[PATCH bpf-next v2 0/2] bpf: fix null pointer access for malformed BPF_CORE_TYPE_ID_LOCAL relos

[PATCH bpf-next v2 0/2] bpf: fix null pointer access for malformed BPF_CORE_TYPE_ID_LOCAL relos

[Eduard Zingerman]

Liu RuiTong reported an in-kernel null pointer derefence when
processing BPF_CORE_TYPE_ID_LOCAL relocations referencing non-existing
BTF types. Fix this by adding proper id checks.

Changes v1->v2:
- moved check from bpf_core_calc_relo_insn() to bpf_core_apply()
  now both in kernel and in libbpf relocation type id is guaranteed
  to exist when bpf_core_calc_relo_insn() is called;
- added a test case.

v1: https://lore.kernel.org/bpf/20240821164620.1056362-1-eddyz87@gmail.com/

Eduard Zingerman (2):
  bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
  selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

 kernel/bpf/btf.c                              |   8 ++
 .../selftests/bpf/prog_tests/core_reloc_raw.c | 124 ++++++++++++++++++
 2 files changed, 132 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c

-- 
2.45.2

[PATCH bpf-next v2 1/2] bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos

[Eduard Zingerman]

In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
referencing a non-existing BTF type, function bpf_core_calc_relo_insn
would cause a null pointer deference.

Fix this by adding a proper check upper in call stack, as malformed
relocation records could be passed from user space.

Simplest reproducer is a program:

    r0 = 0
    exit

With a single relocation record:

    .insn_off = 0,          /* patch first instruction */
    .type_id = 100500,      /* this type id does not exist */
    .access_str_off = 6,    /* offset of string "0" */
    .kind = BPF_CORE_TYPE_ID_LOCAL,

See the link for original reproducer or next commit for a test case.

Fixes: 74753e1462e7 ("libbpf: Replace btf__type_by_id() with btf_type_by_id().")
Reported-by: Liu RuiTong <cnitlrt@gmail.com>
Closes: https://lore.kernel.org/bpf/CAK55_s6do7C+DVwbwY_7nKfUz0YLDoiA1v6X3Y9+p0sWzipFSA@mail.gmail.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 kernel/bpf/btf.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index b12db397303e..e38e770a6945 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8888,6 +8888,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	struct bpf_core_cand_list cands = {};
 	struct bpf_core_relo_res targ_res;
 	struct bpf_core_spec *specs;
+	const struct btf_type *type;
 	int err;
 
 	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
@@ -8897,6 +8898,13 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	if (!specs)
 		return -ENOMEM;
 
+	type = btf_type_by_id(ctx->btf, relo->type_id);
+	if (!type) {
+		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
+			relo_idx, relo->type_id);
+		return -EINVAL;
+	}
+
 	if (need_cands) {
 		struct bpf_cand_cache *cc;
 		int i;
-- 
2.45.2

Re: [PATCH bpf-next v2 1/2] bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos

[Andrii Nakryiko]

On Wed, Aug 21, 2024 at 5:18 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
> referencing a non-existing BTF type, function bpf_core_calc_relo_insn
> would cause a null pointer deference.
>
> Fix this by adding a proper check upper in call stack, as malformed
> relocation records could be passed from user space.
>
> Simplest reproducer is a program:
>
>     r0 = 0
>     exit
>
> With a single relocation record:
>
>     .insn_off = 0,          /* patch first instruction */
>     .type_id = 100500,      /* this type id does not exist */
>     .access_str_off = 6,    /* offset of string "0" */
>     .kind = BPF_CORE_TYPE_ID_LOCAL,
>
> See the link for original reproducer or next commit for a test case.
>
> Fixes: 74753e1462e7 ("libbpf: Replace btf__type_by_id() with btf_type_by_id().")
> Reported-by: Liu RuiTong <cnitlrt@gmail.com>
> Closes: https://lore.kernel.org/bpf/CAK55_s6do7C+DVwbwY_7nKfUz0YLDoiA1v6X3Y9+p0sWzipFSA@mail.gmail.com/
> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
> ---
>  kernel/bpf/btf.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>

