[PATCH bpf-next v2] selftests/bpf: Negative test case for tail call map

[PATCH bpf-next v2] selftests/bpf: Negative test case for tail call map

[Paul Chaignon]

This patch adds a negative test case for the following verifier error.

    expected prog array map for tail call

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
---
Changes in v2:
  - Moved the test to prog_tests format as suggested by Eduard.
  - Rebased.
  - v1: https://lore.kernel.org/bpf/7cec754c8d4cc2d93a50e9091d7ccc7f33d454d4.1751578055.git.paul.chaignon@gmail.com/

 .../selftests/bpf/prog_tests/verifier.c       |  2 ++
 .../selftests/bpf/progs/verifier_tailcall.c   | 32 +++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_tailcall.c

diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index c9da06741104..77ec95d4ffaa 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -85,6 +85,7 @@
 #include "verifier_store_release.skel.h"
 #include "verifier_subprog_precision.skel.h"
 #include "verifier_subreg.skel.h"
+#include "verifier_tailcall.skel.h"
 #include "verifier_tailcall_jit.skel.h"
 #include "verifier_typedef.skel.h"
 #include "verifier_uninit.skel.h"
@@ -219,6 +220,7 @@ void test_verifier_stack_ptr(void)            { RUN(verifier_stack_ptr); }
 void test_verifier_store_release(void)        { RUN(verifier_store_release); }
 void test_verifier_subprog_precision(void)    { RUN(verifier_subprog_precision); }
 void test_verifier_subreg(void)               { RUN(verifier_subreg); }
+void test_verifier_tailcall(void)             { RUN(verifier_tailcall); }
 void test_verifier_tailcall_jit(void)         { RUN(verifier_tailcall_jit); }
 void test_verifier_typedef(void)              { RUN(verifier_typedef); }
 void test_verifier_uninit(void)               { RUN(verifier_uninit); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_tailcall.c b/tools/testing/selftests/bpf/progs/verifier_tailcall.c
new file mode 100644
index 000000000000..662a6528ce4f
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_tailcall.c
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u32);
+} map_array SEC(".maps");
+
+SEC("socket")
+__description("invalid map type for tail call")
+__failure __msg("expected prog array map for tail call")
+__failure_unpriv
+__flag(BPF_F_ANY_ALIGNMENT)
+__naked void invalid_map_for_tail_call(void)
+{
+	asm volatile ("		\
+	r2 = %[map_array] ll;	\
+	r3 = 0;			\
+	call %[bpf_tail_call];	\
+	exit;			\
+"	:
+	: __imm(bpf_tail_call),
+	  __imm_addr(map_array)
+	: __clobber_all);
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.43.0

Re: [PATCH bpf-next v2] selftests/bpf: Negative test case for tail call map

[Yonghong Song]

On 7/4/25 6:04 AM, Paul Chaignon wrote:
> This patch adds a negative test case for the following verifier error.
>
>      expected prog array map for tail call
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

LGTM with a nit below.

Acked-by: Yonghong Song <yonghong.song@linux.dev>

> ---
> Changes in v2:
>    - Moved the test to prog_tests format as suggested by Eduard.
>    - Rebased.
>    - v1: https://lore.kernel.org/bpf/7cec754c8d4cc2d93a50e9091d7ccc7f33d454d4.1751578055.git.paul.chaignon@gmail.com/
>
>   .../selftests/bpf/prog_tests/verifier.c       |  2 ++
>   .../selftests/bpf/progs/verifier_tailcall.c   | 32 +++++++++++++++++++
>   2 files changed, 34 insertions(+)
>   create mode 100644 tools/testing/selftests/bpf/progs/verifier_tailcall.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index c9da06741104..77ec95d4ffaa 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -85,6 +85,7 @@
>   #include "verifier_store_release.skel.h"
>   #include "verifier_subprog_precision.skel.h"
>   #include "verifier_subreg.skel.h"
> +#include "verifier_tailcall.skel.h"
>   #include "verifier_tailcall_jit.skel.h"
>   #include "verifier_typedef.skel.h"
>   #include "verifier_uninit.skel.h"
> @@ -219,6 +220,7 @@ void test_verifier_stack_ptr(void)            { RUN(verifier_stack_ptr); }
>   void test_verifier_store_release(void)        { RUN(verifier_store_release); }
>   void test_verifier_subprog_precision(void)    { RUN(verifier_subprog_precision); }
>   void test_verifier_subreg(void)               { RUN(verifier_subreg); }
> +void test_verifier_tailcall(void)             { RUN(verifier_tailcall); }
>   void test_verifier_tailcall_jit(void)         { RUN(verifier_tailcall_jit); }
>   void test_verifier_typedef(void)              { RUN(verifier_typedef); }
>   void test_verifier_uninit(void)               { RUN(verifier_uninit); }
> diff --git a/tools/testing/selftests/bpf/progs/verifier_tailcall.c b/tools/testing/selftests/bpf/progs/verifier_tailcall.c
> new file mode 100644
> index 000000000000..662a6528ce4f
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_tailcall.c
> @@ -0,0 +1,32 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +struct {
> +	__uint(type, BPF_MAP_TYPE_ARRAY);
> +	__uint(max_entries, 1);
> +	__type(key, __u32);
> +	__type(value, __u32);
> +} map_array SEC(".maps");
> +
> +SEC("socket")
> +__description("invalid map type for tail call")
> +__failure __msg("expected prog array map for tail call")
> +__failure_unpriv
> +__flag(BPF_F_ANY_ALIGNMENT)

The __flag(BPF_F_ANY_ALIGNMENT) is not necessary as it is
for load/store insns in the bpf prog. In the below bpf prog,
there are no load/store insns.

> +__naked void invalid_map_for_tail_call(void)
> +{
> +	asm volatile ("		\
> +	r2 = %[map_array] ll;	\
> +	r3 = 0;			\
> +	call %[bpf_tail_call];	\
> +	exit;			\
> +"	:
> +	: __imm(bpf_tail_call),
> +	  __imm_addr(map_array)
> +	: __clobber_all);
> +}
> +
> +char _license[] SEC("license") = "GPL";