Re: [PATCH bpf-next 2/2] selftests/bpf: Add testcases for callback with tailcall

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The test `tailcall_direct_callback` intentionally expects a verifier bug message (`"callback unexpected regs 1"`), which triggers a kernel `WARN_ONCE`.
--

--- Patch [2]: [PATCH bpf-next 2/2] selftests/bpf: Add testcases for callback with tailcall ---
commit 037342732803eb60c98636ac87d004705531bc5d
Author: Pu Lehui <pulehui@huawei.com>

selftests/bpf: Add testcases for callback with tailcall

This patch adds three testcases for BPF callbacks interacting with tail calls.
It tests scenarios where a callback directly invokes a tail call, or where
subprograms invoked by the callback issue the tail call.

> diff --git a/tools/testing/selftests/bpf/progs/tailcall_callback.c b/tools/testing/selftests/bpf/progs/tailcall_callback.c
> new file mode 100644
> index 0000000000000..504d8e7a69969
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/tailcall_callback.c
[ ... ]
> +/* callback involving tail call directly is rejected */
> +SEC("tc")
> +__failure __msg("callback unexpected regs 1")
> +int tailcall_direct_callback(struct __sk_buff *skb)
> +{

[Severity: High]
Does expecting this specific failure message codify a kernel warning as a
passing testcase?

The message "callback unexpected regs 1" is emitted by verifier_bug() in
kernel/bpf/backtrack.c during precision backtracking, which intentionally
triggers a kernel WARN_ONCE. On systems configured with panic_on_warn=1,
such as syzbot or standard CI environments, wouldn't loading this test cause
a kernel panic?

If the verifier hits an internal state corruption (tracking r0 back into a
faked exit) and triggers verifier_bug() before it can gracefully reject the
program, does this indicate that the underlying issue with callbacks and tail
calls isn't fully fixed by the series?

> +	clobber_regs_stack();
> +
> +	bpf_loop(1, callback_loop_1, &skb, 0);
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260711104727.4023420-1-pulehui@huaweicloud.com?part=2