[PATCH bpf-next 0/2] selftests/bpf: fix for veristat file/prog filters processing

[PATCH bpf-next 0/2] selftests/bpf: fix for veristat file/prog filters processing

[Eduard Zingerman]

At the moment veristat filtering behaves unexpectedly for the
following filter expression:

  -f !file/prog

The expression rejects all programs with name 'prog', and all programs
in a file with name 'file'. Fix the expression to exclude only a
program 'prog' from a file 'file', also add a set of tests to exercise
filtering logic.

---
Eduard Zingerman (2):
      selftests/bpf: fix for veristat file/prog filters processing
      selftests/bpf: exercise veristat filtering logic in a selftest

 .../selftests/bpf/prog_tests/test_veristat.c       | 98 ++++++++++++++++++++++
 tools/testing/selftests/bpf/progs/veristat_bar.c   |  3 +
 tools/testing/selftests/bpf/progs/veristat_foo.c   | 31 +++++++
 tools/testing/selftests/bpf/veristat.c             | 76 +++++++++++------
 4 files changed, 181 insertions(+), 27 deletions(-)
---
base-commit: d114bb98936770c501c958bf2bc5fb6b7c0bad7b
change-id: 20260811-veristat-filter-fix-920cff2a288a

[PATCH bpf-next 1/2] selftests/bpf: fix for veristat file/prog filters processing

[Eduard Zingerman]

At the moment veristat filtering behaves unexpectedly for the
following filter expression:

  -f !file/prog

The expression rejects all programs with name 'prog', and all programs
in a file with name 'file'. This commit fixes the expression to
exclude only a program 'prog' from a file 'file'. Additionally,
the commit makes empty filters like '-f ""' or '-f "/"' and error.
Here is the filtering behaviour compared old versus new:

| filter   | file | prog | old verdict | new verdict |
|----------+------+------+-------------+-------------|
| !foo     | foo  | bar  | skipped     | skipped     |
| !foo     | bar  | foo  | skipped     | skipped     |
| !foo/bar | foo  | bar  | skipped     | skipped     |
| !foo/bar | foo  | buz  | skipped     | processed   | (!)
| !foo/bar | bar  | bar  | skipped     | processed   | (!)
| !foo/    | foo  | bar  | skipped     | skipped     |
| !foo/    | bar  | bar  | processed   | processed   |
| !/bar    | foo  | bar  | skipped     | skipped     |
| !/bar    | foo  | foo  | processed   | processed   |
| !/       | foo  | bar  | processed   | error       | (!)
| !        | foo  | bar  | processed   | error       | (!)
|----------+------+------+-------------+-------------|
| foo      | foo  | bar  | processed   | processed   |
| foo      | bar  | foo  | processed   | processed   |
| foo/bar  | foo  | bar  | processed   | processed   |
| foo/bar  | foo  | buz  | skipped     | skipped     |
| foo/bar  | bar  | bar  | skipped     | skipped     |
| foo/     | foo  | bar  | processed   | processed   |
| foo/     | bar  | bar  | skipped     | skipped     |
| /bar     | foo  | bar  | processed   | processed   |
| /bar     | foo  | foo  | skipped     | skipped     |
| /        | foo  | bar  | processed   | error       | (!)
|          | foo  | bar  | skipped     | error       | (!)

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 tools/testing/selftests/bpf/veristat.c | 76 ++++++++++++++++++++++------------
 1 file changed, 49 insertions(+), 27 deletions(-)

diff --git a/tools/testing/selftests/bpf/veristat.c b/tools/testing/selftests/bpf/veristat.c
index c9c257784ee3..6aaa06790daa 100644
--- a/tools/testing/selftests/bpf/veristat.c
+++ b/tools/testing/selftests/bpf/veristat.c
@@ -514,6 +514,40 @@ static bool is_bpf_obj_file(const char *path) {
 	return err == 0;
 }
 
