From nobody Fri Apr 17 01:39:13 2026 Received: from out-186.mta1.migadu.com (out-186.mta1.migadu.com [95.215.58.186]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5085F3A4F2F; Tue, 24 Feb 2026 15:41:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.186 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947705; cv=none; b=FO7DPiTgF2E9ApsD2tQUUHe/SLObwRzsFbwdy2guAfRb6rH91lJrs47u7Or9TVPyx1uUuNh+ZpWp52SrvNk0gYgz4oi+lS4ve6JZ+YB5FeK+tnGyfFAsej3dImIKrQZff6aYeMLeFRXSnPUyuUf+A3DQXlaq/9o9YwLuqpZ+O74= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947705; c=relaxed/simple; bh=bmVgVbbAsIpP/rmDfom1zRhish8zs46PI2CTp495ax0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=REMf2PIylaV0e05J4BzmafOZGqdPRnY6oqnJ3VbIisjAmwF1oBLCGbyywdZ5+9FxQY1qbp/RWxnWA9z/Hfzn89o8ERitZv8ubpzQATJWs5jA1hTBBf8ofGkwaSptrGhsG8fmXYEm41uUBdZabMDcAi8OasDdLlIs5o2vqUJ5RIw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=IPsfAJWJ; arc=none smtp.client-ip=95.215.58.186 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="IPsfAJWJ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947702; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SUijMo22lEst1QalzzO5DxpySqFjsbDhvTZO2rndGXo=; b=IPsfAJWJ+bwSmfJa/MvtuBb3vU1duUHYq7tVA2apCx+uCk6ajzEFMZhX9kj2o08gLCf1vU 8VrDFqd6fluPrDLF51sYVcR9gx29Jjn1ypzGzs/3onukFNtvyYWM8B/007eucABm4yd5sD X6dYtvVdD5IzOUSkzXF82m3G3/6Rujs= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 1/8] bpf: Add fsession to verbose log in check_get_func_ip() Date: Tue, 24 Feb 2026 23:40:17 +0800 Message-ID: <20260224154024.12504-2-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Since bpf_get_func_ip() is supported for fsession intuitively, add fsession to the verbose log in check_get_func_ip(). No functional change intended. Signed-off-by: Leon Hwang --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1153a828ce8d..9e9c04e08fba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11463,7 +11463,7 @@ static int check_get_func_ip(struct bpf_verifier_en= v *env) =20 if (type =3D=3D BPF_PROG_TYPE_TRACING) { if (!bpf_prog_has_trampoline(env->prog)) { - verbose(env, "func %s#%d supported only for fentry/fexit/fmod_ret progr= ams\n", + verbose(env, "func %s#%d supported only for fentry/fexit/fsession/fmod_= ret programs\n", func_id_name(func_id), func_id); return -ENOTSUPP; } --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-173.mta1.migadu.com (out-173.mta1.migadu.com [95.215.58.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9065027F4F5 for ; Tue, 24 Feb 2026 15:41:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947712; cv=none; b=bigh21wUCF/tq+k4VVk5P+lCV6cWKRk2984b2YVjnRKJpF1EQ7h07KmAHKTGPXlF4EgbmpF8K7I9uhZ37EC5VoH8SVQQKXAwdrO1MgxADF4dTdiKXthtX9dSLpQnxHEAaBOAiuktM3J0VaJ/rP/13V7nNNypb0Ung7FYYHaLV88= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947712; c=relaxed/simple; bh=EUskLKncGN6F8VI22eEL+Udchk5d/0odV1f99i2e4Qw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M0GJxCDO+atjWrfjxTz2I/yop3j2agTAcKgGCR8RwQAzOAhDDGIQPervtz3vxwJ2/ihQz+ilYYHARcAtLokHol/thjPAK2TjvyKv60NpVw/pNTKqnVbrb1FEM6UZRqgB0MvehYAT1tiqF+piTEsTE5h5xQuuPRqdJSC8u3SrlUA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=A+YeBNLv; arc=none smtp.client-ip=95.215.58.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="A+YeBNLv" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6cOL5Wb4sgredTy87bpW5d+Y+NrZLlqF3fUGuWvVJO0=; b=A+YeBNLvkz0x5/Xcs+YiJgOUOdD2hUtekrZe2eaTx3qFUj8bBvegW77N78dTlZ0xqbp7Cx JoSrejSze62FIadruV+nVbVxRhl1CkASPwZ+dL77mim8xCJCY88Ik7XNZA4+gbui/rnKAE Bi2zIfKZqfZRqdbyqNVpr4/EVtetFe8= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 2/8] bpf: Disallow !kprobe_write_ctx progs tail-calling kprobe_write_ctx progs Date: Tue, 24 Feb 2026 23:40:18 +0800 Message-ID: <20260224154024.12504-3-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" uprobe programs that can modify pt_regs require different runtime assumptions than pt_regs-read-only uprobe programs. Mixing both in one prog_array can make owner expectations diverge from callee behavior. Reject the combination of !kprobe_write_ctx progs with kprobe_write_ctx progs in __bpf_prog_map_compatible() to address the issue. Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers= ") Signed-off-by: Leon Hwang --- include/linux/bpf.h | 7 ++++--- kernel/bpf/core.c | 3 +++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b78b53198a2e..2a2f6448a5fb 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -285,9 +285,10 @@ struct bpf_list_node_kern { */ struct bpf_map_owner { enum bpf_prog_type type; - bool jited; - bool xdp_has_frags; - bool sleepable; + u32 jited:1, + xdp_has_frags:1, + sleepable:1, + kprobe_write_ctx:1; u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; const struct btf_type *attach_func_proto; enum bpf_attach_type expected_attach_type; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 3ece2da55625..f99a901b5e48 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2402,6 +2402,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->jited =3D fp->jited; map->owner->xdp_has_frags =3D aux->xdp_has_frags; map->owner->sleepable =3D fp->sleepable; + map->owner->kprobe_write_ctx =3D aux->kprobe_write_ctx; map->owner->expected_attach_type =3D fp->expected_attach_type; map->owner->attach_func_proto =3D aux->attach_func_proto; for_each_cgroup_storage_type(i) { @@ -2415,6 +2416,8 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->jited =3D=3D fp->jited && map->owner->xdp_has_frags =3D=3D aux->xdp_has_frags && map->owner->sleepable =3D=3D fp->sleepable; + if (ret && (!map->owner->kprobe_write_ctx && aux->kprobe_write_ctx)) + ret =3D false; if (ret && map->map_type =3D=3D BPF_MAP_TYPE_PROG_ARRAY && map->owner->expected_attach_type !=3D fp->expected_attach_type) --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-187.mta1.migadu.com (out-187.mta1.migadu.com [95.215.58.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DFE161A9F93 for ; Tue, 24 Feb 2026 15:42:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.187 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947737; cv=none; b=nuwMs08/FJGXexf1nymmnqZ7Gn1xF2caJU5yRJNlIeBpmOhV0WOjA0u+1xFdcA9gEDY6F+J/hDwhExcJ9v0A/eq/GasMfz9WNcYw3xzlBk6ZJJEYaXVFx5Twq4ldT0EyDUgI7fE0sgqMyvDuo/z1HACyOX1iJdPTC4RLIyvnfkk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947737; c=relaxed/simple; bh=i77qiDOJwVYNU0fXo1gf5ZhKDZtHcHKLVVhBz9+ewlY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e0v+9Zho4crwgljmxZXQ69LITC3C+PymplRyxZ6d6SsLGOmt7oSSYvpFLSZjzyc61yxBPvRdVI87l0H6L5kaPVWrk2C/J5s4dPaOVN4ZZXJB4ZvKX53EwKk2oE0UquvRUklTK0wKXw9d727+rVEQEL1nV3p5aK5fl8F40QbcQR0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SN5vFkDC; arc=none smtp.client-ip=95.215.58.187 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SN5vFkDC" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947734; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=20Bmo9nBK2Cr9h1IHwRqI0WnKsF7kVCkMXCL3S8USXg=; b=SN5vFkDCuMfeygOOygxlOHwnxdCLHMQp4YP+7O6SK+wYVg6mejn1zQM+x6vQBnsTk/vgGH hfOUbkcRzhTeFz1JvHPY8LB4wOZHbXtkjtytMi7cr8L+y0AE1AuqvMPrgXFpHDPu1R1tvQ NjkdWEdrWax6E2KAfDtml4w4DOxD7uY= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 3/8] bpf: Disallow !call_get_func_ip progs tail-calling call_get_func_ip progs Date: Tue, 24 Feb 2026 23:40:19 +0800 Message-ID: <20260224154024.12504-4-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Trampoline-based tracing programs that call bpf_get_func_ip() rely on func_ip stored on stack. Mixing them with tracing programs that do not share this requirement creates asymmetric expectations in tail calls. Reject the combination of !call_get_func_ip progs with call_get_func_ip progs in __bpf_prog_map_compatible() to address the issue. Fixes: 1e37392cccde ("bpf: Enable BPF_TRAMP_F_IP_ARG for trampolines with c= all_get_func_ip") Signed-off-by: Leon Hwang --- include/linux/bpf.h | 3 ++- kernel/bpf/core.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 2a2f6448a5fb..65793fd146c5 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -288,7 +288,8 @@ struct bpf_map_owner { u32 jited:1, xdp_has_frags:1, sleepable:1, - kprobe_write_ctx:1; + kprobe_write_ctx:1, + call_get_func_ip:1; u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; const struct btf_type *attach_func_proto; enum bpf_attach_type expected_attach_type; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index f99a901b5e48..01fce3fba0be 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2403,6 +2403,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->xdp_has_frags =3D aux->xdp_has_frags; map->owner->sleepable =3D fp->sleepable; map->owner->kprobe_write_ctx =3D aux->kprobe_write_ctx; + map->owner->call_get_func_ip =3D fp->call_get_func_ip; map->owner->expected_attach_type =3D fp->expected_attach_type; map->owner->attach_func_proto =3D aux->attach_func_proto; for_each_cgroup_storage_type(i) { @@ -2418,6 +2419,9 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->sleepable =3D=3D fp->sleepable; if (ret && (!map->owner->kprobe_write_ctx && aux->kprobe_write_ctx)) ret =3D false; + if (ret && (!map->owner->call_get_func_ip && fp->call_get_func_ip && + prog_type =3D=3D BPF_PROG_TYPE_TRACING)) + ret =3D false; if (ret && map->map_type =3D=3D BPF_MAP_TYPE_PROG_ARRAY && map->owner->expected_attach_type !=3D fp->expected_attach_type) --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-189.mta1.migadu.com (out-189.mta1.migadu.com [95.215.58.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61A0D1A9F93; Tue, 24 Feb 2026 15:42:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.189 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947743; cv=none; b=bcyd5CjO6plzu3N2bX7ZaZVr4FhABS1EZCuAylA06f1w3Y79EBdJRBYwwqiN6TZz9EUjMsoyokNDramuQFbzCDXIvSUiPUuMG9YmLjGcSSti3P0kg3NMIGCOV9JdHwYUGayPxLoFapzpbtgiLdv3xA6zm8OV/iVZmN/D77w+jHI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947743; c=relaxed/simple; bh=XlIzMybjjeNU4KyEifGFEeHLenW/genbPa7xSqDl1vU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C7c4Ii+G9WxdfwrwmB9IvHE++uxeJGp/SJKeMnqTYmZRqTw1ZeGB0dpjNGScDugfo4iSu6KdLkcOLcNcMIejodS/33TLUWMiOgBOz7KLTA7R4F2XmZkcGzQD1cM+Ia1NMv5klqOEOS7UGxm6MDTl26Y0P42MO9y7K8KSyhLZI3Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ktwy5w5H; arc=none smtp.client-ip=95.215.58.189 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ktwy5w5H" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947739; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5QH8l6CJx3ffsF93aY6sNBfg1kIlQOkrhZPP2sAud1g=; b=ktwy5w5HYvk9AKnoffWJTP1u6gtyHleZfgMoGkHzx4Rx9+fkLGYPfCjqgPLQeqNuDQiv44 GoCDWK68O37mgblx4U70PeC8Bu1knRozeEI1Ia2c0NQ560AkxrPVwWcNc3UM5U1sFZ9MIh Csz5qnMSv7ZbM8NzWwWzxn5xCx7OJYg= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 4/8] bpf: Disallow !call_session_cookie progs tail-calling call_session_cookie progs Date: Tue, 24 Feb 2026 23:40:20 +0800 Message-ID: <20260224154024.12504-5-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" bpf_session_cookie() depends on consistent session metadata stored on stack for fsession programs. Mixing fsession programs that do and do not rely on these helpers in tail calls can violate that runtime contract. Disallow the combination of !call_session_cookie progs and call_session_cookie progs in __bpf_prog_map_compatible() to address the issue. Fixes: eeee4239dbb1 ("bpf: support fsession for bpf_session_cookie") Signed-off-by: Leon Hwang --- include/linux/bpf.h | 3 ++- kernel/bpf/core.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 65793fd146c5..c74db70f9be1 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -289,7 +289,8 @@ struct bpf_map_owner { xdp_has_frags:1, sleepable:1, kprobe_write_ctx:1, - call_get_func_ip:1; + call_get_func_ip:1, + call_session_cookie:1; u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; const struct btf_type *attach_func_proto; enum bpf_attach_type expected_attach_type; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 01fce3fba0be..904a8dbfd56f 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2404,6 +2404,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->sleepable =3D fp->sleepable; map->owner->kprobe_write_ctx =3D aux->kprobe_write_ctx; map->owner->call_get_func_ip =3D fp->call_get_func_ip; + map->owner->call_session_cookie =3D fp->call_session_cookie; map->owner->expected_attach_type =3D fp->expected_attach_type; map->owner->attach_func_proto =3D aux->attach_func_proto; for_each_cgroup_storage_type(i) { @@ -2422,6 +2423,9 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, if (ret && (!map->owner->call_get_func_ip && fp->call_get_func_ip && prog_type =3D=3D BPF_PROG_TYPE_TRACING)) ret =3D false; + if (ret && (!map->owner->call_session_cookie && fp->call_session_cookie = && + prog_type =3D=3D BPF_PROG_TYPE_TRACING)) + ret =3D false; if (ret && map->map_type =3D=3D BPF_MAP_TYPE_PROG_ARRAY && map->owner->expected_attach_type !=3D fp->expected_attach_type) --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C576E3A4F57 for ; Tue, 24 Feb 2026 15:42:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947748; cv=none; b=slVEGYC6icIq+CYzCi1xS1DanW6OVqA85K03uLkgbqNhW/5CvxaOG9l85aCiOjjdckiz14O0un0IlJgrS371Wekvy9U3Bl6SloiCW4O6T2y7v/3mMrlGKiGi3jSIFqnAO5s+clxWbAjiZ5FVdOIQKRk99T8Z112JofuVdUkuFE0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947748; c=relaxed/simple; bh=MnFhEKNIzjXvigv4lxIPNTGgFi/zYkk/xBW6Z/qPfVA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=idkTdto7kl9aEf7fK7MLdyKHm5YQrRgiQhvLS4UsDwnoDjX3rBj0zl60v0bLlwTrIBARhmDtjbeCkbc+3YDX+gggOl/LeDEWuYEbONqHucyjRD5aDOECraw9OuRm9E+HUd0A7q3DHU1dWX08HcCc7voklt/DYaXg9bNqV2Q7YWk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=vrCx26Eg; arc=none smtp.client-ip=95.215.58.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="vrCx26Eg" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947745; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/b+70PPkY/pfbfwzHHp1MTkubPK3K5BdD6G2vC79gfY=; b=vrCx26Eg2houGeS4NexccmEm22FNdHtVz5G+g/Sjm2mJvX/nP/+HkunFUwk5ONLwk/jVX4 lcpWGFzfdS7VG0z3b9Mr9uLh8pBItyBG8fiApzWSki+jC3J5IsvoKC21psNEV0RUKyvI8I J9unfd3UUprSA0mXC04TwPg72ajaZFA= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 5/8] bpf: Disallow !call_session_is_return progs tail-calling call_session_is_return progs Date: Tue, 24 Feb 2026 23:40:21 +0800 Message-ID: <20260224154024.12504-6-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" bpf_session_is_return() depends on consistent session metadata stored on stack for fsession programs. Mixing fsession programs that do and do not rely on these helpers in tail calls can violate that runtime contract. Disallow the combination of !call_session_is_return progs and call_session_is_return progs in __bpf_prog_map_compatible() to address the issue. Fixes: 27d89baa6da8 ("bpf: support fsession for bpf_session_is_return") Signed-off-by: Leon Hwang --- include/linux/bpf.h | 4 +++- kernel/bpf/core.c | 4 ++++ kernel/bpf/verifier.