[PATCH bpf-next 0/3] bpf: Show precise rejected function when attaching to __noreturn and __btf_id functions
Show precise rejected function name when attaching to __noreturn and __btf_id functions. Add selftest for attaching tracing to __btf_id functions.
--- KaFai Wan (3): bpf: Show precise rejected function when attaching to __noreturn functions bpf: Show precise rejected function when attaching to __btf_id functions selftests/bpf: Add selftest for attaching tracing to __btf_id functions
kernel/bpf/verifier.c | 5 ++++- .../selftests/bpf/prog_tests/tracing_btf_ids.c | 16 ++++++++++++++++ .../selftests/bpf/progs/fexit_noreturns.c | 2 +- .../selftests/bpf/progs/tracing_btf_ids.c | 15 +++++++++++++++ 4 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_btf_ids.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_btf_ids.c
Show the precise rejected function name when attaching fexit/fmod_ret to __noreturn functions.
$ ./fexit libbpf: prog 'fexit': BPF program load failed: -EINVAL libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG -- Attaching fexit/fmod_ret to __noreturn function 'do_exit' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com --- kernel/bpf/verifier.c | 3 ++- tools/testing/selftests/bpf/progs/fexit_noreturns.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 53007182b46b..275d82fb1a1a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23942,7 +23942,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) } else if ((prog->expected_attach_type == BPF_TRACE_FEXIT || prog->expected_attach_type == BPF_MODIFY_RETURN) && btf_id_set_contains(&noreturn_deny, btf_id)) { - verbose(env, "Attaching fexit/fmod_ret to __noreturn functions is rejected.\n"); + verbose(env, "Attaching fexit/fmod_ret to __noreturn function '%s' is rejected.\n", + tgt_info.tgt_name); return -EINVAL; }
diff --git a/tools/testing/selftests/bpf/progs/fexit_noreturns.c b/tools/testing/selftests/bpf/progs/fexit_noreturns.c index 54654539f550..b1c33d958ae2 100644 --- a/tools/testing/selftests/bpf/progs/fexit_noreturns.c +++ b/tools/testing/selftests/bpf/progs/fexit_noreturns.c @@ -8,7 +8,7 @@ char _license[] SEC("license") = "GPL";
SEC("fexit/do_exit") -__failure __msg("Attaching fexit/fmod_ret to __noreturn functions is rejected.") +__failure __msg("Attaching fexit/fmod_ret to __noreturn function 'do_exit' is rejected.") int BPF_PROG(noreturns) { return 0;
Show the precise rejected function name when attaching tracing to __btf_id functions.
$ ./fentry libbpf: prog 'migrate_disable': BPF program load failed: -EINVAL libbpf: prog 'migrate_disable': -- BEGIN PROG LOAD LOG -- Attaching tracing to __btf_id function 'migrate_disable' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com --- kernel/bpf/verifier.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 275d82fb1a1a..2779d63e1f8b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23938,6 +23938,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) { + verbose(env, "Attaching tracing to __btf_id function '%s' is rejected.\n", + tgt_info.tgt_name); return -EINVAL; } else if ((prog->expected_attach_type == BPF_TRACE_FEXIT || prog->expected_attach_type == BPF_MODIFY_RETURN) &&
On Thu, Jul 10, 2025 at 9:27 AM KaFai Wan mannkafai@gmail.com wrote:
Show the precise rejected function name when attaching tracing to __btf_id functions.
$ ./fentry libbpf: prog 'migrate_disable': BPF program load failed: -EINVAL libbpf: prog 'migrate_disable': -- BEGIN PROG LOAD LOG -- Attaching tracing to __btf_id function 'migrate_disable' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com
kernel/bpf/verifier.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 275d82fb1a1a..2779d63e1f8b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23938,6 +23938,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) {
verbose(env, "Attaching tracing to __btf_id function '%s' is rejected.\n",tgt_info.tgt_name);
"Attaching tracing to __btf_id" ?! What does it mean? Drop "__btf_id" and "tracing" bits.
-- pw-bot: cr
On Fri, Jul 11, 2025 at 1:19 AM Alexei Starovoitov alexei.starovoitov@gmail.com wrote:
On Thu, Jul 10, 2025 at 9:27 AM KaFai Wan mannkafai@gmail.com wrote:
Show the precise rejected function name when attaching tracing to __btf_id functions.
$ ./fentry libbpf: prog 'migrate_disable': BPF program load failed: -EINVAL libbpf: prog 'migrate_disable': -- BEGIN PROG LOAD LOG -- Attaching tracing to __btf_id function 'migrate_disable' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com
kernel/bpf/verifier.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 275d82fb1a1a..2779d63e1f8b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23938,6 +23938,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) {
verbose(env, "Attaching tracing to __btf_id function '%s' is rejected.\n",tgt_info.tgt_name);"Attaching tracing to __btf_id" ?! What does it mean?