+/* Exact filter match */
+static bool name_filter_matches(struct filter *f, const char *filename, const char *prog_name)
+{
+	if (f->any_glob)
+		return glob_matches(filename, f->any_glob) ||
+		       (prog_name && glob_matches(prog_name, f->any_glob));
+	if (f->file_glob && f->prog_glob)
+		return prog_name &&
+		       glob_matches(filename, f->file_glob) &&
+		       glob_matches(prog_name, f->prog_glob);
+	if (f->file_glob)
+		return glob_matches(filename, f->file_glob);
+	if (f->prog_glob)
+		return prog_name && glob_matches(prog_name, f->prog_glob);
+	return false;
+}
+
+/* Check if the filter does not outright reject the file name */
+static bool name_filter_may_match(struct filter *f, const char *filename)
+{
+	if (f->file_glob)
+		return glob_matches(filename, f->file_glob);
+	/*
+	 * If we don't know program name yet, any_glob filter
+	 * has to assume that current BPF object file might be
+	 * relevant; we'll check again later on after opening
+	 * BPF object file, at which point program name will
+	 * be known finally.
+	 */
+	if (f->any_glob || f->prog_glob)
+		return true;
+	return false;
+}
+
 static bool should_process_file_prog(const char *filename, const char *prog_name)
 {
 	struct filter *f;
@@ -521,16 +555,7 @@ static bool should_process_file_prog(const char *filename, const char *prog_name
 
 	for (i = 0; i < env.deny_filter_cnt; i++) {
 		f = &env.deny_filters[i];
-		if (f->kind != FILTER_NAME)
-			continue;
-
-		if (f->any_glob && glob_matches(filename, f->any_glob))
-			return false;
-		if (f->any_glob && prog_name && glob_matches(prog_name, f->any_glob))
-			return false;
-		if (f->file_glob && glob_matches(filename, f->file_glob))
-			return false;
-		if (f->prog_glob && prog_name && glob_matches(prog_name, f->prog_glob))
+		if (f->kind == FILTER_NAME && name_filter_matches(f, filename, prog_name))
 			return false;
 	}
 
@@ -540,24 +565,15 @@ static bool should_process_file_prog(const char *filename, const char *prog_name
 			continue;
 
 		allow_cnt++;
-		if (f->any_glob) {
-			if (glob_matches(filename, f->any_glob))
-				return true;
-			/* If we don't know program name yet, any_glob filter
-			 * has to assume that current BPF object file might be
-			 * relevant; we'll check again later on after opening
-			 * BPF object file, at which point program name will
-			 * be known finally.
-			 */
-			if (!prog_name || glob_matches(prog_name, f->any_glob))
-				return true;
-		} else {
-			if (f->file_glob && !glob_matches(filename, f->file_glob))
-				continue;
-			if (f->prog_glob && prog_name && !glob_matches(prog_name, f->prog_glob))
-				continue;
+		if (prog_name && name_filter_matches(f, filename, prog_name))
+			return true;
+		/*
+		 * If there is no prog_name and the file name is not blocked by
+		 * the filter, allow to open the file. Afterwards there would be
+		 * a second refining query with prog_name set.
+		 */
+		if (!prog_name && name_filter_may_match(f, filename))
 			return true;
-		}
 	}
 
 	/* if there are no file/prog name allow filters, allow all progs,
@@ -703,6 +719,12 @@ static int append_filter(struct filter **filters, int *cnt, const char *str)
 		}
 	}
 
+	if ((!f->any_glob && !f->file_glob && !f->prog_glob) ||
+	    (f->any_glob && strcmp(f->any_glob, "") == 0)) {
+		fprintf(stderr, "Invalid filter: '%s'\n", str);
+		return -EINVAL;
+	}
+
 	*cnt += 1;
 	return 0;
 }

-- 
2.55.0

Re: [PATCH bpf-next 1/2] selftests/bpf: fix for veristat file/prog filters processing

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2974 bytes --]

