}

Can extack._msg be NULL here?

extack is zero-initialised (struct netlink_ext_ack extack = {};), and _msg
stays NULL whenever dev_xdp_attach_link() fails without anyone calling
NL_SET_ERR_MSG().  Many ndo_bpf implementations do exactly that.  For
example, ixgbe_xdp() -> ixgbe_xdp_setup() has several -EINVAL and -ENOMEM
returns that don't set an extack message, and mlx5e_xdp_set() ->
mlx5e_xdp_allowed() returns -EINVAL with only a netdev_warn().

If the caller passed BPF_COMMON_ATTRS with log_level != 0
(bpf_verifier_log_attr_valid() accepts log_level=1 even with a NULL log_buf
and a log_size of 0), bpf_verifier_log_needed() is true and the call chain
becomes:

  bpf_log(log, NULL)
    -> bpf_verifier_vlog(log, NULL, args)
      -> vscnprintf(log->kbuf, BPF_VERIFIER_TMP_LOG_SIZE, NULL, args)
        -> vsnprintf()    /* while (*fmt.str) with fmt.str == NULL */

which dereferences NULL.  The tracepoint on the next line copes with NULL
because __assign_str() substitutes a placeholder string, and the netlink ack
path also checks extack->_msg, so this new bpf_log() call looks like the only
consumer without a NULL check.

Passing the message as the format string also means a '%' in an extack
message would be interpreted as a conversion, and unlike the other bpf_log()
messages in link_create(), this one has no trailing newline.  Would
something like this be better?

  if (extack._msg)
          bpf_log(log, "%s\n", extack._msg);

This isn't fixed later in the series.  Commit 2a63a314e533 ("bpf: Retire
tracepoint bpf_xdp_link_attach_failed") removes the tracepoint but keeps
bpf_log(log, extack._msg), so no NULL-safe consumer is left on this path.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

[PATCH bpf-next 3/6] bpf: Retire tracepoint bpf_xdp_link_attach_failed

[Leon Hwang]

In the previous patch, it has a proper way to back-propagate the
underlying driver error message to user space via the BPF syscall common
attributes.

The tracepoint bpf_xdp_link_attach_failed seems redundant to report the
error message. And, the tracepoint doesn't report the ifindex alongside
the error message [1].

So, retire the tracepoint bpf_xdp_link_attach_failed and its selftest.

According to the tracepoint change discussion [2], please revert this
patch if users complain about the disappeared tracepoint
bpf_xdp_link_attach_failed in the future.

Links:
[1] https://lore.kernel.org/bpf/CAFk-A4mE9Jweo2hfX7y_85xbPyt0FqpMT1EvqX1OcYZ=LTLgRA@mail.gmail.com/
[2] https://lore.kernel.org/linux-mm/CY8PR11MB7134346A3E4BB28ECA28D6E989132@CY8PR11MB7134.namprd11.prod.outlook.com/

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/trace/events/xdp.h                    | 17 -----
 net/core/dev.c                                |  1 -
 .../selftests/bpf/prog_tests/xdp_attach.c     | 65 -------------------
 .../bpf/progs/test_xdp_attach_fail.c          | 54 ---------------
 4 files changed, 137 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
index 18c0ac514fcb..f1d4d0702884 100644
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -362,23 +362,6 @@ TRACE_EVENT(mem_connect,
 	)
 );
 
-TRACE_EVENT(bpf_xdp_link_attach_failed,
-
-	TP_PROTO(const char *msg),
-
-	TP_ARGS(msg),
-
-	TP_STRUCT__entry(
-		__string(msg, msg)
-	),
-
-	TP_fast_assign(
-		__assign_str(msg);
-	),
-
-	TP_printk("errmsg=%s", __get_str(msg))
-);
-
 #endif /* _TRACE_XDP_H */
 
 #include <trace/define_trace.h>
diff --git a/net/core/dev.c b/net/core/dev.c
index fdc1de21f358..266b510abd53 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10816,7 +10816,6 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
 		link->dev = NULL;
 		bpf_link_cleanup(&link_primer);
 		bpf_log(log, extack._msg);
-		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
 
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
index e6bcb6051402..fa3cac5488f5 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <test_progs.h>
-#include "test_xdp_attach_fail.skel.h"
 
 #define IFINDEX_LO 1
 #define XDP_FLAGS_REPLACE		(1U << 4)
@@ -86,74 +85,10 @@ static void test_xdp_attach(const char *file)
 	bpf_object__close(obj1);
 }
 