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index c74db70f9be1..6be5f81b61e7 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -290,7 +290,8 @@ struct bpf_map_owner { sleepable:1, kprobe_write_ctx:1, call_get_func_ip:1, - call_session_cookie:1; + call_session_cookie:1, + call_session_is_return:1; u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; const struct btf_type *attach_func_proto; enum bpf_attach_type expected_attach_type; @@ -1699,6 +1700,7 @@ struct bpf_prog_aux { bool changes_pkt_data; bool might_sleep; bool kprobe_write_ctx; + bool call_session_is_return; /* Do we call bpf_session_is_return */ u64 prog_array_member_cnt; /* counts how many times as member of prog_arr= ay */ struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cn= t */ struct bpf_arena *arena; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 904a8dbfd56f..44aeb49b2d1b 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2405,6 +2405,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, map->owner->kprobe_write_ctx =3D aux->kprobe_write_ctx; map->owner->call_get_func_ip =3D fp->call_get_func_ip; map->owner->call_session_cookie =3D fp->call_session_cookie; + map->owner->call_session_is_return =3D aux->call_session_is_return; map->owner->expected_attach_type =3D fp->expected_attach_type; map->owner->attach_func_proto =3D aux->attach_func_proto; for_each_cgroup_storage_type(i) { @@ -2426,6 +2427,9 @@ static bool __bpf_prog_map_compatible(struct bpf_map = *map, if (ret && (!map->owner->call_session_cookie && fp->call_session_cookie = && prog_type =3D=3D BPF_PROG_TYPE_TRACING)) ret =3D false; + if (ret && (!map->owner->call_session_is_return && aux->call_session_is_= return && + prog_type =3D=3D BPF_PROG_TYPE_TRACING)) + ret =3D false; if (ret && map->map_type =3D=3D BPF_MAP_TYPE_PROG_ARRAY && map->owner->expected_attach_type !=3D fp->expected_attach_type) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9e9c04e08fba..919075ee3479 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14409,6 +14409,8 @@ static int check_kfunc_call(struct bpf_verifier_env= *env, struct bpf_insn *insn, =20 if (meta.func_id =3D=3D special_kfunc_list[KF_bpf_session_cookie]) env->prog->call_session_cookie =3D true; + if (meta.func_id =3D=3D special_kfunc_list[KF_bpf_session_is_return]) + env->prog->aux->call_session_is_return =3D true; =20 return 0; } --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD8C8396D14 for ; Tue, 24 Feb 2026 15:42:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.184 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947770; cv=none; b=Lh0pIaLNuVmfNrXcr6HZZhPdZ5z5VfKwad1gIYCY+92EP7DiaEeG2wd0bBkvYcJxf1QkfZebf0uB7Q6rvDQQ/5GyWlWUIbUwEYdmamoRJ5SSu95VvHl9T8mejmQf3+d4wtlo7eo9rFuT/0xfCqCoxE6mpBu9hE5QTAZ/bGBe8E8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947770; c=relaxed/simple; bh=f849xKyoZAajEGHjpBZZX77DXEVvDQzC30RhKa7IJuQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZhS7n2AXc+08jFD27v5e6AjOkf2t3CBBPHSsCxmGzm2GbTVTwsYQhbwPjHJKpVgXxJDWPW9AyAuz81+vBDqQCaftMKPKnd/ImGO2ZK7o7gi6EKdY/HFOjovZviE9IDUAoFQCn3BJr4JX+YsZOPYw/WHNIsDd/Ykepup1Zv7Y0hI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=GVMrA6rW; arc=none smtp.client-ip=91.218.175.184 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="GVMrA6rW" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BJFu39HW6jkSyHpZDpx94eEtrHBuJjXZaAVXvr0cMw0=; b=GVMrA6rW0c99pjcn5e96vFYBY1ETaJKSNpNlkk7cNHwOOR90o6NpkBH+s0SzgoEYbqkZMZ Ts+NmrtYx/bRwSVCM3kikcfF7SE/wHQ9rppddZkUt0gmLow9yXpdIjf+5+rHGfHnpl41jo 6MaU+ltZq5yHbC9eVqYhE62PQc2yoyU= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 6/8] selftests/bpf: Add a test to verify kprobe_write_ctx compatibility enforcement Date: Tue, 24 Feb 2026 23:40:22 +0800 Message-ID: <20260224154024.12504-7-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add prog_array coverage for kprobe programs with and without kprobe_write_ctx requirements. The test verifies one-way enforcement: !kprobe_write_ctx programs cannot tail-call kprobe_write_ctx programs. Assisted-by: Codex:gpt-5.3-codex Signed-off-by: Leon Hwang --- .../selftests/bpf/prog_tests/attach_probe.c | 44 +++++++++++++++++++ .../selftests/bpf/progs/kprobe_write_ctx.c | 6 +++ 2 files changed, 50 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/= testing/selftests/bpf/prog_tests/attach_probe.c index 9e77e5da7097..a9444db92246 100644 --- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c +++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c @@ -220,11 +220,53 @@ static void test_attach_kprobe_write_ctx(void) =20 kprobe_write_ctx__destroy(skel); } + +static void test_kprobe_write_ctx_prog_array_compat(void) +{ + __u32 key =3D 0, read_prog_fd, write_prog_fd; + struct kprobe_write_ctx *skel =3D NULL; + int map_fd =3D -1, err; + + skel =3D kprobe_write_ctx__open_and_load(); + if (!ASSERT_OK_PTR(skel, "kprobe_write_ctx__open_and_load")) + return; + + map_fd =3D bpf_map_create(BPF_MAP_TYPE_PROG_ARRAY, NULL, sizeof(key), + sizeof(__u32), 1, NULL); + if (!ASSERT_GE(map_fd, 0, "bpf_map_create")) + goto cleanup; + + read_prog_fd =3D bpf_program__fd(skel->progs.kprobe_read_ctx); + write_prog_fd =3D bpf_program__fd(skel->progs.kprobe_write_ctx); + if (!ASSERT_GE(read_prog_fd, 0, "read_prog_fd")) + goto cleanup; + if (!ASSERT_GE(write_prog_fd, 0, "write_prog_fd")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &read_prog_fd, BPF_ANY); + if (!ASSERT_OK(err, "bpf_map_update_elem success")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &write_prog_fd, BPF_ANY); + if (!ASSERT_ERR(err, "bpf_map_update_elem failure")) + goto cleanup; + ASSERT_EQ(errno, EINVAL, "bpf_map_update_elem errno"); + +cleanup: + if (map_fd >=3D 0) + close(map_fd); + kprobe_write_ctx__destroy(skel); +} #else static void test_attach_kprobe_write_ctx(void) { test__skip(); } + +static void test_kprobe_write_ctx_prog_array_compat(void) +{ + test__skip(); +} #endif =20 static void test_attach_probe_auto(struct test_attach_probe *skel) @@ -434,6 +476,8 @@ void test_attach_probe(void) test_attach_kprobe_long_event_name(); if (test__start_subtest("kprobe-write-ctx")) test_attach_kprobe_write_ctx(); + if (test__start_subtest("kprobe-write-ctx-prog-array-compat")) + test_kprobe_write_ctx_prog_array_compat(); =20 cleanup: test_attach_probe__destroy(skel); diff --git a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c b/tools/t= esting/selftests/bpf/progs/kprobe_write_ctx.c index f77aef0474d3..09e0c487bde5 100644 --- a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c +++ b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c @@ -13,6 +13,12 @@ int kprobe_write_ctx(struct pt_regs *ctx) return 0; } =20 +SEC("kprobe") +int kprobe_read_ctx(struct pt_regs *ctx) +{ + return 0; +} + SEC("kprobe.multi") int kprobe_multi_write_ctx(struct pt_regs *ctx) { --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26F9B223DE7 for ; Tue, 24 Feb 2026 15:42:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947775; cv=none; b=m+RrvypYeukIFyFlyflN3ICn/0sLFW86zPtnQSsrCCC3eZWQTvRSumqWH58/UCz7WNwmqrW8qUpLc8jAz/bvIGyD9RGv0kCr0D0c/c1wGkR1RbJyTl7NXFdMQ5Zp4EDoYuiUWIIcR7Q7EWhj0H7uSiEeMVXnutTVsxUXIlmy6LI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947775; c=relaxed/simple; bh=NHdxzPJAtBr7xEqxXkZkD/fNi+zTIHjksONscrsRtW8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sWagyekuN8rj2IYKSfXJWwFzhssWrFIf2HtuqRb4BqGFlDco28w4bpPZTLXWMNlOBYdlY0lY21G7p0thNrsa9sfP1RZQNv0566pM1Dw5119QFDO2b+8bwQYx+02ZWMHKpJEUEpO9MPBUPw4RMvhrWgVr8JpS/QvjGh20VyOETd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=vTMgeP0c; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="vTMgeP0c" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947772; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2BOzvXBrvd4MIf2KjLhTZ2sIZQ/Qdk4vFnBFVzdfMQ4=; b=vTMgeP0c81KkszjqgGD3qGWLo9OUqlvVh5hqfG5GnjurGp7dmWbzvJ/c8gpg91aDTRL4Fy jeJwIeQhFjqSgDGz6bI7sLXaDO0E3AQyQ7kR/2Ba14ip54n/OSjfcBJAh0bcF2xQoEIB7H nehxhSl5Kih1JtL4lCXATJnSz+7upuY= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 7/8] selftests/bpf: Add a test to verify call_get_func_ip compatibility enforcement Date: Tue, 24 Feb 2026 23:40:23 +0800 Message-ID: <20260224154024.12504-8-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add prog_array coverage for tracing programs that differ in bpf_get_func_ip() dependency. The test verifies one-way enforcement: !call_get_func_ip programs cannot tail-call call_get_func_ip programs. Assisted-by: Codex:gpt-5.3-codex Signed-off-by: Leon Hwang --- .../bpf/prog_tests/get_func_ip_test.c | 46 +++++++++++++++++++ .../selftests/bpf/progs/get_func_ip_test.c | 6 +++ 2 files changed, 52 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/get_func_ip_test.c b/to= ols/testing/selftests/bpf/prog_tests/get_func_ip_test.c index 7772a0f288d3..670457d4e159 100644 --- a/tools/testing/selftests/bpf/prog_tests/get_func_ip_test.c +++ b/tools/testing/selftests/bpf/prog_tests/get_func_ip_test.c @@ -139,3 +139,49 @@ void test_get_func_ip_test(void) test_function_entry(); test_function_body(); } + +static void test_prog_array_call_get_func_ip_compat(void) +{ + __u32 key =3D 0, with_get_func_ip_fd, without_get_func_ip_fd; + struct get_func_ip_test *skel =3D NULL; + int map_fd =3D -1, err; + + skel =3D get_func_ip_test__open(); + if (!ASSERT_OK_PTR(skel, "get_func_ip_test__open")) + return; + + err =3D get_func_ip_test__load(skel); + if (!ASSERT_OK(err, "get_func_ip_test__load")) + goto cleanup; + + with_get_func_ip_fd =3D bpf_program__fd(skel->progs.test1); + without_get_func_ip_fd =3D bpf_program__fd(skel->progs.test1_dummy); + if (!ASSERT_GE(with_get_func_ip_fd, 0, "with_get_func_ip_fd")) + goto cleanup; + if (!ASSERT_GE(without_get_func_ip_fd, 0, "without_get_func_ip_fd")) + goto cleanup; + + map_fd =3D bpf_map_create(BPF_MAP_TYPE_PROG_ARRAY, NULL, sizeof(key), + sizeof(__u32), 1, NULL); + if (!ASSERT_GE(map_fd, 0, "bpf_map_create")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &without_get_func_ip_fd, BPF_AN= Y); + if (!ASSERT_OK(err, "bpf_map_update_elem success")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &with_get_func_ip_fd, BPF_ANY); + if (!ASSERT_ERR(err, "bpf_map_update_elem failure")) + goto cleanup; + ASSERT_EQ(errno, EINVAL, "bpf_map_update_elem errno"); + +cleanup: + if (map_fd >=3D 0) + close(map_fd); + get_func_ip_test__destroy(skel); +} + +void test_get_func_ip_test_prog_map_compatible(void) +{ + test_prog_array_call_get_func_ip_compat(); +} diff --git a/tools/testing/selftests/bpf/progs/get_func_ip_test.c b/tools/t= esting/selftests/bpf/progs/get_func_ip_test.c index 45eaa54d1ac7..6a7d306af96e 100644 --- a/tools/testing/selftests/bpf/progs/get_func_ip_test.c +++ b/tools/testing/selftests/bpf/progs/get_func_ip_test.c @@ -32,6 +32,12 @@ int BPF_PROG(test1, int a) return 0; } =20 +SEC("fentry/bpf_fentry_test1") +int BPF_PROG(test1_dummy, int a) +{ + return 0; +} + __u64 test2_result =3D 0; SEC("fexit/bpf_fentry_test2") int BPF_PROG(test2, int a) --=20 2.52.0 From nobody Fri Apr 17 01:39:13 2026 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 747A73A6411 for ; Tue, 24 Feb 2026 15:43:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947781; cv=none; b=c6+NPf82LnwASMEj1IIeHZpWYEYAC5VsQBJrk8mWLSVnqE3e/U0YW91Bh8tYHdyl25gYzH3/yzj4b+lx3ac4rHclS8TOEFfAWoUyCfCjdgzgGdcUkBQSZIawpP1aRUDxpUgwZIbJEeKTEDY+AkU/0BDKjFtA4SjODEs9BhObFFU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771947781; c=relaxed/simple; bh=uuVhZPMLQTKvEryzY971QiuVD2Q5biMcf6jIeRvmjdY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qTeLT5rVYs/P6UPMDKsJp+QAanZmDq+7BjIjulTV4+Ou7SxZgGfRhNTbeADirl43l/E0rzi2XM6UVLRUPkkcHfFkOiWOD3U0p9cIkAcCLcOPZXYYhQufGBxFF8B4i6pW6pX3rpi5Hgi9v7zJntogrCznvK8NxmKaPYb3ElC0Lrg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=uZEM5850; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="uZEM5850" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1771947777; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ajSl2pdKTk9QEmR1MISxYniJhjrbh949cm//bffiNdc=; b=uZEM5850Y3+L8n2F0E2j8gvf1S+N/9cpVe6vGsjsonYOWoAP+wN70FqWvPpNA7+gBckmtT HOu+F0hkzQan8fKFArHhGjZLnnjnOCPgEOIAtOhLsGSO4rVauNeoxJaaQNWNnK4H5uqgjU hFEvDwCEjejr491rTRD/pxQDq4bn4CQ= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Feng Yang , Leon Hwang , Menglong Dong , Puranjay Mohan , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Pu Lehui , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 8/8] selftests/bpf: Add a test to verify session-kfunc compatibility enforcement Date: Tue, 24 Feb 2026 23:40:24 +0800 Message-ID: <20260224154024.12504-9-leon.hwang@linux.dev> In-Reply-To: <20260224154024.12504-1-leon.hwang@linux.dev> References: <20260224154024.12504-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add prog_array coverage for tracing programs that differ in bpf_session_cookie() / bpf_session_is_return() usage. The test verifies one-way enforcement: !call_session_* programs cannot tail-call call_session_* programs. Assisted-by: Codex:gpt-5.3-codex Signed-off-by: Leon Hwang --- .../selftests/bpf/prog_tests/fsession_test.c | 47 +++++++++++++++++++ .../selftests/bpf/progs/fsession_test.c | 6 +++ 2 files changed, 53 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/fsession_test.c b/tools= /testing/selftests/bpf/prog_tests/fsession_test.c index a299aeb8cc2e..304986544a8d 100644 --- a/tools/testing/selftests/bpf/prog_tests/fsession_test.c +++ b/tools/testing/selftests/bpf/prog_tests/fsession_test.c @@ -129,6 +129,51 @@ static void test_fsession_cookie(void) fsession_test__destroy(skel); } =20 +static void test_fsession_prog_array_session_kfunc_compat(void) +{ + struct fsession_test *skel =3D NULL; + __u32 key =3D 0, session_kfunc_prog_fd, no_session_kfunc_prog_fd; + int map_fd =3D -1, err; + + skel =3D fsession_test__open(); + if (!ASSERT_OK_PTR(skel, "fsession_test__open")) + goto cleanup; + + err =3D fsession_test__load(skel); + if (err =3D=3D -EOPNOTSUPP) { + test__skip(); + goto cleanup; + } + if (!ASSERT_OK(err, "fsession_test__load")) + goto cleanup; + + session_kfunc_prog_fd =3D bpf_program__fd(skel->progs.test9); + no_session_kfunc_prog_fd =3D bpf_program__fd(skel->progs.test12); + if (!ASSERT_GE(session_kfunc_prog_fd, 0, "session_kfunc_prog_fd")) + goto cleanup; + if (!ASSERT_GE(no_session_kfunc_prog_fd, 0, "no_session_kfunc_prog_fd")) + goto cleanup; + + map_fd =3D bpf_map_create(BPF_MAP_TYPE_PROG_ARRAY, NULL, sizeof(key), + sizeof(__u32), 1, NULL); + if (!ASSERT_GE(map_fd, 0, "bpf_map_create")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &no_session_kfunc_prog_fd, BPF_= ANY); + if (!ASSERT_OK(err, "bpf_map_update_elem success")) + goto cleanup; + + err =3D bpf_map_update_elem(map_fd, &key, &session_kfunc_prog_fd, BPF_ANY= ); + if (!ASSERT_ERR(err, "bpf_map_update_elem failure")) + goto cleanup; + ASSERT_EQ(errno, EINVAL, "bpf_map_update_elem errno"); + +cleanup: + if (map_fd >=3D 0) + close(map_fd); + fsession_test__destroy(skel); +} + void test_fsession_test(void) { if (test__start_subtest("fsession_test")) @@ -137,4 +182,6 @@ void test_fsession_test(void) test_fsession_reattach(); if (test__start_subtest("fsession_cookie")) test_fsession_cookie(); + if (test__start_subtest("fsession_prog_array_session_kfunc_compat")) + test_fsession_prog_array_session_kfunc_compat(); } diff --git a/tools/testing/selftests/bpf/progs/fsession_test.c b/tools/test= ing/selftests/bpf/progs/fsession_test.c index 86e8a2fe467e..1e6be28bcc3d 100644 --- a/tools/testing/selftests/bpf/progs/fsession_test.c +++ b/tools/testing/selftests/bpf/progs/fsession_test.c @@ -177,3 +177,9 @@ int BPF_PROG(test11, int a) test11_result =3D a =3D=3D 1; return 0; } + +SEC("fsession/bpf_fentry_test1") +int BPF_PROG(test12, int a, int ret) +{ + return 0; +} --=20 2.52.0