>     selftests/bpf: fix for veristat file/prog filters processing
>
>     At the moment veristat filtering behaves unexpectedly for the
>     following filter expression:
>
>       -f !file/prog
>
>     The expression rejects all programs with name 'prog', and all programs
>     in a file with name 'file'. This commit fixes the expression to
>     exclude only a program 'prog' from a file 'file'. Additionally,
>     the commit makes empty filters like '-f ""' or '-f "/"' and error.
>     Here is the filtering behaviour compared old versus new:
>
>     | filter   | file | prog | old verdict | new verdict |
>     |----------+------+------+-------------+-------------|
>     | !foo     | foo  | bar  | skipped     | skipped     |
>     | !foo     | bar  | foo  | skipped     | skipped     |
>     | !foo/bar | foo  | bar  | skipped     | skipped     |
>     | !foo/bar | foo  | buz  | skipped     | processed   | (!)
>     | !foo/bar | bar  | bar  | skipped     | processed   | (!)
>     | !foo/    | foo  | bar  | skipped     | skipped     |
>     | !foo/    | bar  | bar  | processed   | processed   |
>     | !/bar    | foo  | bar  | skipped     | skipped     |
>     | !/bar    | foo  | foo  | processed   | processed   |
>     | !/       | foo  | bar  | processed   | error       | (!)
>     | !        | foo  | bar  | processed   | error       | (!)
>     |----------+------+------+-------------+-------------|
>     | foo      | foo  | bar  | processed   | processed   |
>     | foo      | bar  | foo  | processed   | processed   |
>     | foo/bar  | foo  | bar  | processed   | processed   |
>     | foo/bar  | foo  | buz  | skipped     | skipped     |
>     | foo/bar  | bar  | bar  | skipped     | skipped     |
>     | foo/     | foo  | bar  | processed   | processed   |
>     | foo/     | bar  | bar  | skipped     | skipped     |
>     | /bar     | foo  | bar  | processed   | processed   |
>     | /bar     | foo  | foo  | skipped     | skipped     |
>     | /        | foo  | bar  | processed   | error       | (!)
>     |          | foo  | bar  | skipped     | error       | (!)
>
>     Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

This looks like a bug fix for existing tooling. The changelog table marks
four behavior rows with '(!)', showing the OR-matching bug being fixed and
empty filters now being rejected. Should this include a Fixes: tag?

The broken semantics - deny filter matching on file OR prog independently,
and empty filters being silently accepted - were introduced when the separate
should_process_file() and should_process_prog() helpers were merged into
should_process_file_prog():

  Fixes: 10b1b3f3e56a ("selftests/bpf: consolidate and improve file/prog filtering in veristat")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31521742364

Re: [PATCH bpf-next 1/2] selftests/bpf: fix for veristat file/prog filters processing

[Eduard Zingerman]

On Tue, 2026-08-11 at 18:41 +0000, bot+bpf-ci@kernel.org wrote:
> >     selftests/bpf: fix for veristat file/prog filters processing
> > 
> >     At the moment veristat filtering behaves unexpectedly for the
> >     following filter expression:
> > 
> >       -f !file/prog
> > 
> >     The expression rejects all programs with name 'prog', and all programs
> >     in a file with name 'file'. This commit fixes the expression to
> >     exclude only a program 'prog' from a file 'file'. Additionally,
> >     the commit makes empty filters like '-f ""' or '-f "/"' and error.
> >     Here is the filtering behaviour compared old versus new:
> > 
> >     | filter   | file | prog | old verdict | new verdict |
> >     |----------+------+------+-------------+-------------|
> >     | !foo     | foo  | bar  | skipped     | skipped     |
> >     | !foo     | bar  | foo  | skipped     | skipped     |
> >     | !foo/bar | foo  | bar  | skipped     | skipped     |
> >     | !foo/bar | foo  | buz  | skipped     | processed   | (!)
> >     | !foo/bar | bar  | bar  | skipped     | processed   | (!)
> >     | !foo/    | foo  | bar  | skipped     | skipped     |
> >     | !foo/    | bar  | bar  | processed   | processed   |
> >     | !/bar    | foo  | bar  | skipped     | skipped     |
> >     | !/bar    | foo  | foo  | processed   | processed   |
> >     | !/       | foo  | bar  | processed   | error       | (!)
> >     | !        | foo  | bar  | processed   | error       | (!)
> >     |----------+------+------+-------------+-------------|
> >     | foo      | foo  | bar  | processed   | processed   |
> >     | foo      | bar  | foo  | processed   | processed   |
> >     | foo/bar  | foo  | bar  | processed   | processed   |
> >     | foo/bar  | foo  | buz  | skipped     | skipped     |
> >     | foo/bar  | bar  | bar  | skipped     | skipped     |
> >     | foo/     | foo  | bar  | processed   | processed   |
> >     | foo/     | bar  | bar  | skipped     | skipped     |
> >     | /bar     | foo  | bar  | processed   | processed   |
> >     | /bar     | foo  | foo  | skipped     | skipped     |
> >     | /        | foo  | bar  | processed   | error       | (!)
> >     |          | foo  | bar  | skipped     | error       | (!)
> > 
> >     Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
> 
> This looks like a bug fix for existing tooling. The changelog table marks
> four behavior rows with '(!)', showing the OR-matching bug being fixed and
> empty filters now being rejected. Should this include a Fixes: tag?
> 
> The broken semantics - deny filter matching on file OR prog independently,
> and empty filters being silently accepted - were introduced when the separate
> should_process_file() and should_process_prog() helpers were merged into
> should_process_file_prog():
> 
>   Fixes: 10b1b3f3e56a ("selftests/bpf: consolidate and improve file/prog filtering in veristat")
> 