The term "tracing" refers to BPF_PROG_TYPE_TRACING. I believe it is useful because it helps identify which functions cannot be attached by a given BPF program type. Perhaps we should replace "tracing" with "a tracing prog" for clarity?
Drop "__btf_id" and "tracing" bits.
On Fri, 2025-07-11 at 17:57 +0800, Yafang Shao wrote:
On Fri, Jul 11, 2025 at 1:19 AM Alexei Starovoitov alexei.starovoitov@gmail.com wrote:
On Thu, Jul 10, 2025 at 9:27 AM KaFai Wan mannkafai@gmail.com wrote:
Show the precise rejected function name when attaching tracing to __btf_id functions.
$ ./fentry libbpf: prog 'migrate_disable': BPF program load failed: -EINVAL libbpf: prog 'migrate_disable': -- BEGIN PROG LOAD LOG -- Attaching tracing to __btf_id function 'migrate_disable' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com
kernel/bpf/verifier.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 275d82fb1a1a..2779d63e1f8b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23938,6 +23938,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) { + verbose(env, "Attaching tracing to __btf_id function '%s' is rejected.\n", + tgt_info.tgt_name);
"Attaching tracing to __btf_id" ?! What does it mean?
The term "tracing" refers to BPF_PROG_TYPE_TRACING. I believe it is useful because it helps identify which functions cannot be attached by a given BPF program type.
Thanks, this is what I want to express.
Perhaps we should replace "tracing" with "a tracing prog" for clarity?
Looks good, may be 'tracing programs' could be fine.
Drop "__btf_id" and "tracing" bits.
On Thu, 2025-07-10 at 10:19 -0700, Alexei Starovoitov wrote:
On Thu, Jul 10, 2025 at 9:27 AM KaFai Wan mannkafai@gmail.com wrote:
Show the precise rejected function name when attaching tracing to __btf_id functions.
$ ./fentry libbpf: prog 'migrate_disable': BPF program load failed: -EINVAL libbpf: prog 'migrate_disable': -- BEGIN PROG LOAD LOG -- Attaching tracing to __btf_id function 'migrate_disable' is rejected.
Signed-off-by: KaFai Wan mannkafai@gmail.com
kernel/bpf/verifier.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 275d82fb1a1a..2779d63e1f8b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23938,6 +23938,8 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return ret; } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) { + verbose(env, "Attaching tracing to __btf_id function '%s' is rejected.\n", + tgt_info.tgt_name);
"Attaching tracing to __btf_id" ?! What does it mean? Drop "__btf_id" and "tracing" bits.
My fault, I mean "Attaching tracing programs to function" in 'btf_id_deny'.
I will change it in v2.
-- pw-bot: cr
The reuslt:
$ tools/testing/selftests/bpf/test_progs --name=tracing_btf_ids #467/1 tracing_btf_ids/btf_ids:OK #467 tracing_btf_ids:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED
Signed-off-by: KaFai Wan mannkafai@gmail.com --- .../selftests/bpf/prog_tests/tracing_btf_ids.c | 16 ++++++++++++++++ .../selftests/bpf/progs/tracing_btf_ids.c | 15 +++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_btf_ids.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_btf_ids.c
diff --git a/tools/testing/selftests/bpf/prog_tests/tracing_btf_ids.c b/tools/testing/selftests/bpf/prog_tests/tracing_btf_ids.c new file mode 100644 index 000000000000..b45b9ac3630c --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/tracing_btf_ids.c @@ -0,0 +1,16 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <test_progs.h> +#include "tracing_btf_ids.skel.h" + +void test_tracing_btf_ids(void) +{ + int btf_id; + + // `migrate_disable` depends on `CONFIG_SMP`, may not exists + btf_id = libbpf_find_vmlinux_btf_id("migrate_disable", BPF_TRACE_FENTRY); + if (btf_id <= 0) + return; + + RUN_TESTS(tracing_btf_ids); +} diff --git a/tools/testing/selftests/bpf/progs/tracing_btf_ids.c b/tools/testing/selftests/bpf/progs/tracing_btf_ids.c new file mode 100644 index 000000000000..92a7f2e9fb89 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/tracing_btf_ids.c @@ -0,0 +1,15 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/bpf.h> +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> +#include "bpf_misc.h" + +char _license[] SEC("license") = "GPL"; + +SEC("fentry/migrate_disable") +__failure __msg("Attaching tracing to __btf_id function 'migrate_disable' is rejected.") +int BPF_PROG(btf_ids) +{ + return 0; +}
linux-kselftest-mirror@lists.linaro.org
-
Alexei Starovoitov -
KaFai Wan -
Yafang Shao