LGTM

Acked-by: Andrii Nakryiko <andrii@kernel.org>

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index b12db397303e..e38e770a6945 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -8888,6 +8888,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
>         struct bpf_core_cand_list cands = {};
>         struct bpf_core_relo_res targ_res;
>         struct bpf_core_spec *specs;
> +       const struct btf_type *type;
>         int err;
>
>         /* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
> @@ -8897,6 +8898,13 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
>         if (!specs)
>                 return -ENOMEM;
>
> +       type = btf_type_by_id(ctx->btf, relo->type_id);
> +       if (!type) {
> +               bpf_log(ctx->log, "relo #%u: bad type id %u\n",
> +                       relo_idx, relo->type_id);
> +               return -EINVAL;
> +       }
> +
>         if (need_cands) {
>                 struct bpf_cand_cache *cc;
>                 int i;
> --
> 2.45.2
>

[PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Eduard Zingerman]

Check that verifier rejects BPF program containing relocation
pointing to non-existent BTF type.

To force relocation resolution on kernel side test case uses
bpf_attr->core_relos field. This field is not exposed by libbpf,
so directly do BPF system call in the test.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 .../selftests/bpf/prog_tests/core_reloc_raw.c | 124 ++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c

diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
new file mode 100644
index 000000000000..1ab3ab305d3b
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/* Test cases that can't load programs using libbpf and need direct
+ * BPF syscall access
+ */
+
+#include <sys/syscall.h>
+#include <bpf/libbpf.h>
+#include <bpf/btf.h>
+
+#include "test_progs.h"
+#include "test_btf.h"
+#include "bpf/libbpf_internal.h"
+
+static char log[16 * 1024];
+
+/* Check that verifier rejects BPF program containing relocation
+ * pointing to non-existent BTF type.
+ */
+static void test_bad_local_id(void)
+{
+	struct test_btf {
+		struct btf_header hdr;
+		__u32 types[15];
+		char strings[128];
+	} raw_btf = {
+		.hdr = {
+			.magic = BTF_MAGIC,
+			.version = BTF_VERSION,
+			.hdr_len = sizeof(struct btf_header),
+			.type_off = 0,
+			.type_len = sizeof(raw_btf.types),
+			.str_off = offsetof(struct test_btf, strings) -
+				   offsetof(struct test_btf, types),
+			.str_len = sizeof(raw_btf.strings),
+		},
+		.types = {
+			BTF_PTR_ENC(0),					/* [1] void*  */
+			BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),	/* [2] int    */
+			BTF_FUNC_PROTO_ENC(2, 1),			/* [3] int (*)(void*) */
+			BTF_FUNC_PROTO_ARG_ENC(8, 1),
+			BTF_FUNC_ENC(8, 3)			/* [4] FUNC 'foo' type_id=2   */
+		},
+		.strings = "\0int\0 0\0foo\0"
+	};
+	__u32 log_level = 1 | 2 | 4;
+	LIBBPF_OPTS(bpf_btf_load_opts, opts,
+		    .log_buf = log,
+		    .log_size = sizeof(log),
+		    .log_level = log_level,
+	);
+	struct bpf_insn insns[] = {
+		BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	struct bpf_func_info funcs[] = {
+		{
+			.insn_off = 0,
+			.type_id = 4,
+		}
+	};
+	struct bpf_core_relo relos[] = {
+		{
+			.insn_off = 0,		/* patch first instruction (r0 = 0) */
+			.type_id = 100500,	/* !!! this type id does not exist */
+			.access_str_off = 6,	/* offset of "0" */
+			.kind = BPF_CORE_TYPE_ID_LOCAL,
+		}
+	};
+	union bpf_attr attr = {};
+	int saved_errno;
+	int prog_fd = -1;
+	int btf_fd = -1;
+
+	btf_fd = bpf_btf_load(&raw_btf, sizeof(raw_btf), &opts);
+	saved_errno = errno;
+	if (btf_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
+		printf("-------- BTF load log start --------\n");
+		printf("%s", log);
+		printf("-------- BTF load log end ----------\n");
+	}
+	if (btf_fd < 0) {
+		PRINT_FAIL("bpf_btf_load() failed, errno=%d\n", saved_errno);
+		return;
+	}
+
+	memset(log, 0, sizeof(log));
+	attr.prog_btf_fd = btf_fd;
+	attr.prog_type = BPF_TRACE_RAW_TP;
+	attr.license = (__u64)"GPL";
+	attr.insns = (__u64)&insns;
+	attr.insn_cnt = sizeof(insns) / sizeof(*insns);
+	attr.log_buf = (__u64)log;
+	attr.log_size = sizeof(log);
+	attr.log_level = log_level;
+	attr.func_info = (__u64)funcs;
+	attr.func_info_cnt = sizeof(funcs) / sizeof(*funcs);
+	attr.func_info_rec_size = sizeof(*funcs);
+	attr.core_relos = (__u64)relos;
+	attr.core_relo_cnt = sizeof(relos) / sizeof(*relos);
+	attr.core_relo_rec_size = sizeof(*relos);
+	prog_fd = sys_bpf_prog_load(&attr, sizeof(attr), 1);
+	saved_errno = errno;
+	if (prog_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
+		printf("-------- program load log start --------\n");
+		printf("%s", log);
+		printf("-------- program load log end ----------\n");
+	}
+	if (prog_fd >= 0) {
+		PRINT_FAIL("sys_bpf_prog_load() expected to fail\n");
+		goto out;
+	}
+	ASSERT_HAS_SUBSTR(log, "relo #0: bad type id 100500", "program load log");
+
+out:
+	close(prog_fd);
+	close(btf_fd);
+}
+
+void test_core_reloc_raw(void)
+{
+	if (test__start_subtest("bad_local_id"))
+		test_bad_local_id();
+}
-- 
2.45.2