Yeah, fixes tag should be added.

[PATCH bpf-next 2/2] selftests/bpf: exercise veristat filtering logic in a selftest

[Eduard Zingerman]

Test cases for veristat file/prog name filtering logic.
Check various formulations for any (*foo*), file (*foo*/),
prog (/*bar*) and file/prog (*foo*/bar) filters, alongside
errorneous filters and mixed allow/deny filter expressions.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 .../selftests/bpf/prog_tests/test_veristat.c       | 98 ++++++++++++++++++++++
 tools/testing/selftests/bpf/progs/veristat_bar.c   |  3 +
 tools/testing/selftests/bpf/progs/veristat_foo.c   | 31 +++++++
 3 files changed, 132 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_veristat.c b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
index 9aff08ac55c0..e1eda4ae755e 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_veristat.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
@@ -37,6 +37,13 @@ static struct fixture *init_fixture(void)
 	return fix;
 }
 
+static void read_output(struct fixture *fix)
+{
+	ssize_t len = pread(fix->fd, fix->output, fix->sz - 1, 0);
+
+	fix->output[len < 0 ? 0 : len] = 0;
+}
+
 static void teardown_fixture(struct fixture *fix)
 {
 	free(fix->output);
@@ -230,6 +237,95 @@ static void test_no_array_index_for_array(void)
 	teardown_fixture(fix);
 }
 
