From: Yonghong Song <yonghong.song@linux.dev>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
kernel-team@fb.com
Subject: [PATCH bpf-next v4 09/12] selftests/bpf: Check the member named for an unsupported kfunc return type
Date: Fri, 28 Aug 2026 23:16:00 -0700 [thread overview]
Message-ID: <20260829061600.1697800-1-yonghong.song@linux.dev> (raw)
In-Reply-To: <20260829061514.1690730-1-yonghong.song@linux.dev>
Add tests to cover cases where a kfunc return type is rejected with
proper messages including member names and array types.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
.../selftests/bpf/progs/aggregate_ret_kfunc.c | 82 +++++++++++++++++++
.../selftests/bpf/test_kmods/bpf_testmod.c | 40 +++++++++
.../bpf/test_kmods/bpf_testmod_kfunc.h | 42 ++++++++++
3 files changed, 164 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/aggregate_ret_kfunc.c b/tools/testing/selftests/bpf/progs/aggregate_ret_kfunc.c
index f10e5cf6fd89..0361a7b42c9b 100644
--- a/tools/testing/selftests/bpf/progs/aggregate_ret_kfunc.c
+++ b/tools/testing/selftests/bpf/progs/aggregate_ret_kfunc.c
@@ -19,6 +19,11 @@ void __kfunc_btf_root(void)
"r"(&bpf_kfunc_call_test_ret_fastcall),
"r"(&bpf_kfunc_call_test_ret_ptr),
"r"(&bpf_kfunc_call_test_ret_ii),
+ "r"(&bpf_kfunc_call_test_ret_nested),
+ "r"(&bpf_kfunc_call_test_ret_ptr_arr),
+ "r"(&bpf_kfunc_call_test_ret_deep),
+ "r"(&bpf_kfunc_call_test_ret_arr_struct),
+ "r"(&bpf_kfunc_call_test_ret_arr2d),
"r"(&bpf_kfunc_call_test_ret_big));
}
@@ -72,6 +77,7 @@ __naked int aggregate_ret_kfunc_fastcall_fail(void)
SEC("tc")
__arch_x86_64 __arch_arm64
__failure __msg("is not composed of scalars or arena pointers")
+__msg("member 'p' has type PTR")
__naked int aggregate_ret_kfunc_ptr_fail(void)
{
asm volatile (
@@ -84,6 +90,82 @@ __naked int aggregate_ret_kfunc_ptr_fail(void)
: __clobber_all);
}
+SEC("tc")
+__arch_x86_64 __arch_arm64
+__failure __msg("is not composed of scalars or arena pointers")
+__msg("member 'in.p' has type PTR")
+__naked int aggregate_ret_kfunc_nested_ptr_fail(void)
+{
+ asm volatile (
+ "r1 = 0;"
+ "call %[bpf_kfunc_call_test_ret_nested];"
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_kfunc_call_test_ret_nested)
+ : __clobber_all);
+}
+
+SEC("tc")
+__arch_x86_64 __arch_arm64
+__failure __msg("is not composed of scalars or arena pointers")
+__msg("member 'p[]' has type PTR")
+__naked int aggregate_ret_kfunc_ptr_arr_fail(void)
+{
+ asm volatile (
+ "call %[bpf_kfunc_call_test_ret_ptr_arr];"
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_kfunc_call_test_ret_ptr_arr)
+ : __clobber_all);
+}
+
+SEC("tc")
+__arch_x86_64 __arch_arm64
+__failure __msg("is not composed of scalars or arena pointers")
+__msg("member 'in1[].in2.p' has type PTR")
+__naked int aggregate_ret_kfunc_arr_struct_fail(void)
+{
+ asm volatile (
+ "call %[bpf_kfunc_call_test_ret_arr_struct];"
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_kfunc_call_test_ret_arr_struct)
+ : __clobber_all);
+}
+
+SEC("tc")
+__arch_x86_64 __arch_arm64
+__failure __msg("is not composed of scalars or arena pointers")
+__msg("member 'a[].p' has type PTR")
+__naked int aggregate_ret_kfunc_arr2d_fail(void)
+{
+ asm volatile (
+ "call %[bpf_kfunc_call_test_ret_arr2d];"
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_kfunc_call_test_ret_arr2d)
+ : __clobber_all);
+}
+
+SEC("tc")
+__arch_x86_64 __arch_arm64
+__failure __msg("max struct nesting depth exceeded")
+__naked int aggregate_ret_kfunc_too_deep_fail(void)
+{
+ asm volatile (
+ "r1 = 0;"
+ "call %[bpf_kfunc_call_test_ret_deep];"
+ "r0 = 0;"
+ "exit;"
+ :
+ : __imm(bpf_kfunc_call_test_ret_deep)
+ : __clobber_all);
+}
+
SEC("tc")
__arch_x86_64 __arch_arm64
__failure __msg("R2 !read_ok")
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 850cf4f830c4..dff1ad6f491f 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -981,6 +981,41 @@ __bpf_kfunc struct prog_test_ret_ptr bpf_kfunc_call_test_ret_ptr(u64 tag)
return r;
}
+__bpf_kfunc struct prog_test_ret_nested bpf_kfunc_call_test_ret_nested(u64 tag)
+{
+ struct prog_test_ret_nested r = { .in = { .p = NULL }, .tag = tag };
+
+ return r;
+}
+
+__bpf_kfunc struct prog_test_ret_ptr_arr bpf_kfunc_call_test_ret_ptr_arr(void)
+{
+ struct prog_test_ret_ptr_arr r = { .p = { NULL, NULL } };
+
+ return r;
+}
+
+__bpf_kfunc struct prog_test_ret_arr_struct bpf_kfunc_call_test_ret_arr_struct(void)
+{
+ struct prog_test_ret_arr_struct r = {};
+
+ return r;
+}
+
+__bpf_kfunc struct prog_test_ret_arr2d bpf_kfunc_call_test_ret_arr2d(void)
+{
+ struct prog_test_ret_arr2d r = {};
+
+ return r;
+}
+
+__bpf_kfunc struct prog_test_ret_deep bpf_kfunc_call_test_ret_deep(u64 v)