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Andrii Nakryiko]

On Wed, Aug 21, 2024 at 5:18 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> Check that verifier rejects BPF program containing relocation
> pointing to non-existent BTF type.
>
> To force relocation resolution on kernel side test case uses
> bpf_attr->core_relos field. This field is not exposed by libbpf,
> so directly do BPF system call in the test.
>
> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
> ---
>  .../selftests/bpf/prog_tests/core_reloc_raw.c | 124 ++++++++++++++++++
>  1 file changed, 124 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
> new file mode 100644
> index 000000000000..1ab3ab305d3b
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/core_reloc_raw.c
> @@ -0,0 +1,124 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +/* Test cases that can't load programs using libbpf and need direct
> + * BPF syscall access
> + */
> +
> +#include <sys/syscall.h>
> +#include <bpf/libbpf.h>
> +#include <bpf/btf.h>
> +
> +#include "test_progs.h"
> +#include "test_btf.h"
> +#include "bpf/libbpf_internal.h"
> +
> +static char log[16 * 1024];
> +
> +/* Check that verifier rejects BPF program containing relocation
> + * pointing to non-existent BTF type.
> + */
> +static void test_bad_local_id(void)
> +{
> +       struct test_btf {
> +               struct btf_header hdr;
> +               __u32 types[15];
> +               char strings[128];
> +       } raw_btf = {
> +               .hdr = {
> +                       .magic = BTF_MAGIC,
> +                       .version = BTF_VERSION,
> +                       .hdr_len = sizeof(struct btf_header),
> +                       .type_off = 0,
> +                       .type_len = sizeof(raw_btf.types),
> +                       .str_off = offsetof(struct test_btf, strings) -
> +                                  offsetof(struct test_btf, types),
> +                       .str_len = sizeof(raw_btf.strings),
> +               },
> +               .types = {
> +                       BTF_PTR_ENC(0),                                 /* [1] void*  */
> +                       BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),  /* [2] int    */
> +                       BTF_FUNC_PROTO_ENC(2, 1),                       /* [3] int (*)(void*) */
> +                       BTF_FUNC_PROTO_ARG_ENC(8, 1),
> +                       BTF_FUNC_ENC(8, 3)                      /* [4] FUNC 'foo' type_id=2   */
> +               },
> +               .strings = "\0int\0 0\0foo\0"
> +       };
> +       __u32 log_level = 1 | 2 | 4;
> +       LIBBPF_OPTS(bpf_btf_load_opts, opts,
> +                   .log_buf = log,
> +                   .log_size = sizeof(log),
> +                   .log_level = log_level,
> +       );
> +       struct bpf_insn insns[] = {
> +               BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +               BPF_EXIT_INSN(),
> +       };
> +       struct bpf_func_info funcs[] = {
> +               {
> +                       .insn_off = 0,
> +                       .type_id = 4,
> +               }
> +       };
> +       struct bpf_core_relo relos[] = {
> +               {
> +                       .insn_off = 0,          /* patch first instruction (r0 = 0) */
> +                       .type_id = 100500,      /* !!! this type id does not exist */
> +                       .access_str_off = 6,    /* offset of "0" */
> +                       .kind = BPF_CORE_TYPE_ID_LOCAL,
> +               }
> +       };
> +       union bpf_attr attr = {};
> +       int saved_errno;
> +       int prog_fd = -1;
> +       int btf_fd = -1;
> +
> +       btf_fd = bpf_btf_load(&raw_btf, sizeof(raw_btf), &opts);
> +       saved_errno = errno;
> +       if (btf_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
> +               printf("-------- BTF load log start --------\n");
> +               printf("%s", log);
> +               printf("-------- BTF load log end ----------\n");
> +       }
> +       if (btf_fd < 0) {
> +               PRINT_FAIL("bpf_btf_load() failed, errno=%d\n", saved_errno);
> +               return;
> +       }
> +
> +       memset(log, 0, sizeof(log));

generally speaking there is no need to memset log buffer (maybe just a
first byte, to be safe)

on the other hand, just `union bpf_attr attr = {};` is breakage
waiting to happen, I'd do memset(0) on that, we did run into problems
with that before (I believe it was systemd)

> +       attr.prog_btf_fd = btf_fd;
> +       attr.prog_type = BPF_TRACE_RAW_TP;
> +       attr.license = (__u64)"GPL";
> +       attr.insns = (__u64)&insns;
> +       attr.insn_cnt = sizeof(insns) / sizeof(*insns);
> +       attr.log_buf = (__u64)log;
> +       attr.log_size = sizeof(log);
> +       attr.log_level = log_level;
> +       attr.func_info = (__u64)funcs;
> +       attr.func_info_cnt = sizeof(funcs) / sizeof(*funcs);
> +       attr.func_info_rec_size = sizeof(*funcs);
> +       attr.core_relos = (__u64)relos;
> +       attr.core_relo_cnt = sizeof(relos) / sizeof(*relos);
> +       attr.core_relo_rec_size = sizeof(*relos);

I was wondering for a bit why you didn't just use bpf_prog_load(), and
it seems like it's due to core_relos fields? I don't see why we can't
extend the bpf_prog_load() API to allow to specify those. (would allow
to avoid open-coding this whole bpf_attr business, but it's fine as is
as well)

> +       prog_fd = sys_bpf_prog_load(&attr, sizeof(attr), 1);
> +       saved_errno = errno;
> +       if (prog_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
> +               printf("-------- program load log start --------\n");
> +               printf("%s", log);
> +               printf("-------- program load log end ----------\n");
> +       }
> +       if (prog_fd >= 0) {
> +               PRINT_FAIL("sys_bpf_prog_load() expected to fail\n");
> +               goto out;
> +       }
> +       ASSERT_HAS_SUBSTR(log, "relo #0: bad type id 100500", "program load log");
> +
> +out:
> +       close(prog_fd);
> +       close(btf_fd);
> +}
> +
> +void test_core_reloc_raw(void)
> +{
> +       if (test__start_subtest("bad_local_id"))
> +               test_bad_local_id();
> +}
> --
> 2.45.2
>

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Eduard Zingerman]

On Wed, 2024-08-21 at 21:29 -0700, Andrii Nakryiko wrote:

[...]

> > +       btf_fd = bpf_btf_load(&raw_btf, sizeof(raw_btf), &opts);
> > +       saved_errno = errno;
> > +       if (btf_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
> > +               printf("-------- BTF load log start --------\n");
> > +               printf("%s", log);
> > +               printf("-------- BTF load log end ----------\n");
> > +       }
> > +       if (btf_fd < 0) {
> > +               PRINT_FAIL("bpf_btf_load() failed, errno=%d\n", saved_errno);
> > +               return;
> > +       }
> > +
> > +       memset(log, 0, sizeof(log));
> 
> generally speaking there is no need to memset log buffer (maybe just a
> first byte, to be safe)

Will change.

> on the other hand, just `union bpf_attr attr = {};` is breakage
> waiting to happen, I'd do memset(0) on that, we did run into problems
> with that before (I believe it was systemd)

Compilers optimize out 'smth = {}' where 'smth' escapes?
I mean, I will change it to memset(0), but the fact that you observed
such behaviour is disturbing beyond limit...

I already run into gcc vs clang behaviour differences for the first
iteration of this test where I had:

    union bpf_attr {
	.prog_type = ...
    };

clang did not zero out all members of the union, while gcc did.

> > +       attr.prog_btf_fd = btf_fd;
> > +       attr.prog_type = BPF_TRACE_RAW_TP;
> > +       attr.license = (__u64)"GPL";
> > +       attr.insns = (__u64)&insns;
> > +       attr.insn_cnt = sizeof(insns) / sizeof(*insns);
> > +       attr.log_buf = (__u64)log;
> > +       attr.log_size = sizeof(log);
> > +       attr.log_level = log_level;
> > +       attr.func_info = (__u64)funcs;
> > +       attr.func_info_cnt = sizeof(funcs) / sizeof(*funcs);
> > +       attr.func_info_rec_size = sizeof(*funcs);
> > +       attr.core_relos = (__u64)relos;
> > +       attr.core_relo_cnt = sizeof(relos) / sizeof(*relos);
> > +       attr.core_relo_rec_size = sizeof(*relos);
> 
> I was wondering for a bit why you didn't just use bpf_prog_load(), and
> it seems like it's due to core_relos fields?

Yes, it is in commit message :)

> I don't see why we can't extend the bpf_prog_load() API to allow to
> specify those. (would allow to avoid open-coding this whole bpf_attr
> business, but it's fine as is as well)

Maybe extend API as a followup?
The test won't change much, just options instead of bpf_attr.

[...]

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Andrii Nakryiko]

On Wed, Aug 21, 2024 at 9:39 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Wed, 2024-08-21 at 21:29 -0700, Andrii Nakryiko wrote:
>
> [...]
>
> > > +       btf_fd = bpf_btf_load(&raw_btf, sizeof(raw_btf), &opts);
> > > +       saved_errno = errno;
> > > +       if (btf_fd < 0 || env.verbosity > VERBOSE_NORMAL) {
> > > +               printf("-------- BTF load log start --------\n");
> > > +               printf("%s", log);
> > > +               printf("-------- BTF load log end ----------\n");
> > > +       }
> > > +       if (btf_fd < 0) {
> > > +               PRINT_FAIL("bpf_btf_load() failed, errno=%d\n", saved_errno);
> > > +               return;
> > > +       }
> > > +
> > > +       memset(log, 0, sizeof(log));
> >
> > generally speaking there is no need to memset log buffer (maybe just a
> > first byte, to be safe)
>
> Will change.
>
> > on the other hand, just `union bpf_attr attr = {};` is breakage
> > waiting to happen, I'd do memset(0) on that, we did run into problems
> > with that before (I believe it was systemd)
>
> Compilers optimize out 'smth = {}' where 'smth' escapes?
> I mean, I will change it to memset(0), but the fact that you observed
> such behaviour is disturbing beyond limit...

compiler is not obligated to zero out padding in the struct/union, and
kernel is pretty strict about that, that's the issue. memset(0)
guarantees all the bytes are set to zero, not just those that belong
to fields