+/*
+ * Name filter tests below run veristat on veristat_foo.bpf.o and
+ * veristat_bar.bpf.o, both defining programs 'foo', 'bar' and 'buz'.
+ * Every entry describes a single (filters, file, prog) combination and
+ * tells whether that program is expected in the veristat output:
+ * 'true' if it is, 'false' if it is not and -1 if veristat is expected
+ * to reject the filter.
+ */
+#define FILTER_OBJS "veristat_foo.bpf.o veristat_bar.bpf.o"
+
+static const struct name_filter_case {
+	const char *filters;
+	const char *file;
+	const char *prog;
+	int included;
+} name_filter_cases[] = {
+	/* no filters, every program is processed */
+	{ "",			"foo", "foo", true  },
+	{ "",			"foo", "bar", true  },
+	{ "",			"foo", "buz", true  },
+	{ "",			"bar", "foo", true  },
+	{ "",			"bar", "bar", true  },
+	{ "",			"bar", "buz", true  },
+	/* deny filters */
+	{ "-f '!*foo*'",	"foo", "bar", false },
+	{ "-f '!*foo*'",	"bar", "foo", false },
+	{ "-f '!*foo*/bar'",	"foo", "bar", false },
+	{ "-f '!*foo*/bar'",	"foo", "buz", true  },
+	{ "-f '!*foo*/bar'",	"bar", "bar", true  },
+	{ "-f '!*foo*/'",	"foo", "bar", false },
+	{ "-f '!*foo*/'",	"bar", "bar", true  },
+	{ "-f '!/bar'",		"foo", "bar", false },
+	{ "-f '!/bar'",		"foo", "foo", true  },
+	{ "-f '!/'",		"foo", "bar", -1    },
+	{ "-f '!'",		"foo", "bar", -1    },
+	/* allow filters */
+	{ "-f '*foo*'",		"foo", "bar", true  },
+	{ "-f '*foo*'",		"bar", "foo", true  },
+	{ "-f '*foo*/bar'",	"foo", "bar", true  },
+	{ "-f '*foo*/bar'",	"foo", "buz", false },
+	{ "-f '*foo*/bar'",	"bar", "bar", false },
+	{ "-f '*foo*/'",	"foo", "bar", true  },
+	{ "-f '*foo*/'",	"bar", "bar", false },
+	{ "-f '/bar'",		"foo", "bar", true  },
+	{ "-f '/bar'",		"foo", "foo", false },
+	{ "-f '/'",		"foo", "bar", -1    },
+	{ "-f ''",		"foo", "bar", -1    },
+	/* allow and deny filters combined */
+	{ "-f '*foo*/' -f '!/bar'", "foo", "foo", true  },
+	{ "-f '*foo*/' -f '!/bar'", "foo", "bar", false },
+	{ "-f '*foo*/' -f '!/bar'", "bar", "foo", false },
+};
+
+static void test_name_filters(void)
+{
+	struct fixture *fix = init_fixture();
+	const struct name_filter_case *t;
+	char cmd[512], row[64], name[128];
+	int i, err;
+
+	for (i = 0; i < ARRAY_SIZE(name_filter_cases); i++) {
+		t = &name_filter_cases[i];
+		/* stderr is merged with stdout in order to catch error messages */
+		snprintf(cmd, sizeof(cmd), "%s " FILTER_OBJS " -q -o csv -e file,prog %s > %s 2>&1",
+			 fix->veristat, t->filters, fix->tmpfile);
+		err = system(cmd);
+		read_output(fix);
+
+		snprintf(row, sizeof(row), "veristat_%s.bpf.o,%s", t->file, t->prog);
+		snprintf(name, sizeof(name), "veristat %s: %s", t->filters, row);
+		switch (t->included) {
+		case true:
+			ASSERT_OK(err, name);
+			ASSERT_HAS_SUBSTR(fix->output, row, name);
+			break;
+		case false:
+			ASSERT_OK(err, name);
+			ASSERT_FALSE(!!strstr(fix->output, row), name);
+			break;
+		case -1:
+			ASSERT_NEQ(err, 0, name);
+			ASSERT_HAS_SUBSTR(fix->output, "Invalid filter", name);
+			break;
+		}
+	}
+
+	teardown_fixture(fix);
+}
+
 void test_veristat(void)
 {
 	if (test__start_subtest("set_global_vars_succeeds"))
@@ -256,6 +352,8 @@ void test_veristat(void)
 	if (test__start_subtest("test_no_array_index_for_array"))
 		test_no_array_index_for_array();
 
+	if (test__start_subtest("name_filters"))
+		test_name_filters();
 }
 
 #undef __CHECK_STR
diff --git a/tools/testing/selftests/bpf/progs/veristat_bar.c b/tools/testing/selftests/bpf/progs/veristat_bar.c
new file mode 100644
index 000000000000..83d2a2a1dfc9
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/veristat_bar.c
@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+#include "veristat_foo.c"
diff --git a/tools/testing/selftests/bpf/progs/veristat_foo.c b/tools/testing/selftests/bpf/progs/veristat_foo.c
new file mode 100644
index 000000000000..bd24b97664b4
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/veristat_foo.c
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+/*
+ * Programs below exist only to exercise veristat's -f name filters,
+ * their bodies are irrelevant, only the names matter.
+ * This file is also included by veristat_bar.c, so that the same set of
+ * program names is available in two differently named object files.
+ */
+
+SEC("socket")
+int foo(void *ctx)
+{
+	return 0;
+}
+
+SEC("socket")
+int bar(void *ctx)
+{
+	return 0;
+}
+
+SEC("socket")
+int buz(void *ctx)
+{
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";

-- 
2.55.0

Re: [PATCH bpf-next 2/2] selftests/bpf: exercise veristat filtering logic in a selftest

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3869 bytes --]

> Test cases for veristat file/prog name filtering logic.
> Check various formulations for any (*foo*), file (*foo*/),
> prog (/*bar*) and file/prog (*foo*/bar) filters, alongside
> errorneous filters and mixed allow/deny filter expressions.