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-static void on_xdp_errmsg(void *ctx, int cpu, void *data, __u32 size)
-{
-	struct xdp_errmsg *ctx_errmg = ctx, *tp_errmsg = data;
-
-	memcpy(&ctx_errmg->msg, &tp_errmsg->msg, ERRMSG_LEN);
-}
-
-static const char tgt_errmsg[] = "Invalid XDP flags for BPF link attachment";
-
-static void test_xdp_attach_fail(const char *file)
-{
-	struct test_xdp_attach_fail *skel = NULL;
-	struct xdp_errmsg errmsg = {};
-	struct perf_buffer *pb = NULL;
-	struct bpf_object *obj = NULL;
-	int err, fd_xdp;
-
-	LIBBPF_OPTS(bpf_link_create_opts, opts);
-
-	skel = test_xdp_attach_fail__open_and_load();
-	if (!ASSERT_OK_PTR(skel, "test_xdp_attach_fail__open_and_load"))
-		goto out_close;
-
-	err = test_xdp_attach_fail__attach(skel);
-	if (!ASSERT_EQ(err, 0, "test_xdp_attach_fail__attach"))
-		goto out_close;
-
-	/* set up perf buffer */
-	pb = perf_buffer__new(bpf_map__fd(skel->maps.xdp_errmsg_pb), 1,
-			      on_xdp_errmsg, NULL, &errmsg, NULL);
-	if (!ASSERT_OK_PTR(pb, "perf_buffer__new"))
-		goto out_close;
-
-	err = bpf_prog_test_load(file, BPF_PROG_TYPE_XDP, &obj, &fd_xdp);
-	if (!ASSERT_EQ(err, 0, "bpf_prog_test_load"))
-		goto out_close;
-
-	opts.flags = 0xFF; // invalid flags to fail to attach XDP prog
-	err = bpf_link_create(fd_xdp, IFINDEX_LO, BPF_XDP, &opts);
-	if (!ASSERT_EQ(err, -EINVAL, "bpf_link_create"))
-		goto out_close;
-
-	/* read perf buffer */
-	err = perf_buffer__poll(pb, 100);
-	if (!ASSERT_GT(err, -1, "perf_buffer__poll"))
-		goto out_close;
-
-	ASSERT_STRNEQ((const char *) errmsg.msg, tgt_errmsg,
-		      42 /* strlen(tgt_errmsg) */, "check error message");
-
-out_close:
-	perf_buffer__free(pb);
-	bpf_object__close(obj);
-	test_xdp_attach_fail__destroy(skel);
-}
-
 void serial_test_xdp_attach(void)
 {
 	if (test__start_subtest("xdp_attach"))
 		test_xdp_attach("./test_xdp.bpf.o");
 	if (test__start_subtest("xdp_attach_dynptr"))
 		test_xdp_attach("./test_xdp_dynptr.bpf.o");
-	if (test__start_subtest("xdp_attach_failed"))
-		test_xdp_attach_fail("./xdp_dummy.bpf.o");
 }
diff --git a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c b/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
deleted file mode 100644
index 2ff1b596e87e..000000000000
--- a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
+++ /dev/null
@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright Leon Hwang */
-
-#include <linux/bpf.h>
-#include <bpf/bpf_helpers.h>
-
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-struct {
-	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__type(key, int);
-	__type(value, int);
-} xdp_errmsg_pb SEC(".maps");
-
-struct xdp_attach_error_ctx {
-	unsigned long unused;
-
-	/*
-	 * bpf does not support tracepoint __data_loc directly.
-	 *
-	 * Actually, this field is a 32 bit integer whose value encodes
-	 * information on where to find the actual data. The first 2 bytes is
-	 * the size of the data. The last 2 bytes is the offset from the start
-	 * of the tracepoint struct where the data begins.
-	 * -- https://github.com/iovisor/bpftrace/pull/1542
-	 */
-	__u32 msg; // __data_loc char[] msg;
-};
-
-/*
- * Catch the error message at the tracepoint.
- */
-
-SEC("tp/xdp/bpf_xdp_link_attach_failed")
-int tp__xdp__bpf_xdp_link_attach_failed(struct xdp_attach_error_ctx *ctx)
-{
-	char *msg = (void *)(__u64) ((void *) ctx + (__u16) ctx->msg);
-	struct xdp_errmsg errmsg = {};
-
-	bpf_probe_read_kernel_str(&errmsg.msg, ERRMSG_LEN, msg);
-	bpf_perf_event_output(ctx, &xdp_errmsg_pb, BPF_F_CURRENT_CPU, &errmsg,
-			      ERRMSG_LEN);
-	return 0;
-}
-
-/*
- * Reuse the XDP program in xdp_dummy.c.
- */
-
-char LICENSE[] SEC("license") = "GPL";
-- 
2.55.0

[PATCH bpf-next 4/6] libbpf: Factor out __bpf_sys_fd helper

[Leon Hwang]

In the next patch, it also needs to use the extended BPF syscall to
receive the reported log.

So, factor out __bpf_sys_fd helper.

No functional changes intended.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index b49822d212ae..17e73e443bc7 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -203,6 +203,27 @@ int bump_rlimit_memlock(void)
 	return 0;
 }
 
+static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
+			struct bpf_log_opts *log_opts)
+{
+	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
+	struct bpf_common_attr attr_common;
+	int fd;
+
+	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
+		memset(&attr_common, 0, attr_common_sz);
+		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
+		attr_common.log_size = OPTS_GET(log_opts, size, 0);
+		attr_common.log_level = OPTS_GET(log_opts, level, 0);
+		fd = sys_bpf_ext_fd(cmd, attr, attr_sz, &attr_common, attr_common_sz);
+		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
+	} else {
+		fd = sys_bpf_fd(cmd, attr, attr_sz);
+		OPTS_SET(log_opts, true_size, 0);
+	}
+	return fd;
+}
+
 int bpf_map_create(enum bpf_map_type map_type,
 		   const char *map_name,
 		   __u32 key_size,
@@ -211,8 +232,6 @@ int bpf_map_create(enum bpf_map_type map_type,
 		   const struct bpf_map_create_opts *opts)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, excl_prog_hash_size);
-	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
-	struct bpf_common_attr attr_common;
 	struct bpf_log_opts *log_opts;
 	union bpf_attr attr;
 	int fd;
@@ -251,17 +270,7 @@ int bpf_map_create(enum bpf_map_type map_type,
 	if (!OPTS_VALID(log_opts, bpf_log_opts))
 		return libbpf_err(-EINVAL);
 
-	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
-		memset(&attr_common, 0, attr_common_sz);
-		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
-		attr_common.log_size = OPTS_GET(log_opts, size, 0);
-		attr_common.log_level = OPTS_GET(log_opts, level, 0);
-		fd = sys_bpf_ext_fd(BPF_MAP_CREATE, &attr, attr_sz, &attr_common, attr_common_sz);
-		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
-	} else {
-		fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
-		OPTS_SET(log_opts, true_size, 0);
-	}
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);
 	return libbpf_err_errno(fd);
 }
 
-- 
2.55.0

Re: [PATCH bpf-next 4/6] libbpf: Factor out __bpf_sys_fd helper

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

> libbpf: Factor out __bpf_sys_fd helper

TL;DR: Commit message nit only: subject and body call the new helper
__bpf_sys_fd, but the code names it __sys_bpf_fd. Should the message match?

> libbpf: Factor out __bpf_sys_fd helper
>
> In the next patch, it also needs to use the extended BPF syscall to
> receive the reported log.
>
> So, factor out __bpf_sys_fd helper.
>
> No functional changes intended.
>
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>

This isn't a bug, but the subject and body name the helper __bpf_sys_fd,
while the function the patch adds is:

+static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
+			struct bpf_log_opts *log_opts)

which follows the existing sys_bpf(), sys_bpf_fd() and sys_bpf_ext_fd()
naming.

Should the subject and body say __sys_bpf_fd instead, so that searching the
log for the real function name finds this commit?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

[PATCH bpf-next 5/6] libbpf: Add bpf_link_create_log API

[Leon Hwang]

Add a new API to accept the log opts, instead of extending the existing
struct bpf_link_create_opts.

In the struct bpf_link_create_opts, it seems not proper to append a
tailing common log field prior to those variant length fields.

Add a new API to avoid breaking the struct bpf_link_create_opts.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c      | 24 ++++++++++++++++++++----
 tools/lib/bpf/bpf.h      |  5 +++++
 tools/lib/bpf/libbpf.map |  1 +
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 17e73e443bc7..eb127d71f3c8 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -788,9 +788,10 @@ int bpf_prog_detach2(int prog_fd, int target_fd, enum bpf_attach_type type)
 	return bpf_prog_detach_opts(prog_fd, target_fd, type, NULL);
 }
 
-int bpf_link_create(int prog_fd, int target_fd,
-		    enum bpf_attach_type attach_type,
-		    const struct bpf_link_create_opts *opts)
+static int __bpf_link_create(int prog_fd, int target_fd,
+			     enum bpf_attach_type attach_type,
+			     const struct bpf_link_create_opts *opts,
+			     struct bpf_log_opts *log_opts)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, link_create);
 	__u32 target_btf_id, iter_info_len, relative_id;
@@ -965,7 +966,7 @@ int bpf_link_create(int prog_fd, int target_fd,
 		break;
 	}
 proceed:
-	fd = sys_bpf_fd(BPF_LINK_CREATE, &attr, attr_sz);
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_LINK_CREATE, log_opts);
 	if (fd >= 0)
 		return fd;
 	/* we'll get EINVAL if LINK_CREATE doesn't support attaching fentry
@@ -999,6 +1000,21 @@ int bpf_link_create(int prog_fd, int target_fd,
 	}
 }
 
+int bpf_link_create(int prog_fd, int target_fd,
+		    enum bpf_attach_type attach_type,
+		    const struct bpf_link_create_opts *opts)
+{
+	return __bpf_link_create(prog_fd, target_fd, attach_type, opts, NULL);
+}
+
+int bpf_link_create_log(int prog_fd, int target_fd,
+			enum bpf_attach_type attach_type,
+			const struct bpf_link_create_opts *opts,
+			struct bpf_log_opts *log_opts)
+{
+	return __bpf_link_create(prog_fd, target_fd, attach_type, opts, log_opts);
+}
+
 int bpf_link_detach(int link_fd)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, link_detach);
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 826d9cc9ab65..dedaf8086902 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -484,6 +484,11 @@ LIBBPF_API int bpf_link_create(int prog_fd, int target_fd,
 			       enum bpf_attach_type attach_type,
 			       const struct bpf_link_create_opts *opts);
 
+LIBBPF_API int bpf_link_create_log(int prog_fd, int target_fd,
+				   enum bpf_attach_type attach_type,
+				   const struct bpf_link_create_opts *opts,
+				   struct bpf_log_opts *log_opts);
+
 LIBBPF_API int bpf_link_detach(int link_fd);
 
 struct bpf_link_update_opts {
diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
index eeba4072a5da..990e2f926ecc 100644
--- a/tools/lib/bpf/libbpf.map
+++ b/tools/lib/bpf/libbpf.map
@@ -458,6 +458,7 @@ LIBBPF_1.7.0 {
 
 LIBBPF_1.8.0 {
 	global:
+		bpf_link_create_log;
 		bpf_map__attach_cgroup_opts;
 		bpf_prog_stream_open;
 		bpf_program__add_flags;
-- 
2.55.0

Re: [PATCH bpf-next 5/6] libbpf: Add bpf_link_create_log API

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] libbpf: missing OPTS_VALID() check for log_opts in __bpf_link_create()
- [Medium] libbpf: bpf_link_create_log added to released LIBBPF_1.8.0 in libbpf.map
--

commit 5adb04f5088a9ab6aa21d83e4c9370c13ebdaab6
Author: Leon Hwang <leon.hwang@linux.dev>

libbpf: Add bpf_link_create_log API

This commit introduces the bpf_link_create_log() API to pass struct
bpf_log_opts when creating BPF links without modifying struct
bpf_link_create_opts.

> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index 17e73e443bc7a..eb127d71f3c83 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c
> @@ -788,9 +788,10 @@ int bpf_prog_detach2(int prog_fd, int target_fd, enum bpf_attach_type type)
>  	return bpf_prog_detach_opts(prog_fd, target_fd, type, NULL);
>  }
>  
> -int bpf_link_create(int prog_fd, int target_fd,
> -		    enum bpf_attach_type attach_type,
> -		    const struct bpf_link_create_opts *opts)
> +static int __bpf_link_create(int prog_fd, int target_fd,
> +			     enum bpf_attach_type attach_type,
> +			     const struct bpf_link_create_opts *opts,
> +			     struct bpf_log_opts *log_opts)
>  {
>  	const size_t attr_sz = offsetofend(union bpf_attr, link_create);
>  	__u32 target_btf_id, iter_info_len, relative_id;
> @@ -965,7 +966,7 @@ int bpf_link_create(int prog_fd, int target_fd,
>  		break;
>  	}
>  proceed:
> -	fd = sys_bpf_fd(BPF_LINK_CREATE, &attr, attr_sz);
> +	fd = __sys_bpf_fd(&attr, attr_sz, BPF_LINK_CREATE, log_opts);

[Severity: Medium]
Should __bpf_link_create() validate log_opts with OPTS_VALID(log_opts,
bpf_log_opts) before passing it to __sys_bpf_fd()?

Currently __bpf_link_create() validates opts, but not log_opts:

tools/lib/bpf/bpf.c:__bpf_link_create() {
	if (!OPTS_VALID(opts, bpf_link_create_opts))
		return libbpf_err(-EINVAL);
}

When a caller passes a malformed struct bpf_log_opts (such as an invalid sz
or non-zero unknown trailing fields) to bpf_link_create_log(),
__bpf_link_create() forwards it directly to __sys_bpf_fd(), which accesses
log_opts via OPTS_GET() and OPTS_SET() without checking OPTS_VALID().

For comparison, bpf_map_create() validates log_opts before calling
__sys_bpf_fd():

tools/lib/bpf/bpf.c:bpf_map_create() {
	log_opts = OPTS_GET(opts, log_opts, NULL);
	if (!OPTS_VALID(log_opts, bpf_log_opts))
		return libbpf_err(-EINVAL);

	fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);
}

[ ... ]

> diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
> index eeba4072a5dac..990e2f926ecc3 100644
> --- a/tools/lib/bpf/libbpf.map
> +++ b/tools/lib/bpf/libbpf.map
> @@ -458,6 +458,7 @@ LIBBPF_1.7.0 {
>  
>  LIBBPF_1.8.0 {
>  	global:
> +		bpf_link_create_log;
>  		bpf_map__attach_cgroup_opts;
>  		bpf_prog_stream_open;
>  		bpf_program__add_flags;

[Severity: Medium]
Should bpf_link_create_log be placed under the LIBBPF_1.9.0 stanza in
tools/lib/bpf/libbpf.map instead of LIBBPF_1.8.0?

LIBBPF_1.8.0 is already succeeded by LIBBPF_1.9.0 at the bottom of
tools/lib/bpf/libbpf.map:

LIBBPF_1.9.0 {
} LIBBPF_1.8.0;

Adding bpf_link_create_log to LIBBPF_1.8.0 exports the new symbol under the
previous version node rather than the current LIBBPF_1.9.0 development cycle.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261017142649.51047-1-leon.hwang@linux.dev?part=5

Re: [PATCH bpf-next 5/6] libbpf: Add bpf_link_create_log API

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1305 bytes --]

> libbpf: Add bpf_link_create_log API

TL;DR: Commit message only: the rationale for adding bpf_link_create_log()
instead of extending bpf_link_create_opts is vague ("it seems not proper") and
one sentence is self-contradictory; no code issues raised.

> libbpf: Add bpf_link_create_log API
>
> Add a new API to accept the log opts, instead of extending the existing
> struct bpf_link_create_opts.
>
> In the struct bpf_link_create_opts, it seems not proper to append a
> tailing common log field prior to those variant length fields.
>
> Add a new API to avoid breaking the struct bpf_link_create_opts.
>
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>

This isn't a bug, but could the changelog say more concretely why a log
field cannot be added to struct bpf_link_create_opts (for example, the
trailing union growing for future link types), rather than "it seems not
proper"?

The sentence "append a tailing common log field prior to those variant
length fields" also reads as self-contradictory, since "append" and "prior
to" point in opposite directions.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

[PATCH bpf-next 6/6] selftests/bpf: Add tests to verify link_create logs

[Leon Hwang]