>
> I already run into gcc vs clang behaviour differences for the first
> iteration of this test where I had:
>
>     union bpf_attr {
>         .prog_type = ...
>     };
>
> clang did not zero out all members of the union, while gcc did.
>
> > > +       attr.prog_btf_fd = btf_fd;
> > > +       attr.prog_type = BPF_TRACE_RAW_TP;
> > > +       attr.license = (__u64)"GPL";
> > > +       attr.insns = (__u64)&insns;
> > > +       attr.insn_cnt = sizeof(insns) / sizeof(*insns);
> > > +       attr.log_buf = (__u64)log;
> > > +       attr.log_size = sizeof(log);
> > > +       attr.log_level = log_level;
> > > +       attr.func_info = (__u64)funcs;
> > > +       attr.func_info_cnt = sizeof(funcs) / sizeof(*funcs);
> > > +       attr.func_info_rec_size = sizeof(*funcs);
> > > +       attr.core_relos = (__u64)relos;
> > > +       attr.core_relo_cnt = sizeof(relos) / sizeof(*relos);
> > > +       attr.core_relo_rec_size = sizeof(*relos);
> >
> > I was wondering for a bit why you didn't just use bpf_prog_load(), and
> > it seems like it's due to core_relos fields?
>
> Yes, it is in commit message :)
>

ain't nobody got time for reading commit messages ;)

> > I don't see why we can't extend the bpf_prog_load() API to allow to
> > specify those. (would allow to avoid open-coding this whole bpf_attr
> > business, but it's fine as is as well)
>
> Maybe extend API as a followup?
> The test won't change much, just options instead of bpf_attr.

yep, follow up is good, thanks

>
> [...]
>

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Alexei Starovoitov]

On Thu, Aug 22, 2024 at 9:51 AM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> > > I don't see why we can't extend the bpf_prog_load() API to allow to
> > > specify those. (would allow to avoid open-coding this whole bpf_attr
> > > business, but it's fine as is as well)
> >
> > Maybe extend API as a followup?
> > The test won't change much, just options instead of bpf_attr.
>
> yep, follow up is good, thanks

I don't think we want this extension to bpf_prog_load() libbpf api.
This is internal gen_loader use.

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Andrii Nakryiko]

On Thu, Aug 22, 2024 at 9:55 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Thu, Aug 22, 2024 at 9:51 AM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > > > I don't see why we can't extend the bpf_prog_load() API to allow to
> > > > specify those. (would allow to avoid open-coding this whole bpf_attr
> > > > business, but it's fine as is as well)
> > >
> > > Maybe extend API as a followup?
> > > The test won't change much, just options instead of bpf_attr.
> >
> > yep, follow up is good, thanks
>
> I don't think we want this extension to bpf_prog_load() libbpf api.
> This is internal gen_loader use.

bpf_prog_load() is just a wrapper around BPF_PROG_LOAD command of
bpf() syscall, so it feels appropriate to expose all the available
kernel functionality, even if libbpf itself doesn't use some parts of
it. Those core_relos fields are there in bpf_attr and are part of
UAPI, what's wrong with making them available in low-level API?

Re: [PATCH bpf-next v2 2/2] selftests/bpf: test for malformed BPF_CORE_TYPE_ID_LOCAL relocation

[Alexei Starovoitov]

On Thu, Aug 22, 2024 at 10:27 AM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Thu, Aug 22, 2024 at 9:55 AM Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Thu, Aug 22, 2024 at 9:51 AM Andrii Nakryiko
> > <andrii.nakryiko@gmail.com> wrote:
> > >
> > > > > I don't see why we can't extend the bpf_prog_load() API to allow to
> > > > > specify those. (would allow to avoid open-coding this whole bpf_attr
> > > > > business, but it's fine as is as well)
> > > >
> > > > Maybe extend API as a followup?
> > > > The test won't change much, just options instead of bpf_attr.
> > >
> > > yep, follow up is good, thanks
> >
> > I don't think we want this extension to bpf_prog_load() libbpf api.
> > This is internal gen_loader use.
>
> bpf_prog_load() is just a wrapper around BPF_PROG_LOAD command of
> bpf() syscall, so it feels appropriate to expose all the available
> kernel functionality, even if libbpf itself doesn't use some parts of
> it. Those core_relos fields are there in bpf_attr and are part of
> UAPI, what's wrong with making them available in low-level API?

because it's a maintenance cost for something where
the single user is a selftest.
Hence I wouldn't bother, but I don't insist.