This isn't a bug, but there's a typo: "errorneous" should be "erroneous".
Also, is the prog filter form meant to be "/bar" rather than "/*bar*" to
match the cases in the table?

> diff --git a/tools/testing/selftests/bpf/prog_tests/test_veristat.c b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> index 9aff08ac55c0..e1eda4ae755e 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> @@ -37,6 +37,13 @@ static struct fixture *init_fixture(void)
>  	return fix;
>  }
>
> +static void read_output(struct fixture *fix)
> +{
> +	ssize_t len = pread(fix->fd, fix->output, fix->sz - 1, 0);
> +
> +	fix->output[len < 0 ? 0 : len] = 0;
> +}
> +

This isn't a bug, but since read_output() also terminates the buffer, would
it make sense to switch the existing read()/pread() call sites in this file
over to it as well? The new helper is safer than the bare reads used in the
other subtests.

> +/*
> + * Name filter tests below run veristat on veristat_foo.bpf.o and
> + * veristat_bar.bpf.o, both defining programs 'foo', 'bar' and 'buz'.
> + * Every entry describes a single (filters, file, prog) combination and
> + * tells whether that program is expected in the veristat output:
> + * 'true' if it is, 'false' if it is not and -1 if veristat is expected
> + * to reject the filter.
> + */
> +#define FILTER_OBJS "veristat_foo.bpf.o veristat_bar.bpf.o"
> +
> +static const struct name_filter_case {
> +	const char *filters;
> +	const char *file;
> +	const char *prog;
> +	int included;
> +} name_filter_cases[] = {
> +	/* no filters, every program is processed */
> +	{ "",			"foo", "foo", true  },
> +	{ "",			"foo", "bar", true  },
> +	{ "",			"foo", "buz", true  },
> +	{ "",			"bar", "foo", true  },
> +	{ "",			"bar", "bar", true  },
> +	{ "",			"bar", "buz", true  },
> +	/* deny filters */
> +	{ "-f '!*foo*'",	"foo", "bar", false },
> +	{ "-f '!*foo*'",	"bar", "foo", false },

A subsystem pattern flags this as potentially concerning: the table rows for
'-f !*foo*' both assert 'false' (row should be absent), but there is no row
that asserts 'true' (row should be present) for the same filter. Every other
filter with 'false' rows also has a 'true' row for the same filter string.

For example:
  '!*foo*/bar' has (foo,buz)/(bar,bar) true
  '!*foo*/' has (bar,bar) true
  '!/bar' has (foo,foo) true
  '*foo*/bar' has (foo,bar) true

Adding one positive row for '-f !*foo*', such as { "-f '!*foo*'", "bar",
"bar", true }, would make this filter's coverage consistent with the rest
of the table. A regression that made the any-glob deny form reject everything
would still satisfy both existing rows plus ASSERT_OK(err), because absence
of a row is all that is checked.

The expectations themselves are correct (they match veristat's implementation
and the changelog table of the preceding fix commit), so this is a
test-completeness observation rather than a functional bug.

[ ... ]

> diff --git a/tools/testing/selftests/bpf/progs/veristat_bar.c b/tools/testing/selftests/bpf/progs/veristat_bar.c
> new file mode 100644
> index 000000000000..83d2a2a1dfc9
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/veristat_bar.c
> @@ -0,0 +1,3 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
> +#include "veristat_foo.c"

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31521742364

Re: [PATCH bpf-next 2/2] selftests/bpf: exercise veristat filtering logic in a selftest

[Eduard Zingerman]

On Tue, 2026-08-11 at 18:56 +0000, bot+bpf-ci@kernel.org wrote:
> > Test cases for veristat file/prog name filtering logic.
> > Check various formulations for any (*foo*), file (*foo*/),
> > prog (/*bar*) and file/prog (*foo*/bar) filters, alongside
> > errorneous filters and mixed allow/deny filter expressions.
> 
> This isn't a bug, but there's a typo: "errorneous" should be "erroneous".