+{
+ struct prog_test_ret_deep r = { .l1 = { .l2 = { .l3 = { .l4 = { .v = v } } } } };
+
+ return r;
+}
+
__bpf_kfunc struct prog_test_ret_ii bpf_kfunc_call_test_ret_ii(int a, int b)
{
struct prog_test_ret_ii r = { .a = a, .b = b };
@@ -1539,6 +1574,11 @@ BTF_ID_FLAGS(func, bpf_kfunc_call_test_i128)
BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_pair)
BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_fastcall, KF_FASTCALL)
BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_ptr)
+BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_nested)
+BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_ptr_arr)
+BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_arr_struct)
+BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_arr2d)
+BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_deep)
BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_ii)
#endif
BTF_ID_FLAGS(func, bpf_kfunc_call_test_ret_big)
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
index 65e693ada736..9202c31ba6c9 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
@@ -70,6 +70,43 @@ struct prog_test_ret_ptr { /* 16 bytes: contains a pointer */
__u64 tag;
};
+struct prog_test_ret_nested { /* 16 bytes: the pointer hides one level down */
+ struct {
+ void *p;
+ } in;
+ __u64 tag;
+};
+
+struct prog_test_ret_ptr_arr { /* 16 bytes: an array of pointers */
+ void *p[2];
+};
+
+struct prog_test_ret_arr_struct { /* 16 bytes: the pointer is under an array of structs */
+ struct {
+ struct {
+ void *p;
+ } in2;
+ } in1[2];
+};
+
+struct prog_test_ret_arr2d { /* 16 bytes: a two dimensional array of structs */
+ struct {
+ void *p;
+ } a[1][2];
+};
+
+struct prog_test_ret_deep { /* 8 bytes, but nested past the 4-level walk limit */
+ struct {
+ struct {
+ struct {
+ struct {
+ __u64 v;
+ } l4;
+ } l3;
+ } l2;
+ } l1;
+};
+
struct prog_test_ret_big { /* 24 bytes: too large for R0:R2 */
__u64 a;
__u64 b;
@@ -159,6 +196,11 @@ struct prog_test_ret_pair bpf_kfunc_call_test_ret_pair(__u64 a, __u64 b) __ksym;
struct prog_test_ret_pair bpf_kfunc_call_test_ret_fastcall(__u64 a, __u64 b) __ksym;
struct prog_test_ret_ii bpf_kfunc_call_test_ret_ii(int a, int b) __ksym;
struct prog_test_ret_ptr bpf_kfunc_call_test_ret_ptr(__u64 tag) __ksym;
+struct prog_test_ret_nested bpf_kfunc_call_test_ret_nested(__u64 tag) __ksym;
+struct prog_test_ret_ptr_arr bpf_kfunc_call_test_ret_ptr_arr(void) __ksym;
+struct prog_test_ret_arr_struct bpf_kfunc_call_test_ret_arr_struct(void) __ksym;
+struct prog_test_ret_arr2d bpf_kfunc_call_test_ret_arr2d(void) __ksym;
+struct prog_test_ret_deep bpf_kfunc_call_test_ret_deep(__u64 v) __ksym;
struct prog_test_ret_big bpf_kfunc_call_test_ret_big(void) __ksym;
__u64 bpf_kfunc_call_stack_arg(__u64 a, __u64 b, __u64 c, __u64 d,
__u64 e, __u64 f, __u64 g, __u64 h,
--
2.53.0-Meta
next prev parent reply other threads:[~2026-08-29 6:16 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-29 6:15 [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 01/12] bpf: Record each half of a paired return value in verifier diagnostics Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 02/12] bpf: Drop the recursion depth argument of btf_type_is_scalar_struct() Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 03/12] bpf: Add btf_type_is_arena_ptr() Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 04/12] bpf: Let the by-value struct walk take the kinds of member it accepts Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 05/12] bpf: Let a by-value struct nest arrays and structs freely Yonghong Song
2026-08-29 7:11 ` bot+bpf-ci
2026-08-29 6:15 ` [PATCH bpf-next v4 06/12] bpf: Report which member makes a kfunc return type unsupported Yonghong Song
2026-08-29 7:11 ` bot+bpf-ci
2026-08-29 6:15 ` [PATCH bpf-next v4 07/12] bpf: Allow a global function to return arena pointers by value Yonghong Song
2026-08-29 6:15 ` [PATCH bpf-next v4 08/12] bpf: Allow arena pointers in a by-value kfunc return Yonghong Song
2026-08-29 6:16 ` Yonghong Song [this message]
2026-08-29 6:16 ` [PATCH bpf-next v4 10/12] selftests/bpf: Test global functions returning arena pointers by value Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 11/12] selftests/bpf: Test kfuncs " Yonghong Song
2026-08-29 6:16 ` [PATCH bpf-next v4 12/12] docs/bpf: Document arena pointers in a by-value return Yonghong Song
2026-08-30 1:33 ` Kumar Kartikeya Dwivedi
2026-08-31 2:42 ` Yonghong Song
2026-08-30 1:20 ` [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260829061600.1697800-1-yonghong.song@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=kernel-team@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox