Re: [PATCH bpf-next v3 2/2] libbpf: fetch probeable prog type from token for feature probes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Feature probes for FEAT_BPF_COOKIE and FEAT_PROBE_READ_KERN will unconditionally fail because they test helpers unsupported by the dynamically selected BPF_PROG_TYPE_SOCKET_FILTER.
--

commit 0109a2d3173a7dbf585e1f1ba9c12c5a9120c9eb
Author: Yuan Chen <chenyuan@kylinos.cn>

libbpf: fetch probeable prog type from token for feature probes

This commit updates feature probes to dynamically select a program type
based on the provided BPF token instead of hardcoding SOCKET_FILTER or
TRACEPOINT. If no token is provided, it defaults to SOCKET_FILTER.

> diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> index b7e388f99d0bb..f008ee50e2466 100644
> --- a/tools/lib/bpf/features.c
> +++ b/tools/lib/bpf/features.c

[ ... ]

> @@ -257,8 +318,13 @@ static int probe_kern_probe_read_kernel(int token_fd)
>  		BPF_EXIT_INSN(),
>  	};
>  	int fd, insn_cnt = ARRAY_SIZE(insns);
> +	int prog_type;
>  
> -	fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
> +	prog_type = token_probeable_prog_type(token_fd);
> +	if (prog_type < 0)
> +		return 1;
> +
> +	fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insn_cnt, &opts);

[Severity: High]
Will this unconditionally fail the probe for FEAT_PROBE_READ_KERN?

If no token is provided, or the token allows SOCKET_FILTER,
token_probeable_prog_type() returns BPF_PROG_TYPE_SOCKET_FILTER.

Because SOCKET_FILTER does not support the bpf_probe_read_kernel helper,
the verifier will reject the load with an unknown func error.

Does this result in libbpf falsely reporting the feature as missing for
all applications?

[ ... ]

> @@ -435,8 +507,13 @@ static int probe_kern_bpf_cookie(int token_fd)
>  		.prog_flags = token_fd ? BPF_F_TOKEN_FD : 0,
>  	);
>  	int ret, insn_cnt = ARRAY_SIZE(insns);
> +	int prog_type;
>  
> -	ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
> +	prog_type = token_probeable_prog_type(token_fd);
> +	if (prog_type < 0)
> +		return 1;
> +
> +	ret = bpf_prog_load(prog_type, NULL, "GPL", insns, insn_cnt, &opts);

[Severity: High]
Similarly, will this break the FEAT_BPF_COOKIE probe?

If prog_type resolves to BPF_PROG_TYPE_SOCKET_FILTER, it will not support
the bpf_get_attach_cookie helper being tested here, causing the verifier
to reject the probe program.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610145059.113412-1-chenyuan_fl@163.com?part=2