Oops

> Also, is the prog filter form meant to be "/bar" rather than "/*bar*" to
> match the cases in the table?

Nope, *bar* is fine.

> 
> > diff --git a/tools/testing/selftests/bpf/prog_tests/test_veristat.c b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> > index 9aff08ac55c0..e1eda4ae755e 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/test_veristat.c
> > @@ -37,6 +37,13 @@ static struct fixture *init_fixture(void)
> >  	return fix;
> >  }
> > 
> > +static void read_output(struct fixture *fix)
> > +{
> > +	ssize_t len = pread(fix->fd, fix->output, fix->sz - 1, 0);
> > +
> > +	fix->output[len < 0 ? 0 : len] = 0;
> > +}
> > +
> 
> This isn't a bug, but since read_output() also terminates the buffer, would
> it make sense to switch the existing read()/pread() call sites in this file
> over to it as well? The new helper is safer than the bare reads used in the
> other subtests.

Makes sense.

> > +/*
> > + * Name filter tests below run veristat on veristat_foo.bpf.o and
> > + * veristat_bar.bpf.o, both defining programs 'foo', 'bar' and 'buz'.
> > + * Every entry describes a single (filters, file, prog) combination and
> > + * tells whether that program is expected in the veristat output:
> > + * 'true' if it is, 'false' if it is not and -1 if veristat is expected
> > + * to reject the filter.
> > + */
> > +#define FILTER_OBJS "veristat_foo.bpf.o veristat_bar.bpf.o"
> > +
> > +static const struct name_filter_case {
> > +	const char *filters;
> > +	const char *file;
> > +	const char *prog;
> > +	int included;
> > +} name_filter_cases[] = {
> > +	/* no filters, every program is processed */
> > +	{ "",			"foo", "foo", true  },
> > +	{ "",			"foo", "bar", true  },
> > +	{ "",			"foo", "buz", true  },
> > +	{ "",			"bar", "foo", true  },
> > +	{ "",			"bar", "bar", true  },
> > +	{ "",			"bar", "buz", true  },
> > +	/* deny filters */
> > +	{ "-f '!*foo*'",	"foo", "bar", false },
> > +	{ "-f '!*foo*'",	"bar", "foo", false },
> 
> A subsystem pattern flags this as potentially concerning: the table rows for
> '-f !*foo*' both assert 'false' (row should be absent), but there is no row
> that asserts 'true' (row should be present) for the same filter. Every other
> filter with 'false' rows also has a 'true' row for the same filter string.

Makes sense to add.

> For example:
>   '!*foo*/bar' has (foo,buz)/(bar,bar) true
>   '!*foo*/' has (bar,bar) true
>   '!/bar' has (foo,foo) true
>   '*foo*/bar' has (foo,bar) true
> 
> Adding one positive row for '-f !*foo*', such as { "-f '!*foo*'", "bar",
> "bar", true }, would make this filter's coverage consistent with the rest
> of the table. A regression that made the any-glob deny form reject everything
> would still satisfy both existing rows plus ASSERT_OK(err), because absence
> of a row is all that is checked.
> 
> The expectations themselves are correct (they match veristat's implementation
> and the changelog table of the preceding fix commit), so this is a
> test-completeness observation rather than a functional bug.
> 
> [ ... ]
> 
> > diff --git a/tools/testing/selftests/bpf/progs/veristat_bar.c b/tools/testing/selftests/bpf/progs/veristat_bar.c
> > new file mode 100644
> > index 000000000000..83d2a2a1dfc9
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/progs/veristat_bar.c
> > @@ -0,0 +1,3 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
> > +#include "veristat_foo.c"
> 
> [ ... ]
> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31521742364