Add tests to verify the new logs in link_create and xdp link_create,
including a log reported via extack when fail to create an xdp link.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 .../selftests/bpf/prog_tests/xdp_link.c       | 132 ++++++++++++++++++
 1 file changed, 132 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_link.c b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
index e7e9f3c22edf..e2b2ec3cc4e3 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_link.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
@@ -150,3 +150,135 @@ void serial_test_xdp_link(void)
 	test_xdp_link__destroy(skel1);
 	test_xdp_link__destroy(skel2);
 }
+
+static void test_link_create_invalid_prog_fd(void)
+{
+	const char *msg = "Invalid prog_fd.\n";
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	fd = bpf_link_create_log(-1, IFINDEX_LO, BPF_XDP, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		return;
+	}
+
+	ASSERT_EQ(fd, -EBADF, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+}
+
+static void test_link_create_invalid_attach_type(void)
+{
+	const char *msg = "Invalid attach_type.\n";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	log_opts.true_size = 0;
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
+				 BPF_CGROUP_INET_INGRESS, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+static void test_link_create_xdp_invalid_target_ifindex(void)
+{
+	const char *msg = "Invalid target_ifindex.\n";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	/* Interface indices are positive; zero cannot identify a device. */
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), 0,
+				 BPF_XDP, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+static void test_link_create_xdp_extack(void)
+{
+	const char *msg = "Invalid XDP flags for BPF link attachment";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_link_create_opts, opts,
+		    .flags = XDP_FLAGS_REPLACE,
+	);
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
+				 BPF_XDP, &opts, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+void test_link_create_log(void)
+{
+	if (test__start_subtest("invalid_prog_fd"))
+		test_link_create_invalid_prog_fd();
+	if (test__start_subtest("invalid_attach_type"))
+		test_link_create_invalid_attach_type();
+	if (test__start_subtest("xdp/invalid_target_ifindex"))
+		test_link_create_xdp_invalid_target_ifindex();
+	if (test__start_subtest("xdp/extack"))
+		test_link_create_xdp_extack();
+}
-- 
2.55.0

Re: [PATCH bpf-next 6/6] selftests/bpf: Add tests to verify link_create logs

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2811 bytes --]

> selftests/bpf: Add tests to verify link_create logs

TL;DR: Nits only, in the new link_create log selftests in xdp_link.c: the four
subtests repeat the same setup and assertions and could share a helper, and
one has a redundant true_size = 0.

> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_link.c b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_link.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_link.c

[ ... ]

> @@ -150,3 +150,135 @@ void serial_test_xdp_link(void)
>  	test_xdp_link__destroy(skel1);
>  	test_xdp_link__destroy(skel2);
>  }
> +
> +static void test_link_create_invalid_prog_fd(void)
> +{
> +	const char *msg = "Invalid prog_fd.\n";
> +	char log_buf[128] = {};
> +	int fd;
> +	LIBBPF_OPTS(bpf_log_opts, log_opts,
> +		    .buf = log_buf,
> +		    .size = sizeof(log_buf),
> +		    .level = 1,
> +	);
> +
> +	fd = bpf_link_create_log(-1, IFINDEX_LO, BPF_XDP, NULL, &log_opts);
> +	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
> +		close(fd);
> +		return;
> +	}
> +
> +	ASSERT_EQ(fd, -EBADF, "fd");
> +	ASSERT_STREQ(log_buf, msg, "log_buf");
> +	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
> +}

This isn't a bug, but the four new test_link_create_*() functions repeat the
same log_buf and LIBBPF_OPTS(bpf_log_opts, ...) setup, and the same trailing
ASSERT_EQ(fd, ...) / ASSERT_STREQ(log_buf, msg) /
ASSERT_EQ(log_opts.true_size, strlen(msg) + 1) sequence.  They differ only in
prog fd, target, attach type, expected errno and message.

This looks close to test_map_create() in map_init.c.  Could the four
link_create log tests share a small helper that takes the prog fd, target,
attach type, opts, expected errno and message?

> +
> +static void test_link_create_invalid_attach_type(void)
> +{
> +	const char *msg = "Invalid attach_type.\n";
> +	struct test_xdp_link *skel;
> +	char log_buf[128] = {};
> +	int fd;
> +	LIBBPF_OPTS(bpf_log_opts, log_opts,
> +		    .buf = log_buf,
> +		    .size = sizeof(log_buf),
> +		    .level = 1,
> +	);
> +
> +	skel = test_xdp_link__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
> +		return;
> +
> +	log_opts.true_size = 0;

This isn't a bug, but is the log_opts.true_size = 0; line needed here?
LIBBPF_OPTS() already zero-initializes log_opts, true_size is only written by
libbpf after the syscall, and the other three tests omit this line.

> +	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
> +				 BPF_CGROUP_INET_INGRESS, NULL, &log_opts);

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581